某次线下ctf比赛的复现

记某次线下ctf比赛， 选择题 200 分，ctf ： 10题

1 看不见的flag

杂项

打开发现是一个 打不开的 png 格式图片

参考PNG文件格式

使用winhex打开，对照

文件头不对，而且没有宽度

百度搜索 爆破图片宽高

有代码，直接抄

import zlib
import struct

filename = 'misc4.png'
with open(filename, 'rb') as f:
    all_b = f.read()
    crc32key = int(all_b[29:33].hex(),16)
    data = bytearray(all_b[12:29])
    n = 4095            #理论上0xffffffff,但考虑到屏幕实际/cpu，0x0fff就差不多了
    for w in range(n):          #高和宽一起爆破
        width = bytearray(struct.pack('>i', w))     #q为8字节，i为4字节，h为2字节
        for h in range(n):
            height = bytearray(struct.pack('>i', h))
            for x in range(4):
                data[x+4] = width[x]
                data[x+8] = height[x]
            crc32result = zlib.crc32(data)
            if crc32result == crc32key:
                print("宽为：",end="")
                print(width)
                print("高为：",end="")
                print(height)
                exit(0)

拿到宽高

修改

打开图片

getflag

flag{Png_is_v3ry_fu0ny!}

2 easystega

一张图片

记事本打开

getflag

flag{w9ii12y3jbdjh123}

3 word文件本质

word 是一个压缩包文件，这是我偶然间发现的

所以直接用压缩包文件打开

Flag.xml

getflag

KEY{y0u_ar3_rirght}

4 badimage

我以为是一个坏的图片，然后发现我做不了，直接用 记事本打开搜索，居然找到了

getflag

Flag{yc4pl0fvjs2k1t7T}

Flag f改成小写提交

5 ctrypto3

给了一个 c 代码和 一个 被加密的文件

然后看不懂代码， 太难了

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <time.h>

#define KEY_SIZE 32
#define BUFF_SIZE 1024

unsigned int holdrand = 0;

static void Srand (unsigned int seed) {
  holdrand = seed;
}

static int Rand (void) {
  return(((holdrand = holdrand * 214013L + 2531011L) >> 16) & 0x7fff);
}

char* genere_key(void) {
  int i;
  static char key[KEY_SIZE+1];
  const char charset[] = 
    "abcdefghijklmnopqrstuvwxyz"
    "ABCDEFGHIJKLMNOPQRSTUVWXYZ"
    "123456789";
  
  for(i = 0; i < KEY_SIZE; i++) {
    key[i] = charset[Rand() % (sizeof(charset) - 1)];
  }
  key[KEY_SIZE] = '';

  return key;
}

void crypt_buffer(unsigned char *buffer, size_t size, char *key) {
  size_t i;
  int j;

  j = 0;
  for(i = 0; i < size; i++) {
    if(j >= KEY_SIZE)
      j = 0;
    buffer[i] ^= key[j];
    j++;
  }
}

void crypt_file(FILE *in, FILE *out) {
  unsigned char buffer[BUFF_SIZE];
  char *key;
  size_t size;

  key = genere_key();

  printf("[+] Using key : %s
", key);

  do {
    size = fread(buffer, 1, BUFF_SIZE, in);
    crypt_buffer(buffer, size, key);
    fwrite(buffer, 1, size, out);

  }while(size == BUFF_SIZE);  
}

int main(int argc, char **argv) {
  char path[128];
  FILE *in, *out;

  Srand(time(NULL));

  if(argc != 2) {
    printf("[-] Usage : %s <file>
", argv[0]);
    return EXIT_FAILURE;
  }

  snprintf(path, sizeof(path)-1, "%s.crypt", argv[1]);

  if((in = fopen(argv[1], "r")) == NULL) {
    perror("[-] fopen (in) ");
    return EXIT_FAILURE;
  }

  if((out = fopen(path, "w")) == NULL) {
    perror("[-] fopen (out) ");
    return EXIT_FAILURE;
  }

  crypt_file(in, out);

  printf("[+] File %s crypted !
", path);
  printf("[+] DONE.
");
  return EXIT_SUCCESS;
}

