Web
一点点魔法
Target: http://1.13.245.197:9895/
[22:21:56] Starting:
[22:21:58] 403 - 220B - /.ht_wsr.txt
[22:21:58] 403 - 223B - /.htaccess.bak1
[22:21:58] 403 - 223B - /.htaccess.save
[22:21:58] 403 - 223B - /.htaccess.orig
[22:21:58] 403 - 225B - /.htaccess.sample
[22:21:58] 403 - 224B - /.htaccess_extra
[22:21:58] 403 - 223B - /.htaccess_orig
[22:21:58] 403 - 221B - /.htaccess_sc
[22:21:58] 403 - 221B - /.htaccessOLD
[22:21:58] 403 - 221B - /.htaccessBAK
[22:21:58] 403 - 213B - /.htm
[22:21:58] 403 - 222B - /.htaccessOLD2
[22:21:58] 403 - 220B - /.httr-oauth
[22:21:58] 403 - 223B - /.htpasswd_test
[22:21:59] 403 - 214B - /.html
[22:21:59] 403 - 219B - /.htpasswds
[22:22:24] 405 - 0B - /index.php
[22:22:24] 405 - 0B - /index.php/login/
[22:22:37] 403 - 223B - /server-status/
[22:22:37] 403 - 222B - /server-status
Task Completed
GET访问,无法访问到,抓包修改为POST,得到提示:Tips: Must be accessed from Xiaohong's own computer.
我们修改一下X-Forwarded-For:127.0.0.1
Flag: flag{ef15892ef92c8d1ce18b603415040d3c}
网络管理系统
Target: http://1.13.245.197:9560/#/
[22:20:12] Starting:
[22:20:15] 403 - 300B - /.ht_wsr.txt
[22:20:15] 403 - 303B - /.htaccess.bak1
[22:20:15] 403 - 303B - /.htaccess.orig
[22:20:15] 403 - 305B - /.htaccess.sample
[22:20:15] 403 - 303B - /.htaccess.save
[22:20:15] 403 - 304B - /.htaccess_extra
[22:20:15] 403 - 303B - /.htaccess_orig
[22:20:15] 403 - 301B - /.htaccess_sc
[22:20:15] 403 - 301B - /.htaccessBAK
[22:20:15] 403 - 301B - /.htaccessOLD
[22:20:15] 403 - 302B - /.htaccessOLD2
[22:20:15] 403 - 293B - /.htm
[22:20:15] 403 - 294B - /.html
[22:20:15] 403 - 303B - /.htpasswd_test
[22:20:15] 403 - 299B - /.htpasswds
[22:20:15] 403 - 300B - /.httr-oauth
[22:20:30] 301 - 320B - /assets -> http://1.13.245.197:9560/assets/
[22:20:30] 403 - 296B - /assets/
[22:20:33] 200 - 0B - /config.php
[22:20:41] 200 - 2KB - /index.php
[22:20:41] 200 - 3KB - /index.php.bak
[22:20:46] 200 - 2KB - /index.php/login/
[22:20:55] 403 - 302B - /server-status
[22:20:55] 403 - 303B - /server-status/
Task Completed
存在SQL注入,直接数组绕过:
password[]=1&username=admin[]=1
然后就是命令执行了%0d
ip=127.0.0.1%0dls
有长度限制,我们绕过长度限制,查看pin15558823456g.php
这里%0d之后只能跟4个字符;发现是对全部的长度限制,我们重新构造
ip=8.0.0.1%0dls /
数据库账号密码泄露了,不知道是不是这样做的,再扫描一下开放的端口
└─# masscan 1.13.245.197 -p 0-65535 --rate=1000
Starting masscan 1.3.2 (http://bit.ly/14GZzcT) at 2023-05-10 05:46:27 GMT
Initiating SYN Stealth Scan
Scanning 1 hosts [65536 ports/host]
Discovered open port 10000/tcp on 1.13.245.197
Discovered open port 9560/tcp on 1.13.245.197
Discovered open port 110/tcp on 1.13.245.197
Discovered open port 7677/tcp on 1.13.245.197
Discovered open port 9080/tcp on 1.13.245.197
Discovered open port 7678/tcp on 1.13.245.197
Discovered open port 9895/tcp on 1.13.245.197
Discovered open port 25/tcp on 1.13.245.197
Discovered open port 9051/tcp on 1.13.245.197
Discovered open port 22/tcp on 1.13.245.197
胖虎
感觉是文件上传,先扫描一下把
Target: http://1.13.245.197:9051/
[01:27:37] Starting:
[01:27:40] 403 - 300B - /.ht_wsr.txt
[01:27:40] 403 - 303B - /.htaccess.bak1
[01:27:41] 403 - 305B - /.htaccess.sample
[01:27:41] 403 - 303B - /.htaccess.save
[01:27:41] 403 - 303B - /.htaccess.orig
[01:27:41] 403 - 303B - /.htaccess_orig
[01:27:41] 403 - 304B - /.htaccess_extra
[01:27:41] 403 - 301B - /.htaccess_sc
[01:27:41] 403 - 301B - /.htaccessBAK
[01:27:41] 403 - 301B - /.htaccessOLD
[01:27:41] 403 - 302B - /.htaccessOLD2
[01:27:41] 403 - 294B - /.html
[01:27:41] 403 - 303B - /.htpasswd_test
[01:27:41] 403 - 293B - /.htm
[01:27:41] 403 - 299B - /.htpasswds
[01:27:41] 403 - 300B - /.httr-oauth
[01:27:55] 200 - 550B - /admin_login.php
[01:28:05] 200 - 86B - /checklogin.php
[01:28:17] 200 - 1KB - /index.php
[01:28:17] 200 - 1KB - /index.php/login/
[01:28:35] 403 - 302B - /server-status
[01:28:35] 403 - 303B - /server-status/
[01:28:50] 200 - 203KB - /www.zip
Task Completed
sqliBlind
感觉是SQL注入,先扫描一下把
Target: http://1.13.245.197:9080/
[01:30:49] Starting:
[01:30:52] 403 - 300B - /.ht_wsr.txt
[01:30:52] 403 - 303B - /.htaccess.bak1
[01:30:52] 403 - 303B - /.htaccess.orig
[01:30:52] 403 - 303B - /.htaccess.save
[01:30:52] 403 - 301B - /.htaccessBAK
[01:30:52] 403 - 305B - /.htaccess.sample
[01:30:52] 403 - 301B - /.htaccess_sc
[01:30:52] 403 - 304B - /.htaccess_extra
[01:30:52] 403 - 301B - /.htaccessOLD
[01:30:52] 403 - 303B - /.htaccess_orig
[01:30:52] 403 - 302B - /.htaccessOLD2
[01:30:52] 403 - 293B - /.htm
[01:30:52] 403 - 294B - /.html
[01:30:52] 403 - 299B - /.htpasswds
[01:30:52] 403 - 300B - /.httr-oauth
[01:30:52] 403 - 303B - /.htpasswd_test
[01:31:16] 301 - 317B - /css -> http://1.13.245.197:9080/css/
[01:31:24] 200 - 23B - /index.php
[01:31:24] 200 - 23B - /index.php/login/
[01:31:27] 200 - 2KB - /login.php
[01:31:40] 403 - 302B - /server-status
[01:31:40] 403 - 303B - /server-status/
Task Completed
Crypto
mikumiku
Hex
Html Entity
Base64
ASCII
flag{8ea44e39c914c5ddfbb9808c10033421}
hafuhafu
题目给出n,e和base64加密后的c,简单的RSA,脚本如下:
