0
2021 长安“战疫”网络安全卫士守护赛 WriteUp
source link: https://blog.csdn.net/qq_42880719/article/details/122382709
Go to the source link to view the article. You can view the picture content, updated content and better typesetting reading experience. If the link is broken, please click the button below to view the snapshot at that time.
麻薯星的zyz想要生猴子!!!麻薯星的zyz想要生猴子!!!麻薯星的zyz想要生猴子!!!
队友第一轮做了俩Web之后就摆烂了 寄
总体来说长安战疫基本大部分题都偏向入门，适合大一新生练练手
少部分多百度也能做。
还有很小部分就看积累吧。
按照迷宫走然后取字的拼音即可
字是战长恙长战恙河长山山安战疫疫战疫安疫长安恙
flag是：
cazy{zhanchangyangchangzhanyanghechangshanshananzhanyiyizhanyianyichanganyang}
朴实无华的取证
首先查看版本 imageinfo得到WinXPSP2x86
然后pslist，注意到
![[外链图片转存失败,源站可能有防盗链机制,建议将图片保存下来直接上传(img-wkF0LZgx-1641631822267)(mumuzi.assets/image-20220108103445403.png)]](https://img-blog.csdnimg.cn/70d9fdd94bb24a0b86a723c880d5fe27.png?x-oss-process=image/watermark,type_d3F5LXplbmhlaQ,shadow_50,text_Q1NETiBA5pivTXVtdXpp,size_20,color_FFFFFF,t_70,g_se,x_16)
![[外链图片转存失败,源站可能有防盗链机制,建议将图片保存下来直接上传(img-5u2OCci0-1641631822270)(mumuzi.assets/image-20220108103513837.png)]](https://img-blog.csdnimg.cn/b6bc9593a9ca42f2a37a0d9efa4a45a5.png?x-oss-process=image/watermark,type_d3F5LXplbmhlaQ,shadow_50,text_Q1NETiBA5pivTXVtdXpp,size_20,color_FFFFFF,t_70,g_se,x_16)
发现目录是桌面而并非Desktop，重新filescan一下，导出有用信息
![[外链图片转存失败,源站可能有防盗链机制,建议将图片保存下来直接上传(img-r6LzEg9C-1641631822278)(mumuzi.assets/image-20220108103543050.png)]](https://img-blog.csdnimg.cn/d7890c2bd0c246c0b9b28b41958b51e8.png?x-oss-process=image/watermark,type_d3F5LXplbmhlaQ,shadow_50,text_Q1NETiBA5pivTXVtdXpp,size_20,color_FFFFFF,t_70,g_se,x_16)
首先zip的密码是上面说的20211209
其次，得到的txt是加密函数，而密文在flag.png上。反过来写一个脚本
但是我写了几次都没写对
。。。。于是有了这个脚本
s = 'fdcb[8ldq?zloo?fhuwdlqob?vxffhhg?lq?iljkwlqj?wkh?hslghplf]'
for i in s:
if(ord(i)>=ord('a') and ord(i)<=ord('w')):
print(chr(ord(i)-3),end='')
elif(i == 'a'):
print('x',end='')
elif(i == 'b'):
print('y',end='')
elif(i == 'c'):
print('z',end='')
elif(i == "|"):
print('_')
else:
print(chr(ord(i)+32),end='')
#ca`_{Xian_šill_certainl__s˜cceed_in_fighting_the_epidemic}
查了一下certainl后面应该还有个y
然后前面那个单词是will，后面那个单词是succeed，于是得到flag提交正确
cazy{Xian_will_certainly_succeed_in_fighting_the_epidemic}
导出HTTP流，在导出的其中两个文件发现hex串，都是很明显的zip，hex–>ascii，得到zip，打开zip得到两文件，一个key.ws一个flag.txt
ws很明显的whitespace，直接https://vii5ard.github.io/whitespace/得到key:XiAnWillBeSafe
然后flag.txt很明显的SNOW
.\SNOW.EXE -p XiAnWillBeSafe -C .\flag.txt
![[外链图片转存失败,源站可能有防盗链机制,建议将图片保存下来直接上传(img-5EINTl6Z-1641631822281)(mumuzi.assets/image-20220108104800137.png)]](https://img-blog.csdnimg.cn/e73eff4d3bef4ba0ae7cb1e9ff699660.png)