不会， 真香

6 simpleCrypto.txt

给了一个文本文档

题目： simpleCrypto
内容： hex((m>>388)<<388)=0xb3ed7763ea4f8a9e444093c1922f32a30d9e9502e566a8cefb3416905afecb5c57d3a065f41a4f193d968ea095dd56568e59cf599c35c61252f78f46e300da8dc696fa16d428a8fa71a8d64bb5a2659a11d43e74edcb7a95a7fd27d46004b7e5e45fada0aadf82b30749d1037ff73435e1a8058162e83a75da40fb793f7cad2c36ab12c66751ca205e97c52893d37bbb8e7077467befdbeb21aea590bffc83f4571edec7e6a5660e7dbdb2bbfa2b9a57633c3f2b54fc459da95f0ee402cd51746491af316a54da12b5e8693566034ac0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 
n = 0x00bef498e6eb2cffe71312da47ab89d2c47db7438ea2cfa992ddddbc2a01978001fc51e286e6ebf028396cdb8b3323c60e6b9d50cd84187cf7f48e3875a2f0890f70b02333ad89db2923863ce146562286f63fb0a1d0198e3a6862ba5ac12e85a5c6d0d27cb1c81bdf69cc5bc95b8001a2f744517f9437b4ddd5a076fc0e9a5de1a7a268c40f31aa29e8dc27c0b3a182299ca7a9335b4bd4585452f6107c238e486c98dd73a5f9862e9e80b152f53381c72f897107551c281259ac3ee32c4b4f46cc03127d1bf699acd0266f3c6729253c70da0c69b1560fa172735709866b375b6eba294e1ce8b46fba798ba380080b4bf9603998cac199d9cd46e30ae8da9e7f 
e = 3 
c = 0xb5db85220ca60232ea1bb2be0e11c72299bb16db26be7287e5859e7935fb7536327de36e691003a26002187f887d8ca6e0f537b78848179e9be0d61f0759e7ac3e69281ded720bef58b1c88d63bc937ffe13f2bb92ec3f037b2e889bce7012b3fba323d7b279ed253b98426ac3b5ed2db45dc4f9a7da25c2cbca4226e8f3eeaad7a7a7320c8a04b157df59611f91fff37d525b7505ca3f36ad206c147ed707c43275115c5fe90de6cf0e63cff74bab7756fc411d355ff9560934d13a51c6f94f69f7c765650dba182d7f59154f55cc59d488382f6a837bd91165f15196b0f34e3344a0a6d911dc3c140e139e5c19a6d60c9290a653e7698f3f32ab65f0b4cebL 
flag = 'flag{' + '{:x}'.format(m)[-32:]) +'}'
答案：

