GKCTF2021 X DASCTF应急挑战杯WP

签到
导出HTTP

在shell18发现cat flag并且base64
Tmpshell19就是flag
并且转ascii之后base64解码是每行翻转的base。写个脚本

num = 0x64306c455357644251306c6e51554e4a5a3046355355737764306c7154586c4a616b31355357704e65556c7154586c4a616b31355357704e65556c7154586c4a616b31355357704e65556c7154586c4a616b31355357704e65556c7154576c44546d39525241707154586c4a616b31355357704e65556c7154586c4a616b31355357704e65556c7154586c4a616b31355357704e65556c7162314645616b46445357644251306c6e51554e4a5a32644554545a46524530325157704e5a3046365458524e524531305257704e436e5177553078304d464e4d6444425454485177553078304d464e4d6444425454485177553078304d464e4d6444425454485177553078304d464e4d6444425454485177553078304d464e4d644442705130354e65556c7154586c4a616b31355357704e65556b4b4e6b467154576442656b31305455524e644556715458644a616b38775a566f324d6d56774e557377643074795556645a64315a485a48593152556c3051576c4e4d5546355a4777316255733254545a7162475a7763573579555552304d464e4d64444254544170304d464e4d6444425454485177553078304d464e4d6444425454485177553078304d464e4d6444425454485177553078304d464e4d6444425454485177553078304d464e4d537a42425357526159585a764e7a567462485a735130354e564530325255524e436e6f77655531334d464e4e6555467154545a524e327877596a647362584a5252484a7a5131706f516c68614d446c745647637751306c355655524a4d315a74596e4676656d3951567974736357563151303477553078304d464e4d64444254544851775530774b63336858576d786b4d5659354d544e6c4e325179576d684752324a7a576d31615a7a427363446c7064573569567974585a7a427363446c7064573569567974585a7a427363446c706457356956797458537a423354586876564531336230524e6555464454517045546a4252524534775555527356324636546c684e65444258596d593562464a48556b524f5245347759584a6b4d464a6d4f565a6162444658596e644252456c6b556d46746345524c61577832526b6c6b556d46746345524c61577832566b747754544a5a436a303955556c6f545442525245347755516f3d
num = hex(num)

s = ['wIDIgACIgACIgAyIK0wIjMyIjMyIjMyIjMyIjMyIjMyIjMyIjMyIjMyIjMyIjMyIjMyIjMiCNoQD','jMyIjMyIjMyIjMyIjMyIjMyIjMyIjMyIjMyIjoQDjACIgACIgACIggDM6EDM6AjMgAzMtMDMtEjM','t0SLt0SLt0SLt0SLt0SLt0SLt0SLt0SLt0SLt0SLt0SLt0SLt0SLt0SLt0iCNMyIjMyIjMyIjMyI','6AjMgAzMtMDMtEjMwIjO0eZ62ep5K0wKrQWYwVGdv5EItAiM1Aydl5mK6M6jlfpqnrQDt0SLt0SL','t0SLt0SLt0SLt0SLt0SLt0SLt0SLt0SLt0SLt0SLt0SLt0SLt0SLK0AIdZavo75mlvlCNMTM6EDM','z0yMw0SMyAjM6Q7lpb7lmrQDrsCZhBXZ09mTg0CIyUDI3VmbqozoPW+lqeuCN0SLt0SLt0SLt0SL','sxWZld1V913e7d2ZhFGbsZmZg0lp9iunbW+Wg0lp9iunbW+Wg0lp9iunbW+WK0wMxoTMwoDMyACM','DN0QDN0QDlWazNXMx0Wbf9lRGRDNDN0ard0Rf9VZl1WbwADIdRampDKilvFIdRampDKilvVKpM2Y','==QIhM0QDN0Q']
flag = ''
for i in s:
    flag += i[::-1]
print(flag)

