MISC

signin

  • misc果然是脑洞题,我不是很做的来

image-20240925221800032

  • 已签和未签的如下

image-20240925221831551

image-20240925221841614

  • 按照题目要求,直接就把luo记为缺勤,把其他人都签到了,即可得到flag,moectf{Thanks_For_You_signing_in_4ND_W3l0c0me_T0_M0ecTf_2024!!!}

image-20240925221950816

ez_Forensics

  • 下载附件,看到是一个.raw文件,题目也说了是内存取证,所以我决定使用Linux下的volatility进行取证

  • 题目描述中给了提示,在关闭cmd之前ubw保存了电脑的内存镜像

image-20240925220325061

  • 题目给出了cmd是Windows下的终端,现在我要先使用volatility -f ./flag.raw imageinfo命令查看一下该.raw文件的信息
  • 发现是可能是这些操作系统 Win7SP1x64, Win7SP0x64, Win2008R2SP0x64, Win2008R2SP1x64_24000, Win2008R2SP1x64_23418, Win2008R2SP1x64, Win7SP1x64_24000, Win7SP1x64_23418
  • 经过筛查是Win7SP1x64

image-20240925220623871

  • 然后再使用volatility -f /home/myheart/Forensic/flag.raw --profile=Win7SP1x64 pslist命令提取进程
  • 发现cmd.exePID 344 PPID 2148 Thds 1 Hnds20 Sess 1
  • 从而确认了cmd.exe有在进程中运行

image-20240925220941496

  • 然后再使用volatility -f /home/myheart/Forensic/flag.raw --profile=Win7SP1x64 cmdscan
  • cmdscan是一个插件,用于查找 cmd.exe(命令提示符)相关的命令历史记录。它会扫描内存中的数据,以寻找用户在命令提示符中输入的命令。然后发现有npm将flag写入flag.txt文件的历史记录,并且还可以看到flag的具体内容

image-20240925221410015

  • 所以得到flag为moectf{WWBGY-TLVC5-XKYBZ}

WEB

Web渗透测试与审计入门指北

  • 下载pdf,浏览一遍pdf,在最后会看到一个附件,搭建网站就有flag

image-20241003091713670

  • 下载好phpstudy,然后启动一些服务

image-20241003091851587

  • 点击网站,再点击管理,打开根目录,将附件给的东西复制粘贴过去

image-20241003091919475

  • 这样再选择打开网站,就会得到flag
image-20241003092045948
  • 网站如下,flag:moectf{H3r3'5_@_flYinG_kIss_f0r_yoU!}

image-20241003092058496

弗拉格之地的入口

  • 打开环境,进入环境对应的网站,会出现如下的提示

image-20241003092340330

  • 看到有爬虫字样,我想到了Python课讲到爬虫时会有一个爬虫协议,一般都是在网站的robots.txt这个网页下

image-20241003092606655

  • 进入网页果然看到了一些信息,发现这里面给出了一个/webtutorEntry.php,进入这个文件对应的网页
  • 进入后就会看到flag了moectf{cONGraTU1atioN_foR_Kn0w1ng_RoboTS-txT250f2}

image-20241003092719956

弗拉格之地的挑战

垫刀之路01: MoeCTF?启动!

  • 打开题目可以看到,这里已经是getshell了,并且可以输出执行命令的结果

image-20241003094742832

  • 然后先ls,查看一下该目录,发现是web网页的后端代码,这里应该是在web目录下

image-20241003094936733

  • 我这边直接ls ../../../,查看到了根目录下有flagcat flag后却发现flag不再这里面,在环境变量里面

image-20241003095052518

image-20241003095125592

  • 所以我又执行了env发现环境变量里面有flag,这样flag就找到了,flag moectf{wEIc0m3-To-MOECtF_anD_rOaDI_ST@rTup-By_sxrHHh15f}

image-20241003095233782

ez_http

  • 打开环境,环境这边显示着要使用post方法,这么一看就需要burp进行抓包了

image-20241003095952730

  • 抓包到后的http包是这样的
1
2
3
4
5
6
7
8
9
10
11
12
13
14
GET / HTTP/1.1
Host: 127.0.0.1:60635
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:130.0) Gecko/20100101 Firefox/130.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/png,image/svg+xml,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
Sec-Fetch-User: ?1
Priority: u=0, i

  • 使用post参数
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
POST / HTTP/1.1
Host: 127.0.0.1:60635
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:130.0) Gecko/20100101 Firefox/130.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/png,image/svg+xml,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
Sec-Fetch-User: ?1
Priority: u=0, i


  • 又看到提示,要求POST参数要imoau=sb

image-20241003100246989

  • 上网搜了下,POST参数要放在Priority: u=0, i需要空一行,即post头结束后要空一行,然后Content-Length: 8这一行内容burp在发送时会自动补全,这边遇到问题,怎么发包都发不过去(问题是第二次做(复现)的时候遇到的,第一次做没遇到这个问题)。问题出来我没有使用burp的右键修改方法,而是直接手动修改POST参数导致发包出现问题。
image-20241003104644673
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
POST / HTTP/1.1
Host: 127.0.0.1:50088
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:130.0) Gecko/20100101 Firefox/130.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/png,image/svg+xml,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Priority: u=0, i
Content-Type: application/x-www-form-urlencoded
Content-Length: 8

imoau=sb
  • 之后收到提示,才get头这边添加参数,但是方法还是post,由于发包不支持中文,所以就将大帅转换成十六进制

image-20241003110415410

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
POST /?xt=%E5%A4%A7%E5%B8%85b HTTP/1.1
Host: 127.0.0.1:50088
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:130.0) Gecko/20100101 Firefox/130.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/png,image/svg+xml,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Priority: u=0, i
Content-Type: application/x-www-form-urlencoded
Content-Length: 8

imoau=sb
  • 之后要求,即添加Referer: https://www.xidian.edu.cn/

image-20241003110611836

  • 又要求cookie参数

image-20241003110653715

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
POST /?xt=%E5%A4%A7%E5%B8%85b HTTP/1.1
Host: 127.0.0.1:50088
cookie: user=admin
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:130.0) Gecko/20100101 Firefox/130.0
Referer: https://www.xidian.edu.cn/
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/png,image/svg+xml,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Priority: u=0, i
Content-Type: application/x-www-form-urlencoded
Content-Length: 8

imoau=sb
  • 要求使用指定浏览器源

image-20241003110808320

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
POST /?xt=%E5%A4%A7%E5%B8%85b HTTP/1.1
Host: 127.0.0.1:50088
cookie: user=admin
User-Agent: MoeDedicatedBrowser
Referer: https://www.xidian.edu.cn/
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/png,image/svg+xml,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Priority: u=0, i
Content-Type: application/x-www-form-urlencoded
Content-Length: 8

imoau=sb
  • 然后只要求本地通过
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
POST /?xt=%E5%A4%A7%E5%B8%85b HTTP/1.1
Host: 127.0.0.1:50088
cookie: user=admin
User-Agent: MoeDedicatedBrowser
Referer: https://www.xidian.edu.cn/
X-Forwarded-For:127.0.0.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/png,image/svg+xml,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Priority: u=0, i
Content-Type: application/x-www-form-urlencoded
Content-Length: 8

imoau=sb
  • 最后得到flagmoectf{y0u-@Re_ReaIIy_Re4LLY_VerY-c13VER!!!46056}

image-20241003111044152

CRYPTO

现代密码学入门指北

  • 下载入门指北并阅读到末尾的时候,给出了题目,简单的rsa加密
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
from Crypto.Util.number import bytes_to_long, getPrime
from secret import flag
p = getPrime(128)
q = getPrime(128)
n = p*q
e = 65537
m = bytes_to_long(flag)
c = pow(m, e, n)
print(f"n = {n}")
print(f"p = {p}")
print(f"q = {q}")
print(f"c = {c}")

'''
n = 40600296529065757616876034307502386207424439675894291036278463517602256790833
p = 197380555956482914197022424175976066223
q = 205695522197318297682903544013139543071
c = 36450632910287169149899281952743051320560762944710752155402435752196566406306
'''
  • 解密脚本如下:
1
2
3
4
5
6
7
8
9
10
11
12
import libnum
import gmpy2
n = 40600296529065757616876034307502386207424439675894291036278463517602256790833
p = 197380555956482914197022424175976066223
q = 205695522197318297682903544013139543071
c = 36450632910287169149899281952743051320560762944710752155402435752196566406306
e = 65537
phi_n = (p-1)*(q-1)
d = gmpy2.invert(e,phi_n)
m = pow(c,d,n)
print(libnum.n2s(int(m)))
# moectf{the_way_to_crypto}

Signin

  • 题目给了一个简单的rsa加密,正常解密即可
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
from Crypto.Util.number import*
from secret import flag


m = bytes_to_long(flag)
p = getPrime(1024)
q = getPrime(1024)
n = p*q
e = 65537
c = pow(m,e,n)
pq = (p-1)*(q-2)
qp = (q-1)*(p-2)
p_q = p + q

print(f"{c = }")
print(f"{pq = }")
print(f"{qp = }")
print(f"{n = }")
print(f"{p_q = }")
'''
c = 5654386228732582062836480859915557858019553457231956237167652323191768422394980061906028416785155458721240012614551996577092521454960121688179565370052222983096211611352630963027300416387011219744891121506834201808533675072141450111382372702075488292867077512403293072053681315714857246273046785264966933854754543533442866929316042885151966997466549713023923528666038905359773392516627983694351534177829247262148749867874156066768643169675380054673701641774814655290118723774060082161615682005335103074445205806731112430609256580951996554318845128022415956933291151825345962528562570998777860222407032989708801549746
pq = 18047017539289114275195019384090026530425758236625347121394903879980914618669633902668100353788910470141976640337675700570573127020693081175961988571621759711122062452192526924744760561788625702044632350319245961013430665853071569777307047934247268954386678746085438134169871118814865536503043639618655569687154230787854196153067547938936776488741864214499155892870610823979739278296501074632962069426593691194105670021035337609896886690049677222778251559566664735419100459953672218523709852732976706321086266274840999100037702428847290063111455101343033924136386513077951516363739936487970952511422443500922412450462
qp = 18047017539289114275195019384090026530425758236625347121394903879980914618669633902668100353788910470141976640337675700570573127020693081175961988571621759711122062452192526924744760561788625702044632350319245961013430665853071569777307047934247268954386678746085438134169871118814865536503043639618655569687077087914198877794354459669808240133383828356379423767736753506794441545506312066344576298453957064590180141648690226266236642320508613544047037110363523129966437840660693885863331837516125853621802358973786440314619135781324447765480391038912783714312479080029167695447650048419230865326299964671353746764860
n = 18047017539289114275195019384090026530425758236625347121394903879980914618669633902668100353788910470141976640337675700570573127020693081175961988571621759711122062452192526924744760561788625702044632350319245961013430665853071569777307047934247268954386678746085438134169871118814865536503043639618655569687534959910892789661065614807265825078942931717855566686073463382398417205648946713373617006449901977718981043020664616841303517708207413215548110294271101267236070252015782044263961319221848136717220979435486850254298686692230935985442120369913666939804135884857831857184001072678312992442792825575636200505903
p_q = 279533706577501791569740668595544511920056954944184570513187478007551195831693428589898548339751066551225424790534556602157835468618845221423643972870671556362200734472399328046960316064864571163851111207448753697980178391430044714097464866523838747053135392202848167518870720149808055682621080992998747265496
'''
  • 先根据方程,利用sage解出方程
1
2
3
4
5
6
p = var('p')
q = var('q')

eq1=(p-1)*(q-2)==18047017539289114275195019384090026530425758236625347121394903879980914618669633902668100353788910470141976640337675700570573127020693081175961988571621759711122062452192526924744760561788625702044632350319245961013430665853071569777307047934247268954386678746085438134169871118814865536503043639618655569687154230787854196153067547938936776488741864214499155892870610823979739278296501074632962069426593691194105670021035337609896886690049677222778251559566664735419100459953672218523709852732976706321086266274840999100037702428847290063111455101343033924136386513077951516363739936487970952511422443500922412450462
eq2 = (q-1)*(p-2)==18047017539289114275195019384090026530425758236625347121394903879980914618669633902668100353788910470141976640337675700570573127020693081175961988571621759711122062452192526924744760561788625702044632350319245961013430665853071569777307047934247268954386678746085438134169871118814865536503043639618655569687077087914198877794354459669808240133383828356379423767736753506794441545506312066344576298453957064590180141648690226266236642320508613544047037110363523129966437840660693885863331837516125853621802358973786440314619135781324447765480391038912783714312479080029167695447650048419230865326299964671353746764860
solve([eq1,eq2],p,q)
  • 得到p、q后直接rsa解密即可
1
2
3
4
5
6
7
8
9
10
11
12
13
14
import libnum
import gmpy2
c = 5654386228732582062836480859915557858019553457231956237167652323191768422394980061906028416785155458721240012614551996577092521454960121688179565370052222983096211611352630963027300416387011219744891121506834201808533675072141450111382372702075488292867077512403293072053681315714857246273046785264966933854754543533442866929316042885151966997466549713023923528666038905359773392516627983694351534177829247262148749867874156066768643169675380054673701641774814655290118723774060082161615682005335103074445205806731112430609256580951996554318845128022415956933291151825345962528562570998777860222407032989708801549746
pq = 18047017539289114275195019384090026530425758236625347121394903879980914618669633902668100353788910470141976640337675700570573127020693081175961988571621759711122062452192526924744760561788625702044632350319245961013430665853071569777307047934247268954386678746085438134169871118814865536503043639618655569687154230787854196153067547938936776488741864214499155892870610823979739278296501074632962069426593691194105670021035337609896886690049677222778251559566664735419100459953672218523709852732976706321086266274840999100037702428847290063111455101343033924136386513077951516363739936487970952511422443500922412450462
qp = 18047017539289114275195019384090026530425758236625347121394903879980914618669633902668100353788910470141976640337675700570573127020693081175961988571621759711122062452192526924744760561788625702044632350319245961013430665853071569777307047934247268954386678746085438134169871118814865536503043639618655569687077087914198877794354459669808240133383828356379423767736753506794441545506312066344576298453957064590180141648690226266236642320508613544047037110363523129966437840660693885863331837516125853621802358973786440314619135781324447765480391038912783714312479080029167695447650048419230865326299964671353746764860
n = 18047017539289114275195019384090026530425758236625347121394903879980914618669633902668100353788910470141976640337675700570573127020693081175961988571621759711122062452192526924744760561788625702044632350319245961013430665853071569777307047934247268954386678746085438134169871118814865536503043639618655569687534959910892789661065614807265825078942931717855566686073463382398417205648946713373617006449901977718981043020664616841303517708207413215548110294271101267236070252015782044263961319221848136717220979435486850254298686692230935985442120369913666939804135884857831857184001072678312992442792825575636200505903
p_q = 279533706577501791569740668595544511920056954944184570513187478007551195831693428589898548339751066551225424790534556602157835468618845221423643972870671556362200734472399328046960316064864571163851111207448753697980178391430044714097464866523838747053135392202848167518870720149808055682621080992998747265496
p = 101195416461091716428326199733504078281010548412226222689665080411126731520752210150756388683557219973649948209094722629248795549538890771346214761833764975454769057589710497693291150424006859232283601953197097456280805871953601208233200402046794268614613979577032173301390416040533984248749301081715040789947
q = 178338290116410075141414468862040433639046406531958347823522397596424464310941218439142159656193846577575476581439833972909039919079954450077429211036906580907431676882688830353669165640857711931567509254251656241699372519476443505864264464477044478438521412625815994217480304109274071433871779911283706475549
phi_n = (p-1)*(q-1)
e = 65537
d = gmpy2.invert(e,phi_n)
print(libnum.n2s(int(pow(c,d,n))))
# moectf{Just_4_signin_ch4ll3ng3_for_y0u}

ez_hash

  • 该题是hash爆破,这题原本暑假的时候就尝试做了,但是使用Python爆破不出来,然后去在线md5查询,查询出来了,但是看结果要钱,就没查看了
  • 到了开学知道了有hashcat这个工具,可以使用显卡爆破,就爆破出来了
  • 题目附件
1
2
3
4
5
6
7
8
9
from hashlib import sha256
from secret import flag, secrets

assert flag == b'moectf{' + secrets + b'}'
assert secrets[:4] == b'2100' and len(secrets) == 10
hash_value = sha256(secrets).hexdigest()
print(f"{hash_value = }")
# secret = 2100******
# hash_value = '3a5137149f705e4da1bf6742e62c018e3f7a1784ceebcb0030656a2b42f50b6a'
  • 使用hashcat爆破,在Linux下安装好hash,然后输入指令
    • SHA256: -m 1400
    • -a 3 指定使用掩码攻击(暴力破解)
    • 2100 固定为前 4 位,?d?d?d?d?d?d 表示 6 个未知的数字
1
hashcat -m 1400 -a 3 3a5137149f705e4da1bf6742e62c018e3f7a1784ceebcb0030656a2b42f50b6a 2100?d?d?d?d?d?d
  • 爆破得到的结果为
1
2100360168
  • flag:moectf{2100360168}

Big and small

  • 还是一个rsa加密,但是e很小,直接开方即可
  • 题目:
1
2
3
4
5
6
7
8
9
10
11
12
13
from secret import flag
from Crypto.Util.number import*
m = long_to_bytes(flag)
p = getPrime(1024)
q = getPrime(1024)
n = p*q
e = 3
c = pow(m,e,n)
'''
c = 150409620528288093947185249913242033500530715593845912018225648212915478065982806112747164334970339684262757
e = 3
n = 20279309983698966932589436610174513524888616098014944133902125993694471293062261713076591251054086174169670848598415548609375570643330808663804049384020949389856831520202461767497906977295453545771698220639545101966866003886108320987081153619862170206953817850993602202650467676163476075276351519648193219850062278314841385459627485588891326899019745457679891867632849975694274064320723175687748633644074614068978098629566677125696150343248924059801632081514235975357906763251498042129457546586971828204136347260818828746304688911632041538714834683709493303900837361850396599138626509382069186433843547745480160634787
'''
  • exp:
1
2
3
4
5
6
7
8
import libnum
import gmpy2
c = 150409620528288093947185249913242033500530715593845912018225648212915478065982806112747164334970339684262757
e = 3
n = 20279309983698966932589436610174513524888616098014944133902125993694471293062261713076591251054086174169670848598415548609375570643330808663804049384020949389856831520202461767497906977295453545771698220639545101966866003886108320987081153619862170206953817850993602202650467676163476075276351519648193219850062278314841385459627485588891326899019745457679891867632849975694274064320723175687748633644074614068978098629566677125696150343248924059801632081514235975357906763251498042129457546586971828204136347260818828746304688911632041538714834683709493303900837361850396599138626509382069186433843547745480160634787
m = libnum.nroot(c,e)
print(libnum.n2s(int(m)))
# flag{xt>is>s>b}

baby_equation

  • 这题开了俩个提示,还是没思路,最后和某个已经做出来的师傅对了下思路,发现思路问题,之后思路正确了就做下去了

  • 其中题目中的俩个提示也还是有用的

  • 题目附件如下,主要聚焦到assert的这个式子中

1
2
3
4
5
6
7
8
9
10
from Crypto.Util.number import *
from secret import flag


l = len(flag)
m1, m2 = flag[:l//2], flag[l//2:]
a = bytes_to_long(m1)
b = bytes_to_long(m2)
k = 0x2227e398fc6ffcf5159863a345df85ba50d6845f8c06747769fee78f598e7cb1bcf875fb9e5a69ddd39da950f21cb49581c3487c29b7c61da0f584c32ea21ce1edda7f09a6e4c3ae3b4c8c12002bb2dfd0951037d3773a216e209900e51c7d78a0066aa9a387b068acbd4fb3168e915f306ba40
assert ((a**2 + 1)*(b**2 + 1) - 2*(a - b)*(a*b - 1)) == 4*(k + a*b)
  • 题目提示用yafu分解,我这边是将4k分解,得到,很明显,k能分解出这么多式子,甚至都是俩个或偶数个的素数,这就要想到,4k可以因式分解成与ab相关的因式而且还是代平方的那种
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
P1 = 2
P1 = 2
P1 = 2
P1 = 2
P1 = 2
P1 = 2
P1 = 2
P1 = 2
P1 = 3
P1 = 3
P1 = 3
P1 = 3
P2 = 31
P2 = 31
P2 = 61
P2 = 61
P3 = 223
P3 = 223
P4 = 4013
P4 = 4013
P6 = 281317
P6 = 281317
P7 = 4151351
P7 = 4151351
P13 = 5404604441993
P13 = 5404604441993
P14 = 26798471753993
P14 = 26798471753993
P44 = 64889106213996537255229963986303510188999911
P44 = 64889106213996537255229963986303510188999911
P29 = 25866088332911027256931479223
P29 = 25866088332911027256931479223
P9 = 370523737
P9 = 370523737
P9 = 339386329
P9 = 339386329
  • 所以接下来就对assert的那个式子进行因式分解,结果分解半天分解错了QAQ
  • 最后得到的结果还是AI跑出来的

image-20241008013015286

  • 接下来用上第二个提示,由于我并不知道a+1可以分解成那些素数的乘积,但我知道flag中有moectf(这也就是第二个提示),所以我就考虑使用随机数的办法进行爆破,结果当然是爆破出来了
1
2
3
4
5
6
7
8
9
10
11
12
13
c = [64889106213996537255229963986303510188999911,25866088332911027256931479223,26798471753993,339386329,370523737,5404604441993,4151351,281317,4013,223,61,31,2,2,2,2,3,3]
for i in range(len(c)):
for j in range(100000):
random_elements = random.sample(c, i)
p = 1
for x in random_elements:
p *= x
b = libnum.n2s(p)
if b'moectf' in b:
print(b)
print(libnum.s2n(b))
# b'moectf{7he_Fund4m3nt4l_th30r4' 这个是a+1跑出来的,而不是a的值
# 2950365559902224963252311699604518749050102395042841254385700637274676
  • 得到a+1的值就可以利用因式分解的值可以算出b的值,从而知道flag的后半部分了
1
2
3
4
5
6
7
8
9
a_plus_1 = 2950365559902224963252311699604518749050102395042841254385700637274676
a = a_plus_1-1
print(libnum.n2s(a))
b_1 = g//(a_plus_1**2)
b_1 = libnum.nroot(b_1,2)
print(libnum.n2s(b_1+1))
# b'moectf{7he_Fund4m3nt4l_th30r3' 这个才是真正的flag的前半部分
# b'm_0f_4rithm3tic_i5_p0w4rful!}'
# moectf{7he_Fund4m3nt4l_th30r3m_0f_4rithm3tic_i5_p0w4rful!}

RE

逆向工程入门指北

  • 下载pdf附件翻到第二页
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
#include <iostream>
int main()
{
char password_enc[] = {
123, 121, 115, 117, 98, 112, 109, 100, 37, 96, 37, 100, 101, 37, 73, 39,
101, 73, 119, 73, 122, 121, 120, 113, 73, 122, 121, 120, 113, 73, 97, 119,
111, 73, 98, 121, 73, 115, 110, 102, 122, 121, 100, 115, 107, 22 };
// 因为a^b=c时, b^c=a, 所以我们可以这样还原数据:
char password[47];
for (int i = 0; i < 46; i++) {
password[i] = password_enc[i] ^ 22;
}
password[46] = 0; // 使用0字符来截断掉%s的无尽输出..
printf("%s\n", password); // 哈哈,这就是本题的f l a g,自己运行一下交上去吧!
return 0;
}
  • 这个就是本题flag
1
2
3
4
5
6
a = [ 123, 121, 115, 117, 98, 112, 109, 100, 37, 96, 37, 100, 101, 37, 73, 39,
101, 73, 119, 73, 122, 121, 120, 113, 73, 122, 121, 120, 113, 73, 97, 119,
111, 73, 98, 121, 73, 115, 110, 102, 122, 121, 100, 115, 107, 22]
for i in a:
print(chr(i^22),end='')
# moectf{r3v3rs3_1s_a_long_long_way_to_explore}

异或

  • 使用IDA反编译附件,然后查看反编译的代码,发现就是简单的异或

image-20241007222336914

  • 加密后的数据保存在byte_1400022B8数据段中,使用shift+E提取数组

image-20241007222423810

  • 编写解密脚本
1
2
3
4
5
6
7
8
a = [ 73,  75,  65,  71,  80,  66,  95,  65,  28,  22,
70, 16, 19, 28, 64, 9, 66, 22, 70, 28,
9, 16, 16, 66, 29, 9, 70, 21, 20, 20,
9, 23, 22, 20, 65, 64, 64, 22, 20, 71,
18, 64, 20, 89]
for i in a:
print(chr(i^0x24),end='')
# moectf{e82b478d-f2b8-44f9-b100-320edd20c6d0}

UPX

  • 简单的upx脱壳,直接下载upx脱壳工具,使用指令upx-d脱壳,这里就不演示了
  • 脱壳后使用IDA反编译,反编译完即可看到flagmoectf{ec5390dd-f8cf-4b02-bc29-3bb0c5604c29}

image-20241007223024688

upx-revenge

  • 魔改的upx脱壳,下载附件后使用010Editor打开,然后将这两个地方分别改为UPX0UPX1

  • 然后就可以使用upx脱壳软件upx -d进行自动脱壳了

image-20240927202757801

  • 脱壳完之后再使用IDA打开,即可看到flag

image-20240927202824136

  • flag文件moectf{554ea35c-a1bb-4d8f-a323-bd697564bf27}

RC4

  • 下载附件后使用IDA打开,然后快速定位到main函数中
  • 发现A71A68ECD82711CC8C9B16155CD2673E82ADCE75D4BC5756C28A52B86BD6CCF8A4BA722FE05715B92411是密文
  • 密钥是RC4_1s_4w3s0m3

image-20241007223630697

  • 然后直接在线rc4解密即可,如果是为了学习而做题的话建议使用Python手搓rc4解密脚本,得到flag
1
moectf{why_Rc4_haS_The_Rev32sabl3_pr0ceSS}

image-20241007223759632

Tea

  • 在另一篇文章中写过了,这里直接复制粘贴

  • 题目附件就只给一个.exe的可执行程序

image-20240827142857426

  • 先运行一下这个点exe文件。发现程序已经给出后面一部分的flag。然后前面的flag使用未知数表示。该程序让用户输入前三段的flag

image-20240827142943495

  • 然后使用IDA反编译一下,主要加密函数如下

image-20240827143206799

  • 由于该题将库函数的符号表给去掉了,所以先推出一些函数,更方便看代码

image-20240827144926606

  • 对于这一步就是要用户输入正确的部分flag

image-20240827143256972

  • 接下来对下面进行分析,发现有几个变量
    • 但是由于scanf后面需要跟一个变量,但是可能由于反编译的问题。
    • 这样v10、v9、v11三个变量可能就是要求输入的明文
    • 所以变量v4、v5是明文

image-20240827145604067

  • 然后查看循环和循环里面的式子
    • 可以初步判断v6是循环次数,也就是TEA加密的轮数
    • 而循环内部就是加密的算法

image-20240827143829326

  • 然后最后的是判断flag是否正确

image-20240827144143170

  • 现在目前的重点在于分析该步骤的算法
  • 由最后一步判断得知
    • v4加密后最终的值为676078132
    • v5加密后最终的值为957400408
  • 由一开始v3=0然后每次循环都有v3 -= 1640531527,可知最后一次加密时的值为v3 =-1640531527*32
  • 然后是最核心的算法,这里还要注意的是可能存在溢出或者回绕,可能需要取模或者进行位运算
1
2
v4 += (v5+v3)^(16*v5 + 170260386) ^ ((v5 >> 5) + 1870148662);
v5 += (v4+v3)^(16*v4 + 1634038898) ^ ((v4 >> 5) + 1634038904);
  • 由于v5的最后一次加密与运算后的v4有关,所以解密的时候应该是v5先进行运算
1
2
3
4
5
6
7
v5 = 957400408
v4 = 676078132
v3 = -1640531527*32

v5 -= (v4 + v3) ^ (16 * v4 + 1634038898) ^ ((v4 >> 5) + 1634038904);
v4 -= (v5 + v3) ^ (16 * v5 + 1702060386) ^ ((v5 >> 5) + 1870148662);
v3 += 1640531527;

image-20240827145956235

  • 通过加密可以编写解密脚本,但是由于存在整数溢出和回绕的问题,为了不取模,直接编写C语言脚本进行解密。而不编写Python脚本解密
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
#include<stdio.h>
int main()
{
unsigned int v4 = 676078132;
unsigned int v5 = 957400408;
int v3 = -1640531527 * 32;
printf("%d\n",v6);
for(int i = 0;i < 32;i++)
{
v5 -= (v4 + v3) ^ (16 * v4 + 1634038898) ^ ((v4 >> 5) + 1634038904);
v4 -= (v5 + v3) ^ (16 * v5 + 1702060386) ^ ((v5 >> 5) + 1870148662);
v3 += 1640531527;
}

printf("%u %u",v4,v5);
return 0;
}
  • Python脚本实现解密是通过位运算
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
def decrypt(v4, v5, rounds):
delta = 1640531527
v3 = (-delta * rounds) & 0xFFFFFFFF # 初始值,保持32位无符号整数

for _ in range(rounds):
# 计算解密过程中的 v5
v5 = (v5 - ((v4 + v3) ^ (16 * v4 + 1634038898) ^ ((v4 >> 5) + 1634038904))) & 0xFFFFFFFF
# 计算解密过程中的 v4
v4 = (v4 - ((v5 + v3) ^ (16 * v5 + 1702060386) ^ ((v5 >> 5) + 1870148662))) & 0xFFFFFFFF
# 更新 v3
v3 = (v3 + delta) & 0xFFFFFFFF

return v4, v5

# 示例使用
if __name__ == "__main__":
# 假设这是加密后的 v4 和 v5 值
v4_encrypted = 676078132
v5_encrypted = 957400408

# 解密轮数 (与加密时使用的轮数相同)
rounds = 32

# 解密
v4_decrypted, v5_decrypted = decrypt(v4_encrypted, v5_encrypted, rounds)

print(f"Decrypted v4 = {v4_decrypted}")
print(f"Decrypted v5 = {v5_decrypted}")

  • 运行后将结果转换为16进制
1
2
3
4
0x836153a5
0x8e0049bd
将x那部分替换为836153a5,将y那部分替换为8e00,将z那部分替换为49bd。
moectf{836153a5-8e00-49bd-9c42-caf30620caaf}

d0tN3t

  • .dll逆向,使用工具ILSpy逆向,可以直接反编译出内容,然后进行解密,主要问题就出在工具上。IDApro反编译不了.dll文件

  • ILSpy下载地址:Releases · icsharpcode/ILSpy (github.com)

image-20241007215824029

  • 下载.exe版后解压,进入解压文件,.exe文件,然后点击进去
image-20241007215923583
  • 在程序内部打开附件就行

image-20241007220006913

  • 然后点击进入到这里,就可以看到加密逻辑了

image-20241007220032190

  • 加密逻辑如下图

image-20241007220046748

  • 编写脚本一把梭,注意异或i*i有时候会超出255,所以要异或i*i后要与一个0xFF
1
2
3
4
5
6
7
8
a = [173, 146, 161, 174, 132, 179, 187, 234, 231, 244,177, 161, 65, 13, 18, 12, 166, 247, 229, 207,125, 109, 67, 180, 230, 156, 125, 127, 182, 236,105, 21, 215, 148, 92, 18, 199, 137, 124, 38,228, 55, 62, 164]
b = []
for i in range(len(a)):
b.append(((a[i]^(i*i))&0xff^0x72) - 114)
print(b)
for i in b:
print(chr(i),end='')
# moectf{7ce581d2-b2ab-4ceb-9bbe-435873083db6}

dynamic

  • 简单的动态调试题目,下载附件,使用IDA打开发现有给数据,但是给的数据是加密过后的数据,不是真正的flag
  • 但是在程序运行的过程中就会调用加密(解密)函数,可以把flag给解密出来,这时就会出现flag,但是flag在栈上
  • 所以我们需要动态调试取查看栈上的内容

image-20240927194435239

  • 先在该处打下断点

image-20240927194643539

  • 然后再按下F9键,选择该选项

image-20240927194724747

  • 选择完后就会进入动态调试的模式,这样就在栈上可以看到flag的16进制模式

image-20240927194806319

  • 将这一串16进制复制下来,丢入在线16进制转字符串

image-20240927194846304

  • flag其实已经得到了,但是由于是小端序的内存表示,所以我写了个Python脚本,将flag变成正常的flag
1
2
3
4
5
6
7
8
9
10
11
12
13
14
a = '''317B667463656F6D
2D34343963346438
3038342D63373439
632D363335392D38
3362366434336437
000000007D373238'''
b = a.split('\n')
#print(b[0][-2:16])
print(int('38',16))
print(b)
for i in b:
for j in range(len(i)-8):
print(chr(int(i[-2-2*j:16-2*j],16)),end='')
# moectf{18d4c944-947c-4808-9536-c7d34d6b3827}

Just-Run-It

  • 下载附件,然后打开,发现给了4个程序,分别是exeelfriscv.elfapk四个文件

image-20240928120901652

  • 先运行一下.exe文件,这样就会给出一个十六进制的字符串

image-20240928120953384

1
6257396c5933526d657a55355a6d45
  • 然后转字符串后就变成
1
bW9lY3RmezU5ZmE
  • 运行apk文件,就直接将该文件拖入雷电模拟器中,然后运行
  • 运行了一下0x3.riscv0x64.elf,运行结果显示一串数组(十进制),将这一串数组转为字符串。

image-20240928122109231

1
WU1NzRjZjliOX0=

逆向工程进阶之北

ezMAZE

  • 此题考点算是比较综合的了,深搜和广搜,位压缩,动态调试
  • 拿到附件后使用IDA进行反编译,反编译之后就会解读代码

image-20241001092428464

  • 然后在检查迷宫路径这边有一个函数,函数名称为sub_7FF70B961190,点击去查看,发现是检查位压缩的0、1位
  • 所以 byte_7FF70B965000就是地图了

image-20241001092509624

  • 点击 byte_7FF70B965000查看地图,发现是一个位压缩的地图形式,1为墙,0为路

image-20241001092641526

  • 这样我就先在该位置打下断点

image-20241001092745346

  • 进行动态调试,找到迷宫存放的地址,然后将迷宫提取为二进制文件

image-20241001092812481

  • 使用Python将其转换为0、1字符串的迷宫
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
def extract_and_convert_to_binary_string(input_file):
# 读取二进制文件
with open(input_file, 'rb') as f:
data = f.read()

# 将二进制数据转换为01字符串
binary_string = ''.join(format(byte, '08b') for byte in data)

return binary_string


# 示例使用
binary_string = extract_and_convert_to_binary_string("D:\\aaa")
print(binary_string)

# 示例使用
#compress_binary_file("D:\\aaa", 'D:\\output')
a = '1111111111111111111111111111111111111111111111111111111111111111111111111111111110111111111111111110101010101000101001001001001001001111111111111111111111111111100000000000000000111101000101001001010010010010101110000000000000000000111111111111111111111111101110111101101000011111001010010111101111111111111111101111111111000000000000000011101111011010110111000000000000000011000000000000000011111111110111111111111111111011110110101101110111111111111111110111111111111111111111111100000000000000001110111101101011011100000000000000001100000000000000001111111111111111111111111011100001000010000111111111111111111011111111111111111011111111110000000000000000111111111111111111110000000000000000110000000000000000111111111101111111111111111110000111110000111101111111111111111101111111111111111111111111000000000000000011101111111101101111000000000000000011000000000011111000011111111111111111111110111000011111000111111111111111111110111111111110111110110111111111111111111111101111110111110110111101001010010111101111111111101111101101111111111111111111111001100001111100001111111111111111111011111111111011111011011111100000000000000001001111111111111111100000000000000000100000000000111110110111111011111101111111011011111111111111111011111111111111111011111111111111101101111110010110101010110110000000000000000010000000000000000010000000011111111011011111100101101010101101111111111111111110111111111111111110111111110111111110110111111001010101001011011100000000000000001100000000000000001100000001111111101101111110010101010010110111011111111111111111011111111111111111011111111111111011011111101010101001011001110000000000000000110000000000000000110000000000000110110111111001001001010111011111111111111111101111111111111111101111111111111101101101111110010010100101000111000000000000000011000000000000000011000000000000011011011111100010100100101101110111111111111111110111111111111111110111111111111110110111111010111011010101011100000000000000001100000000000000001100000000000011101101111110010101010010101111111111111111111011111111111111111011111111111110111011011111100010100100101001001010010100001110110000000000000000111111111111101110110111111011111101111111011111111111111111100001111111111111111111111111111011101101111111111111111111111111010101011101011111111111111111111111111111111110111011011111100000000000000000111000110101010011010100101010100110000000000000001110110111111011111111111111101111010101000100101111111111111111101111111111111111101101111110100000000000000011111111111111111111000000000000000011000000000000000011011111101011111111111111111111110000000111110111111111111111110111111111111111110111111010000000000000001111111101111101111100000000000000001100000000000000001101111110111111111111111011111111011111011111111111111111111011111111111111111011011111101000000000000000111111110111110111110000000000000000110000000000000000110111111010111111111111111111111101111101111101111111111111111101111111111111111101111110100000000000000011111111011111011111000000000000000011000000000000000011011111101111111111111110111111110111110111111111111111111110111111111111111110110111111011110010001011101111111101111101111111111111111111101111111111111111101101111110101001001001001001111111011111011111111111111111111011111111111111111001011111101100101010000111001111110111110111100000000000000000100000000000000011010111111011000101010010111011111101111111111011111111111111111011111111111110110101111110101010001000101110000000000000000010000000000000000010000000011111100001011111101111010010100111111111111111111110111111111111111110111111110111111111110111111011001001010010101100000000000000001100000000000000001100000001111111111101111110110100100101001011011111111111111111011111111111111111011111111111111111011111101100100100101010110000000000000000110000000000000000110000000000000000110111111011001001010010010111111111111111101111111111111111101111111111111111101101111110110010010101001101000000000000000011000000000000000011000000000000000011011111101100100101001001010111111111111111110111111111111111110111111111111111110111111011001010010001001100000000000000000000000000000000111100000000000000001101111110110000100010010111111111111111111111111111111111111000011111111111111011011111101111001001000100010000111111111110000000000000000000111111111111111110110111111000000000000000000000000000000000001101111111111111111010010100100010100101111111111111111111111111111111111111111111111111111111111111111111111111111111111111'
print(len(a)//80)
for i in range(56-1):
print(a[0+i*80:80+i*80])

  • 然后以迷宫56行,80列的形式输出

image-20241001093024171

  • 起点坐标为(2,2),真实起点应该为(1,1),终点坐标为(55,75),真实的终点应该为(54,74),知道起点和终点,直接编写深度搜索和广度搜索算法寻找迷宫路径
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
from collections import deque


def is_valid_move(maze, visited, row, col):
return (0 <= row < len(maze)) and (0 <= col < len(maze[0])) and (maze[row][col] == '0' and not visited[row][col])


def iterative_dfs(maze, start_row, start_col):
stack = [(start_row, start_col, '')] # (行, 列, 路径)
visited = [[False] * len(maze[0]) for _ in range(len(maze))]

while stack:
row, col, path = stack.pop()
print(f"DFS访问: 行={row}, 列={col}, 路径={path}") # 打印当前访问的位置和路径

if (row, col) == (54, 74): # 到达终点
return path

visited[row][col] = True
directions = [(0, 1, 'd'), (1, 0, 's'), (0, -1, 'a'), (-1, 0, 'w')] # 右,下,左,上

for dr, dc, direction in directions:
new_row, new_col = row + dr, col + dc
if is_valid_move(maze, visited, new_row, new_col):
stack.append((new_row, new_col, path + direction))

return None


def bfs(maze):
rows, cols = len(maze), len(maze[0])
queue = deque([(1, 1, '')]) # 起点 (1, 1)
visited = [[False] * cols for _ in range(rows)]
visited[1][1] = True

directions = [(0, 1, 'd'), (1, 0, 's'), (0, -1, 'a'), (-1, 0, 'w')] # 右,下,左,上

while queue:
row, col, path = queue.popleft()
print(f"BFS访问: 行={row}, 列={col}, 路径={path}") # 打印当前访问的位置和路径

if (row, col) == (54, 74): # 到达终点
return path

for dr, dc, direction in directions:
new_row, new_col = row + dr, col + dc
if is_valid_move(maze, visited, new_row, new_col):
visited[new_row][new_col] = True
queue.append((new_row, new_col, path + direction))

return None
# 示例迷宫字符串
maze_str = """\
11111111111111111111111111111111111111111111111111111111111111111111111111111111
10111111111111111110101010101000101001001001001001001111111111111111111111111111
10000000000000000011110100010100100101001001001010111000000000000000000011111111
11111111111111111011101111011010000111110010100101111011111111111111111011111111
11000000000000000011101111011010110111000000000000000011000000000000000011111111
11011111111111111111101111011010110111011111111111111111011111111111111111111111
11000000000000000011101111011010110111000000000000000011000000000000000011111111
11111111111111111011100001000010000111111111111111111011111111111111111011111111
11000000000000000011111111111111111111000000000000000011000000000000000011111111
11011111111111111111100001111100001111011111111111111111011111111111111111111111
11000000000000000011101111111101101111000000000000000011000000000011111000011111
11111111111111111011100001111100011111111111111111111011111111111011111011011111
11111111111111111011111101111101101111010010100101111011111111111011111011011111
11111111111111111001100001111100001111111111111111111011111111111011111011011111
10000000000000000100111111111111111110000000000000000010000000000011111011011111
10111111011111110110111111111111111110111111111111111110111111111111111011011111
10010110101010110110000000000000000010000000000000000010000000011111111011011111
10010110101010110111111111111111111011111111111111111011111111011111111011011111
10010101010010110111000000000000000011000000000000000011000000011111111011011111
10010101010010110111011111111111111111011111111111111111011111111111111011011111
10101010100101100111000000000000000011000000000000000011000000000000011011011111
10010010010101110111111111111111111011111111111111111011111111111111011011011111
10010010100101000111000000000000000011000000000000000011000000000000011011011111
10001010010010110111011111111111111111011111111111111111011111111111111011011111
10101110110101010111000000000000000011000000000000000011000000000000111011011111
10010101010010101111111111111111111011111111111111111011111111111110111011011111
10001010010010100100101001010000111011000000000000000011111111111110111011011111
10111111011111110111111111111111111000011111111111111111111111111110111011011111
11111111111111111111010101011101011111111111111111111111111111111110111011011111
10000000000000000011100011010101001101010010101010011000000000000000111011011111
10111111111111111011110101010001001011111111111111111011111111111111111011011111
10100000000000000011111111111111111111000000000000000011000000000000000011011111
10101111111111111111111111000000011111011111111111111111011111111111111111011111
10100000000000000011111111011111011111000000000000000011000000000000000011011111
10111111111111111011111111011111011111111111111111111011111111111111111011011111
10100000000000000011111111011111011111000000000000000011000000000000000011011111
10101111111111111111111111011111011111011111111111111111011111111111111111011111
10100000000000000011111111011111011111000000000000000011000000000000000011011111
10111111111111111011111111011111011111111111111111111011111111111111111011011111
10111100100010111011111111011111011111111111111111111011111111111111111011011111
10101001001001001001111111011111011111111111111111111011111111111111111001011111
10110010101000011100111111011111011110000000000000000010000000000000001101011111
10110001010100101110111111011111111110111111111111111110111111111111101101011111
10101010001000101110000000000000000010000000000000000010000000011111100001011111
10111101001010011111111111111111111011111111111111111011111111011111111111011111
10110010010100101011000000000000000011000000000000000011000000011111111111011111
10110100100101001011011111111111111111011111111111111111011111111111111111011111
10110010010010101011000000000000000011000000000000000011000000000000000011011111
10110010010100100101111111111111111011111111111111111011111111111111111011011111
10110010010101001101000000000000000011000000000000000011000000000000000011011111
10110010010100100101011111111111111111011111111111111111011111111111111111011111
10110010100100010011000000000000000000000000000000001111000000000000000011011111
10110000100010010111111111111111111111111111111111111000011111111111111011011111
10111100100100010001000011111111111000000000000000000011111111111111111011011111
10000000000000000000000000000000000011011111111111111110100101001000101001011111
"""
maze = [list(row) for row in maze_str.strip().split('\n')]

# 调用迭代DFS和BFS
print("DFS路径:")
dfs_path = iterative_dfs(maze, 1, 1) # 起点为 (1, 1)
print("BFS路径:")
bfs_path = bfs(maze)

print(f"DFS最终路径: {dfs_path}")
print(f"BFS最终路径: {bfs_path}")
  • 得到最终路径
1
2
3
4
DFS最终路径: sddddddddddddddddssaaaaaaaaaaaaaaassdddddddddddddddssaaaaaaaaaaaaaaassdddddddddddddddsssdsdssddddddddddddddddssaaaaaaaaaaaaaaassdddddddddddddddssaaaaaaaaaaaaaaassdddddddddddddddsssdddwdddddddddddddddwwaaaaaaaaaaaaaaawwdddddddddddddddwwaaaaaaaaaaaaaaawwdddddddddddddddwwaaaaaaaaaaaaaaaawwddddddddddddddddwwwwaaaaaaaaaaaaaaawwdddddddddddddddwwaaaaaaaaaaaaaaawwddwdsddddwdsdddddddwwddddddddddddddddddssaaaaaaaaaaaaaaassdddddddddddddddssaaaaaaaaaaaaaaassdddddddddssssaaaaaaaaaassdddddddssaaaaaassddddddddddddssaaaaaaaaaaaassdddddddddddsssssaaaaaaaaaaaaaassaaaaaaaaaaaaaaassdddddddddddddddssaaaaaaaaaaaaaaassdddddddddddddddssssaaaaaaaaaaaaaaaassddddddddddddddddssaaaaaaaaaaaaaaassdddddddddddddddssaaaaaaaaaaaaaaassaaaaaaaaaaaaaaaaaawwdddddddddddddddwwaaaaaaaaaaaaaaawwdddddddddddddddwwaaaaaaaaaaaaaaaawwawawwwaaaaaaaaaaaaaawwddddddddddddddwwaaaaaaaaaaaaaawwddddddddddddddwwaaaaaaaaaaaaaaaasssssssssssssssssssssssssdddddwwdssddwwwdsssddwdwwdsssddwdsdddwdsdwdsddddddddddddwddddddddddddddddddwdddwwwdddddddddddddddwwaaaaaaaaaaaaaaawwddddddwwaaaaaaawwddddddddddddddssdddwwwawwwaaaaaaaaaaaaaaawwdddddddddddddddwwaaaaaaaaaaaaaaawwdddddddddddddddwwwwwwwwwwwwwwwwwwwwwdddssssssssssssssssssssssssssssssssssssssssssss
BFS最终路径: sddddddddddddddddssaaaaaaaaaaaaaaassdddddddddddddddssaaaaaaaaaaaaaaassdddddddddddddddsssdsdssddddddddddddddddssaaaaaaaaaaaaaaassdddddddddddddddssaaaaaaaaaaaaaaassdddddddddddddddsssdddwdddddddddddddddwwaaaaaaaaaaaaaaawwdddddddddddddddwwaaaaaaaaaaaaaaawwdddddddddddddddwwaaaaaaaaaaaaaaaawwddddddddddddddddwwwwaaaaaaaaaaaaaaawwdddddddddddddddwwaaaaaaaaaaaaaaawwdddddddddddddddwwddddddddddddddddddssaaaaaaaaaaaaaaassdddddddddddddddssaaaaaaaaaaaaaaassdddddddddssssaaaaaaaaaassdddddddssaaaaaassddddddddddddssaaaaaaaaaaaassdddddddddddsssssaaaaaaaaaaaaaassaaaaaaaaaaaaaaassdddddddddddddddssaaaaaaaaaaaaaaassdddddddddddddddssssaaaaaaaaaaaaaaaassddddddddddddddddssaaaaaaaaaaaaaaassdddddddddddddddssaaaaaaaaaaaaaaassaaaaaaaaaaaaaaaaaawwdddddddddddddddwwaaaaaaaaaaaaaaawwdddddddddddddddwwaaaaaaaaaaaaaaaawwawawwwaaaaaaaaaaaaaawwddddddddddddddwwaaaaaaaaaaaaaawwddddddddddddddwwaaaaaaaaaaaaaaaasssssssssssssssssssssssssddddddddddddddddddddddddddddddddddwddddddddddddddddddwdddwwwdddddddddddddddwwaaaaaaaaaaaaaaawwddddddwwaaaaaaawwddddddddddddddssdddwwwawwwaaaaaaaaaaaaaaawwdddddddddddddddwwaaaaaaaaaaaaaaawwdddddddddddddddwwwwwwwwwwwwwwwwwwwwwdddssssssssssssssssssssssssssssssssssssssssssss


  • 最后输入最终路径,得到flag,这里只有输入BFS最终路径才能得到flag

image-20241001094650144

moectf{the_18446744024826406994_amazing_maze!!}

PWN

二进制漏洞审计入门指北

  • 题目给了个入门指北,最好还是看一下

image-20240904113011026

  • 签到题,学会nc直接就送flag

image-20240904112505198

flag:moectf{Welcome_to_the_journey_of_Pwn}

NotEnoughTime

  • 题目:说是检测数学能力,其实是练习接收与发送,与靶机交互。

image-20240904114303972

  • 这题会发送一些数学四则运算的题目,算式均为 C 语言表达式,整数除法。还有时间限制

image-20240904114553199

  • 这种情况就需要使用Python脚本实现交互
    • 先将第一个和第二个固定的算式单独做一个接收和发送
    • 然后再接收一行字符串
    • 接下来使用Python的eval()函数,eval()函数执行其传递的参数内容,并返回结果
    • 对接收的算式先进行处理,比如将换行符去掉,将最后接收到的=号去掉
    • 最后使用eval()函数进行计算
    • 再将计算结果发送出去,进而实现自动化计算脚本
  • exp如下:
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
from pwn import *
context(log_level = 'debug')
p = remote("172.25.144.1",50357)
p.sendlineafter(b'1 + 1 = ',str(2).encode("utf-8"))
p.sendlineafter(b'4 / 3 - 1 = ',str(0).encode("utf-8"))
p.recvuntil(b'OK, then some tough ones. Be WELL PREPARED!')
while True:
a = p.recvuntil(b'=')
a = a.decode("utf-8")
b = ''
for i in a:
if i == '\n':
continue
if i == '=':
continue
if i == '/':
b += '//'
continue
b += i
print('b = ',b)
c = eval(b)
print(c)
p.send(str(int(c)).encode('utf-8'))
p.sendline(b'')
# 最后得到flag
# moectf{ar1tHMETiC-IS_NOT_M@th3mATIcs1d259bb}

no_more_gets

  • 题目:

image-20240904120653431

AI