import gmpy2 from Crypto.Util.number import * import base64 e = 65537 n = 25572000680139535995611501720832880791477922165939342981900803052781801299380515116746468338767634903543966903733806796606602206278399959935132433794098659859300196212479681357625729637405673432324426686371817007872620401911782200407165085213561959188129407530503934445657941975876616947807157374921539755157591354073652053446791467492853468641331291383821277151309959102082454909164831353055082841581194955483740168677333571647148118920605752176786316535817860771644086331929655259439187676703604894258185651165017526744816185992824404330229600417035596255176459265305168198215607187593109533971751842888237880624087 p = 149930380465516707151079321019435489399072155945793735032334088844599773034021170995501688132861944516938448679935403246643441984203770825485165700862168437691254557323938150173733659070945061763789341407547559935070758242521126066900261360899379463301621378242061934281538210192731229473900396425739817670867 q = 170559166199281256887953076784727902849936084815549184550874370897326056825177365209113910954088389779180174518262922176726833811470419181874717574929460298509184863124213663255559781224744696195678069242025195218017449489985102637547369070225979448169459840545693721393354651993457943927480894225788038743661 phi = (p - 1) * (q - 1) d = gmpy2.invert(e, phi) c_str = 'DTlEiAKLE24m19es4TBWl4Uo2MvmQMEYqWBCFggWJlJSjCwl3fT9322ytgudiQW2raDh53e6t2edygpFOP+MsAPXlU469rlmVng5JyDl0CF0ypevnaM5i+CvNT2mBoDadIYnPBVGMtj9HVVPDpMIgv5bF9N5ddQS7JB21oDdQBdDLTkKvcSqegtjNFv04R8+yrqOMZYpzdCRRw0j/MMt2JefC6z36mjrTL85A9EKlwKg5ydW7qELycfjBvzB/cwJ7mJ2I0xVPToa3sSLNDyddFttATwU6wmCa4XaWpTwVR/PfET2FRj0p+8UwYSDdlLLh6gRUVURpT+2jc9zx/rhOw==' c = bytes_to_long(base64.b64decode(c_str)) m = pow(c,d,n) print(long_to_bytes(m)) //flag{D0nT_uS3_Th3_kN0w_n}
crypto1
import gmpy2 from Crypto.Util.number import * c1=163820585866464748037603720038892832306554988255206332863466690031251112393421587550794518466136449805972150046258007843678810670858951387865544768705860991912961811815403716953592063388227590617471347829805148489681889353092402164643007648065816490395610440358210631794473074518280532005297323838015000696012544093096729757248560313800119985077628515064121290046849842744649645290768993658687322260767120966685347950282971463554789285475522426817366147609763855420569516751283073981560233583052224238576709207099742418240326781531079937393665507293492304460161648982800074101163393514977619796309524278704876480025742024160221890561273557038260189577859945055862584556222614337893856036135407528568963925417637444291244325443939058848883360791328763182036736991538226734334763710031379376903812920870564906505631446736446351432678455275793428547686664667539262939321057216659646680245853118886811477642137593470574356360886586517623917262716025748350280034971229225621439570870095238910932174538777011907435005615951965481796660744335386804670981037480723346003591779345801230978946027215192726050182071464556997361600570176261668330138026540849862934790571484498436157306820319598552136374283506981655462848489790309701474742231765 n=839123934774248293554478900304805652005840721338630070412976096583047842775036231818774021937639649434688167897414096334116238084902194754637764024750792816721392354301739479608067847343792597904131386883826936202738091643779024125141255264223247609242732797223111375906539968766539699070553220024835237726906103489324159983224252110158455246369757060858217509822937163152185972444899932745256697748371372158650749600653559864702036394611754651413137001635037310384486835415211127040685857231115447354804277699698486014015179198727374388217592948103504783273235502069953842424278640309430812418432009515965525235385145845104436993038590088545931577484359861647891101843425163557830467877799969686630827090586068831286572090214049241078519089880483666226861834918996928339953135949773709823413539900554860599681940844430108740145857463465317542463460369739470382431178811713605099730666854586750420573809975950891432736357055207659867908960389714343184134892741009452909757459817636609433427812924456782545899375540553326445169985403837463499577711582154287873330657825693756960147166773280203881994461147955853897180714973259859345569061880741001595805100970589056125774856383495601030032566633812017502429733745385901436096392471289 e1=806324329 c2=273242589426480927826167181440879042261352093903608434884600905569452427185873771727772405404505268635334400366319247889103997045566310053661596019565754930974302295439331258267831862178643151110272578792132366938072461672903904131261872916290092535496394107067073669859724326918200655564533782970003007228779265786965898584930920671749110403164178828194786698903692367972071819235589738473333448909143263601696287295696594333362374640947177450581133679785322780121777626014738094838546764265270540875237752587231957198655334919482389040609616499842407581630400649266699612327355801522626608567074516199161612041393966746535463537504182396463306145605244107129067775658018376118992392243654356151728789607874911337696728619623272935933692059586381093273314357325686727609120412886454183336002684696756892485413467576457476017669378668920561188578039728356555469910921968008598794341024437414411415025750797861498237313315133504763627579092827456484850672726497492397166505646338025210493939717283132813965892266364677296542793933736272452657509115949431627829562871153172728793514100920642454624860024655189013182334029353933043493447139401983635409889928162529397033633451464690205097492717456395000561496206701612814279836034509030 e2=981665371 # 解题模板 s1 = int(gmpy2.gcdext(e1,e2)[1]) s2 = int(gmpy2.gcdext(e1,e2)[2]) m = pow(c1,s1,n) * pow(c2,s2,n) %n flag = long_to_bytes(m) print(flag)
crypto2
