2021年“春秋杯”新年欢乐赛WP

  • A+
所属分类:逆向工程

作者:红色代码战队 编辑:白帽子社区运营团队




    "白帽子社区在线CTF靶场BMZCTF,欢迎各位在这里练习、学习,BMZCTF全身心为网络安全赛手提供优质学习环境,链接(http://www.bmzclub.cn/)

"    





2021年“春秋杯”新年欢乐赛WP
签到
题目描述:
万物皆有"FUN",电脑扫"FUN"活动,提供大写的"FUN"字样,即可获取flag~题目附件:https://pan.baidu.com/s/16OzIZigwsmaNYEo2TPsawg提取码:GAME
新年快乐.exe会调用摄像头扫描,用一张带有FUN字样的图片识别即可得到flag
flag{ju5t_f0r_FUN}


2021年“春秋杯”新年欢乐赛WP
十二宫的挑衅
题目描述
但愿你能解出密文,不然我就会继续犯罪:)本题获取flag提交前请加上flag{}
题目附件:https://pan.baidu.com/share/init?surl=azH9zgRu_hg8r-O5kDgB3w提取码:GAME
根据题目和提示,得知是黄道十二宫杀手密码,是最近刚刚被破解的。参考:
https://www.sohu.com/a/437973880_610300
 
将图片内容抄写下来:
^#@[email protected]#()/>@?==%1(!)>(*+3<#[email protected]$^.4&)8%#&6!=%1#$-$+5&?#!.03!%[email protected]=1010?(*~#??.+)%&.7^8=1%*^[email protected]@8>&*9[email protected](+7)<%3#@^4&@@<.)#3*#%%<<*++@.?=~**+!==65^@&
然后按上面的文章里介绍的方法进行排列组合,使用脚本:
s1=r'^#@[email protected]#()/>@?==%1('*9s2=r'!)>(*+3<#[email protected]$^.'*9s3=r'4&)8%#5&6!=%1#$-$'*9s4=r'+5&?#!.03!%[email protected]=101'*9s5=r'0?(*~#??.+)%&.7^8'*9s6=r'=1%*^[email protected]@8>&*9'*9s7=r'[email protected](+7)<%3#@^4'*9s8=r'&@@<.)#3*#%%<<*++'*9s9=r'[email protected]?=~**+!==65^@&'*9
tmp=''for i in range(17): tmp += s1[i]+s2[i+2]+s3[i+4]+s4[i+6]+s5[i+8]+s6[i+10]+s7[i+12]+s8[i+14]+s9[i+16]
def cut(obj, sec): str_list = [obj[i:i+sec] for i in range(0,len(obj),sec)] print(str_list) return str_list
l1=cut(tmp,17)for i in l1: print (i)
得到:
^>%[email protected]*&#(#[email protected]#+[email protected]*53)[email protected][email protected]$+&!%>^&[email protected]%&&[email protected]?#<!=.*[email protected]=(#[email protected]@<~)8%=^=0.*/611811)*>@#00%8#[email protected]$1?*53!?7-+(^(*==$$5*=+#==^4&~$7%6%.&?#5)%51!)#?$<<^()8!?7%<@
再用上面文章中的软件:AZdecrypt,进行解密:
AZdecrypt: https://m.majorgeeks.com/files/details/azdecrypt.html
2021年“春秋杯”新年欢乐赛WP
看到中间有flag的字样。
重新拼接,得到flag
flag{WUUHUUTAKEOFF}