cazy{C4n_y0u_underSt4nd_th3_b0oK_With0ut_Str1ng}
查看流量包发现大量的base64串，导出http发现secret.txt，base64解码发现是zip，保存后打开发现是拼图
因为不知道大小，所以猜了一个12*4
命令montage *png -tile 12x4 -geometry 100x100+0+0 out2.png
然后用gaps
python3 gaps --image=out2.png --generations=10 --population=48 --size=100 --save
我gaps有问题，代数太多跑一会就报错，不加save跑完就直接报错。。。
![[外链图片转存失败,源站可能有防盗链机制,建议将图片保存下来直接上传(img-qmPkoNBX-1641631822284)(mumuzi.assets/image-20220108104953204.png)]](https://img-blog.csdnimg.cn/124b6b2052ac4ad0886eb56523ba6f4f.png?x-oss-process=image/watermark,type_d3F5LXplbmhlaQ,shadow_50,text_Q1NETiBA5pivTXVtdXpp,size_20,color_FFFFFF,t_70,g_se,x_16)
得到flag，X的大小写记不住了
cazy{make_XiAN_great_Again}
binary
文件头能看出来是class文件，直接扔jadx
数组转出来
s = [77, 68, 65, 119, 77, 68, 65, 119, 77, 68, 69, 119, 77, 84, 69, 120, 77, 68, 65, 119, 77, 68, 65, 119, 77, 68, 65, 120, 77, 84, 69, 120, 77, 84, 69, 119, 77, 84, 69, 120, 77, 68, 65, 119, 77, 68, 65, 119, 77, 70, 120, 117, 77, 68, 69, 120, 77, 84, 69, 120, 77, 68, 69, 119, 77, 84, 69, 119, 77, 84, 65, 120, 77, 68, 69, 120, 77, 84, 69, 120, 77, 68, 65, 119, 77, 84, 69, 120, 77, 68, 69, 120, 77, 68, 69, 120, 77, 84, 69, 120, 77, 70, 120, 117, 77, 68, 69, 119, 77, 68, 65, 120, 77, 68, 69, 119, 77, 68, 65, 119, 77, 84, 69, 120, 77, 84, 65, 119, 77, 68, 69, 120, 77, 84, 65, 120, 77, 68, 69, 120, 77, 68, 69, 120, 77, 68, 69, 119, 77, 68, 65, 120, 77, 70, 120, 117, 77, 68, 69, 119, 77, 68, 65, 120, 77, 68, 69, 120, 77, 68, 65, 119, 77, 68, 65, 120, 77, 84, 65, 119, 77, 68, 69, 120, 77, 84, 65, 119, 77, 68, 65, 119, 77, 84, 65, 120, 77, 68, 69, 119, 77, 68, 65, 120, 77, 70, 120, 117, 77, 68, 69, 119, 77, 68, 65, 120, 77, 68, 69, 120, 77, 84, 65, 120, 77, 84, 65, 120, 77, 84, 65, 119, 77, 84, 69, 119, 77, 84, 69, 119, 77, 84, 65, 120, 77, 84, 69, 120, 77, 68, 69, 119, 77, 68, 65, 120, 77, 70, 120, 117, 77, 68, 69, 120, 77, 84, 69, 120, 77, 68, 69, 119, 77, 84, 69, 120, 77, 68, 69, 119, 77, 68, 65, 119, 77, 68, 65, 119, 77, 84, 65, 119, 77, 84, 65, 119, 77, 68, 65, 120, 77, 68, 69, 120, 77, 84, 69, 120, 77, 70, 120, 117, 77, 68, 65, 119, 77, 68, 65, 119, 77, 68, 69, 119, 77, 84, 65, 120, 77, 68, 69, 119, 77, 84, 65, 120, 77, 68, 69, 119, 77, 84, 65, 120, 77, 68, 69, 119, 77, 84, 65, 120, 77, 68, 65, 119, 77, 68, 65, 119, 77, 70, 120, 117, 77, 84, 69, 120, 77, 84, 69, 120, 77, 84, 69, 119, 77, 68, 69, 119, 77, 68, 65, 119, 77, 68, 65, 119, 77, 68, 69, 119, 77, 68, 69, 120, 77, 68, 65, 120, 77, 84, 69, 120, 77, 84, 69, 120, 77, 84, 69, 120, 77, 86, 120, 117, 77, 84, 69, 119, 77, 68, 65, 120, 77, 68, 69, 119, 77, 84, 65, 120, 77, 68, 65, 119, 77, 