[b01lers2020]Welcome to Earth

刚点进来会一直加载,然后跳转到了/die

看一下刚进来页面的源代码

<!DOCTYPE html>
<html>
  <head>
    <title>Welcome to Earth</title>
  </head>
  <body>
    <h1>AMBUSH!</h1>
    <p>You've gotta escape!</p>
    <img src="/static/img/f18.png" alt="alien mothership" style="width:60vw;" />
    <script>
      document.onkeydown = function(event) {
        event = event || window.event;
        if (event.keyCode == 27) {
          event.preventDefault();
          window.location = "/chase/";
        } else die();
      };

      function sleep(ms) {
        return new Promise(resolve => setTimeout(resolve, ms));
      }

      async function dietimer() {
        await sleep(10000);
        die();
      }

      function die() {
        window.location = "/die/";
      }

      dietimer();
    </script>
  </body>
</html>

可以看到keycode == 27的时候会跳转到/chase/页面,27是键盘上的ESC键,当然我们也可以直接输入chase直接跳转到这个页面,然后查看chase页面的源码

<!DOCTYPE html>
<html>
  <head>
    <title>Welcome to Earth</title>
  </head>
  <body>
    <h1>CHASE!</h1>
    <p>
      You managed to chase one of the enemy fighters, but there's a wall coming
      up fast!
    </p>
    <button onclick="left()">Left</button>
    <button onclick="right()">Right</button>

    <img
      src="/static/img/Canyon_Chase_16.png"
      alt="canyon chase"
      style="width:60vw;"
    />
    <script>
      function sleep(ms) {
        return new Promise(resolve => setTimeout(resolve, ms));
      }

      async function dietimer() {
        await sleep(1000);
        die();
      }

      function die() {
        window.location = "/die/";
      }

      function left() {
        window.location = "/die/";
      }

      function leftt() {
        window.location = "/leftt/";
      }

      function right() {
        window.location = "/die/";
      }

      dietimer();
    </script>
  </body>
</html>

可以看到有个leftt,访问他

页面源代码

<!DOCTYPE html>
<html>
  <head>
    <title>Welcome to Earth</title>
  </head>
  <body>
    <h1>SHOOT IT</h1>
    <p>You've got the bogey in your sights, take the shot!</p>
    <img
      src="/static/img/locked.png"
      alt="locked on"
      style="width:60vw;"
    />
    </br>
    <button onClick="window.location='/die/'">Take the shot</button>
    <!-- <button onClick="window.location='/shoot/'">Take the shot</button> -->
  </body>
</html>