n = 8604206664806745342168308407736664243779255857304203559954887795876314292548808824569221326135442951396570846730905060035093483091560994483766999321792528742385522688674491325318243227665651447454225684489922429130701999583472403938977116046240939097443373997461261268576566757297338922187501639574851029992578820698058472586961747714012538193674494758948475663291020567990855344532515152207300039545667460492842519422816159286385691631813719409268620014517296396144435387913805962148004421071107300134917 e = 65537 dp = 5322568719169737161435373804079374052963099217986542304765220927456862340459918748565303396239095461305158145873483711181078415768561073654821282898895792014510875476759654876641542774715410624823541347 c = 7713010941776018394460937838688101138886389440124967436362634520453525787263803153048839218904596792025221739398376160611187175949223252314089684537538587279344619934441104448127018949686378560731689286639199775823979889880011530090416478590812561931551073004551522758033697758211066364688996430692968155580514545636400072748535651733331992209003506999556029761752106288763442020289094502293759308446402753316908997325117590363436976980346946963276901401118341392396023155471904168993033594607832278309287
import gmpy2 import libnum e = 65537 n = 8604206664806745342168308407736664243779255857304203559954887795876314292548808824569221326135442951396570846730905060035093483091560994483766999321792528742385522688674491325318243227665651447454225684489922429130701999583472403938977116046240939097443373997461261268576566757297338922187501639574851029992578820698058472586961747714012538193674494758948475663291020567990855344532515152207300039545667460492842519422816159286385691631813719409268620014517296396144435387913805962148004421071107300134917 c = 7713010941776018394460937838688101138886389440124967436362634520453525787263803153048839218904596792025221739398376160611187175949223252314089684537538587279344619934441104448127018949686378560731689286639199775823979889880011530090416478590812561931551073004551522758033697758211066364688996430692968155580514545636400072748535651733331992209003506999556029761752106288763442020289094502293759308446402753316908997325117590363436976980346946963276901401118341392396023155471904168993033594607832278309287 dp = 5322568719169737161435373804079374052963099217986542304765220927456862340459918748565303396239095461305158145873483711181078415768561073654821282898895792014510875476759654876641542774715410624823541347 p=gmpy2.gcd(pow(2,e*dp,n)-2,n) print(p) for i in range(1, e): p = (dp * e - 1) // i + 1 if n % p == 0: q = n // p print(p) break phi_n = (p - 1) * (q - 1) d = gmpy2.invert(e, phi_n) m = pow(c, d, n) print(m) flag = libnum.n2s(int(m)) print(flag)
crepper?
第一次做nc的密码题,没有什么头绪
[+]proof: skr=os.urandom(8) [+]hashlib.sha256(skr).hexdigest()=00fa16e31f6ce084cdcbebeb73c6f37898e7ad83f5a3b04a5688b7ba05d83007 [+]skr[0:5].encode('hex')=1e9c0657bf [-]skr.encode('hex')=
#!/usr/bin/env python # -*- coding: UTF-8 -*- ''' @File :NCCRYP.py @IDE :PyCharm @Author :SlackMoon安全 @Date :2023/5/10 15:10 ''' from Crypto.Util.number import * import hashlib for i in range(10000,20000000): tar = 0x1e9c0657bf payload = long_to_bytes(i) payload = long_to_bytes(tar) + payload if hashlib.sha256(payload).hexdigest() == '00fa16e31f6ce084cdcbebeb73c6f37898e7ad83f5a3b04a5688b7ba05d83007' : print(i) break #1e9c0657bf8c295e
输入后得到题目
[+]Generating challenge 1 [+]n=13112061820685643239663831166928327119579425830632458568801544406506769461279590962772340249183569437559394200635526183698604582385769381159563710823689417274479549627596095398621182995891454516953722025068926293512505383125227579169778946631369961753587856344582257683672313230378603324005337788913902434023431887061454368566100747618582590270385918204656156089053519709536001906964008635708510672550219546894006091483520355436091053866312718431318498783637712773878423777467316605865516248176248780637132615807886272029843770186833425792049108187487338237850806203728217374848799250419859646871057096297020670904211 [+]e=3 [+]m=random.getrandbits(512) [+]c=pow(m,e,n)=15987554724003100295326076036413163634398600947695096857803937998969441763014731720375196104010794555868069024393647966040593258267888463732184495020709457560043050577198988363754703741636088089472488971050324654162166657678376557110492703712286306868843728466224887550827162442026262163340935333721705267432790268517 [+]((m>>72)<<72)=2519188594271759205757864486097605540135407501571078627238849443561219057751843170540261842677239681908736 [-]long_to_bytes(m).encode('hex')=
import gmpy2 from Crypto.Util.number import long_to_bytes c =15987554724003100295326076036413163634398600947695096857803937998969441763014731720375196104010794555868069024393647966040593258267888463732184495020709457560043050577198988363754703741636088089472488971050324654162166657678376557110492703712286306868843728466224887550827162442026262163340935333721705267432790268517 m = gmpy2.iroot(c,3)[0] print(long_to_bytes(m)) //b'FLAG{2^8rsa7589693fc689c77c5f5262d654272427}' //464c41477b325e3872736137353839363933666336383963373763356635323632643635343237323432377d
输入Hex后的Flag得到下一题:
