ISCC 2019 Writeup
- 一个菜鸡的iscc之旅,还有蜜汁强迫症,好好的工具不用,非要每道题自己写代码,就更艰难了。基本上都是python2写的,但其实除了web的一道题,大部分稍微改改和python3都能通用。
- pwn题是菜鸡中的菜鸡,学了好久还是一道没做出来。。
- 然后脑洞是个坑,提交flag的格式也是个坑。
Misc
1. 隐藏的信息(50)
- 这是一个被混淆的文件,但是我忘记了这个文件的密码。你能够帮助我还原明文吗?
- 八进制转十进制转ASCII码,疑似base64加密,解密得到flag,python代码如下:
import base64
with open("message.txt", "r") as f:
cipher = f.read()
cipher_list = cipher.split(' ')
base_cipher = ''
for each in cipher_list:
base_cipher += chr(int(each, 8))
flag = base64.b64decode(base_cipher)
print flag
2. 最危险的地方就是最安全的地方(100)
- 打开文件就知道了
- jpg打不开,改一下文件头,得到图片,是个表情包:修复我没用啊。。binwalk分析一下,发现后面有压缩的图片文件,分离之后是49个png二维码和1个jpg二维码,扫码:remake:最危险的地方就是最安全的地方+1~+10086,又是一个坑。hexdump分析一下50.jpg(因为和别的二维码比起来,它看着就很特殊),大片的\x00区域,拉到中间有字符的区域,就看到flag了,提取代码如下:
- 还有一种分析,看题目,直接右键50.jpg,看属性,有段base64编码,解码就是flag:
with open('50.jpg', 'rb') as f:
data = f.read(4500)
flag = data[0x107c:0x1097]
flag = flag.replace('\x00','')
print flag
3. 解密成绩单(100)
- 老师为了保密将某门课程的成绩单进行了加密处理,但在查成绩时忘记了自己原来是怎样进行了加密,你能帮同学们顺利查到成绩吗?
- 加密的压缩包,因为没有任何提示,怀疑是伪加密。伪加密可以直接用binwalk提取,果然提取出来了。然后,我也不知道我怎么就把杂项做成逆向了,大概是因为太菜。。
- C#做法(也可以直接IDA看IL指令,也不复杂)。用软件.NET.Reflector将C#反汇编,将Score_List导出,分析函数,定义了一系列浮点数,在btnLogin_Click函数中将浮点数逐个转成整型再转成字符添加到字符串,然后字符串弹框,直接写个脚本就得到flag了。或者根据函数checkUsername() 和 checkPassword()输入用户名admin,密码ISCCq19pc1Yhb6SqtGhliYH688feCH7lqQxtfa2MpOdONW1wmIleBo4TW5n就弹窗得到了flag。
namespace Score_List
{
using System;
using System.ComponentModel;
using System.Drawing;
using System.Text;
using System.Windows.Forms;
public class score_list : Form
{
private int loginAttemptCount = 1;
private float r1 = 73f;
private float r2 = 83f;
private float r3 = 67f;
private float r4 = 67f;
private float r5 = 123f;
private float r6 = 89f;
private float r7 = 48f;
private float r8 = 117f;
private float r9 = 95f;
private float r10 = 70f;
private float r11 = 48f;
private float r12 = 85f;
private float r13 = 110f;
private float r14 = 68f;
private float r15 = 95f;
private float r16 = 84f;
private float r17 = 104f;
private float r18 = 69f;
private float r19 = 95f;
private float r20 = 80f;
private float r21 = 52f;
private float r22 = 83f;
private float r23 = 83f;
private float r24 = 87f;
private float r25 = 48f;
private float r26 = 82f;
private float r27 = 68f;
private float r28 = 33f;
private float r29 = 125f;
private IContainer components;
private Button btnLogin;
private Label lblUsername;
private TextBox txtUsername;
private Button btnCancel;
private GroupBox groupBox1;
private Label lblPassword;
private TextBox txtPassword;
public score_list()
{
this.InitializeComponent();
}
private void btnCancel_Click(object sender, EventArgs e)
{
Application.Exit();
}
private void btnLogin_Click(object sender, EventArgs e)
{
if (this.checkUsername() && this.checkPassword())
{
StringBuilder builder = new StringBuilder();
char ch = Convert.ToChar((int) this.r1);
builder.Append(ch.ToString());
ch = Convert.ToChar((int) this.r2);
builder.Append(ch.ToString());
ch = Convert.ToChar((int) this.r3);
builder.Append(ch.ToString());
ch = Convert.ToChar((int) this.r4);
builder.Append(ch.ToString());
ch = Convert.ToChar((int) this.r5);
builder.Append(ch.ToString());
ch = Convert.ToChar((int) this.r6);
builder.Append(ch.ToString());