2021年“春秋杯”新年欢乐赛WP
evilMem
题目描述
Nothing is true, everything is permitted.
题目附件:https://pan.baidu.com/share/init?surl=d_iXtu75TiHqfRQxG9rtjA提取码:GAME
内存取证
volatility -f image.vmem--profile=Win7SP1x86_23418 consoles
检查到运行了EvilImage.exe:
volatility -f image.vmem--profile=Win7SP1x86_23418 filescan | grep "EvilImage"
选择把偏移量为0x000000003e661758处的EvilImage.exe和0x000000003fae29d0处的Evil.dll导出,进行逆向分析
得到假的flag
检查发现有个 EviI.dll 在Temp目录
再次检索EviI.dll:
volatility -f image.vmem--profile=Win7SP1x86_23418 filescan | grep "EviI.dll"
Temp目录下有个 temp.dll 目录,根据偏移量0x000000003fa295c0把这个EviI.dll文件导出:
volatility -f image.vmem--profile=Win7SP1x86_23418 dumpfiles -Q 0x000000003fa295c0 -D ./
得到真实的dll
命名为final.dll,写c程序进行调用,方便动态调试:#include <stdio.h>#include <Windows.h>#include <stdlib.h>
int main(){ HMODULE module =LoadLibrary("./final.dll");if (module == NULL) {printf("failed to load"); system("pause");return 1; }typedef int (*checkFlag)(char*); checkFlag enc; enc =(checkFlag)GetProcAddress(module, "checkFlag");char flag[33] ="flag{This_flag___is__fake!_LoL}";printf("%d",enc(flag)); system("pause");return 0;}
算法比较复杂,但核心在密钥的迭代部分,对明文的处理只是简单的异或
我们在调试过程中可以把最后异或的数据dump出来,与密文进行异或,即可得到明文
这里密钥的初始向量iv也是要求我们输入然后进行check的
直接断在cmp处即可拿到iv的值: chunqiu!
然后动态调试,拿到迭代后的密钥:
[3902883464, 2885746025, 308237244,3821724833, 1298426892, 174067991, 1567365918, 3069366163, 3936683401,3035474549, 1368817305, 2628628533]
最后简单的异或脚本:
res=[0x8FC02AEE, 0xC533AF12, 0x753E13D1,0xBCAD8AC8, 0x2400023D, 0x7E032265, 0x11336272, 0xB68F83FC]data=[3902883464, 2885746025, 308237244,3821724833, 1298426892, 174067991, 1567365918, 3069366163, 3936683401,3035474549, 1368817305, 2628628533]from struct import *for i in range(8):print(pack('<I',data[i]^res[i]).decode(),end="")
得到flag
flag{[email protected]_1ndir3ctly_LoL}