点Take the shot会跳转到die

在注释里面可以看到shoot,访问

点击Continue跳转到door

页面源代码

<!DOCTYPE html>
<html>
  <head>
    <title>Welcome to Earth</title>
    <script src="/static/js/door.js"></script>
  </head>
  <body>
    <h1>YOU APPROACH THE ALIEN CRAFT!</h1>
    <p>How do you get inside?</p>
    <img src="/static/img/ship.png" alt="crashed ship" style="width:60vw;" />
    <form id="door_form">
      <input type="radio" name="side" value="0" />0
      <input type="radio" name="side" value="1" />1
      <input type="radio" name="side" value="2" />2
      <input type="radio" name="side" value="3" />3
      <input type="radio" name="side" value="4" />4
      <input type="radio" name="side" value="5" />5
      <input type="radio" name="side" value="6" />6
      <input type="radio" name="side" value="7" />7
      <input type="radio" name="side" value="8" />8
      <input type="radio" name="side" value="9" />9
      <input type="radio" name="side" value="10" />10
      <input type="radio" name="side" value="11" />11
      <input type="radio" name="side" value="12" />12
      <input type="radio" name="side" value="13" />13
      <input type="radio" name="side" value="14" />14
      <input type="radio" name="side" value="15" />15
      <input type="radio" name="side" value="16" />16
      <input type="radio" name="side" value="17" />17
      <input type="radio" name="side" value="18" />18
      <input type="radio" name="side" value="19" />19
      <input type="radio" name="side" value="20" />20
      <input type="radio" name="side" value="21" />21
      <input type="radio" name="side" value="22" />22
      <input type="radio" name="side" value="23" />23
      <input type="radio" name="side" value="24" />24
      <input type="radio" name="side" value="25" />25
      <input type="radio" name="side" value="26" />26
      <input type="radio" name="side" value="27" />27
      <input type="radio" name="side" value="28" />28
      <input type="radio" name="side" value="29" />29
      <input type="radio" name="side" value="30" />30
      <input type="radio" name="side" value="31" />31
      <input type="radio" name="side" value="32" />32
      <input type="radio" name="side" value="33" />33
      <input type="radio" name="side" value="34" />34
      <input type="radio" name="side" value="35" />35
      <input type="radio" name="side" value="36" />36
      <input type="radio" name="side" value="37" />37
      <input type="radio" name="side" value="38" />38
      <input type="radio" name="side" value="39" />39
      <input type="radio" name="side" value="40" />40
      <input type="radio" name="side" value="41" />41
      <input type="radio" name="side" value="42" />42
      <input type="radio" name="side" value="43" />43
      <input type="radio" name="side" value="44" />44
      <input type="radio" name="side" value="45" />45
      <input type="radio" name="side" value="46" />46
      <input type="radio" name="side" value="47" />47
      <input type="radio" name="side" value="48" />48
      <input type="radio" name="side" value="49" />49
      <input type="radio" name="side" value="50" />50
      <input type="radio" name="side" value="51" />51
      <input type="radio" name="side" value="52" />52
      <input type="radio" name="side" value="53" />53
      <input type="radio" name="side" value="54" />54
      <input type="radio" name="side" value="55" />55
      <input type="radio" name="side" value="56" />56
      <input type="radio" name="side" value="57" />57
      <input type="radio" name="side" value="58" />58
      <input type="radio" name="side" value="59" />59
      <input type="radio" name="side" value="60" />60
      <input type="radio" name="side" value="61" />61
      <input type="radio" name="side" value="62" />62
      <input type="radio" name="side" value="63" />63
      <input type="radio" name="side" value="64" />64
      <input type="radio" name="side" value="65" />65
      <input type="radio" name="side" value="66" />66
      <input type="radio" name="side" value="67" />67
      <input type="radio" name="side" value="68" />68
      <input type="radio" name="side" value="69" />69
      <input type="radio" name="side" value="70" />70
      <input type="radio" name="side" value="71" />71
      <input type="radio" name="side" value="72" />72
      <input type="radio" name="side" value="73" />73
      <input type="radio" name="side" value="74" />74
      <input type="radio" name="side" value="75" />75
      <input type="radio" name="side" value="76" />76
      <input type="radio" name="side" value="77" />77
      <input type="radio" name="side" value="78" />78
      <input type="radio" name="side" value="79" />79
      <input type="radio" name="side" value="80" />80
      <input type="radio" name="side" value="81" />81
      <input type="radio" name="side" value="82" />82
      <input type="radio" name="side" value="83" />83
      <input type="radio" name="side" value="84" />84
      <input type="radio" name="side" value="85" />85
      <input type="radio" name="side" value="86" />86
      <input type="radio" name="side" value="87" />87
      <input type="radio" name="side" value="88" />88
      <input type="radio" name="side" value="89" />89
      <input type="radio" name="side" value="90" />90
      <input type="radio" name="side" value="91" />91
      <input type="radio" name="side" value="92" />92
      <input type="radio" name="side" value="93" />93
      <input type="radio" name="side" value="94" />94
      <input type="radio" name="side" value="95" />95
      <input type="radio" name="side" value="96" />96
      <input type="radio" name="side" value="97" />97
      <input type="radio" name="side" value="98" />98
      <input type="radio" name="side" value="99" />99
      <input type="radio" name="side" value="100" />100
      <input type="radio" name="side" value="101" />101
      <input type="radio" name="side" value="102" />102
      <input type="radio" name="side" value="103" />103
      <input type="radio" name="side" value="104" />104
      <input type="radio" name="side" value="105" />105
      <input type="radio" name="side" value="106" />106
      <input type="radio" name="side" value="107" />107
      <input type="radio" name="side" value="108" />108
      <input type="radio" name="side" value="109" />109
      <input type="radio" name="side" value="110" />110
      <input type="radio" name="side" value="111" />111
      <input type="radio" name="side" value="112" />112
      <input type="radio" name="side" value="113" />113
      <input type="radio" name="side" value="114" />114
      <input type="radio" name="side" value="115" />115
      <input type="radio" name="side" value="116" />116
      <input type="radio" name="side" value="117" />117
      <input type="radio" name="side" value="118" />118
