SDBCTF2021 writeup

WEB

Ez_math

下方有相应计算语句，那么构建

a=1，b=1，c=1)+207137+(1

语句为：

得出flag

---

Ez_math2

和上面的方法一样

---

Ez_login

尝试万能密码

admin' or '1'='1

提交得到flag

---

套娃

is_numeric()检测变量是否为数字或数字字符串

阅读代码后构造payload

https://69ab9160.cpolar.io/?cr0fy=2072a

 进入第二个页面

 可以用数组绕过sha1检测，payload：

https://69ab9160.cpolar.io/come_baby.php/?N0vice[]=1&&Elli0t[]=2

 进入第三个页面

发现存在is_array检测数组

只能用sha1碰撞，找到谷歌发布的sha1

N0vice=%25PDF-1.3%0A%25%E2%E3%CF%D3%0A%0A%0A1%200%20obj%0A%3C%3C/Width%202%200%20R/Height%203%200%20R/Type%204%200%20R/Subtype%205%200%20R/Filter%206%200%20R/ColorSpace%207%200%20R/Length%208%200%20R/BitsPerComponent%208%3E%3E%0Astream%0A%FF%D8%FF%FE%00%24SHA-1%20is%20dead%21%21%21%21%21%85/%EC%09%239u%9C9%B1%A1%C6%3CL%97%E1%FF%FE%01sF%DC%91f%B6%7E%11%8F%02%9A%B6%21%B2V%0F%F9%CAg%CC%A8%C7%F8%5B%A8Ly%03%0C%2B%3D%E2%18%F8m%B3%A9%09%01%D5%DFE%C1O%26%FE%DF%B3%DC8%E9j%C2/%E7%BDr%8F%0EE%BC%E0F%D2%3CW%0F%EB%14%13%98%BBU.%F5%A0%A8%2B%E31%FE%A4%807%B8%B5%D7%1F%0E3.%DF%93%AC5%00%EBM%DC%0D%EC%C1%A8dy%0Cx%2Cv%21V%60%DD0%97%91%D0k%D0%AF%3F%98%CD%A4%BCF%29%B1&
Elli0t=%25PDF-1.3%0A%25%E2%E3%CF%D3%0A%0A%0A1%200%20obj%0A%3C%3C/Width%202%200%20R/Height%203%200%20R/Type%204%200%20R/Subtype%205%200%20R/Filter%206%200%20R/ColorSpace%207%200%20R/Length%208%200%20R/BitsPerComponent%208%3E%3E%0Astream%0A%FF%D8%FF%FE%00%24SHA-1%20is%20dead%21%21%21%21%21%85/%EC%09%239u%9C9%B1%A1%C6%3CL%97%E1%FF%FE%01%7FF%DC%93%A6%B6%7E%01%3B%02%9A%AA%1D%B2V%0BE%CAg%D6%88%C7%F8K%8CLy%1F%E0%2B%3D%F6%14%F8m%B1i%09%01%C5kE%C1S%0A%FE%DF%B7%608%E9rr/%E7%ADr%8F%0EI%04%E0F%C20W%0F%E9%D4%13%98%AB%E1.%F5%BC%94%2B%E35B%A4%80-%98%B5%D7%0F%2A3.%C3%7F%AC5%14%E7M%DC%0F%2C%C1%A8t%CD%0Cx0Z%21Vda0%97%89%60k%D0%BF%3F%98%CD%A8%04F%29%A1

提交得到flag

---

召唤神龙 

进入检查----猜测flag在网页某个代码中----搜索flag得到

---

MISC

抽奖

发现是gif文件，进行分离，之前的工具不知道为啥分离不了，去在线工具找gif分离

找到个二维码，扫描得到flag

---

藏猫猫 

 

使用工具找

---

倘来之物 

  打开发现是一个图片，丢入binwalk分析

发现有zip存在，把它提取出来

 发现一串base64编码，解码得到flag

---

N0vice的游戏 

一个压缩包，爆破密码为123456，得到二维码，扫码得到key

第二个为一张图片，放入binwalk分离

 