68, 69, 119, 77, 84, 69, 120, 77, 84, 69, 120, 77, 68, 69, 119, 77, 68, 65, 119, 77, 68, 65, 120, 77, 84, 65, 119, 77, 70, 120, 117, 77, 68, 69, 119, 77, 84, 69, 119, 77, 84, 65, 119, 77, 68, 69, 120, 77, 68, 65, 120, 77, 68, 65, 120, 77, 68, 65, 119, 77, 68, 69, 119, 77, 68, 69, 120, 77, 68, 69, 119, 77, 84, 65, 120, 77, 84, 69, 119, 77, 86, 120, 117, 77, 84, 65, 120, 77, 84, 65, 119, 77, 68, 65, 119, 77, 84, 65, 119, 77, 84, 69, 120, 77, 84, 65, 119, 77, 84, 69, 119, 77, 68, 65, 120, 77, 84, 65, 120, 77, 68, 65, 119, 77, 68, 65, 120, 77, 68, 65, 120, 77, 70, 120, 117, 77, 84, 69, 120, 77, 68, 69, 120, 77, 84, 69, 120, 77, 84, 69, 120, 77, 68, 65, 120, 77, 68, 69, 119, 77, 84, 69, 119, 77, 84, 65, 119, 77, 68, 69, 120, 77, 68, 69, 119, 77, 84, 65, 120, 77, 84, 69, 119, 77, 70, 120, 117, 77, 84, 65, 120, 77, 68, 69, 120, 77, 68, 65, 119, 77, 84, 69, 120, 77, 68, 65, 119, 77, 68, 65, 119, 77, 68, 69, 120, 77, 68, 69, 119, 77, 68, 65, 119, 77, 68, 65, 119, 77, 68, 65, 119, 77, 68, 65, 120, 77, 70, 120, 117, 77, 68, 69, 120, 77, 68, 69, 119, 77, 84, 65, 119, 77, 84, 65, 119, 77, 68, 69, 119, 77, 68, 65, 120, 77, 84, 65, 120, 77, 84, 69, 119, 77, 84, 65, 120, 77, 84, 69, 119, 77, 84, 69, 120, 77, 84, 69, 119, 77, 86, 120, 117, 77, 68, 65, 120, 77, 68, 69, 119, 77, 68, 69, 119, 77, 68, 69, 120, 77, 84, 69, 120, 77, 84, 69, 119, 77, 84, 69, 120, 77, 68, 65, 119, 77, 68, 69, 120, 77, 68, 65, 120, 77, 68, 69, 119, 77, 68, 65, 120, 77, 70, 120, 117, 77, 68, 65, 120, 77, 68, 65, 119, 77, 84, 69, 119, 77, 84, 69, 120, 77, 68, 69, 120, 77, 68, 69, 120, 77, 68, 65, 120, 77, 84, 65, 119, 77, 84, 69, 119, 77, 68, 69, 120, 77, 68, 65, 120, 77, 84, 69, 119, 77, 86, 120, 117, 77, 84, 69, 120, 77, 68, 69, 119, 77, 68, 69, 120, 77, 68, 65, 119, 77, 84, 69, 120, 77, 84, 69, 120, 77, 84, 65, 120, 77, 84, 65, 120, 77, 68, 65, 120, 77, 84, 65, 119, 77, 68, 65, 119, 77, 68, 65, 120, 77, 70, 120, 117, 77, 68, 65, 119, 77, 68, 69, 120, 77, 84, 65, 120, 77, 68, 69, 119, 77, 68, 65, 120, 77, 84, 69, 119, 77, 68, 65, 119, 77, 68, 69, 119, 77, 84, 69, 119, 77, 84, 69, 120, 77, 84, 69, 120, 77, 68, 69, 120, 77, 86, 120, 117, 77, 84, 69, 119, 77, 84, 69, 119, 77, 68, 69, 120, 77, 68, 69, 119, 77, 84, 69, 119, 77, 84, 65, 119, 77, 84, 69, 119, 77, 68, 65, 120, 77, 68, 69, 119, 77, 68, 69, 120, 77, 68, 65, 119, 77, 68, 69, 119, 77, 70, 120, 117, 77, 68, 69, 119, 77, 84, 65, 119, 77, 84, 65, 119, 77, 84, 69, 120, 77, 84, 65, 119, 77, 84, 65, 119, 77, 68, 65, 119, 77, 84, 65, 119, 77, 84, 69, 120, 77, 68, 65, 120, 77, 68, 65, 120, 77, 68, 69, 