      <input type="radio" name="side" value="119" />119
      <input type="radio" name="side" value="120" />120
      <input type="radio" name="side" value="121" />121
      <input type="radio" name="side" value="122" />122
      <input type="radio" name="side" value="123" />123
      <input type="radio" name="side" value="124" />124
      <input type="radio" name="side" value="125" />125
      <input type="radio" name="side" value="126" />126
      <input type="radio" name="side" value="127" />127
      <input type="radio" name="side" value="128" />128
      <input type="radio" name="side" value="129" />129
      <input type="radio" name="side" value="130" />130
      <input type="radio" name="side" value="131" />131
      <input type="radio" name="side" value="132" />132
      <input type="radio" name="side" value="133" />133
      <input type="radio" name="side" value="134" />134
      <input type="radio" name="side" value="135" />135
      <input type="radio" name="side" value="136" />136
      <input type="radio" name="side" value="137" />137
      <input type="radio" name="side" value="138" />138
      <input type="radio" name="side" value="139" />139
      <input type="radio" name="side" value="140" />140
      <input type="radio" name="side" value="141" />141
      <input type="radio" name="side" value="142" />142
      <input type="radio" name="side" value="143" />143
      <input type="radio" name="side" value="144" />144
      <input type="radio" name="side" value="145" />145
      <input type="radio" name="side" value="146" />146
      <input type="radio" name="side" value="147" />147
      <input type="radio" name="side" value="148" />148
      <input type="radio" name="side" value="149" />149
      <input type="radio" name="side" value="150" />150
      <input type="radio" name="side" value="151" />151
      <input type="radio" name="side" value="152" />152
      <input type="radio" name="side" value="153" />153
      <input type="radio" name="side" value="154" />154
      <input type="radio" name="side" value="155" />155
      <input type="radio" name="side" value="156" />156
      <input type="radio" name="side" value="157" />157
      <input type="radio" name="side" value="158" />158
      <input type="radio" name="side" value="159" />159
      <input type="radio" name="side" value="160" />160
      <input type="radio" name="side" value="161" />161
      <input type="radio" name="side" value="162" />162
      <input type="radio" name="side" value="163" />163
      <input type="radio" name="side" value="164" />164
      <input type="radio" name="side" value="165" />165
      <input type="radio" name="side" value="166" />166
      <input type="radio" name="side" value="167" />167
      <input type="radio" name="side" value="168" />168
      <input type="radio" name="side" value="169" />169
      <input type="radio" name="side" value="170" />170
      <input type="radio" name="side" value="171" />171
      <input type="radio" name="side" value="172" />172
      <input type="radio" name="side" value="173" />173
      <input type="radio" name="side" value="174" />174
      <input type="radio" name="side" value="175" />175
      <input type="radio" name="side" value="176" />176
      <input type="radio" name="side" value="177" />177
      <input type="radio" name="side" value="178" />178
      <input type="radio" name="side" value="179" />179
      <input type="radio" name="side" value="180" />180
      <input type="radio" name="side" value="181" />181
      <input type="radio" name="side" value="182" />182
      <input type="radio" name="side" value="183" />183
      <input type="radio" name="side" value="184" />184
      <input type="radio" name="side" value="185" />185
      <input type="radio" name="side" value="186" />186
      <input type="radio" name="side" value="187" />187
      <input type="radio" name="side" value="188" />188
      <input type="radio" name="side" value="189" />189
      <input type="radio" name="side" value="190" />190
      <input type="radio" name="side" value="191" />191
      <input type="radio" name="side" value="192" />192
      <input type="radio" name="side" value="193" />193
      <input type="radio" name="side" value="194" />194
      <input type="radio" name="side" value="195" />195
      <input type="radio" name="side" value="196" />196
      <input type="radio" name="side" value="197" />197
      <input type="radio" name="side" value="198" />198
      <input type="radio" name="side" value="199" />199
      <input type="radio" name="side" value="200" />200
      <input type="radio" name="side" value="201" />201
      <input type="radio" name="side" value="202" />202
      <input type="radio" name="side" value="203" />203
      <input type="radio" name="side" value="204" />204
      <input type="radio" name="side" value="205" />205
      <input type="radio" name="side" value="206" />206
      <input type="radio" name="side" value="207" />207
      <input type="radio" name="side" value="208" />208
      <input type="radio" name="side" value="209" />209
      <input type="radio" name="side" value="210" />210
      <input type="radio" name="side" value="211" />211
      <input type="radio" name="side" value="212" />212
      <input type="radio" name="side" value="213" />213
      <input type="radio" name="side" value="214" />214
      <input type="radio" name="side" value="215" />215
      <input type="radio" name="side" value="216" />216
      <input type="radio" name="side" value="217" />217
      <input type="radio" name="side" value="218" />218
      <input type="radio" name="side" value="219" />219
      <input type="radio" name="side" value="220" />220
      <input type="radio" name="side" value="221" />221
      <input type="radio" name="side" value="222" />222
      <input type="radio" name="side" value="223" />223
      <input type="radio" name="side" value="224" />224
      <input type="radio" name="side" value="225" />225
      <input type="radio" name="side" value="226" />226
      <input type="radio" name="side" value="227" />227
      <input type="radio" name="side" value="228" />228
      <input type="radio" name="side" value="229" />229
      <input type="radio" name="side" value="230" />230
      <input type="radio" name="side" value="231" />231
      <input type="radio" name="side" value="232" />232
      <input type="radio" name="side" value="233" />233
      <input type="radio" name="side" value="234" />234
      <input type="radio" name="side" value="235" />235
      <input type="radio" name="side" value="236" />236
      <input type="radio" name="side" value="237" />237
      <input type="radio" name="side" value="238" />238
      <input type="radio" name="side" value="239" />239
