前言

Web

Empty

進入到網頁後，看到有個怪怪標頭，感覺可以直接前往找到其中一段看一下cookie有什麼東東

FLAG:THJCC{cookie_&_view_source_!} THJCC CTF

Blog

這題靠通靈密碼是這個 username=admin password=iloveshark

FLAG:THJCC{w31c0me_h@cker} THJCC CTF

Reverse

Baby C

會發現這題只是XOR而已，反著回去就好，反正數值都給你了截原題目程式

1
int main(){
2
    char c[50];
3
    int a[50]={44, 48, 50, 59, 59, 3, 16, 12, 12, 8, 11, 66, 87, 87, 15, 15, 15, 86, 1, 23, 13, 12, 13, 26, 29, 86, 27, 23, 21, 87, 15, 25, 12, 27, 16, 71, 14, 69, 75, 32, 59, 46, 53, 75, 63, 75, 8, 22, 11, 5};
4
    scanf("%s", c);
5
    for(int i=0;i<50;i++){
6
        if (((int)c[i]^120)!=a[i]){
7
            printf("Password Incorrect!!!\n");
8
            return 0;
9
        }
10
    }
11
    printf("Password Correct!!!\n");
12
    return 0;
13
}

解題程式

1
int main() {
2
    int a[50] = {44, 48, 50, 59, 59, 3, 16, 12, 12, 8, 11, 66, 87, 87, 15, 15, 15, 86, 1, 23, 13, 12, 13, 26, 29, 86, 27, 23, 21, 87, 15, 25, 12, 27, 16, 71, 14, 69, 75, 32, 59, 46, 53, 75, 63, 75, 8, 22, 11, 5};
3
    char c[51];
4
    for(int i = 0; i < 50; i++) {
5
        c[i] = (char)(a[i] ^ 120);
6
    }
7
    printf("%s\n", c);
8
    return 0;
9
}

FLAG:THJCC{https://www.youtube.com/watch?v=3XCVM3G3pns}↗ THJCC CTF

PYC REVERSE

這題要把.pyc還原用線上反編譯工具就好反編譯的結果

1
#!/usr/bin/env python
2
# visit https://tool.lu/pyc/ for more information
3
# Version: Python 3.10
4

5
from FLAG import FLAG
6
from Crypto.Util.number import bytes_to_long
7

8
def xor1(flag):
9
    return flag ^ 124789
10

11
def xor2(flag):
12
    return flag ^ 487531
13

14
def xor3(flag):
15
    return flag ^ 784523
16

17
def xor4(flag):
18
    return flag ^ 642871
19

20
def xor5(flag):
21
    return flag ^ 474745
22

23
flag = bytes_to_long(FLAG)
24
count = 0
25
count += 1
26
if count == 1:
27
    flag = xor1(flag)
28
    count += 2
29
    if count == 3:
30
        flag = xor2(flag)
31
        count += 1
32
    if count == 4:
33
        flag = xor3(flag)
34
        count -= 2
35
    else:
36
        flag = xor2(flag)
37
        count += 1
38
else:
39
    flag = xor3(flag)
40
    count += 5
41
if count == 2:
42
    flag = xor4(flag)
43
elif count == 6:
44
    flag = xor5(flag)
45
print(flag)

發現跟著msg.txt逆著XOR回去就好解題程式：

1
from Crypto.Util.number import long_to_bytes
2
flag = FLAG = 10730390416708814647386325276467849806006354580175878786363505755256613965929606057246313695
3
def xor1(flag):
4
    return flag ^ 124789
5
def xor2(flag):
6
    return flag ^ 487531
7
def xor3(flag):
8
    return flag ^ 784523
9
def xor4(flag):
10
    return flag ^ 642871
11
def xor5(flag):
12
    return flag ^ 474745
13
count = 0
14
count += 1
15
if count == 1:
16
    flag = xor1(flag)
17
    count += 2
18
    if count == 3:
19
        flag = xor2(flag)
20
        count += 1
21
    if count == 4:
22
        flag = xor3(flag)
23
        count -= 2
24
    else:
25
        flag = xor2(flag)
26
        count += 1
27
else:
28
    flag = xor3(flag)
29
    count += 5
30
if count == 2:
31
    flag = xor4(flag)
32
elif count == 6:
33
    flag = xor5(flag)
34
print(long_to_bytes(flag))

FLAG:THJCC{pyc_rev3r3e_C3n_u32_on1i5e_t0Ol} THJCC CTF

Pwn

nc

連上nc後他會問你Never Gonna Give You Up的作者是誰

FLAG:THJCC{N3veR_g0nn4_l37_You_dOwn!!!} THJCC CTF

NPSC

我用垃圾寫法寫得運算之久讓我感到疑惑

1
from pwn import *
2
def max_score(balls):
3
    if not balls:
4
        return 0
5
    max_score = 0
6
    for i in range(len(balls)):
7
        score = balls[i]
8
        remaining_balls = balls[i+1:]
9
        for j in range(len(remaining_balls)):
10
            if score >= remaining_balls[j]:
11
                score += remaining_balls[j]
12
            else:
13
                break
14
        max_score = max(max_score, score)
15
    return max_score
16