[+]Generating challenge 2 [+]n=12784625729032789592766625203074018101354917751492952685083808825504221816847310910447532133616954262271205877651255598995305639194329607493047941212754523879402744065076183778452640602625242851184095546100200565113016690161053808950384458996881574266573992526357954507491397978278604102524731393059303476350167738237822647246425836482533150025923051544431330502522043833872580483142594571802189321599016725741260254170793393777293145010525686561904427613648184843619301241414264343057368192416551134404100386155751297424616254697041043851852081071306219462991969849123668248321130382231769250865190227630009181759219 [+]e=65537 [+]m=random.getrandbits(512) [+]c=pow(m,e,n)=627824086157119245056478875800598959553774250161670787506083253960788230737588761787385686125828765665617567887904228030839535317987589608761534500003128247164233774794784231518212804270056404565710426613938264302998015421153393879729263551292024543756422702956470022959537221269172084619081368498693930550456153543628170306324206266216348386707008661128717431426237486511309767286175518238620230507201952867261283880986868752676549613958785288914989429224582849218395471672295410036858881836363364885164276983237312235831591858044908369376855484127614933545955544787160352042318378588039587911741028067576722790778 [+]((p>>128)<<128)=97522826022187678545924975588711975512906538181361325096919121233043973599759518562689050415761485716705615149641768982838255403594331293651224395590747133152128042950062103156564440155088882592644046069208405360324372057140890317518802130081198060093576841538008960560391380395697098964411821716664506908672 [-]long_to_bytes(m).encode('hex')=
import gmpy2 import binascii from Crypto.Util.number import long_to_bytes e = 65537 n = 12784625729032789592766625203074018101354917751492952685083808825504221816847310910447532133616954262271205877651255598995305639194329607493047941212754523879402744065076183778452640602625242851184095546100200565113016690161053808950384458996881574266573992526357954507491397978278604102524731393059303476350167738237822647246425836482533150025923051544431330502522043833872580483142594571802189321599016725741260254170793393777293145010525686561904427613648184843619301241414264343057368192416551134404100386155751297424616254697041043851852081071306219462991969849123668248321130382231769250865190227630009181759219 c = 627824086157119245056478875800598959553774250161670787506083253960788230737588761787385686125828765665617567887904228030839535317987589608761534500003128247164233774794784231518212804270056404565710426613938264302998015421153393879729263551292024543756422702956470022959537221269172084619081368498693930550456153543628170306324206266216348386707008661128717431426237486511309767286175518238620230507201952867261283880986868752676549613958785288914989429224582849218395471672295410036858881836363364885164276983237312235831591858044908369376855484127614933545955544787160352042318378588039587911741028067576722790778 p = 97522826022187678545924975588711975512906538181361325096919121233043973599759518562689050415761485716705615149641768982838255403594331293651224395590747133152128042950062103156564440155088882592644046069208405360324372057140890317518802130081198060093576841538008960560661715295741651653499691458486798196487 q = 131093675711613661161476275473445206682597559447006571385482255727609238786596952165801814021602699749876712682307789568113374768689632642728986573211776526473651771104432443501294668372441525987174391472994271054873305324343666279426741897612827889525440428582592216151586138881806196331920758968403508531637 phi = (q-1) * (p-1) d = gmpy2.invert(e,phi) m = gmpy2.powmod(c,d,n) print(long_to_bytes(m)) print(binascii.hexlify(long_to_bytes(m))) b'FLAG{2^8rsa6e277f355dbe6da3edd6f356d2db6d6f}' b'464c41477b325e3872736136653237376633353564626536646133656464366633353664326462366436667d'
输入得到下一题:
[+]Generating challenge 3 [+]n=92896523979616431783569762645945918751162321185159790302085768095763248357146198882641160678623069857011832929179987623492267852304178894461486295864091871341339490870689110279720283415976342208476126414933914026436666789270209690168581379143120688241413470569887426810705898518783625903350928784794371176183 [+]e=3 [+]m=random.getrandbits(512) [+]c=pow(m,e,n)=56164378185049402404287763972280630295410174183649054805947329504892979921131852321281317326306506444145699012788547718091371389698969718830761120076359634262880912417797038049510647237337251037070369278596191506725812511682495575589039521646062521091457438869068866365907962691742604895495670783101319608530 [+]d&((1<<512)-1)=787673996295376297668171075170955852109814939442242049800811601753001897317556022653997651874897208487913321031340711138331360350633965420642045383644955
def getFullP(low_p, n): R.<x> = PolynomialRing(Zmod(n), implementation='NTL') p = x*2^512 + low_p root = (p-n).monic().small_roots(X = 2^128, beta = 0.4) if root: return p(root[0]) return None def phase4(low_d, n, c,e): maybe_p = [] for k in range(1, 4): p = var('p') p0 = solve_mod([e*p*low_d == p + k*(n*p - p^2 - n + p)], 2^512) maybe_p += [int(x[0]) for x in p0] # print(maybe_p) for x in maybe_p: P = getFullP(x, n) if P: break P = int(P) Q = n // P assert P*Q == n d = inverse_mod(e, (P-1)*(Q-1)) print(hex(power_mod(c, d, n))[2:]) n=92896523979616431783569762645945918751162321185159790302085768095763248357146198882641160678623069857011832929179987623492267852304178894461486295864091871341339490870689110279720283415976342208476126414933914026436666789270209690168581379143120688241413470569887426810705898518783625903350928784794371176183 e=3 low_d = 787673996295376297668171075170955852109814939442242049800811601753001897317556022653997651874897208487913321031340711138331360350633965420642045383644955 phase4(low_d, n, c,e) #464c41477b325e3872736135616230383637343566366563373435363139613862363566653465633536307d
输入后下一题