      <input type="radio" name="side" value="240" />240
      <input type="radio" name="side" value="241" />241
      <input type="radio" name="side" value="242" />242
      <input type="radio" name="side" value="243" />243
      <input type="radio" name="side" value="244" />244
      <input type="radio" name="side" value="245" />245
      <input type="radio" name="side" value="246" />246
      <input type="radio" name="side" value="247" />247
      <input type="radio" name="side" value="248" />248
      <input type="radio" name="side" value="249" />249
      <input type="radio" name="side" value="250" />250
      <input type="radio" name="side" value="251" />251
      <input type="radio" name="side" value="252" />252
      <input type="radio" name="side" value="253" />253
      <input type="radio" name="side" value="254" />254
      <input type="radio" name="side" value="255" />255
      <input type="radio" name="side" value="256" />256
      <input type="radio" name="side" value="257" />257
      <input type="radio" name="side" value="258" />258
      <input type="radio" name="side" value="259" />259
      <input type="radio" name="side" value="260" />260
      <input type="radio" name="side" value="261" />261
      <input type="radio" name="side" value="262" />262
      <input type="radio" name="side" value="263" />263
      <input type="radio" name="side" value="264" />264
      <input type="radio" name="side" value="265" />265
      <input type="radio" name="side" value="266" />266
      <input type="radio" name="side" value="267" />267
      <input type="radio" name="side" value="268" />268
      <input type="radio" name="side" value="269" />269
      <input type="radio" name="side" value="270" />270
      <input type="radio" name="side" value="271" />271
      <input type="radio" name="side" value="272" />272
      <input type="radio" name="side" value="273" />273
      <input type="radio" name="side" value="274" />274
      <input type="radio" name="side" value="275" />275
      <input type="radio" name="side" value="276" />276
      <input type="radio" name="side" value="277" />277
      <input type="radio" name="side" value="278" />278
      <input type="radio" name="side" value="279" />279
      <input type="radio" name="side" value="280" />280
      <input type="radio" name="side" value="281" />281
      <input type="radio" name="side" value="282" />282
      <input type="radio" name="side" value="283" />283
      <input type="radio" name="side" value="284" />284
      <input type="radio" name="side" value="285" />285
      <input type="radio" name="side" value="286" />286
      <input type="radio" name="side" value="287" />287
      <input type="radio" name="side" value="288" />288
      <input type="radio" name="side" value="289" />289
      <input type="radio" name="side" value="290" />290
      <input type="radio" name="side" value="291" />291
      <input type="radio" name="side" value="292" />292
      <input type="radio" name="side" value="293" />293
      <input type="radio" name="side" value="294" />294
      <input type="radio" name="side" value="295" />295
      <input type="radio" name="side" value="296" />296
      <input type="radio" name="side" value="297" />297
      <input type="radio" name="side" value="298" />298
      <input type="radio" name="side" value="299" />299
      <input type="radio" name="side" value="300" />300
      <input type="radio" name="side" value="301" />301
      <input type="radio" name="side" value="302" />302
      <input type="radio" name="side" value="303" />303
      <input type="radio" name="side" value="304" />304
      <input type="radio" name="side" value="305" />305
      <input type="radio" name="side" value="306" />306
      <input type="radio" name="side" value="307" />307
      <input type="radio" name="side" value="308" />308
      <input type="radio" name="side" value="309" />309
      <input type="radio" name="side" value="310" />310
      <input type="radio" name="side" value="311" />311
      <input type="radio" name="side" value="312" />312
      <input type="radio" name="side" value="313" />313
      <input type="radio" name="side" value="314" />314
      <input type="radio" name="side" value="315" />315
      <input type="radio" name="side" value="316" />316
      <input type="radio" name="side" value="317" />317
      <input type="radio" name="side" value="318" />318
      <input type="radio" name="side" value="319" />319
      <input type="radio" name="side" value="320" />320
      <input type="radio" name="side" value="321" />321
      <input type="radio" name="side" value="322" />322
      <input type="radio" name="side" value="323" />323
      <input type="radio" name="side" value="324" />324
      <input type="radio" name="side" value="325" />325
      <input type="radio" name="side" value="326" />326
      <input type="radio" name="side" value="327" />327
      <input type="radio" name="side" value="328" />328
      <input type="radio" name="side" value="329" />329
      <input type="radio" name="side" value="330" />330
      <input type="radio" name="side" value="331" />331
      <input type="radio" name="side" value="332" />332
      <input type="radio" name="side" value="333" />333
      <input type="radio" name="side" value="334" />334
      <input type="radio" name="side" value="335" />335
      <input type="radio" name="side" value="336" />336
      <input type="radio" name="side" value="337" />337
      <input type="radio" name="side" value="338" />338
      <input type="radio" name="side" value="339" />339
      <input type="radio" name="side" value="340" />340
      <input type="radio" name="side" value="341" />341
      <input type="radio" name="side" value="342" />342
      <input type="radio" name="side" value="343" />343
      <input type="radio" name="side" value="344" />344
      <input type="radio" name="side" value="345" />345
      <input type="radio" name="side" value="346" />346
      <input type="radio" name="side" value="347" />347
      <input type="radio" name="side" value="348" />348
      <input type="radio" name="side" value="349" />349
      <input type="radio" name="side" value="350" />350
      <input type="radio" name="side" value="351" />351
      <input type="radio" name="side" value="352" />352
      <input type="radio" name="side" value="353" />353
      <input type="radio" name="side" value="354" />354
      <input type="radio" name="side" value="355" />355
      <input type="radio" name="side" value="356" />356
      <input type="radio" name="side" value="357" />357
      <input type="radio" name="side" value="358" />358
      <input type="radio" name="side" value="359" />359
    </form>
    <button onClick="check_door()">Check</button>
  </body>
</html>