120, 77, 86, 120, 117, 77, 68, 69, 119, 77, 84, 65, 120, 77, 68, 65, 120, 77, 84, 65, 119, 77, 68, 69, 120, 77, 84, 65, 119, 77, 68, 69, 120, 77, 68, 65, 120, 77, 68, 65, 119, 77, 68, 65, 120, 77, 68, 69, 119, 77, 84, 65, 119, 77, 70, 120, 117, 77, 84, 65, 119, 77, 84, 69, 119, 77, 84, 69, 120, 77, 84, 69, 119, 77, 84, 69, 120, 77, 68, 69, 120, 77, 68, 65, 120, 77, 68, 65, 120, 77, 84, 69, 120, 77, 84, 69, 119, 77, 84, 65, 120, 77, 84, 69, 119, 77, 86, 120, 117, 77, 84, 69, 119, 77, 84, 69, 119, 77, 68, 65, 120, 77, 68, 69, 120, 77, 84, 65, 119, 77, 68, 65, 119, 77, 68, 69, 119, 77, 84, 69, 120, 77, 68, 69, 120, 77, 68, 65, 119, 77, 84, 65, 120, 77, 84, 65, 120, 77, 70, 120, 117, 77, 68, 65, 120, 77, 84, 65, 119, 77, 84, 65, 119, 77, 68, 69, 120, 77, 84, 69, 119, 77, 84, 69, 119, 77, 68, 65, 120, 77, 84, 69, 120, 77, 68, 69, 119, 77, 68, 69, 119, 77, 68, 69, 120, 77, 84, 69, 119, 77, 86, 120, 117, 77, 68, 69, 119, 77, 84, 65, 119, 77, 68, 65, 119, 77, 84, 69, 120, 77, 68, 69, 119, 77, 84, 69, 120, 77, 68, 69, 120, 77, 68, 69, 119, 77, 84, 69, 120, 77, 84, 69, 120, 77, 68, 69, 119, 77, 68, 65, 120, 77, 70, 120, 117, 77, 68, 69, 119, 77, 84, 65, 120, 77, 84, 65, 120, 77, 84, 65, 119, 77, 84, 65, 119, 77, 84, 65, 119, 77, 68, 65, 119, 77, 68, 69, 120, 77, 68, 69, 119, 77, 68, 65, 120, 77, 68, 65, 120, 77, 84, 69, 120, 77, 86, 120, 117, 77, 68, 69, 120, 77, 68, 69, 119, 77, 68, 65, 120, 77, 68, 65, 119, 77, 84, 69, 120, 77, 68, 65, 120, 77, 68, 69, 120, 77, 68, 65, 120, 77, 84, 65, 120, 77, 84, 69, 120, 77, 84, 65, 119, 77, 84, 69, 119, 77, 70, 120, 117, 77, 68, 69, 120, 77, 84, 65, 119, 77, 84, 69, 120, 77, 84, 69, 119, 77, 68, 65, 119, 77, 68, 65, 120, 77, 68, 69, 120, 77, 68, 69, 120, 77, 68, 69, 120, 77, 84, 65, 119, 77, 84, 69, 120, 77, 84, 69, 119, 77, 70, 120, 117, 77, 68, 69, 119, 77, 68, 69, 120, 77, 68, 65, 120, 77, 68, 69, 120, 77, 68, 65, 120, 77, 68, 69, 119, 77, 68, 65, 120, 77, 68, 69, 120, 77, 84, 65, 120, 77, 84, 65, 119, 77, 68, 65, 119, 77, 68, 65, 119, 77, 70, 120, 117, 77, 84, 69, 120, 77, 84, 69, 120, 77, 84, 69, 119, 77, 84, 65, 120, 77, 84, 65, 119, 77, 84, 69, 120, 77, 68, 65, 120, 77, 84, 69, 119, 77, 68, 69, 119, 77, 84, 65, 120, 77, 84, 69, 119, 77, 84, 65, 120, 77, 86, 120, 117, 77, 68, 65, 119, 77, 68, 65, 119, 77, 68, 69, 120, 77, 84, 65, 119, 77, 68, 69, 120, 77, 84, 65, 120, 77, 84, 65, 120, 77, 68, 69, 120, 77, 68, 65, 119, 77, 84, 65, 120, 77, 68, 69, 119, 77, 68, 69, 119, 77, 70, 120, 117, 77, 68, 69, 120, 77, 84, 69, 120, 77, 68, 69, 120, 77, 84, 65, 119, 77, 84, 69, 