[+]Generating challenge 4 [+]e=3 [+]m=random.getrandbits(512) [+]n1=78642188663937191491235684351005990853149481644703243255021321296087539054265733392095095639539412823093600710316645130404423641473150336492175402885270861906530337207734106926328737198871118125840680572148601743121884788919989184318198417654263598170932154428514561079675550090698019678767738203477097731989 [+]c1=pow(m,e,n1)=23419685303892339080979695469481275906709035609088426118328601771163101123641599051556995351678670765521269546319724616458499631461037359417701720430452076029312714313804716888119910334476982840024696320503747736428099717113471541651211596481005191146454458591558743268791485623924245960696651150688621664860 [+]n2==98174485544103863705821086588292917749386955237408645745685476234349659452606822650329076955303471252833860010724515777826660887118742978051231030080666542833950748806944312437614585352818344599399156268450521239843157288915059003487783576003027303399985723834248634230998110618288843582573006048070816520647 [+]c2=pow(m,e,n2)=72080679612442543693944655041130370753964497034378634203383617624269927191363529233872659451561571441107920350406295389613006330637565645758727103723546610079332161151567096389071050158035757745766399510575237344950873632114050632573903701015749830874081198250578516967517980592506626547273178363503100507676 [+]n3=91638855323231795590642755267985988356764327384001022396221901964430032527111968159623063760057482761918901490239790230176524505469897183382928646349163030620342744192731246392941227433195249399795012672172947919435254998997253131826888070173526892674308708289629739522194864912899817994807268945141349669311 [+]c3=pow(m,e,n3)=22149989692509889061584875630258740744292355239822482581889060656197919681655781672277545701325284646570773490123892626601106871432216449814891757715588851851459306683123591338089745675044763551335899599807235257516935037356212345033087798267959242561085752109746935300735969972249665700075907145744305255616 [-]long_to_bytes(m).encode('hex')=
from gmpy2 import * from Crypto.Util.number import * from functools import reduce import random e=3 m=random.getrandbits(512) n1=78642188663937191491235684351005990853149481644703243255021321296087539054265733392095095639539412823093600710316645130404423641473150336492175402885270861906530337207734106926328737198871118125840680572148601743121884788919989184318198417654263598170932154428514561079675550090698019678767738203477097731989 c1=23419685303892339080979695469481275906709035609088426118328601771163101123641599051556995351678670765521269546319724616458499631461037359417701720430452076029312714313804716888119910334476982840024696320503747736428099717113471541651211596481005191146454458591558743268791485623924245960696651150688621664860 n2=98174485544103863705821086588292917749386955237408645745685476234349659452606822650329076955303471252833860010724515777826660887118742978051231030080666542833950748806944312437614585352818344599399156268450521239843157288915059003487783576003027303399985723834248634230998110618288843582573006048070816520647 c2=72080679612442543693944655041130370753964497034378634203383617624269927191363529233872659451561571441107920350406295389613006330637565645758727103723546610079332161151567096389071050158035757745766399510575237344950873632114050632573903701015749830874081198250578516967517980592506626547273178363503100507676 n3=91638855323231795590642755267985988356764327384001022396221901964430032527111968159623063760057482761918901490239790230176524505469897183382928646349163030620342744192731246392941227433195249399795012672172947919435254998997253131826888070173526892674308708289629739522194864912899817994807268945141349669311 c3=22149989692509889061584875630258740744292355239822482581889060656197919681655781672277545701325284646570773490123892626601106871432216449814891757715588851851459306683123591338089745675044763551335899599807235257516935037356212345033087798267959242561085752109746935300735969972249665700075907145744305255616 #long_to_bytes(m).encode('hex')= N = [n1,n2,n3] c = [c1,c2,c3] def chinese_remainder(modulus, remainders): Sum = 0 prod = reduce(lambda a, b: a*b, modulus) for m_i, r_i in zip(modulus, remainders): p = prod // m_i Sum += r_i * (inverse(p,m_i)*p) return Sum % prod e = 3 pow_m_e = chinese_remainder(N,c) m = iroot(pow_m_e,3)[0] print(long_to_bytes(m)) #b'FLAG{2^8rsa8c5f3cff4bc095349fec65fc2263e878}' #464c41477b325e3872736138633566336366663462633039353334396665633635666332323633653837387d
输入后下一题:
[+]Generating challenge 5 [+]n= 113604829563460357756722229849309932731534576966155520277171862442445354404910882358287832757024693652075211204635679309777620586814014894544893424988818766425089667672311645586528776360047956843961901352792631908859388801090108188344342619580661377758180391734771694803991493164412644148805229529911069578061 [+]e=7 [+]m=random.getrandbits(512) [+]c=pow(m,e,n)=112992730284209629010217336632593897028023711212853788739137950706145189880318698604512926758021533447981943498594790549326550460216939216988828130624120379925895123186121819609415184887470233938291227816332249857236198616538782622327476603338806349004620909717360739157545735826670038169284252348037995399308 [+]x=pow(m+1,e,n)=112992730284209629010217336632593897028023711212853788739137950706145189880318698604512926758021552486915464025361447529153776277710423467951041523831865232164370127602772602643378592695459331174613894578701940837730590029577336924367384969935652616989527416027725713616493815764725131271563545176286794438175 [-]long_to_bytes(m).encode('hex')=