输出

DQoNCiMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIw0KIyAgICAgICAgIDIwMjEtMDMtMzAgMjA6MDE6MDggICAgICAgICAjDQojIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMNCi0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tDQrnqpflj6M6Km5ldyA1MiAtIE5vdGVwYWQrKw0K5pe26Ze0OjIwMjEtMDMtMzAgMjA6MDE6MTMNClvlm57ovaZdIA0KLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0NCueql+WPozoqbmV3IDUyIC0gTm90ZXBhZCsrDQrml7bpl7Q6MjAyMS0wMy0zMCAyMDowMToxMw0KW+Wbnui9pl0gW+Wbnui9pl0gW+Wbnui9pl0gZmZsbGFhZ2d7e319V1dlZWxsY2MpKVvliKDpmaRdIFvliKDpmaRdIDAwbW1lZV9fR0dra0NDNDRGRl9fbW0xMXNzaWlDQ0NDQ0NDQ0NDQ0MhIQ==

ffllaagg{{}}WWeellcc 00mmee__GGkkCC44FF__mm11ssiiCCCCCCCCCCCC!!
拿去bugku的栅栏爆破

把其放进flag里即可
flag{Welc0me_GkC4F_m1siCCCCCC!}

你知道apng吗
首先用apngdis_gui分解
观察到02 10 18 26有二维码

10的二维码在R1通道，18直接用stegsolve反色，26直接扫码，02一直调拉伸调不动，最后用https://merricx.github.io/qrazybox/手撸去了
得到

拼接起来
flag{a3c7e4e5-9b9d-ad20-0327-288a235370ea}
银杏岛の奇妙冒险
一血get（为什么我记得提交的时候Check的C是小写）
还有，题目坐标yz写反了
又是一道不禁局域网的，很白给……
开局了解了剧情后，果断给自己附魔一把锋利
/give @p minecraft:diamond_sword 1 0 {ench:[{id:16,lvl:32767}]}
然后每个都是一刀，就没了

然后分别TP
/tp @p 255 71 -41
/tp @p 291 67 -95
/tp @p 324 79 -190
/tp @p 362 69 -114
然后都是一刀秒，得到part1-4
看群里说用GKCTF包裹

GKCTF{w3lc0me_t0_9kctf_2021_Check_1n}
最终装备，彩蛋也简单，看到鞘翅和烟花知结局

Random
同ISCC的擂台题cryisc差不多，然后以前要过iscc的脚本，就魔改一下即可
也是通过randcrack来爆破，每次只能提交32bits

import random
from hashlib import md5
import randcrack


mask1=(1<<32)-1
mask2=(1<<64)-1
rc=randcrack.RandCrack()
with open("random.txt","r") as f:
    f = f.readlines()
    for i in range(104):
        r = int(f[i*3])
        rc.submit(r&mask1)
        r = int(f[i*3+1])
        rc.submit((r&mask1))
        rc.submit((r&mask2)>>32)
        r = int(f[i*3+2])
        rc.submit((r&mask1))
        rc.submit((r&mask2)>>32)
        rc.submit(r>>64)
c1=rc.predict_randrange(0,2**32-1)
c2=rc.predict_randrange(0,2**32-1)
print(c1) #1838604710
print(c2) #2407284497

flag = md5(str(1838604710).encode()).hexdigest()
print('GKCTF{'+flag+'}')
flag = md5(str(2407284497).encode()).hexdigest()
print('GKCTF{'+flag+'}')

1838604710
2407284497
GKCTF{14c71fec812b754b2061a35a4f6d8421}
GKCTF{e7b48c466c303ed09171b390cd76e741}

哪个是对的我忘了

FireFox Forensics
得到db和json，这是火狐保存密码的文件，找到这个目录

C:\Users\mumuzi\AppData\Roaming\Mozilla\Firefox\Profiles???.default-release

替换掉，然后去火狐查看保存的密码，密码就是flag

GKCTF{9cf21dda-34be-4f6c-a629-9c4647981ad7}

excel 骚操作

发现有些是1，就用条件格式来弄

然后列宽改2.5，手机上用“中国编码”扫码

flag{9ee0cb62-f443-4a72-e9a3-43c0b910757e}
0.03
用我最喜欢的360解压的时候发现有ntfs流隐写

还有之前的

do you believe that you get?
311223313313112122312312313311

有密文和密码本，三分密码。

EBCCAFDDCE

然后是磁盘，用VeraCrypt解密，密码就是EBCCAFDDCE，解密挂载

flag{85ec0e23-ebbe-4fa7-9c8c-e8b743d0d85c}

easycms
扫 塔 懂 ？
/admin.php
然后弱密码，直接admin-12345就进去了。
在模板–自定义里面，保存

然后抓包（第二个包）

那串base64改成/flag的base64

flag{dd9a9d41-a317-474f-875a-fc2d72a44369}

问卷调查：flag{787c37cc-5ec2-9aae-f9c5-c1cc624caec0}