得到key

第三个是修改图片高度 

可以看出下方缺少，winhex修改高度得到key

最终得到flag

---

b1ndog 

lsb隐写

 上方明显有东西

一开始RGB发现没有啥东西，然后看到反向的{   }猜测是BGR，得到flag

---

CRYPTO 

 affine

提示是affine的话就试试仿射

yopf{kj_bjz_hcjn_pyytcr_dtqmre?}

在线工具解码

---

Signin

一开始懵了，然后看到图片名字symbols，一直找，找到了Latex symbol这个东西，对了很久很久很久，总算对照出来了 

 

                                                             flag{fun_LaTeX_Math}

---

Ez_classical

Opkvr eii va seac geopy xb hzkdbgp gvrrnnuvzekmjv gw glvvz ixi bvxeiqfegmfrn xavfyzrb bni plrpgmtkr – eeh zdkvl trxc xuwrw umankvrrk vdaqw.Lslv atgk vw QqspF3xUhNpaEslyfc8bx19ID1F3op9bCRfnflIyjL==. ZYE vw yimm zs uict twa qnrrkz guye hzkdbgp emjo rqzl n vrrbm uj pegewqrmgmvw vvj iktvvoqyi vrtpplort mexzoxegiu vdaq qnrrkzukrg, xyvziz hrxvgoqur nru vzavsawv, mymtxvxp eil ggpijw hitetidiib, grq jiepl vvrzvroqur.

古典密码的话应该是维吉尼亚密码

但是我也不知道密钥是啥，最后找到个网站Vigenere Solver - www.guballa.de在线爆破

看到个base64，解码得到flag

---

Basic_RSA

n = 7168710045719540786046981944478960617029015738768368491690610753094240667686070925471276988585806662404182528613845509600885327970740383330916390612660593
c = 6867458099093215876610304261510609489636746022985210210835338885537647480727039161144038016078969507780730419842377579696934883161819160104081020930669326
e = 0x10001

在线网站分解n无效，可能是接近，调用yufu进行分解，得到p，q

P77 = 84668235163605133373102334532238432455270507565499112735876274741500617207761

P77 = 84668235163605133373102334532238432455270507565499112735876274741500617207713

import gmpy2 as gp
import binascii
p =  gp.mpz()
q =  gp.mpz()
e =  gp.mpz()
c =  gp.mpz()
n = p*q
phi = (p-1) * (q-1)
d = gp.invert(e, phi)
m = pow(c, d, n)
print(m)

转字符得到flag{Th1s_1s_B@sic_R54!}

---

RSA's door

n = 83460170332789543359445060411497091705804347364814281245470592371133663106493530608529409469102954937185667576039172576285648391297318795610422514102512583090612487721046716106948497619174942971205579018112043183472479315627448807683635691353125628950015872682908289145195785920862040617692664410063124332797
c = 26250757423108567792724501378031544698470616542583222949791028734059363700092406162375811441350147327767242910889775661368558849005173412332899512309987806846885085716280099758930498330471269563103649046578356553301448940882198650959085854611488701240627782161420762544029829950158419500083720803957689656782
e = 3

e特别小，那就用低加密指数攻击

#python3
import  RSAwienerHacker
n=
e=
d =  RSAwienerHacker.hack_RSA(e,n)
if d:
    print(d)
import hashlib
flag = "flag{" + hashlib.md5(hex(d)).hexdigest() + "}"
print flag

或者用一些工具更方便，最后得出

14337636555116174986481352878913213645344625778723598546429768360200738449114030392431283977286063235453转字符串flag{We1c0me_To_C0oooooola_Gouliang_Cuppp!}
 

---

Reverse

逆向签到处

打开压缩包发现有密码，直接破解密码得出123456

ida打开文件找到flag

---

PWN 

给出了个端口，kali中用nc进入

121.89.236.144 8889

ls看看目录，cat flag得到flag

flag{fcc93007-ee3a-4e0f-bb13-2465ca0d72ac}