119, 77, 84, 65, 120, 77, 68, 69, 120, 77, 68, 69, 119, 77, 84, 69, 119, 77, 68, 65, 120, 77, 84, 69, 119, 77, 84, 69, 120, 77, 86, 120, 117, 77, 68, 69, 119, 77, 68, 65, 120, 77, 68, 69, 119, 77, 68, 69, 120, 77, 68, 65, 119, 77, 68, 69, 120, 77, 68, 65, 120, 77, 84, 65, 120, 77, 68, 65, 119, 77, 68, 65, 119, 77, 68, 65, 119, 77, 68, 65, 120, 77, 70, 120, 117, 77, 68, 69, 119, 77, 68, 65, 120, 77, 68, 69, 119, 77, 84, 69, 120, 77, 84, 69, 119, 77, 84, 69, 119, 77, 68, 65, 120, 77, 84, 69, 120, 77, 84, 69, 120, 77, 84, 69, 120, 77, 68, 69, 119, 77, 68, 69, 120, 77, 86, 120, 117, 77, 68, 69, 119, 77, 68, 65, 120, 77, 68, 69, 119, 77, 84, 69, 119, 77, 84, 69, 120, 77, 84, 69, 120, 77, 84, 69, 119, 77, 68, 65, 119, 77, 68, 65, 120, 77, 68, 69, 119, 77, 84, 65, 120, 77, 68, 69, 120, 77, 70, 120, 117, 77, 68, 69, 120, 77, 84, 69, 120, 77, 68, 69, 120, 77, 84, 69, 120, 77, 84, 65, 119, 77, 68, 69, 119, 77, 84, 69, 119, 77, 84, 65, 119, 77, 84, 69, 120, 77, 84, 65, 119, 77, 68, 69, 120, 77, 68, 69, 120, 77, 70, 120, 117, 77, 68, 65, 119, 77, 68, 65, 119, 77, 68, 69, 120, 77, 84, 69, 120, 77, 84, 65, 120, 77, 84, 69, 120, 77, 68, 69, 120, 77, 68, 65, 119, 77, 68, 65, 119, 77, 68, 69, 119, 77, 68, 65, 120, 77, 84, 65, 119, 77, 65, 61, 61]
for i in s:
print(chr(i),end='')
得到base64，解码是01串，明显的二维码
s = '0000000101110000000011111101110000000\n0111110101101010111110001110110111110\n0100010100001111000111010110110100010\n0100010110000011000111000001010100010\n0100010111011011001101101011110100010\n0111110101110100000001001000010111110\n0000000101010101010101010101010000000\n1111111100100000000100110011111111111\n1100010101010000101111110100000011000\n0101101000110010010000100110101011101\n1011000001001111001100011010000010010\n1110111111110010101101000110101011100\n1010110001110000000110100000000000010\n0110101001000100011011101011101111101\n0010100100111111101110000110010100010\n0010001101110110110011001100110011101\n1110100110001111111011010011000000010\n0000111010100011100000101101111110111\n1101100110101101001100010100110000100\n0101001001111001000001001110010010111\n0101010011000111000110010000010101000\n1001101111101110110010011111101011101\n1101100010111000000101110110001011010\n0011001000111101100011110100100111101\n0101000001110101110110101111110100010\n0101011011001001000000110100010011111\n0110100010001110010110011011111001100\n0111001111100000010110110111001111100\n0100110010110010100010111011000000000\n1111111101011001110011100101011101011\n0000000111000111011010110001010100100\n0111110111001101010110101100011101111\n0100010100110000110011010000000000010\n0100010101111101100011111111110100111\n0100010101101111111100000010101010110\n0111110111111000101101001111000110110\n0000000111111011110110000000100011000'