在最下面有个check_door函数,他是从上面的/static/js/door.js导入的

function check_door() {j
  var all_radio = document.getElementById("door_form").elements;
  var guess = null;

  for (var i = 0; i < all_radio.length; i++)
    if (all_radio[i].checked) guess = all_radio[i].value;

  rand = Math.floor(Math.random() * 360);
  if (rand == guess) window.location = "/open/";
  else window.location = "/die/";
}

直接访问open

页面源代码

<!DOCTYPE html>
<html>
  <head>
    <title>Welcome to Earth</title>
    <script src="/static/js/open_sesame.js"></script>
  </head>
  <body>
    <h1>YOU FOUND THE DOOR!</h1>
    <p>How do you open it?</p>
    <img src="/static/img/door.jpg" alt="door" style="width:60vw;" />
    <script>
      open(0);
    </script>
  </body>
</html>

查看/static/js/open_sesame.js

function sleep(ms) {
  return new Promise(resolve => setTimeout(resolve, ms));
}

function open(i) {
  sleep(1).then(() => {
    open(i + 1);
  });
  if (i == 4000000000) window.location = "/fight/";
}

访问fight

同样的,得到

// Run to scramble original flag
//console.log(scramble(flag, action));
function scramble(flag, key) {
  for (var i = 0; i < key.length; i++) {
    let n = key.charCodeAt(i) % flag.length;
    let temp = flag[i];
    flag[i] = flag[n];
    flag[n] = temp;
  }
  return flag;
}

function check_action() {
  var action = document.getElementById("action").value;
  var flag = ["{hey", "_boy", "aaaa", "s_im", "ck!}", "_baa", "aaaa", "pctf"];

  // TODO: unscramble function
}

可以看到有flag,但是被打乱了

这里就可以对这个存放flag的数组进行排列了,python中组合用的是itertolls中的combinations,而排列则是permutations

脚本:

from itertools import permutations

flag = ["{hey", "_boy", "aaaa", "s_im", "ck!}", "_baa", "aaaa", "pctf"]

item = permutations(flag)
for i in item:
    k = ''.join(list(i))
    if k.startswith('pctf{hey_boys') and k[-1] == '}':
        print(k)

得到

flag为pctf{hey_boys_im_baaaaaaaaaack!}

  • 0
    点赞
  • 0
    收藏
    觉得还不错? 一键收藏
  • 0
    评论

“相关推荐”对你有帮助么?

  • 非常没帮助
  • 没帮助
  • 一般
  • 有帮助
  • 非常有帮助
提交
评论
添加红包

请填写红包祝福语或标题

红包个数最小为10个

红包金额最低5元

当前余额3.43前往充值 >
需支付:10.00
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明:

1.余额是钱包充值的虚拟货币,按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载,可以购买VIP、付费专栏及课程。

余额充值