看到 e n c 就想到了rsa

公式： 明文的 e 次方 mod n = 密文 其中 明文 为 c 密文 为 m

Python 3.8.2 (tags/v3.8.2:7b3ab59, Feb 25 2020, 22:45:29) [MSC v.1916 32 bit (Intel)] on win32
Type "help", "copyright", "credits" or "license" for more information.
>>> pow(0xb5db85220ca60232ea1bb2be0e11c72299bb16db26be7287e5859e7935fb7536327de36e691003a26002187f887d8ca6e0f537b78848179e9be0d61f0759e7ac3e69281ded720bef58b1c88d63bc937ffe13f2bb92ec3f037b2e889bce7012b3fba323d7b279ed253b98426ac3b5ed2db45dc4f9a7da25c2cbca4226e8f3eeaad7a7a7320c8a04b157df59611f91fff37d525b7505ca3f36ad206c147ed707c43275115c5fe90de6cf0e63cff74bab7756fc411d355ff9560934d13a51c6f94f69f7c765650dba182d7f59154f55cc59d488382f6a837bd91165f15196b0f34e3344a0a6d911dc3c140e139e5c19a6d60c9290a653e7698f3f32ab65f0b4ceb,3,0x00bef498e6eb2cffe71312da47ab89d2c47db7438ea2cfa992ddddbc2a01978001fc51e286e6ebf028396cdb8b3323c60e6b9d50cd84187cf7f48e3875a2f0890f70b02333ad89db2923863ce146562286f63fb0a1d0198e3a6862ba5ac12e85a5c6d0d27cb1c81bdf69cc5bc95b8001a2f744517f9437b4ddd5a076fc0e9a5de1a7a268c40f31aa29e8dc27c0b3a182299ca7a9335b4bd4585452f6107c238e486c98dd73a5f9862e9e80b152f53381c72f897107551c281259ac3ee32c4b4f46cc03127d1bf699acd0266f3c6729253c70da0c69b1560fa172735709866b375b6eba294e1ce8b46fba798ba380080b4bf9603998cac199d9cd46e30ae8da9e7f)
7406108333883632516051063752111789984154984930641427553981380244547450820051773301792389579469673373362498329375384681440308795656648744450232119646664660297470893609220029468620254254671843923124934865834774872081624967427326430321922950462560016438259307948251629231743016043501549033390045737706464978710758904505921393113501263275227911831203150115827599841065645911731914832302543083858701660599999859538441624317718514551520251681459789704667123340970505979933790578130998816228540057021749166534686762246975789297184363266145559393290310601293902027361894904885252202104472659879820448038445659352692228374514
>>> hex(7406108333883632516051063752111789984154984930641427553981380244547450820051773301792389579469673373362498329375384681440308795656648744450232119646664660297470893609220029468620254254671843923124934865834774872081624967427326430321922950462560016438259307948251629231743016043501549033390045737706464978710758904505921393113501263275227911831203150115827599841065645911731914832302543083858701660599999859538441624317718514551520251681459789704667123340970505979933790578130998816228540057021749166534686762246975789297184363266145559393290310601293902027361894904885252202104472659879820448038445659352692228374514)
'0x3aaaed003a3bcc51ad231b263565a6bdf1c295295dc81e1112770541a996e2b64bed3f4f95e660d9609d8f9013c5a48d33bb59a41c14b3a9d04cd163436723a38087717cf257f012ace84ddfd270098ebe56819c3e5f6a886ab35f6d8f0b7fa1b118d0f2814bef0c70f7318b6bd6d6c56d5dd517e548715c388e7a047cd9135568fc63082511588847d48caf8f9fa1585b0875eb9135a39d4509ccf8331ced5800c54ede867155f187acfad12305acedea9271d512bd4e80c3bea256b9cfd71ec48317145f414d116acec095442ce97dc6d374b1f9ab18e910295a70b7cb8327d27b3f16d1295bdb10adca9a4a580f6f2575de653cbec1fb5cc055f15e8c3ff2'
>>> m =  pow(0xb5db85220ca60232ea1bb2be0e11c72299bb16db26be7287e5859e7935fb7536327de36e691003a26002187f887d8ca6e0f537b78848179e9be0d61f0759e7ac3e69281ded720bef58b1c88d63bc937ffe13f2bb92ec3f037b2e889bce7012b3fba323d7b279ed253b98426ac3b5ed2db45dc4f9a7da25c2cbca4226e8f3eeaad7a7a7320c8a04b157df59611f91fff37d525b7505ca3f36ad206c147ed707c43275115c5fe90de6cf0e63cff74bab7756fc411d355ff9560934d13a51c6f94f69f7c765650dba182d7f59154f55cc59d488382f6a837bd91165f15196b0f34e3344a0a6d911dc3c140e139e5c19a6d60c9290a653e7698f3f32ab65f0b4ceb,3,0x00bef498e6eb2cffe71312da47ab89d2c47db7438ea2cfa992ddddbc2a01978001fc51e286e6ebf028396cdb8b3323c60e6b9d50cd84187cf7f48e3875a2f0890f70b02333ad89db2923863ce146562286f63fb0a1d0198e3a6862ba5ac12e85a5c6d0d27cb1c81bdf69cc5bc95b8001a2f744517f9437b4ddd5a076fc0e9a5de1a7a268c40f31aa29e8dc27c0b3a182299ca7a9335b4bd4585452f6107c238e486c98dd73a5f9862e9e80b152f53381c72f897107551c281259ac3ee32c4b4f46cc03127d1bf699acd0266f3c6729253c70da0c69b1560fa172735709866b375b6eba294e1ce8b46fba798ba380080b4bf9603998cac199d9cd46e30ae8da9e7f)
>>> m
7406108333883632516051063752111789984154984930641427553981380244547450820051773301792389579469673373362498329375384681440308795656648744450232119646664660297470893609220029468620254254671843923124934865834774872081624967427326430321922950462560016438259307948251629231743016043501549033390045737706464978710758904505921393113501263275227911831203150115827599841065645911731914832302543083858701660599999859538441624317718514551520251681459789704667123340970505979933790578130998816228540057021749166534686762246975789297184363266145559393290310601293902027361894904885252202104472659879820448038445659352692228374514
>>> hex(m)
'0x3aaaed003a3bcc51ad231b263565a6bdf1c295295dc81e1112770541a996e2b64bed3f4f95e660d9609d8f9013c5a48d33bb59a41c14b3a9d04cd163436723a38087717cf257f012ace84ddfd270098ebe56819c3e5f6a886ab35f6d8f0b7fa1b118d0f2814bef0c70f7318b6bd6d6c56d5dd517e548715c388e7a047cd9135568fc63082511588847d48caf8f9fa1585b0875eb9135a39d4509ccf8331ced5800c54ede867155f187acfad12305acedea9271d512bd4e80c3bea256b9cfd71ec48317145f414d116acec095442ce97dc6d374b1f9ab18e910295a70b7cb8327d27b3f16d1295bdb10adca9a4a580f6f2575de653cbec1fb5cc055f15e8c3ff2'
>>> ((m>>388)<<388)
7406108333883632516051063752111789984154984930641427553981380244547450820051773301792389579469673373362498329375384681440308795656648744450232119646664660297470893609220029468620254254671843923124934865834774872081624967427326430321922950462560016438259307948251629231743016043501549033390045737706464978710758904505921393113501263275227911831203150115827599841065645911731914832302543083858701660599999859538441624317718514551520251681459789704667123340970505979933790578130998816228540057021749165991858559586488877314454455977962226782614546937841712528590853996022182534961217637873074607263356196944597720498176
>>> hex((m>>388)<<388)
'0x3aaaed003a3bcc51ad231b263565a6bdf1c295295dc81e1112770541a996e2b64bed3f4f95e660d9609d8f9013c5a48d33bb59a41c14b3a9d04cd163436723a38087717cf257f012ace84ddfd270098ebe56819c3e5f6a886ab35f6d8f0b7fa1b118d0f2814bef0c70f7318b6bd6d6c56d5dd517e548715c388e7a047cd9135568fc63082511588847d48caf8f9fa1585b0875eb9135a39d4509ccf8331ced5800c54ede867155f187acfad12305acedea9271d512bd4e80c3bea256b9cfd71ec48317145f414d116acec095442ce970000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000'