import binascii def attack(c1, c2, n, e): PR.<x>=PolynomialRing(Zmod(n)) g1 = x^e - c1 g2 = (x+1)^e - c2 def gcd(g1, g2): while g2: g1, g2 = g2, g1 % g2 return g1.monic() return -gcd(g1, g2)[0] n= 113604829563460357756722229849309932731534576966155520277171862442445354404910882358287832757024693652075211204635679309777620586814014894544893424988818766425089667672311645586528776360047956843961901352792631908859388801090108188344342619580661377758180391734771694803991493164412644148805229529911069578061 e=7 c1=112992730284209629010217336632593897028023711212853788739137950706145189880318698604512926758021533447981943498594790549326550460216939216988828130624120379925895123186121819609415184887470233938291227816332249857236198616538782622327476603338806349004620909717360739157545735826670038169284252348037995399308 c2=112992730284209629010217336632593897028023711212853788739137950706145189880318698604512926758021552486915464025361447529153776277710423467951041523831865232164370127602772602643378592695459331174613894578701940837730590029577336924367384969935652616989527416027725713616493815764725131271563545176286794438175 m1 = attack(c1, c2, n, e) print(m1) print(binascii.unhexlify("%x" % int(m1))) c = 16404985139084147094704300764850430964980485772400565266054075398380588297033201409914512724255440373095027298869259036450071617770755361938461322132693877590521575670718076480353565935028734363256919872879837455527948173237810119579078252909879868459848240229599708133153841801633280283847680255816123323196 x = 92463268823628386526871956385934776043432833035349654252757452728405540022093349560058649691620353528569690982904353035470935543182784600771655097406007508218346417446808306197613168219068573563402315939576563452451487014381380516422829248470476887447827532913133023890886210295009811931573875721299817276803 #2519188594271759205757864485636246725747814635521266738394314968508953885010717495394569603836620104361341 #b'FLAG{2^8rsa398cf8df7c26661bb7cb65b2b9fae25e}' #'464c41477b325e3872736133393863663864663763323636363162623763623635623262396661653235657d'
输入后得到下一题:
[+]Generating challenge 6 [+]n=0xbadd260d14ea665b62e7d2e634f20a6382ac369cd44017305b69cf3a2694667ee651acded7085e0757d169b090f29f3f86fec255746674ffa8a6a3e1c9e1861003eb39f82cf74d84cc18e345f60865f998b33fc182a1a4ffa71f5ae48a1b5cb4c5f154b0997dc9b001e441815ce59c6c825f064fdca678858758dc2cebbc4d27L [+]d=random.getrandbits(1024*0.270) [+]e=invmod(d,phin) [+]hex(e)=0x11722b54dd6f3ad9ce81da6f6ecb0acaf2cbc3885841d08b32abc0672d1a7293f9856db8f9407dc05f6f373a2d9246752a7cc7b1b6923f1827adfaeefc811e6e5989cce9f00897cfc1fc57987cce4862b5343bc8e91ddf2bd9e23aea9316a69f28f407cfe324d546a7dde13eb0bd052f694aefe8ec0f5298800277dbab4a33bbL [+]m=random.getrandbits(512) [+]c=pow(m,e,n)=0xe3505f41ec936cf6bd8ae344bfec85746dc7d87a5943b3a7136482dd7b980f68f52c887585d1c7ca099310c4da2f70d4d5345d3641428797030177da6cc0d41e7b28d0abce694157c611697df8d0add3d900c00f778ac3428f341f47ecc4d868c6c5de0724b0c3403296d84f26736aa66f7905d498fa1862ca59e97f8f866cL [-]long_to_bytes(m).encode('hex')=
import time ############################################ # Config ########################################## """ Setting debug to true will display more informations about the lattice, the bounds, the vectors... """ debug = True """ Setting strict to true will stop the algorithm (and return (-1, -1)) if we don't have a correct upperbound on the determinant. Note that this doesn't necesseraly mean that no solutions will be found since the theoretical upperbound is usualy far away from actual results. That is why you should probably use `strict = False` """ strict = False """ This is experimental, but has provided remarkable results so far. It tries to reduce the lattice as much as it can while keeping its efficiency. I see no reason not to use this option, but if things don't work, you should try disabling it """ helpful_only = True dimension_min = 7 # stop removing if lattice reaches that dimension ############################################ # Functions ########################################## # display stats on helpful vectors def helpful_vectors(BB, modulus): nothelpful = 0 for ii in range(BB.dimensions()[0]): if BB[ii,ii] >= modulus: nothelpful += 1 print( nothelpful, "/", BB.dimensions()[0], " vectors are not helpful") # display matrix picture with 0 and X def matrix_overview(BB, bound): for ii in range(BB.dimensions()[0]): a = ('%02d ' % ii) for jj in range(BB.dimensions()[1]): a += '0' if BB[ii,jj] == 0 else 'X' if BB.dimensions()[0] < 60: a += ' ' if BB[ii, ii] >= bound: a += '~' print( a) # tries to remove unhelpful vectors # we start at current = n-1 (last vector) def remove_unhelpful(BB, monomials, bound, current): # end of our recursive function if current == -1 or BB.dimensions()[0] <= dimension_min: return BB # we start by checking from the end for ii in range(current, -1, -1): # if it is unhelpful: if BB[ii, ii] >= bound: affected_vectors = 0 affected_vector_index = 0 # let's check if it affects other vectors for jj in range(ii + 1, BB.dimensions()[0]): # if another vector is affected: # we increase the count if BB[jj, ii] != 0: affected_vectors += 1 affected_vector_index = jj # level:0 # if no other vectors end up affected # we remove it if affected_vectors == 0: print( "* removing unhelpful vector", ii) BB = BB.delete_columns([ii]) BB = BB.delete_rows([ii]) monomials.pop(ii) BB = remove_unhelpful(BB, monomials, bound, ii-1) return BB # level:1 # if just one was affected we check # if it is affecting someone else elif affected_vectors == 1: affected_deeper = True for kk in range(affected_vector_index + 1, BB.dimensions()[0]): # if it