2021年“春秋杯”新年欢乐赛WP
2019-nCoV
题目描述
对nCov了解多少?hint: 1. 增加hint.txt下载  2. 可用python统计次数最多的字符 题目附件:https://pan.baidu.com/s/1ohrUfx19GtaIlPhpi-bvnA提取码:GAME题目hint:https://pan.baidu.com/s/1Hj_hVmC266nIROfr_NkmIw提取码:GAME
COV_hint.zip解压得到hint.txt
NB2HI4B2F4XXO53XFZWWK4TSPFRGS3ZOMNXW2LTDNYXWE3DPM4XVGQKSKMWUG32WFUZC2Z3FNZXW22LDFVQW4YLMPFZWS4ZONB2G23AKNB2HI4DTHIXS653XO4XG4Y3CNEXG43DNFZXGS2BOM5XXML3POJTGM2LOMRSXELYKNB2HI4B2F4XXO53XFZWWK4TSPFRGS3ZOMNXW2LTDNYXWE3DPM4XWG33SN5XGC5TJOJ2XGLLJNZ2HE33EOVRXI2LPNYXGQ5DNNQFAUUDMMVQXGZJANZXXI2LDMUQFI2DFEBWGC4THMVZXIIDTORZHKY3UOVZGC3BAOBZG65DFNFXCAIAKORUGKIDQMFZXG53POJSCA2LTEB2GQZJAEBWWINJINF2CO4ZAM5SW4ZJAONSXC5LFNZRWKKJAMFXGIIDEN4QG433UEBWGK5BAORUGKIHCQCMFY3XCQCMSA2LOEBWWINJIFE======
特征很明显是base32,解码得到如下
http://www.merrybio.com.cn/blog/SARS-CoV-2-genomic-analysis.htmlhttps://www.ncbi.nlm.nih.gov/orffinder/http://www.merrybio.com.cn/blog/coronavirus-introduction.html Please notice The largest structuralproteinthe password is the md5(it's gene sequence)and do not let the ‘n’ in md5()
两个新冠病毒的分析网页,一个基因序列的查询网页
根据提示密码是:md5(刺突蛋白的基因序列翻译)
2021年“春秋杯”新年欢乐赛WP
2021年“春秋杯”新年欢乐赛WP
从提示给的两篇分析文章种可知:最大的结构蛋白是刺突蛋白
基因序列范围:21536-25384
整个基因序列:https://www.ncbi.nlm.nih.gov/nuccore/MN908947.3?report=fasta
根据提示给的链接对基因序列进行翻译:https://www.ncbi.nlm.nih.gov/orffinder/
2021年“春秋杯”新年欢乐赛WP
2021年“春秋杯”新年欢乐赛WP
得到刺突蛋白基因序列的翻译
MFLLTTKRTMFVFLVLLPLVSSQCVNLTTRTQLPPAYTNSFTRGVYYPDKVFRSSVLHSTQDLFLPFFSNVTWFHAIHVSGTNGTKRFDNPVLPFNDGVYFASTEKSNIIRGWIFGTTLDSKTQSLLIVNNATNVVIKVCEFQFCNDPFLGVYYHKNNKSWMESEFRVYSSANNCTFEYVSQPFLMDLEGKQGNFKNLREFVFKNIDGYFKIYSKHTPINLVRDLPQGFSALEPLVDLPIGINITRFQTLLALHRSYLTPGDSSSGWTAGAAAYYVGYLQPRTFLLKYNENGTITDAVDCALDPLSETKCTLKSFTVEKGIYQTSNFRVQPTESIVRFPNITNLCPFGEVFNATRFASVYAWNRKRISNCVADYSVLYNSASFSTFKCYGVSPTKLNDLCFTNVYADSFVIRGDEVRQIAPGQTGKIADYNYKLPDDFTGCVIAWNSNNLDSKVGGNYNYLYRLFRKSNLKPFERDISTEIYQAGSTPCNGVEGFNCYFPLQSYGFQPTNGVGYQPYRVVVLSFELLHAPATVCGPKKSTNLVKNKCVNFNFNGLTGTGVLTESNKKFLPFQQFGRDIADTTDAVRDPQTLEILDITPCSFGGVSVITPGTNTSNQVAVLYQDVNCTEVPVAIHADQLTPTWRVYSTGSNVFQTRAGCLIGAEHVNNSYECDIPIGAGICASYQTQTNSPRRARSVASQSIIAYTMSLGAENSVAYSNNSIAIPTNFTISVTTEILPVSMTKTSVDCTMYICGDSTECSNLLLQYGSFCTQLNRALTGIAVEQDKNTQEVFAQVKQIYKTPPIKDFGGFNFSQILPDPSKPSKRSFIEDLLFNKVTLADAGFIKQYGDCLGDIAARDLICAQKFNGLTVLPPLLTDEMIAQYTSALLAGTITSGWTFGAGAALQIPFAMQMAYRFNGIGVTQNVLYENQKLIANQFNSAIGKIQDSLSSTASALGKLQDVVNQNAQALNTLVKQLSSNFGAISSVLNDILSRLDKVEAEVQIDRLITGRLQSLQTYVTQQLIRAAEIRASANLAATKMSECVLGQSKRVDFCGKGYHLMSFPQSAPHGVVFLHVTYVPAQEKNFTTAPAICHDGKAHFPREGVFVSNGTHWFVTQRNFYEPQIITTDNTFVSGNCDVVIGIVNNTVYDPLQPELDSFKEELDKYFKNHTSPDVDLGDISGINASVVNIQKEIDRLNEVAKNLNESLIDLQELGKYEQYIKWPWYIWLGFIAGLIAIVMVTIMLCCMTSCCSCLKGCCSCGSCCKFDEDDSEPVLKGVKLHYT
计算其md5
> Get-FileHash .S.txt -a md5Algorithm       Hash---------      ---- MD5            98EB1B1760BCC837934C8695A1CEE923
转换成小写得到密码:98eb1b1760bcc837934c8695a1cee923
使用MP3Stego工具解cov.mp3
Decode.exe -X cov.mp3 -P98eb1b1760bcc837934c8695a1cee923
得到cov.mp3.txt
2019-nCoV
realflag.zip的压缩密码即为:2019-nCoV
pass.wav使用SlientEye可解出密文:priebeijoarkjpxmdkucxwdus
2021年“春秋杯”新年欢乐赛WP
解压realflag.zip得到hint2.txt和CoV-1.jpg
hint2.txt