控制台测试了一下，发现不对，然后看到了 c 里面有一个 l ,盲猜最后一位需要跑出来

脚本

#coding = utf-8

n = 0x00bef498e6eb2cffe71312da47ab89d2c47db7438ea2cfa992ddddbc2a01978001fc51e286e6ebf028396cdb8b3323c60e6b9d50cd84187cf7f48e3875a2f0890f70b02333ad89db2923863ce146562286f63fb0a1d0198e3a6862ba5ac12e85a5c6d0d27cb1c81bdf69cc5bc95b8001a2f744517f9437b4ddd5a076fc0e9a5de1a7a268c40f31aa29e8dc27c0b3a182299ca7a9335b4bd4585452f6107c238e486c98dd73a5f9862e9e80b152f53381c72f897107551c281259ac3ee32c4b4f46cc03127d1bf699acd0266f3c6729253c70da0c69b1560fa172735709866b375b6eba294e1ce8b46fba798ba380080b4bf9603998cac199d9cd46e30ae8da9e7f 
e = 3 
c = "0xb5db85220ca60232ea1bb2be0e11c72299bb16db26be7287e5859e7935fb7536327de36e691003a26002187f887d8ca6e0f537b78848179e9be0d61f0759e7ac3e69281ded720bef58b1c88d63bc937ffe13f2bb92ec3f037b2e889bce7012b3fba323d7b279ed253b98426ac3b5ed2db45dc4f9a7da25c2cbca4226e8f3eeaad7a7a7320c8a04b157df59611f91fff37d525b7505ca3f36ad206c147ed707c43275115c5fe90de6cf0e63cff74bab7756fc411d355ff9560934d13a51c6f94f69f7c765650dba182d7f59154f55cc59d488382f6a837bd91165f15196b0f34e3344a0a6d911dc3c140e139e5c19a6d60c9290a653e7698f3f32ab65f0b4ceb"

m1 = 0
for i in range(0x10):
    c += hex(i)[2:]
    print(c)
    c1 = int(c,16)
    m = pow(c1,3,n)
    if hex((m>>388)<<388)==0xb3ed7763ea4f8a9e444093c1922f32a30d9e9502e566a8cefb3416905afecb5c57d3a065f41a4f193d968ea095dd56568e59cf599c35c61252f78f46e300da8dc696fa16d428a8fa71a8d64bb5a2659a11d43e74edcb7a95a7fd27d46004b7e5e45fada0aadf82b30749d1037ff73435e1a8058162e83a75da40fb793f7cad2c36ab12c66751ca205e97c52893d37bbb8e7077467befdbeb21aea590bffc83f4571edec7e6a5660e7dbdb2bbfa2b9a57633c3f2b54fc459da95f0ee402cd51746491af316a54da12b5e8693566034ac0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000:
        m1 = m
        break
flag = 'flag{' + '{:x}'.format(m)[-32:] +'}'
print(flag)

getflag

flag{97e238e0725733ccc1f84f4f373b78df}

7 编码

不会， 略

突发奇想，百度了一下
居然找到了真题，这个是随便找的啊

8 soeasy_re

线上赛做过的题目， 写详细一点

查看文件格式

elf 64位

ida 打开

点开 main 函数

直接 f5 反汇编

unsigned __int64 __fastcall main(__int64 a1, char **a2, char **a3)
{
  char buf; // [rsp+0h] [rbp-30h]
  unsigned __int64 v5; // [rsp+28h] [rbp-8h]

  v5 = __readfsqword(0x28u);
  read(0, &buf, 0x26uLL);
  if ( strlen(&buf) != 38 )
  {
    puts("error");
    exit(0);
  }
  printf("input : %s
", &buf);
  xor_str(&buf, aKakalll);                      // 对输入的字符串进行  xor加密
  if ( !strcmp(&buf, s2) )
    printf("congratulation !", s2);
  return __readfsqword(0x28u) ^ v5;
}