s = s.split('\n')
from PIL import Image
pic = Image.new('RGB',(37,37),(255,255,255))
for i in range(37):
for j in range(37):
if(s[i][j] == '0'):
pic.putpixel((j,i),(0,0,0))
pic.show()
pic.save('fllllag.png')
扫码得到flag
flag{932b2c0070e4897ea7df0190dbf36ece}
Ez_Steg
pyc的steg很明显是剑龙，注意python版本号，我用3.9没跑出来，3.6能跑
跑出来得到key：St3g1sV3ryFuNny
当然密文更明显是emoji-aes，解密得到flag
cazy{Em0j1s_AES_4nd_PyC_St3g_D0_yoU_l1ke}
ez_Encrypt
这次题目的流量包都只需要导出HTTP就能做了
导出之后有个web123，是base64，同样cyberchef解码得到zip文件，用D盾扫
![[外链图片转存失败,源站可能有防盗链机制,建议将图片保存下来直接上传(img-fxGyG6JZ-1641631822289)(mumuzi.assets/image-20220108153726810.png)]](https://img-blog.csdnimg.cn/b5d8a99411384ceb91fc6a783ef60ca1.png)
![[外链图片转存失败,源站可能有防盗链机制,建议将图片保存下来直接上传(img-jCDmViZG-1641631822293)(mumuzi.assets/image-20220108153734258.png)]](https://img-blog.csdnimg.cn/38a20c385c2b4c039c108e524ec5b602.png?x-oss-process=image/watermark,type_d3F5LXplbmhlaQ,shadow_50,text_Q1NETiBA5pivTXVtdXpp,size_20,color_FFFFFF,t_70,g_se,x_16)
百度找一个解php混淆的，除去广告第一个就是https://www.zhaoyuanma.com/phpjm.html
解密得到flag
![[外链图片转存失败,源站可能有防盗链机制,建议将图片保存下来直接上传(img-U2XyWpF1-1641631822296)(mumuzi.assets/image-20220108153841460.png)]](https://img-blog.csdnimg.cn/4718d768b066471ebdfa0f3029ef9b62.png?x-oss-process=image/watermark,type_d3F5LXplbmhlaQ,shadow_50,text_Q1NETiBA5pivTXVtdXpp,size_20,color_FFFFFF,t_70,g_se,x_16)
cazy{PHP_ji4m1_1s_s00000_3aSyyyyyyyyyyy}
Crypto
no_cry_no_can
就单纯的异或，通过格式cazy{找出key的值
key = b'\x5f\x11\x32\xff\x61'
s = b'<pH\x86\x1a&"m\xce\x12\x00pm\x97U1uA\xcf\x0c:NP\xcf\x18~l'
for i in range(len(s)):
print(chr(key[i%5]^s[i]),end='')
cazy{y3_1s_a_h4nds0me_b0y!}
no_can_no_bb
单纯的爆破key,给了key的范围是1,1<<20，还好简单，要不然就不会做了
from Crypto.Util.number import *
from Crypto.Cipher import AES
from tqdm import tqdm
def pad(m):
tmp = 16-(len(m)%16)
return m + bytes([tmp for _ in range(tmp)])
enc=b'\x9d\x18K\x84n\xb8b|\x18\xad4\xc6\xfc\xec\xfe\x14\x0b_T\xe3\x1b\x03Q\x96e\x9e\xb8MQ\xd5\xc3\x1c'
for i in tqdm(range(1<<20)):
key=pad(long_to_bytes(i))
aes=AES.new(key,AES.MODE_ECB)
s = aes.decrypt(enc)
if b'cazy{' in s:
print(s)
no_math_no_cry
真就太久没学数学呗，还有负根，一开始都忘干净了，果然我不适合做cry，但还好这三道和密码学关系不是特别的大。
from Crypto.Util.number import*
import gmpy2
s = 10715086071862673209484250490600018105614048117055336074437503883703510511248211671489145400471130049712947188505612184220711949974689275316345656079538583389095869818942817127245278601695124271626668045250476877726638182396614587807925457735428719972874944279172128411500209111406507112585996098530169