is affecting even one vector # we give up on this one if BB[kk, affected_vector_index] != 0: affected_deeper = False # remove both it if no other vector was affected and # this helpful vector is not helpful enough # compared to our unhelpful one if affected_deeper and abs(bound - BB[affected_vector_index, affected_vector_index]) < abs(bound - BB[ii, ii]): print( "* removing unhelpful vectors", ii, "and", affected_vector_index) BB = BB.delete_columns([affected_vector_index, ii]) BB = BB.delete_rows([affected_vector_index, ii]) monomials.pop(affected_vector_index) monomials.pop(ii) BB = remove_unhelpful(BB, monomials, bound, ii-1) return BB # nothing happened return BB """ Returns: * 0,0 if it fails * -1,-1 if `strict=true`, and determinant doesn't bound * x0,y0 the solutions of `pol` """ def boneh_durfee(pol, modulus, mm, tt, XX, YY): """ Boneh and Durfee revisited by Herrmann and May finds a solution if: * d < N^delta * |x| < e^delta * |y| < e^0.5 whenever delta < 1 - sqrt(2)/2 ~ 0.292 """ # substitution (Herrman and May) PR.<u, x, y> = PolynomialRing(ZZ) Q = PR.quotient(x*y + 1 - u) # u = xy + 1 polZ = Q(pol).lift() UU = XX*YY + 1 # x-shifts gg = [] for kk in range(mm + 1): for ii in range(mm - kk + 1): xshift = x^ii * modulus^(mm - kk) * polZ(u, x, y)^kk gg.append(xshift) gg.sort() # x-shifts list of monomials monomials = [] for polynomial in gg: for monomial in polynomial.monomials(): if monomial not in monomials: monomials.append(monomial) monomials.sort() # y-shifts (selected by Herrman and May) for jj in range(1, tt + 1): for kk in range(floor(mm/tt) * jj, mm + 1): yshift = y^jj * polZ(u, x, y)^kk * modulus^(mm - kk) yshift = Q(yshift).lift() gg.append(yshift) # substitution # y-shifts list of monomials for jj in range(1, tt + 1): for kk in range(floor(mm/tt) * jj, mm + 1): monomials.append(u^kk * y^jj) # construct lattice B nn = len(monomials) BB = Matrix(ZZ, nn) for ii in range(nn): BB[ii, 0] = gg[ii](0, 0, 0) for jj in range(1, ii + 1): if monomials[jj] in gg[ii].monomials(): BB[ii, jj] = gg[ii].monomial_coefficient(monomials[jj]) * monomials[jj](UU,XX,YY) # Prototype to reduce the lattice if helpful_only: # automatically remove BB = remove_unhelpful(BB, monomials, modulus^mm, nn-1) # reset dimension nn = BB.dimensions()[0] if nn == 0: print( "failure") return 0,0 # check if vectors are helpful if debug: helpful_vectors(BB, modulus^mm) # check if determinant is correctly bounded det = BB.det() bound = modulus^(mm*nn) if det >= bound: print( "We do not have det < bound. Solutions might not be found.") print( "Try with highers m and t.") if debug: diff = (log(det) - log(bound)) / log(2) print( "size det(L) - size e^(m*n) = ", floor(diff)) if strict: return -1, -1 else: print( "det(L) < e^(m*n) (good! If a solution exists < N^delta, it will be found)") # display the lattice basis if debug: matrix_overview(BB, modulus^mm) # LLL if debug: print( "optimizing basis of the lattice via LLL, this can take a long time") BB = BB.LLL() if debug: print( "LLL is done!") # transform vector i & j -> polynomials 1 & 2 if debug: print( "looking for independent vectors in the lattice") found_polynomials = False for pol1_idx in range(nn - 1): for pol2_idx in range(pol1_idx + 1, nn): # for i and j, create the two polynomials PR.<w,z> = PolynomialRing(ZZ) pol1 = pol2 = 0 for jj in range(nn): pol1 += monomials[jj](w*z+1,w,z) * BB[pol1_idx, jj] / monomials[jj](UU,XX,YY) pol2 += monomials[jj](w*z+1,w,z) * BB[pol2_idx, jj] / monomials[jj](UU,XX,YY) # resultant PR.<q> = PolynomialRing(ZZ) rr = pol1.resultant(pol2) # are these good polynomials? if rr.is_zero() or rr.monomials() == [1]: continue else: print( "found them, using vectors", pol1_idx, "and", pol2_idx) found_polynomials = True break if found_polynomials: break if not found_polynomials: print( "no independant vectors could be found. This should very rarely happen...") return 0, 0 rr = rr(q, q) # solutions soly = rr.roots() if len(soly) == 0: print( "Your prediction (delta) is too small") return 0, 0 soly = soly[0][0] ss = pol1(q, soly) solx = ss.roots()[0][0] # return solx, soly def example(): ############################################ # How To Use This Script ########################################## # # The problem to solve (edit the following values) # # the modulus N = 0xbadd260d14ea665b62e7d2e634f20a6382ac369cd44017305b69cf3a2694667ee651acded7085e0757d169b090f29f3f86fec255746674ffa8a6a3e1c9e1861003eb39f82cf74d84cc18e345f60865f998b33fc182a1a4ffa71f5ae48a1b5cb4c5f154b0997dc9b001e441815ce59c6c825f064fdca678858758dc2cebbc4d27 # the public exponent e = 0x11722b54dd6f3ad9ce81da6f6ecb0acaf2cbc3885841d08b32abc0672d1a7293f9856db8f9407dc05f6f373a2d9246752a7cc7b1b6923f1827adfaeefc811e6e5989cce9f00897cfc1fc57987cce4862b5343bc8e91ddf2bd9e23aea9316a69f28f407cfe324d546a7dde13eb0bd052f694aefe8ec0f5298800277dbab4a33bb # the cipher c = 0xe3505f41ec936cf6bd8ae344bfec85746dc7d87a5943b3a7136482dd7b980f68f52c887585d1c7ca099310c4da2f70d4d5345d3641428797030177da6cc0d41e7b28d0abce694157c611697df8d0add3d900c00f778ac3428f341f47ecc4d868c6c5de0724b0c3403296d84f26736aa66f7905d498fa1862ca59e97f8f866c # the hypothesis on the private exponent (the theoretical maximum is 0.292) delta = .28 # this means that d < N^delta # # Lattice (tweak those values) # # you should tweak this (after a first run), (e.g. increment it until a solution is found) m = 4 # size of the lattice (bigger the better/slower) # you need to be a lattice master to tweak these t = int((1-2*delta) * m) # optimization from Herrmann and May X = 2*floor(N^delta) # this _might_ be too much Y = floor(N^(1/2)) # correct if p, q are ~ same size # # Don't touch anything below # # Problem put in equation P.