符号基本都给出来了

size_t __fastcall xor_str(const char *a1, const char *a2)
{
  char v2; // r13
  size_t result; // rax
  int i; // [rsp+1Ch] [rbp-24h]

  for ( i = 0; ; ++i )
  {
    result = strlen(a1);
    if ( i >= result )
      break;
    v2 = a1[i];
    a1[i] = v2 ^ a2[i % strlen(a2)];
  }
  return result;
}

一个加密函数， 对 a1 里面的字符串 ascii 码值 逐一 和 a2 的字符串，进行异或加密运算， a2的位数不够，就取余， 就是循环异或

python脚本

#coding=utf-8

l = [0xd,0xd,0xa,6,0x17,0xd,0xa,0x5b,0x59,0x5c,4,0x5e,0xf,
0x5e,0x5c,7,0x5e,2,0x5d,0x5d,0x55,0xf,0x53,0xf,5,0x5a,0xd,
0x5a,0xa,0x59,0x59,0x52,0x5b,0x5c,8,0xf,0x56,0x16]
print(len(l))
s = 'kakalll'

flag = ''
for i in range(38):
    flag += chr(l[i] ^ ord(s[i%len(s)]))
print(flag)

# flag{af087e2c27f5c119d2dd6a6a82370dd7}

getflag

flag{af087e2c27f5c119d2dd6a6a82370dd7}

9 这是什么

打开压缩包，发现有加密，盲猜zip伪加密

winhex 打开 ，搜索十六进制

第三个就是

这一位改成 0000 即可

binwalk 分析 里面的 jpg 文件

提取文件

binwalk -e

只找到这个 信息

KMZWG5RTMZTBGV6Q====

然后不会了

真香

10 拿我旗帜没有那么容易

一个 apk , 幸好 比赛前 恶补了一下 安卓逆向的知识

mumu 模拟器打开

输入密码无显示

jeb 打开

左边找到 MainActivity

右键解析

查看源码

按钮点击后， 取出文本框的内容和 "EYG3QMCS" 进行比较， 比较成功， 打开另一个窗体

查看 另一个窗体执行函数的源码

package ctf.crackme;

import android.app.Activity;
import android.os.Bundle;
import android.view.Menu;
import android.view.MenuItem;
import android.widget.TextView;

public class FlagActivity extends Activity {
    @Override  // android.app.Activity
    protected void onCreate(Bundle savedInstanceState) {
        super.onCreate(savedInstanceState);
        this.setContentView(0x7F030000);  // layout:activity_flag
        String flag = "";
        int[] d = new int[]{75, 69, 89, 0x7B, 97, 0x77, 52, 110, 110, 52, 0x5F, 107, 52, 0x72, 0x5F, 109, 120, 0x5F, 100, 51, 120, 0x7D};
        int i;
        for(i = 0; i < 22; ++i) {
            flag = flag.concat(String.valueOf(((char)d[i])));
        }

        ((TextView)this.findViewById(0x7F080001)).setText(flag);  // id:flagText
    }

    @Override  // android.app.Activity
    public boolean onCreateOptionsMenu(Menu menu) {
        this.getMenuInflater().inflate(0x7F070000, menu);  // menu:flag
        return 1;
    }

    @Override  // android.app.Activity
    public boolean onOptionsItemSelected(MenuItem item) {
        return item.getItemId() == 0x7F080004 ? true : super.onOptionsItemSelected(item);  // id:action_settings
    }
}

出题人把 字符串隐藏 成 十六进制 ,然后放到 文本框中

提取数据 写脚本

#coding = utf-8


l = [75, 69, 89, 0x7B, 97, 0x77, 52, 110, 110, 52, 0x5F, 107, 52, 0x72, 0x5F, 109, 120, 0x5F, 100, 51, 120, 0x7D]
flag = ''
for i in l:
    flag += chr(i)
print(flag)

getflag

KEY{aw4nn4_k4r_mx_d3x}

也可以 输入 EYG3QMCS 直接显示 flag