ch = Convert.ToChar((int) this.r7);
builder.Append(ch.ToString());
ch = Convert.ToChar((int) this.r8);
builder.Append(ch.ToString());
ch = Convert.ToChar((int) this.r9);
builder.Append(ch.ToString());
ch = Convert.ToChar((int) this.r10);
builder.Append(ch.ToString());
ch = Convert.ToChar((int) this.r11);
builder.Append(ch.ToString());
ch = Convert.ToChar((int) this.r12);
builder.Append(ch.ToString());
ch = Convert.ToChar((int) this.r13);
builder.Append(ch.ToString());
ch = Convert.ToChar((int) this.r14);
builder.Append(ch.ToString());
ch = Convert.ToChar((int) this.r15);
builder.Append(ch.ToString());
ch = Convert.ToChar((int) this.r16);
builder.Append(ch.ToString());
ch = Convert.ToChar((int) this.r17);
builder.Append(ch.ToString());
ch = Convert.ToChar((int) this.r18);
builder.Append(ch.ToString());
ch = Convert.ToChar((int) this.r19);
builder.Append(ch.ToString());
ch = Convert.ToChar((int) this.r20);
builder.Append(ch.ToString());
ch = Convert.ToChar((int) this.r21);
builder.Append(ch.ToString());
ch = Convert.ToChar((int) this.r22);
builder.Append(ch.ToString());
ch = Convert.ToChar((int) this.r23);
builder.Append(ch.ToString());
ch = Convert.ToChar((int) this.r24);
builder.Append(ch.ToString());
ch = Convert.ToChar((int) this.r25);
builder.Append(ch.ToString());
ch = Convert.ToChar((int) this.r26);
builder.Append(ch.ToString());
ch = Convert.ToChar((int) this.r27);
builder.Append(ch.ToString());
ch = Convert.ToChar((int) this.r28);
builder.Append(ch.ToString());
builder.Append(Convert.ToChar((int) this.r29).ToString());
int num = (int) MessageBox.Show(builder.ToString());
Application.Exit();
}
if (this.loginAttemptCount > 2)
{
this.showLoginCountExceeded();
Application.Exit();
}
if (!(this.checkUsername() && this.checkPassword()))
{
this.showError();
this.loginAttemptCount++;
}
}
private bool checkPassword() =>
(this.txtPassword.Text == "ISCCq19pc1Yhb6SqtGhliYH688feCH7lqQxtfa2MpOdONW1wmIleBo4TW5n");
private bool checkUsername() =>
(this.txtUsername.Text == "admin");
protected override void Dispose(bool disposing)
{
if (disposing && (this.components > null))
{
this.components.Dispose();
}
base.Dispose(disposing);
}
private void InitializeComponent()
{
this.btnLogin = new Button();
this.lblUsername = new Label();
this.txtUsername = new TextBox();
this.btnCancel = new Button();
this.groupBox1 = new GroupBox();
this.lblPassword = new Label();
this.txtPassword = new TextBox();
this.groupBox1.SuspendLayout();
base.SuspendLayout();
this.btnLogin.Location = new Point(190, 120);
this.btnLogin.Name = "btnLogin";
this.btnLogin.Size = new Size(0x4b, 0x17);
this.btnLogin.TabIndex = 0;
this.btnLogin.Text = "&OK";
this.btnLogin.UseVisualStyleBackColor = true;
this.btnLogin.Click += new EventHandler(this.btnLogin_Click);
this.lblUsername.AutoSize = true;
this.lblUsername.Location = new Point(6, 0x20);
this.lblUsername.Name = "lblUsername";
this.lblUsername.Size = new Size(0x3a, 13);
this.lblUsername.TabIndex = 1;
this.lblUsername.Text = "Username:";
this.lblUsername.TextAlign = ContentAlignment.TopRight;
this.txtUsername.Location = new Point(70, 0x1d);
this.txtUsername.Name = "txtUsername";
this.txtUsername.Size = new Size(0x9a, 20);
this