17
io = remote('23.146.248.36', 30003)
18
io.recvlines(4)
19

20
for round_ in range(3):
21
    print(f'=============== ROUND {round_+1} ===============')
22
    if round_ in [1, 2]:
23
    for _ in range(10):
24
        numbers = eval(io.recvline().decode().strip())
25
        io.sendline(str(max_score(numbers)).encode())
26
        result = io.recvline().decode().strip()
27
        print(f'Input: {numbers}')
28
        print(f'Output: {result}')
29
io.interactive()

Crypto

博元婦產科

其實也就解密這個TUFDVlZ7cFBwLnU0VXJmVGQzay52MEYubVB9Cg== 先憑直覺，Base64回去確實格式有對，然後試試看是不是凱薩一個一個try會發現是位移19個

FLAG:THJCC{wWw.b4BymAk3r.c0M.tW↗} THJCC CTF

Baby RSA

只要用線上的rsa decoder就好了

FLAG:THJCC{small_eeeee_can_be_pwned_easily} THJCC CTF

《SSS.GRIDMAN》

在題目中看到會生成二次方程式的樣子

1
def random_ploy():
2
    poly=[]
3
    for i in range(2):
4
        poly.append(random.randint(99,999))
5
    return poly

polyc 被定義為這兩個係數加上secret用成常數項：

1
polyc =random_ploy()
2
polyc.append(secret)
3
poly_enc = numpy.poly1d(polyc)

numpy.poly1d(polyc) 會 return ax^2 + bx + c 的二次方程式，其中 a 和 b 是隨機的，c 是secret f(x_value, y_value, x) 給定一系列的資料點（x_value, y_value），函數計算了多項式在 x 點的值。其中，shares是題目給我的資料點，就可以找到了。總體而現就是藉由三個點找到方程式的常數項而已。參考文獻：拉格朗日插值多項式↗ 解決程式：

1
def f(x_value, y_value, x):
2
    result = 0
3
    for i in range(len(x_value)):
4
        temp = y_value[i]
5
        for j in range(len(x_value)):
6
            if j != i:
7
                temp = temp * (x - x_value[j]) / (x_value[i] - x_value[j])
8
        result += temp
9
    return result
10
shares = [(139, 3875728327), (982, 4473718807), (707, 4179926407)] #把點點丟進來
11
x_value, y_value = zip(*shares)
12
secret = f(x_value, y_value, 0)
13
print("密碼是：", int(secret))

FLAG:THJCC{SSS_1s_a_c001_w2y_t0_pr0t3c7_s3c23t} THJCC CTF

Misc

原神帳號外流

會有一個登入介面，要從網路封包去抓取打開封包來看，每一組都試一遍，FLAG就噴出來了

FLAG:THJCC{W3r3_sHarKKKKKK_MasT3R_C8763} THJCC CTF

PyJail-0

這是題目執行程式

1
WELCOME='''
2
 ____            _       _ _
3
|  _ \ _   _    | | __ _(_) |
4
| |_) | | | |_  | |/ _` | | |
5
|  __/| |_| | |_| | (_| | | |
6
|_|    \__, |\___/ \__,_|_|_|
7
       |___/
8
'''
9

10
def main():
11

12
    print("-"*30)
13
    print(WELCOME)
14
    print("-"*30)
15
    print("Try to escape!!This is a jail")
16
    a=input("> ")
17
    eval(a)
18

19
if __name__ == '__main__':
20
    main()

會發現只要能跳過就可以所以只要輸入eval(input()) 然後拿到存取的方式__import__('os').system('sh') 這樣就拿到了

FLAG:THJCC{Use_M2g1c_f2un3ti0n_in_P9Ja1l!!} THJCC CTF

PyJail-1

1
WELCOME='''
2
 ____            _       _ _
3
|  _ \ _   _    | | __ _(_) |
4
| |_) | | | |_  | |/ _` | | |
5
|  __/| |_| | |_| | (_| | | |
6
|_|    \__, |\___/ \__,_|_|_|
7
       |___/
8
'''
9

10
def main():
11
    try:
12
        print("-"*30)
13
        print(WELCOME)
14
        print("-"*30)
15
        print("Try to escape!!This is a jail")
16
        print("I increased security!!!")
17
        a=input("> ")
18
        if len(a)<15:
19
            eval(a)
20
        else:
21
            print("Don't escape!!")
22
    except:
23
        print("error")
24
        exit()
25

26
if __name__ == '__main__':
27
    main()

感覺相較上一題變複雜了，但是用同一個策略還是行的通

FLAG:THJCC{Inp3t_b9p2sss_lim1t_1n+p3j2i1!} THJCC CTF

Thanks for reading!

2024 Apr THJCC CTF

Mon Apr 29 2024

1178 words · 10 minutes

Daily writeup