796f75206d7573742070617920617474656e74696f6e20746f204e2070726f7465696e202c486f7720646f20746861742067657420696e746f2074686520766972616c206361707369643f0a646f20796f75206b6e6f772073746567686964653f0a7468652070617373776f726420697320656e637279707420627920566967656ec3a87265204369706865720a74686520736372656374206b65792069732054686520746f702032302063686172616374657273207769746820746865206d6f7374206f6363757272656e6365732061726520636f756e7465642b434f4d424154
十六进制转字符
you must pay attention to N protein ,How dothat get into the viral capsid?do you know steghide?the password is encrypt by Vigenère Cipherthe screct key is The top 20 characterswith the most occurrences are counted+COMBAT
让我们注意N蛋白及进入病毒的过程
2021年“春秋杯”新年欢乐赛WP
分析可知N蛋白进入病毒之前还结合了M蛋白,E蛋白
2021年“春秋杯”新年欢乐赛WP
2021年“春秋杯”新年欢乐赛WP
2021年“春秋杯”新年欢乐赛WP
2021年“春秋杯”新年欢乐赛WP
根据提示统计以下字符
MSDNGPQNQRNAPRITFGGPSDSTGSNQNGERSGARSKQRRPQGLPNNTASWFTALTQHGKEDLKFPRGQGVPINTNSSPDDQIGYYRRATRRIRGGDGKMKDLSPRWYFYYLGTGPEAGLPYGANKDGIIWVATEGALNTPKDHIGTRNPANNAAIVLQLPQGTTLPKGFYAEGSRGGSQASSRSSSRSRNSSRNSTPGSSRGTSPARMAGNGGDAALALLLLDRLNQLESKMSGKGQQQQGQTVTKKSAAEASKKPRQKRTATKAYNVTQAFGRRGPEQTQGNFGDQELIRQGTDYKHWPQIAQFAPSASAFFGMSRIGMEVTPSGTWLTYTGAIKLDDKDPNFKDQVILLNKHIDAYKTFPPTEPKKDKKKKADETQALPQRQKKQQTVTLLPAADLDDFSKQLQQSMSSADSTQAMFHLVDFQVTIAEILLIIMRTFKVSIWNLDYIINLIIKNLSKSLTENKYSQLDEEQPMEIDMADSNGTITVEELKKLLEQWNLVIGFLFLTWICLLQFAYANRNRFLYIIKLIFLWLLWPVTLACFVLAAVYRINWITGGIAIAMACLVGLMWLSYFIASFRLFARTRSMWSFNPETNILLNVPLHGTILTRPLLESELVIGAVILRGHLRIAGHHLGRCDIKDLPKEITVATSRTLSYYKLGASQRVAGDSGFAAYSRYRIGNYKLNTDHSSSSDNIALLVQ
统计字符脚本:https://mochu.blog.csdn.net/article/details/107948700
# -*- coding:utf-8 -*-# Author: mochu7alphabet ="[email protected]#$%^&*()_+-/={}[]"#所有正常打印字符strings = open('./text.txt').read()#读取需要统计频数的文本 result = {}for i in alphabet:    counts = strings.count(i)    i = '{0}'.format(i)    result[i] = counts res = sorted(result.items(), key=lambdaitem: item[1], reverse=True)num = 0for data in res:    num += 1    print('频数第{0}: {1}'.format(num, data)) print('n---------------以下是频数从多到少的字符,按照从前到后排序---------------')for i in res:    flag = str(i[0])    print(flag[0],end="")
结果如下
> python .count.py频数第1: ('L', 70)频数第2: ('A', 57)频数第3: ('G', 57)频数第4: ('S', 56)频数第5: ('T', 48)频数第6: ('I', 44)频数第7: ('R', 44)频数第8: ('K', 42)频数第9: ('Q', 42)频数第10: ('N', 37)频数第11: ('D', 34)频数第12: ('P', 34)频数第13: ('F', 27)频数第14: ('E', 24)频数第15: ('V', 23)频数第16: ('Y', 22)频数第17: ('M', 14)频数第18: ('W', 13)频数第19: ('H', 10)频数第20: ('C', 4)
有频数相同的就逆序排列,最后得到密钥
LGASTRIQKNDPFEVYMWHCCOMBAT
密文为pass.wav用SlientEye解出的
priebeijoarkjpxmdkucxwdus
维吉尼亚密码解密得到CoV-1.jpg的Steghide密码
eliminatenovelcoronavirts
Steghide解密
steghide extract -sf CoV-1.jpg -peliminatenovelcoronavirts
得到flag.txt
flag{we_will_over_come_SARS-COV}



往期精彩文章




BMZCTF刷题集锦
linux下的凭据窃取
jumpserver RCE复现(附带POC)
2021-1 XCTF联赛wp




2021年“春秋杯”新年欢乐赛WP
技术支持:白帽子社区团队
— 扫码关注我们 



本文始发于微信公众号(白帽子社区):2021年“春秋杯”新年欢乐赛WP

发表评论

:?: :razz: :sad: :evil: :!: :smile: :oops: :grin: :eek: :shock: :???: :cool: :lol: :mad: :twisted: :roll: :wink: :idea: :arrow: :neutral: :cry: :mrgreen: