通知文件：关于举办2020年度阜阳市网络与信息安全管理职业技能大赛的通知.pdf
理论题库：2020题库.xlsx

操作题

1.jpeg √

附件：1.jpeg.zip

010editor 打开，搜索 flag：flag{w9ii12y3jbdjh123}
image.png

crypto（base64换编码表）√

请解密这段密文：FqsCFkufDSQgSf4NSgWFGPvMP6FCHwg= 附件：

  1. 这是泄漏的一段明文：
  2. !QAZ@WSX#EDC$RFV%TGB^YHN&UJM*IK<(OL>)P:?_{"+}|`1qaz2wsx3edc4rfv5tgb6yhn7ujm8ik,9ol.0p;/-['=]\The problem is that programs_width is a list. programs_width = list(). If none of these if statements if prog_width == '342' When you read an English book, you often come across new words. You might try to guess what the words mean from the words you know, but when you cannot guess the meanings of new words at all, what should you do?
  3. 和对应的密文：
  4. 8P51AN1SOhXByOy39596PVPOyg9LAOCE9MP+IUr9UfaeIgan+P0xRhbc8VibZ60sJA5xQwKfL3WMF6QgJqFjWSywDBFzG6lkKAriE6My/3MpH2laJ3up/PuwRPhJP6CM871dHj9uFAgXGSQXK6CCK21aJqbwJq5iJhbkGAygG21rJd1C86srJkTo871dHjKdDAhfSkKrF7ye83gXH6MfK2Xr/V19FV1oHjzM86bq87yeFSWM86Mq87WgDSyMHAPoK7QXGADXJ79pFhbkGAygG20bRU0wQfTd9d1SG6Po87MpKU1dFA5N865o84PoFjsrJjXXDqbpGdaXLAbh86bqK6Po86WpHAOXDAWdHkWf86zMKd1kHk9NJdlXAAbh86hrFjCg87ydLU1gHd1wKAPfJd1kG65g87yeFU1kHk9NJd1iFA5o86FdHjgXK6CM87KpJqyf87MpKU1yHqbk/21VKSTXKjCMHV1zHkOXDj5oHqbg86KhFSWf87yeFU1iFA5oGAzwJd1pFV1oFSJXKjbdF7QXDSTXDAsu/21kG65g87WeHkPuF21zHkOXF6vm

编写程序求解：

  1. from mybase64 import *
  3. plain0 = """!QAZ@WSX#EDC$RFV%TGB^YHN&UJM*IK<(OL>)P:?_{"+}|`1qaz2wsx3edc4rfv5tgb6yhn7ujm8ik,9ol.0p;/-['=]\The problem is that programs_width is a list. programs_width = list(). If none of these if statements if prog_width == '342' When you read an English book, you often come across new words. You might try to guess what the words mean from the words you know, but when you cannot guess the meanings of new words at all, what should you do?"""
  4. cipher0 = """8P51AN1SOhXByOy39596PVPOyg9LAOCE9MP+IUr9UfaeIgan+P0xRhbc8VibZ60sJA5xQwKfL3WMF6QgJqFjWSywDBFzG6lkKAriE6My/3MpH2laJ3up/PuwRPhJP6CM871dHj9uFAgXGSQXK6CCK21aJqbwJq5iJhbkGAygG21rJd1C86srJkTo871dHjKdDAhfSkKrF7ye83gXH6MfK2Xr/V19FV1oHjzM86bq87yeFSWM86Mq87WgDSyMHAPoK7QXGADXJ79pFhbkGAygG20bRU0wQfTd9d1SG6Po87MpKU1dFA5N865o84PoFjsrJjXXDqbpGdaXLAbh86bqK6Po86WpHAOXDAWdHkWf86zMKd1kHk9NJdlXAAbh86hrFjCg87ydLU1gHd1wKAPfJd1kG65g87yeFU1kHk9NJd1iFA5o86FdHjgXK6CM87KpJqyf87MpKU1yHqbk/21VKSTXKjCMHV1zHkOXDj5oHqbg86KhFSWf87yeFU1iFA5oGAzwJd1pFV1oFSJXKjbdF7QXDSTXDAsu/21kG65g87WeHkPuF21zHkOXF6vm"""
  6. # 明文转为二进制串
  7. binstr = ""
  8. for i in plain0:
  9.     binstr += "{:08b}".format(ord(i))
  11. # 求新的编码表
  12. # 二进制串每 6 位对应一个密文字符
  13. new_alphabet = ['?'] * 64
  14. for i in range(len(binstr) // 6):
  15.     new_alphabet[int(binstr[i*6: i*6+6], 2)] = cipher0[i]
  17. # 用新的编码表解码
  18. bs64 = Base64(alphabet="".join(new_alphabet))
  19. print(bs64.base64decode("FqsCFkufDSQgSf4NSgWFGPvMP6FCHwg="))

flag{3as41$_CYi%Tfan}

key

黑客小A破解了一个邮箱，从邮箱里获取一个附件，名为e58cee651237c4b323b8ba88b96a1a1q flag格式：key{**} 附件：e58cee651237c4b323b8ba88b96a1a1q.zip

timu_841 √

NGY0ZTM0NTczNDM1NDI0NjQ3MzU0MjQ3NTk1NTQ0NDQ0YjM0MzQ1ODQxMzI0MzUwNDU1NTMzNTU0OTNkM2QzZA==

Base64解码：
4f4e34573435424647354247595544444b3434584132435045553355493d3d3d
Hex -> ASCII：
ON4W45BFG5BGYUDDK44XA2CPEU3UI===
Base32解码：
synt%7BlPcW9phO%7D
URL解码：
synt{lPcW9phO}
Rot13：
flag{yCpJ9cuB}

timu_519 √

59574a4b443250324353584754485941564d4154584559564235465356335144575758545645563d

Hex -> ASCII：
YWJKD2P2CSXGTHYAVMATXEYVB5FSV3QDWWXTVEV=
Rot13：
LJWXQ2C2PFKTGULNIZNGKRLIO5SFI3DQJJKGIRI=
Base32 解码：
ZmxhZyU3QmFZeEhwdTlpJTdE
Base64 解码：
flag%7BaYxHpu9i%7D
URL 解码：
flag{aYxHpu9i}

soeasy_re √

soeasy_re flag格式：flag{**} 附件：soeasy_re.zip

exeinfo 打开，64 bit elf，无壳
image.png
ida64 打开，发现关键代码

  1. unsigned __int64 __fastcall main(int a1, char **a2, char **a3)
  2. {
  3.   char buf[40]; // [rsp+0h] [rbp-30h] BYREF
  4.   unsigned __int64 v5; // [rsp+28h] [rbp-8h]
  6.   v5 = __readfsqword(0x28u);
  7.   read(0, buf, 0x26uLL);
  8.   if ( strlen(buf) != 38 )        // flag 长度为38
  9.   {
  10.     puts("error");
  11.     exit(0);
  12.   }
  13.   printf("input : %s\n", buf);
  14.   sub_4006F6(buf, aKakalll);    // 计算 flag
  15.   if ( !strcmp(buf, s2) )
  16.     printf("congratulation !");
  17.   return __readfsqword(0x28u) ^ v5;
  18. }
  1. size_t __fastcall sub_4006F6(const char *a1, const char *a2)
  2. {
  3.   char v2; // r13
  4.   size_t result; // rax
  5.   int i; // [rsp+1Ch] [rbp-24h]
  7.   for ( i = 0; ; ++i )
  8.   {
  9.     result = strlen(a1);
  10.     if ( i >= result )
  11.       break;
  12.     v2 = a1[i];
  13.     a1[i] = v2 ^ a2[i % strlen(a2)];    // buf[i] = buf[i] ^ aKakalll[i % len(aKakalll[i])]
  14.   }
  15.   return result;
  16. }
  1. .data:00000000006010A0 s2              db 0Dh,0Dh,0Ah          ; DATA XREF: main+83↑o
  2. .data:00000000006010A3                 db    6
  3. .data:00000000006010A4                 db  17h
  4. .data:00000000006010A5                 db  0Dh
  5. .data:00000000006010A6                 db  0Ah
  6. .data:00000000006010A7                 db  5Bh ; [
  7. .data:00000000006010A8                 db  59h ; Y
  8. .data:00000000006010A9                 db  5Ch ; \
  9. .data:00000000006010AA                 db    4
  10. .data:00000000006010AB                 db  5Eh ; ^
  11. .data:00000000006010AC                 db  0Fh
  12. .data:00000000006010AD                 db  5Eh ; ^
  13. .data:00000000006010AE                 db  5Ch ; \
  14. .data:00000000006010AF                 db    7
  15. .data:00000000006010B0                 db  5Eh ; ^
  16. .data:00000000006010B1                 db    2
  17. .data:00000000006010B2                 db  5Dh ; ]
  18. .data:00000000006010B3                 db  5Dh ; ]
  19. .data:00000000006010B4                 db  55h ; U
  20. .data:00000000006010B5                 db  0Fh
  21. .data:00000000006010B6                 db  53h ; S
  22. .data:00000000006010B7                 db  0Fh
  23. .data:00000000006010B8                 db    5
  24. .data:00000000006010B9                 db  5Ah ; Z
  25. .data:00000000006010BA                 db  0Dh
  26. .data:00000000006010BB                 db  5Ah ; Z
  27. .data:00000000006010BC                 db  0Ah
  28. .data:00000000006010BD                 db  59h ; Y
  29. .data:00000000006010BE                 db  59h ; Y
  30. .data:00000000006010BF                 db  52h ; R
  31. .data:00000000006010C0                 db  5Bh ; [
  32. .data:00000000006010C1                 db  5Ch ; \
  33. .data:00000000006010C2                 db    8
  34. .data:00000000006010C3                 db  0Fh
  35. .data:00000000006010C4                 db  56h ; V
  36. .data:00000000006010C5                 db  16h
  37. .data:00000000006010C5 _data           ends

编写程序求 flag：

  1. buf = [0x0D, 0x0D, 0x0A, 6, 0x17, 0x0D, 0x0A, 0x5B, 0x59, 0x5C, 4, 0x5E, 0x0F, 0x5E, 0x5C, 7, 0x5E, 2, 0x5D, 0x5D, 0x55, 0x0F, 0x53, 0x0F, 5, 0x5A, 0x0D, 0x5A, 0x0A, 0x59, 0x59, 0x52, 0x5B, 0x5C, 8, 0x0F, 0x56, 0x16]
  2. aKakalll = 'kakalll'    # len(aKakalll[i]): 7
  4. for i in range(38):
  5.     print(chr(buf[i] ^ ord(aKakalll[i % 7])), end='')

flag{af087e2c27f5c119d2dd6a6a82370dd7}

re02

re02 flag格式：flag{**} 附件：re02.zip

exeinfo 打开，64bit elf

ida64 打开，发现关键代码：

  1. __int64 sub_400BD0()
  2. {
  3.   int v0; // edx
  4.   int v1; // ecx
  5.   int v2; // er8
  6.   int v3; // er9
  7.   unsigned __int64 v4; // rsi
  8.   int v5; // edx
  9.   int v6; // ecx
  10.   int v7; // er8
  11.   int v8; // er9
  12.   int v9; // edx
  13.   int v10; // er8
  14.   int v11; // er9
  15.   int v12; // ecx
  16.   int v13; // eax
  17.   int v14; // eax
  18.   bool v15; // zf
  19.   int v16; // eax
  20.   int v17; // eax
  21.   int i; // [rsp+9Ch] [rbp-B4h]
  22.   char v20[32]; // [rsp+A0h] [rbp-B0h] BYREF
  23.   char v21[28]; // [rsp+C0h] [rbp-90h] BYREF
  24.   int v22; // [rsp+DCh] [rbp-74h]
  25.   char v23[48]; // [rsp+E0h] [rbp-70h] BYREF
  26.   char v24[16]; // [rsp+110h] [rbp-40h] BYREF
  27.   __int64 v25; // [rsp+120h] [rbp-30h] BYREF
  28.   unsigned int v26; // [rsp+13Ch] [rbp-14h]
  29.   __int64 v27; // [rsp+140h] [rbp-10h]
  31.   v26 = 0;
  32.   sub_400320(v24, 0LL);
  33.   sub_400320(v23, 0LL);
  34.   v4 = (unsigned __int64)v24;
  35.   sub_40F940((unsigned int)"input your flag\n", 0, v0, v1, v2, v3);
  36.   sub_40FA70((unsigned int)"%s", (unsigned int)v24, v5, v6, v7, v8);
  37.   v27 = sub_423F00(v24);
  38.   for ( i = -1606510600; ; i = v14 )
  39.   {
  40.     while ( 1 )
  41.     {
  42.       while ( 1 )
  43.       {
  44.         while ( 1 )
  45.         {
  46.           while ( 1 )
  47.           {
  48.             while ( 1 )
  49.             {
  50.               while ( 1 )
  51.               {
  52.                 while ( 1 )
  53.                 {
  54.                   while ( 1 )
  55.                   {
  56.                     v12 = i + 2131024272;
  57.                     if ( i != -2131024272 )
  58.                       break;
  59.                     v22 = 0;
  60.                     i = 1479129251;
  61.                   }
  62.                   if ( i != -1999545321 )
  63.                     break;
  64.                   v4 = (unsigned int)&unk_4A1800;
  65.                   v15 = (unsigned int)sub_400330(v20, v4) == 0;
  66.                   v17 = 787574043;
  67.                   if ( !v15 )
  68.                     v17 = 1098311993;
  69.                   i = v17;
  70.                 }
  71.                 if ( i != -1994519983 )
  72.                   break;
  73.                 v9 = byte_4A17B0[v22];
  74.                 LOBYTE(v4) = byte_4A17B0[v22] ^ v24[v22];
  75.                 v23[v22] = v4;
  76.                 i = -1452531375;
  77.               }
  78.               if ( i != -1606510600 )
  79.                 break;
  80.               v13 = -2131024272;
  81.               v9 = v27;
  82.               if ( v27 != 32 )
  83.                 v13 = -1484903926;
  84.               i = v13;
  85.             }
  86.             if ( i == -1484903926 )
  87.             {
  88.               sub_40F940((unsigned int)"size error", v4, v9, v12, v10, v11);
  89.               sub_40F030(0LL);
  90.             }
  91.             if ( i != -1477025740 )
  92.               break;
  93.             sub_400320(v21, 0LL);
  94.             sub_400320(v20, 0LL);
  95.             sub_400980(&v25, v21);
  96.             sub_400A90(v21, v20);
  97.             v4 = (unsigned int)&unk_4A17E0;
  98.             v15 = (unsigned int)sub_400330(v23, v4) == 0;
  99.             v16 = -1999545321;
  100.             if ( !v15 )
  101.               v16 = 1098311993;
  102.             i = v16;
  103.           }
  104.           if ( i != -1452531375 )
  105.             break;
  106.           ++v22;
  107.           i = 1479129251;
  108.         }
  109.         if ( i != 787574043 )
  110.           break;
  111.         i = 1981717114;
  112.         sub_40F940((unsigned int)"success\n", v4, v9, v12, v10, v11);
  113.       }
  114.       if ( i != 1098311993 )
  115.         break;
  116.       i = 1981717114;
  117.       sub_40F940((unsigned int)"wrong\n", v4, v9, v12, v10, v11);
  118.     }
  119.     if ( i != 1479129251 )
  120.       break;
  121.     v14 = -1477025740;
  122.     if ( v22 < 16 )
  123.       v14 = -1994519983;
  124.   }
  125.   return v26;
  126. }

1.exe √

flag格式：KEY{**} 附件：1.exe.zip

IDA 打开，得到伪代码

  1. int __cdecl main_0(int argc, const char **argv, const char **envp)
  2. {
  3.   int v4; // [esp+0h] [ebp-1A0h]
  4.   const char **v5; // [esp+4h] [ebp-19Ch]
  5.   const char **v6; // [esp+8h] [ebp-198h]
  6.   char v7; // [esp+Ch] [ebp-194h]
  7.   int i; // [esp+D4h] [ebp-CCh]
  8.   int v9; // [esp+E0h] [ebp-C0h]
  9.   int v10[24]; // [esp+ECh] [ebp-B4h]
  10.   char v11; // [esp+14Fh] [ebp-51h]
  11.   char v12[36]; // [esp+178h] [ebp-28h]
  13.   v11 = 0;
  14.   v10[0] = 1;
  15.   v10[1] = 4;
  16.   v10[2] = 14;
  17.   v10[3] = 10;
  18.   v10[4] = 5;
  19.   v10[5] = 36;
  20.   v10[6] = 23;
  21.   v10[7] = 42;
  22.   v10[8] = 13;
  23.   v10[9] = 19;
  24.   v10[10] = 28;
  25.   v10[11] = 13;
  26.   v10[12] = 27;
  27.   v10[13] = 39;
  28.   v10[14] = 48;
  29.   v10[15] = 41;
  30.   v10[16] = 42;
  31.   v10[17] = 26;
  32.   v10[18] = 20;
  33.   v10[19] = 59;
  34.   v10[20] = 4;
  35.   v10[21] = 0;
  36.   printf("plz enter the flag:");
  37.   while ( 1 )
  38.   {
  39.     v7 = getch();
  40.     v12[v11] = v7;
  41.     if ( !v7 || v12[v11] == 13 )
  42.       break;
  43.     if ( v12[v11] == 8 )
  44.     {
  45.       printf("\b\b");
  46.       --v11;
  47.     }
  48.     else
  49.     {
  50.       printf("%c", v12[v11++]);
  51.     }
  52.   }
  53.   v9 = 0;
  54.   for ( i = 0; i < 17; ++i )
  55.   {
  56.     if ( v12[i] != byte_415768[v10[i]] )
  57.       v9 = 1;
  58.   }
  59.   if ( v12[17] != 49 || v12[18] != 48 || v12[19] != 50 || v12[20] != 52 || v12[21] != 125 )
  60.     v9 = 1;
  61.   v12[v11] = 0;
  62.   printf("\r\n");
  63.   if ( v9 )
  64.   {
  65.     printf("u r wrong\r\n\r\n");
  66.     main(v4, v5, v6);
  67.   }
  68.   else
  69.   {
  70.     printf("u r right!\r\n");
  71.   }
  72.   system("pause");
  73.   return 0;
  74. }

编写程序求 flag：
KEY{e2s6ry3r5s8f61024}

rere √

flag格式：flag{**} 附件：rere.zip

拖到 exeinfo 发现是 .net 程序并且有 ConfuserEx 壳
image.png
使用 UnConfuserEx 脱壳
image.png
使用 .NET Reflector 反编译，得到 Program.cs

  1. namespace NET2
  2. {
  3.     using System;
  4.     using System.Linq;
  5.     using System.Text;
  7.     internal class Program
  8.     {
  9.         private static byte[] res1 = new byte[] { 
  10.             0x80, 0x30, 0x98, 0x79, 0x7d, 0xaf, 180, 0xb3, 170, 0xb5, 0x79, 0x19, 0x43, 0xda, 0xcf, 0x61,
  11.             0x26, 0x37, 0xcb, 13, 0x4c, 0x2e, 0xa9, 0x6f, 0x3a, 0x1d, 0xea, 0xed, 0xa8, 0x8f, 0x1b, 0x42,
  12.             0x24, 0xa2, 0x5b, 0x39, 0xec, 0xa7
  13.         };
  15.         public static string ByteToHex(byte[] vByte)
  16.         {
  17.             if ((vByte == null) || (vByte.Length < 1))
  18.             {
  19.                 return null;
  20.             }
  21.             StringBuilder builder = new StringBuilder(vByte.Length * 2);
  22.             for (int i = 0; i < vByte.Length; i++)
  23.             {
  24.                 uint num2 = (uint) (vByte[i] / 0x10);
  25.                 builder.Append((char) (num2 + ((num2 > 9) ? ((long) 0x37) : ((long) 0x30))));
  26.                 num2 = (uint) (vByte[i] % 0x10);
  27.                 builder.Append((char) (num2 + ((num2 > 9) ? ((long) 0x37) : ((long) 0x30))));
  28.             }
  29.             return builder.ToString();
  30.         }
  32.         private static byte[] Encrypt(byte[] data, byte[] key)
  33.         {
  34.             if (data == null)
  35.             {
  36.                 return null;
  37.             }
  38.             byte[] buffer = new byte[data.Length];
  39.             long num = 0L;
  40.             long num2 = 0L;
  41.             byte[] buffer2 = GetKey(key, 0x100);
  42.             for (long i = 0L; i < data.Length; i += 1L)
  43.             {
  44.                 num = (num + 1L) % ((long) buffer2.Length);
  45.                 num2 = (num2 + buffer2[(int) ((IntPtr) num)]) % ((long) buffer2.Length);
  46.                 byte num4 = buffer2[(int) ((IntPtr) num)];
  47.                 buffer2[(int) ((IntPtr) num)] = buffer2[(int) ((IntPtr) num2)];
  48.                 buffer2[(int) ((IntPtr) num2)] = num4;
  49.                 byte num5 = data[(int) ((IntPtr) i)];
  50.                 byte num6 = buffer2[(buffer2[(int) ((IntPtr) num)] + buffer2[(int) ((IntPtr) num2)]) % buffer2.Length];
  51.                 buffer[(int) ((IntPtr) i)] = (byte) (num5 ^ num6);
  52.             }
  53.             return buffer;
  54.         }
  56.         private static byte[] GetKey(byte[] pass, int kLen)
  57.         {
  58.             byte[] buffer = new byte[kLen];
  59.             for (long i = 0L; i < kLen; i += 1L)
  60.             {
  61.                 buffer[(int) ((IntPtr) i)] = (byte) i;
  62.             }
  63.             long num = 0L;
  64.             for (long j = 0L; j < kLen; j += 1L)
  65.             {
  66.                 num = ((num + buffer[(int) ((IntPtr) j)]) + pass[(int) ((IntPtr) (j % ((long) pass.Length)))]) % ((long) kLen);
  67.                 byte num4 = buffer[(int) ((IntPtr) j)];
  68.                 buffer[(int) ((IntPtr) j)] = buffer[(int) ((IntPtr) num)];
  69.                 buffer[(int) ((IntPtr) num)] = num4;
  70.             }
  71.             return buffer;
  72.         }
  74.         public static byte[] HexToByte(string szHex)
  75.         {
  76.             int length = szHex.Length;
  77.             if ((length <= 0) || ((length % 2) != 0))
  78.             {
  79.                 return null;
  80.             }
  81.             int num2 = length / 2;
  82.             byte[] buffer = new byte[num2];
  83.             for (int i = 0; i < num2; i++)
  84.             {
  85.                 uint num3 = (uint) (szHex[i * 2] - ((szHex[i * 2] >= 'A') ? '7' : '0'));
  86.                 if (num3 >= 0x10)
  87.                 {
  88.                     return null;
  89.                 }
  90.                 uint num4 = (uint) (szHex[(i * 2) + 1] - ((szHex[(i * 2) + 1] >= 'A') ? '7' : '0'));
  91.                 if (num4 >= 0x10)
  92.                 {
  93.                     return null;
  94.                 }
  95.                 buffer[i] = (byte) ((num3 * 0x10) + num4);
  96.             }
  97.             return buffer;
  98.         }
  100.         private static void Main(string[] args)
  101.         {
  102.             byte[] key = new byte[] { 0x41, 0x42, 0x43, 0x44, 0x45, 70 };
  103.             Console.WriteLine("You know flag:");
  104.             if (Encrypt(str2ASCII(Console.ReadLine()), key).SequenceEqual<byte>(res1))
  105.             {
  106.                 Console.WriteLine("You are right");
  107.             }
  108.             else
  109.             {
  110.                 Console.WriteLine("You are wrong");
  111.             }
  112.         }
  114.         public static byte[] str2ASCII(string xmlStr) => 
  115.             Encoding.Default.GetBytes(xmlStr);
  116.     }
  117. }

修改程序求 flag：

  1. namespace NET2
  2. {
  3.     using System;
  4.     using System.Linq;
  5.     using System.Text;
  7.     internal class Program
  8.     {
  9.         private static byte[] res1 = new byte[] {
  10.             0x80, 0x30, 0x98, 0x79, 0x7d, 0xaf, 180, 0xb3, 170, 0xb5, 0x79, 0x19, 0x43, 0xda, 0xcf, 0x61,
  11.             0x26, 0x37, 0xcb, 13, 0x4c, 0x2e, 0xa9, 0x6f, 0x3a, 0x1d, 0xea, 0xed, 0xa8, 0x8f, 0x1b, 0x42,
  12.             0x24, 0xa2, 0x5b, 0x39, 0xec, 0xa7
  13.         };
  15.         private static void Decrypt(byte[] key)
  16.         {
  17.             //byte[] buffer = new byte[data.Length];
  18.             long num = 0L;
  19.             long num2 = 0L;
  20.             byte[] buffer2 = GetKey(key, 0x100);
  21.             for (long i = 0L; i < res1.Length; i += 1L)
  22.             {
  23.                 num = (num + 1L) % ((long)buffer2.Length);
  24.                 num2 = (num2 + buffer2[(int)((IntPtr)num)]) % ((long)buffer2.Length);
  25.                 byte num4 = buffer2[(int)((IntPtr)num)];
  26.                 buffer2[(int)((IntPtr)num)] = buffer2[(int)((IntPtr)num2)];
  27.                 buffer2[(int)((IntPtr)num2)] = num4;
  28.                 //byte num5 = data[(int)((IntPtr)i)];
  29.                 byte num6 = buffer2[(buffer2[(int)((IntPtr)num)] + buffer2[(int)((IntPtr)num2)]) % buffer2.Length];
  30.                 //buffer[(int)((IntPtr)i)] = (byte)(num5 ^ num6);
  31.                 for(int j = 32; j < 127; j++)
  32.                 {
  33.                     byte num5 = (byte)j;
  34.                     if((byte)(num5 ^ num6) == res1[(int)((IntPtr)i)])
  35.                     {
  36.                         Console.Write((char)j);
  37.                         break;
  38.                     }
  39.                 }
  40.             }
  41.         }
  43.         private static byte[] GetKey(byte[] pass, int kLen)
  44.         {
  45.             byte[] buffer = new byte[kLen];
  46.             for (long i = 0L; i < kLen; i += 1L)
  47.             {
  48.                 buffer[(int)((IntPtr)i)] = (byte)i;
  49.             }
  50.             long num = 0L;
  51.             for (long j = 0L; j < kLen; j += 1L)
  52.             {
  53.                 num = ((num + buffer[(int)((IntPtr)j)]) + pass[(int)((IntPtr)(j % ((long)pass.Length)))]) % ((long)kLen);
  54.                 byte num4 = buffer[(int)((IntPtr)j)];
  55.                 buffer[(int)((IntPtr)j)] = buffer[(int)((IntPtr)num)];
  56.                 buffer[(int)((IntPtr)num)] = num4;
  57.             }
  58.             return buffer;
  59.         }
  61.         private static void Main(string[] args)
  62.         {
  63.             byte[] key = new byte[] { 0x41, 0x42, 0x43, 0x44, 0x45, 70 };
  64.             Decrypt(key);
  65.         }
  66.     }
  67. }

flag{e484df0963c115a93042388333847726}

timu_837 √

NWE0ZDRhNTQ1MDRkMzMzMzU3NDEzNDUxNTY0NTQ1NGQ1NDU3NTU0OTUyMzc1NjI1MzM1MQ==

Base64解码：
5a4d4a54504d3333574134515645454d54575549523756253351
Hex -> ASCII：
ZMJTPM33WA4QVEEMTWUIR7V%3Q
Rot13：
MZWGCZ33JN4DIRRZGJHVE7I%3D
URL解码：
MZWGCZ33JN4DIRRZGJHVE7I=
Base32解码：
flag{Kx4F92OR}

单选题

  1. 下面对于SSE-CMM保证过程的说法错误的是（D）
  2. A. 保证是指安全需求得到满足的可信任程度
  3. B. 信任程度来自于对安全工程过程结果质量的判断
  4. C. 自验证与证实安全的主要手段包括观察、论证、分析和测试
  5. D. PA“建立保证论据”为PA“验证与证实安全"提供了证据支持
  1. 在业务持续性计划中,RTO指的是什么?(C)
  2. A.灾难备份和恢复
  3. B.恢复技术项目
  4. C.业务恢复时间目标
  5. D.业务恢复点目标
  1. 信息网络安全(风险)评估的方法(B)
  2. A.定量评估
  3. B.定性评估与定量评估相结合
  4. C.定点评估
  5. D.定性评估
  1. 在原告起诉被告抢注域名案件中，以下不能判定被告对其域名的注册、使用具有恶意的是（D）
  2. A.为商业目的将他人驰名商标注册为域名的
  3. B.为商业目的注册与原告的域名近似的域名，故意造成与原告网站的混淆，误导网络用户访问其网站的
  4. C.曾要约高价出售其域名获取不正当利益的
  5. D.注册域名后自己准备使用的
  1. 以下哪一个是对人员安全管理中“授权蔓延”这概念的正确理解？（B）
  2. A.外来人员在进行系统维护时没有收到足够的监控
  3. B.一个人拥有了不是其完成工作所必要的权限
  4. C.敏感岗位和重要操作长期有一个人独自负责
  5. D.员工由一个岗位变动到另一人岗位，累积越来越多权限
  1. 关于加密算法的应用范围，说话正确的有（A）。
  2. A.DSS用于数字签名，RSA用于加密和签名
  3. B.DSS用于密钥交换，IDEA用于加密和签名
  4. C.DSS用于数字签名，MD5用于加密和签名
  5. D.DSS用于加密和签名，MD5用于完整性效验