Sparks_Pion的博客

basic-file-exploitif ((entry_number = strtol(entry, NULL, 10)) == 0){ puts(flag); fseek(stdin, 0, SEEK_END); exit(0);}查询 0 号就可以了┌──(root㉿LAPTOP-Sparks)-[/tmp]└─# nc saturn.picoctf.net 52682Hi, welcome to my echo chamber!Type '1' to ent

IncludespicoCTF{1nclu51v17y_1of2_f7w_2of2_5a94a145}Inspect HTMLpicoCTF{1n5p3t0r_0f_h7ml_b101a689}Local AuthoritypicoCTF{j5_15_7r4n5p4r3n7_b964a657}Search source保存网页，直接搜Forbidden Paths路径穿越Power Cookie重载函数Roboto Sans扫网站看 robots.txtb

file-run1file-run2GDB Test Drivepatchme.pySafe Opener解 Base64unpackme.pybloat.py先 print 看看是啥发现都给解密好了Fresh JavaBbbbloat记得 applyunpackme老套路Keygenme不懂了，直接搜 String 出来了KeygenmeIDA 里面调整一下函数格式IDA 动调，比较前下断点，看 flagWizardlike

Enhance!File types去掉.pdf是一个shell脚本，运行时用到了uudecode，需要sudo apt install sharutils之后就是各种压缩包的嵌套了，QAQ┌──(sparks㉿LAPTOP-Sparks)-[/mnt/…/CTF/pico2022/Misc/File types]└─$ file FlagFlag: current ar archive┌──(sparks㉿LAPTOP-Sparks)-[/mnt/…/CTF/pico2022/Misc

basic-mod1str = '128 63 242 87 151 147 50 369 239 248 205 346 299 73 335 189 105 293 37 214 333 137'd = 'ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789_'print(''.join([d[int(x) % 37] for x in str.split(' ')]))basic-mod2from gmpy2 import *from sympy import inv