BUUCTF WEB WELCOME TO THE EARTH

最新推荐文章于 2022-09-13 21:52:48 发布

显哥无敌

最新推荐文章于 2022-09-13 21:52:48 发布

阅读量4.4k

点赞数

分类专栏： BUUCTF 文章标签： web安全

本文链接：https://blog.csdn.net/qq_41696858/article/details/123632211

版权

BUUCTF 专栏收录该内容

80 篇文章 6 订阅

订阅专栏

日常刷题，打开场景，发现图片过了一段时间会变，看来有js代码
emmm，这题属于是送分题，找路径啥的属实没意思，不妨直接看最后的python脚本呢?
看页面内容

<!DOCTYPE html>
<html>
  <head>
    <title>Welcome to Earth</title>
  </head>
  <body>
    <h1>AMBUSH!</h1>
    <p>You've gotta escape!</p>
    <img src="/static/img/f18.png" alt="alien mothership" style="width:60vw;" />
    <script>
      document.onkeydown = function(event) {
        event = event || window.event;
        if (event.keyCode == 27) {
          event.preventDefault();
          window.location = "/chase/";
        } else die();
      };

      function sleep(ms) {
        return new Promise(resolve => setTimeout(resolve, ms));
      }

      async function dietimer() {
        await sleep(10000);
        die();
      }

      function die() {
        window.location = "/die/";
      }

      dietimer();
    </script>
  </body>
</html>

关键代码

 if (event.keyCode == 27) {
          event.preventDefault();
          window.location = "/chase/";
        } else die();
      };

给了chase目录，访问页面

function sleep(ms) {
        return new Promise(resolve => setTimeout(resolve, ms));
      }

      async function dietimer() {
        await sleep(1000);
        die();
      }

      function die() {
        window.location = "/die/";
      }

      function left() {
        window.location = "/die/";
      }

      function leftt() {
        window.location = "/leftt/";
      }

      function right() {
        window.location = "/die/";
      }

下一个hint:
leftt目录，访问

<!DOCTYPE html>
<html>
  <head>
    <title>Welcome to Earth</title>
  </head>
  <body>
    <h1>YOU SHOT IT DOWN!</h1>
    <p>Well done! You also crash in the process</p>
    <img src="/static/img/parachute.png" alt="parachute" style="width:60vw;" />
    <button onClick="window.location='/door/'">Continue</button>
  </body>
</html>

下一关：访问/door/

<!DOCTYPE html>
<html>
  <head>
    <title>Welcome to Earth</title>
    <script src="/static/js/door.js"></script>
  </head>
  <body>
    <h1>YOU APPROACH THE ALIEN CRAFT!</h1>
    <p>How do you get inside?</p>
    <img src="/static/img/ship.png" alt="crashed ship" style="width:60vw;" />
    <form id="door_form">
     "176" />176
      <input type="radio" name="side" value="177" />177
      ...
    </form>
    <button onClick="check_door()">Check</button>
  </body>
</html>

看来我们要在里面选一个数字，调用的是check_door函数，逻辑在/static/js/door.js里，先看看内容

function check_door() {
  var all_radio = document.getElementById("door_form").elements;
  var guess = null;

  for (var i = 0; i < all_radio.length; i++)
    if (all_radio[i].checked) guess = all_radio[i].value;

  rand = Math.floor(Math.random() * 360);
  if (rand == guess) window.location = "/open/";
  else window.location = "/die/";
}

下一关：/open/

<!DOCTYPE html>
<html>
  <head>
    <title>Welcome to Earth</title>
    <script src="/static/js/open_sesame.js"></script>
  </head>
  <body>
    <h1>YOU FOUND THE DOOR!</h1>
    <p>How do you open it?</p>
    <img src="/static/img/door.jpg" alt="door" style="width:60vw;" />
    <script>
      open(0);
    </script>
  </body>
</html>
同样：/static/js/open_sesame.js
function sleep(ms) {
  return new Promise(resolve => setTimeout(resolve, ms));
}

function open(i) {
  sleep(1).then(() => {
    open(i + 1);
  });
  if (i == 4000000000) window.location = "/fight/";
}

想都不用想，傻子才去真做呢。/fight/

<!DOCTYPE html>
<html>
  <head>
    <title>Welcome to Earth</title>
    <script src="/static/js/fight.js"></script>
  </head>
  <body>
    <h1>AN ALIEN!</h1>
    <p>What do you do?</p>
    <img
      src="/static/img/alien.png"
      alt="door"
      style="width:60vw;"
    />
    </br>
    <input type="text" id="action">
    <button onClick="check_action()">Fight!</button>
  </body>
</html>
访问/static/js/fight.js
// Run to scramble original flag
//console.log(scramble(flag, action));
function scramble(flag, key) {
  for (var i = 0; i < key.length; i++) {
    let n = key.charCodeAt(i) % flag.length;
    let temp = flag[i];
    flag[i] = flag[n];
    flag[n] = temp;
  }
  return flag;
}

function check_action() {
  var action = document.getElementById("action").value;
  var flag = ["{hey", "_boy", "aaaa", "s_im", "ck!}", "_baa", "aaaa", "pctf"];

  // TODO: unscramble function
}

emmmmm，终于是是没有下一关的目录了，看一下逻辑，就是个简单的排列组合
那么写爆破代码，目的是要找以pctf{hey_boys_im开头和ck!}结尾的特定字符串,这就是一个全排列问题,直接拿python的模块permutations来做了

from itertools import permutations
flag = ["{hey", "_boy", "aaaa", "s_im", "ck!}", "_baa", "aaaa", "pctf"]
item = permutations(flag)
for i in item:
	k = ''.join(list(i))
	if k.startswith('pctf{hey_boys_im') and k.endswith == 'ck!}':
		print(k)
得到flag：pctf{hey_boys_im_baaaaaaaaaack!}

参考视频链接:https://www.bilibili.com/video/BV1DL411P7aJ/

显哥无敌

关注

0
点赞
踩
0

收藏

觉得还不错? 一键收藏
0
评论
BUUCTF WEB WELCOME TO THE EARTH

日常刷题，打开场景，发现图片过了一段时间会变，看来有js代码emmm，这题属于是送分题，找路径啥的属实没意思，不妨直接看最后的python脚本呢?看页面内容<!DOCTYPE html><html> <head> <title>Welcome to Earth</title> </head> <body> <h1>AMBUSH!</h1> <p>
复制链接

扫一扫