s -= 0x0338470
s = gmpy2.iroot(s,2)[0]
s = -s
s += (1<<500)
print(long_to_bytes(s))
cazy{1234567890_no_m4th_n0_cRy}
Reverse
combat_slogan
jdgui打开看main就看见加密的flag了，上面函数明显的rot13
在线rot13解一下就行了，然后套上flag{}
flag{We_w11l_f1ght_t0_end_t0_end_cazy}
cute_doge
IDA打开ctf1.exe，搜字符串，看见ZmxhZ3tDaDFuYV95eWRzX2Nhenl9
base64解码就是flag
flag{Ch1na_yyds_cazy}
hello_py
uncompyle6 easy_py.cpython-38.pyc > easy_py.py
出来一个py文件，看了下，首先进encrypt1进行异或，再进入encrypt2进行异或，然后输出和Happy进行比较
既然是这样，那不妨反过来，把num从9到0改成从0到9，把该减的地方改成加，该执行的顺序也换一下。
# uncompyle6 version 3.7.4
# Python bytecode 3.8 (3413)
# Decompiled from: Python 3.8.7 (default, Dec 22 2020, 10:37:26)
# [GCC 10.2.1 20201207]
# Embedded file name: C:\Users\Administrator\Desktop\easy_py.py
# Compiled at: 2021-12-28 15:45:17
# Size of source mod 2**32: 1099 bytes
import threading, time
def encode_1(n):
global num
while True:
if num <= 9:
flag[num] = flag[num] ^ num
num += 1
time.sleep(0.1)
if num > 9:
break
def encode_2(n):
global num
while True:
if num <= 9:
flag[num] = flag[num] ^ flag[(num + 1)]
num += 1
time.sleep(0.1)
if num > 9:
break
while True:
Happy = [
44, 100, 3, 50, 106, 90, 5, 102, 10, 112]
num = 0
f = input('Please input your flag:')
if len(f) == 10:
print('Your input is illegal')
else:
flag = [44, 100, 3, 50, 106, 90, 5, 102, 10, 112]
if(1 == 2):
print('crazymumuzi!')
else:
print("flag to 'ord':", flag)
t1 = threading.Thread(target=encode_1, args=(1, ))
t2 = threading.Thread(target=encode_2, args=(2,))
t2.start()
t1.start()
t1.join()
t2.join()
for i in flag:
print(chr(i),end='')
if flag == Happy:
print('Good job!')
else:
print('No no no!')
# okay decompiling easy_py.cpython-38.pyc
得到flag,包上flag{}即可
flag{He110_cazy}
Recommend
-
29
2021 巅峰极客网络安全技能挑战赛 WriteUp 2021 巅峰极客网络安全技能挑战赛
-
8
2021 第三届“第五空间”网络安全大赛 比赛时间：2021-09-16 09:00 ~ 2021-09-1...
-
9
EasyPHP
-
3
2021 东华杯 大学生网络安全邀请赛 WriteUp 本文首发于安全客：https://www.anquanke.com/post/id/258197
-
6
冬奥「雪地猎人」：破冰踏雪守护网络安全 作者：郝伟静 【原创】 2022-02-23 18:53:11关键字： 奇安信
-
5
威胁情报库系统 实时守护冬奥网络安全 来源：
-
4
冬奥网络安全卫士总结表彰暨“零事故”经验宣讲团成立大会在京召开-51CTO.COM 冬奥网络安全卫士总结表彰暨“零事故”经验宣讲团成立大会在京召开 2022-03-16 20:04:16
-
1
打自闭了，一道做不起。 CheckINgo代码审计 package mainimport ( "fmt" "io" "time" "bytes" "regexp" "os/exec" "plugin" "g...
-
3
长安“战疫”网络安全卫士守护赛 | Lazzaro新冠疫情肆虐全球，这一场疫情阻击战不仅是我国卫生健康领域的一场战疫，也是科学技术领域的一次大考。在这个特殊时期，保障网络安全，防范利用新冠肺炎疫情实施的网络攻击行为是关系广大人民群众切身利益的大...
-
9
守护路途的安全卫士，360 4K行车记录仪G900_原创_新浪众测 ...
About Joyk
Aggregate valuable and interesting links.
Joyk means Joy of geeK