<x,y> = PolynomialRing(ZZ) A = int((N+1)/2) pol = 1 + x * (A + y) # # Find the solutions! # # Checking bounds if debug: print( "=== checking values ===") print( "* delta:", delta) print( "* delta < 0.292", delta < 0.292) print( "* size of e:", int(log(e)/log(2))) print( "* size of N:", int(log(N)/log(2))) print( "* m:", m, ", t:", t) # boneh_durfee if debug: print( "=== running algorithm ===") start_time = time.time() solx, soly = boneh_durfee(pol, e, m, t, X, Y) # found a solution? if solx > 0: print( "=== solution found ===") if False: print( "x:", solx) print( "y:", soly) d = int(pol(solx, soly) / e) m = pow(c,d,N) print( '[-]d is ' + str(d)) print( '[-]m is: ' + str(m)) print( '[-]hex(m) is: ' + '{:x}'.format(int(m))) else: print( "[!]no solution was found!") print( '[!]All Done!') if debug: print(("[!]Timer: %s s" % (time.time() - start_time))) print( '[!]All Done!') if __name__ == "__main__": example()
用sage运行得到
'\nSetting debug to true will display more informations\nabout the lattice, the bounds, the vectors...\n' "\nSetting strict to true will stop the algorithm (and\nreturn (-1, -1)) if we don't have a correct \nupperbound on the determinant. Note that this \ndoesn't necesseraly mean that no solutions \nwill be found since the theoretical upperbound is\nusualy far away from actual results. That is why\nyou should probably use `strict = False`\n" "\nThis is experimental, but has provided remarkable results\nso far. It tries to reduce the lattice as much as it can\nwhile keeping its efficiency. I see no reason not to use\nthis option, but if things don't work, you should try\ndisabling it\n" " \nReturns:\n* 0,0 if it fails\n* -1,-1 if `strict=true`, and determinant doesn't bound\n* x0,y0 the solutions of `pol`\n" === checking values === * delta: 0.280000000000000 * delta < 0.292 True * size of e: 1020 * size of N: 1023 * m: 4 , t: 1 === running algorithm === * removing unhelpful vectors 4 and 5 * removing unhelpful vector 3 * removing unhelpful vectors 1 and 2 * removing unhelpful vector 0 5 / 10 vectors are not helpful We do not have det < bound. Solutions might not be found. Try with highers m and t. size det(L) - size e^(m*n) = 698 00 X 0 0 0 0 0 0 0 0 0 ~ 01 X X 0 0 0 0 0 0 0 0 ~ 02 X X X 0 0 0 0 0 0 0 03 X X X X 0 0 0 0 0 0 04 0 0 0 0 X 0 0 0 0 0 ~ 05 0 0 0 0 X X 0 0 0 0 ~ 06 0 0 0 0 X X X 0 0 0 ~ 07 0 0 0 0 X X X X 0 0 08 0 0 0 0 X X X X X 0 09 X X X X 0 X X X X X optimizing basis of the lattice via LLL, this can take a long time LLL is done! looking for independent vectors in the lattice found them, using vectors 0 and 1 === solution found === [-]d is 776765455081795377117377680209510234887230129318575063382634593357724998207571 [-]m is: 5616256644474643777324927156425296308201436356404797635226215853608752109375728559177663257634746748367999648544612395127292284761610833552163188225026856 [-]hex(m) is: 6b3bb0cdc72a7f2ce89902e19db0fb2c0514c76874b2ca4113b86e6dc128d44cc859283db4ca8b0b5d9ee35032aec8cc8bb96e8c11547915fc9ef05aa2d72b28 [!]Timer: 0.20359492301940918 s [!]All Done!
输入6b3bb0cdc72a7f2ce89902e19db0fb2c0514c76874b2ca4113b86e6dc128d44cc859283db4ca8b0b5d9ee35032aec8cc8bb96e8c11547915fc9ef05aa2d72b28
得到:FLAG{9828f915d621b9a0a5666fc21e5ee84f}
Pwn
MagicRoom
2020网鼎杯的题,没有附件做不来
yundun
2020网鼎杯的题,没有附件做不来
Re
easyGo
先试试能不呢符号执行直接出 ,如果不行再手动分析一下;
import angr import sys class Cracker: def __init__(self, path_to_binary): self.path_to_binary = path_to_binary self.project = angr.Project(path_to_binary) # 初始化状态 self.initial_state = self.project.factory.entry_state() # 初始化模拟器 self.simulation = self.project.factory.simgr(self.initial_state) # 不参与符号执行的地址 self.avoid_address = None def init_state(self): self.initial_state = self.project.factory.entry_state() def set_avoid_address(self, avoid_address): self.avoid_address = avoid_address def simulate_by_output(self, success_output: str, fail_output: str): def is_successful(state): stdout_output = state.posix.dumps(sys.stdout.fileno()) if success_output.encode() in stdout_output: return True else: return False def should_abort(state): stdout_output = state.posix.dumps(sys.stdout.fileno()) if fail_output.encode() in stdout_output: return True else: return False # 初始化模拟器 self.simulation = self.project.factory.simgr(self.initial_state) # 开始查找所有的可能 self.simulation.explore(find=is_successful, avoid=should_abort) # 如果有结果 if self.simulation.found: # 输出第一种可能 solution_state = self.simulation.found[0] print(solution_state.posix.dumps(sys.stdin.fileno())) else: raise Exception('Could not find the solution') def main(): cracker = Cracker("./easyGo") # 比较常用的方法,根据输出进行符号执行 cracker.simulate_by_output( success_output="Congratulation the flag you input is correct!", fail_output="Try again! Come on!") main()
符号分析条件复杂度太高了,还是得自己做;分析很久都没有什么头绪,突然感觉这道题有点熟悉,在网上搜索可以发现CISCN有一道GO题和这个很像;
根据题目名称和 IDA 结合来看,猜测是一个 go 写的程序。
程序的符号信息被去除了,用 IDAGolangHelper 恢复符号信息
然后看 main_main 函数,在 encoding_base64__ptr_Encoding_DecodeString 处下断点。
单步调试到这里,跟进 rsi 地址的内存数据,就能看到 flag 了。
flag{92094daf-33c9-431e-a85a-8bfbd5df98ad}
Misc
a-dump-file
内存取证的题目
查看镜像信息,profile为Win7SP1x64
查看cmd执行的命令,发现添加了一个用户mumuzi,密码(ljmmz)ovo。
然后foremost 镜像文件,找到其中的ZIP文件夹,批量解密,密码为:(ljmmz)ovo
得到Flag
入侵排查
正常做法有点麻烦,SlackMoon师傅教你非预期,直接分解,然后破一下伪加密,直接拿下
MISC1
binwalk -e misc1.png 得到文件,发现23991的文件是压缩包,但是逆序了
解密后保存打开,得到ook文本,再次解密:
flag{0343875a622b2cab8c01e5fcd385503d}