前言

比賽成果紀錄 ctfd.fhh4ck3rs.taipei_team

ctfd.fhh4ck3rs.taipei_scoreboard

Writeup

Web

[穿越檔案的旅人]

題目提示到：「flag 在 /flag.txt」

1
server {
2
    listen 80;
3
    server_name _;
4

5
    location / {
6
        root /html;
7
        index index.html index.htm;
8
    }
9

10
    location /img {
11
        alias /images/;
12
    }
13
}

發現可以用img作為跳板改一下url: https://travaling.fhh4ck3rs.taipei/img../flag.txt

FLAG:FhCTF{how_1_tr4v3rs4l_7h3_w0rld!}

[A Web]

~~我還是diesearch去看~~

有robots.txt誒

先找到第一段：FhCTF{1aSy_t0_f0

有一個登入畫面，可以用sql injection

username = admin

password = 'OR 1=1 --

第二段UnD_A_f1AG_c

登入成功後看到

在isAdmin中是base64格式

只要改成True的base64格式 -> VHJ1ZQ==

FLAG:FhCTF{1aSy_t0_f0UnD_A_f1AG_cAn_u_f1ND_1T}

[Gotcha]

會先發現這是git洩漏利用DotGit擴充去把zip下載下來再把丟到SourceTree去看歷史紀錄

FLAG:FhCTF{I_9iT_!7}

[BMI 計算機]

去看源碼，會發現有eval()可以鑽

先把身高體重用burp suite攔下來

會發現是用strings傳送

把它改成 { "string": "require('fs').readFileSync('flag', 'utf8')"}

就可以執行了

FLAG:FhCTF{bReAk_bM1_cAcu1aT0r}

用githacker抓下來後再用source tree去看

FhCTF{r3m0ve_fr0m_F1LE_6U7_in_Rep0}

[上鎖了！？]

~~先用dirsearch再說~~ 得知有admin，去看main.js發現有#secret 我們知道在flag.txt，但我們沒有權限進去，會被403 所以要用burp suite攔下來後加入referer到locked.fhh4ck3rs.taipei就好 request只要這樣就好

1
GET /admin/flag.txt HTTP/2
2
Host: locked.fhh4ck3rs.taipei
3
Referer: http://locked.fhh4ck3rs.taipei

FLAG:FhCTF{4n_unl0cked_l0ck_15_s7up1d}

[Information]

~~看到連結無腦先用dirsearch~~ 真的有好東西誒，/redoc 到目錄下去看就有了

FLAG:FhCTF{Y0u_r3411y_n33d_t0_l0ck_y0ur_API_d0cum3n75}

[Information Ultimate]

~~老生常談，先用dirsearch~~ 會發現有/docs可以進去有api可以玩先到No One Can Pass 隨便打，會跳出access-token而且還是jwt格式的我們要用jwt-cracker暴力解密鑰發現密鑰是secret 那這樣token就出來了得到flag~~~~ FLAG:FhCTF{N3w_ch4ll3ng3_1n_JWT_c95ceec4ea7d5414f10853e616da8e521f957e7627368a641e46fe74720b53b1}

[Information Revenge]

~~我仍然先用dirsearch~~ 有docs可以進去但是要帳密

題目提到，以他的名字作為擔保，username就是CXPh031x

先用burp suite攔下來看，發現是用username:password的方式驗證而且還套用base64格式知道這些後，~~就可以爆破了~~

這樣就知道密碼是Password1了能進到api那邊直接拿到flag

FLAG:FhCTF{W34k_p455w0rd_m4y_c4u53_d4ng3r}

[Baking Store]

發現是要等旗子烤好我們先用burp suite攔下來，有看到一串特殊的cookie 用ciphey看，發現是這樣的加密方式再把時間改成0秒就好摟囉

FLAG:FhCTF{Cl13nt_s1d3_auth0r1z3d_1s_d4ng3r!!!!}

[Baking Store Revenge]

進去會有一個登入頁面，先隨便註冊後再登入看看看看能不能修改url找到flag 在65536的地方

FLAG:FhCTF{IDOR_1s_t3rr4bl3_w1th_n0_l1m173d...}

Forensics

[MitM 攻擊者]

下載檔案丟進wireshake 從題目中 不要用不安全的協定 去找最特別的協定就找到flag了

fhsfctf{w1ll_a1w4y5_pr3v4il}

[Hex Dumb Dumb]

題目給你一個.chal檔案，但其實他是張圖片 HexDumbDumb 把這張strings出來看，把strings最後部分拿來看抓”)“上面

1
FFFFFF
2
))))))
3
hhhhhh
4
))))))
5
HHHH
6
C))C
7
TTTTTt
8
)))))t
9
FFFFFF
10
))))))
11
)){){)
12
HHHHHH
13
))))))
14
hhhhhh
15
hhhhhh
16
##3###
17
d))d
18
DDDDdd
19
DDDD))
20
u)))
21
UUUU
22
)))m
23
MMMM
24
pppppp
25
))))))
26
PPPP
27
nnnn
28
))))
29
NNNN
30
##3###
31
##3###
32
d))d
33
DDDDdd
34
DDDD))
35
)))m
36
MMMM
37
0000
38
0))))0
39
))))))
40
))))
41
)))r
42
##3###
43
##3###
44
C))C
45
UUUUU
46
U)))))
47
uuuuuu
48
uuuuu
49
RRRRRR
50
))))))
51
##3###
52
]})})]

FLAG:FhCTF{H3xdump_n33d_m0r3_S3CUR3}

[Do you know packet?]

打開題目封包後發現跟usb有關之後到這邊載工具 https://github.com/horosora/wireshark-usb-keyboard-analyzer/tree/master↗ 載好後丟到wireshark 再用wireshark打開封包並使用工具得到flag

FLAG:FhCTF{a_S1mp13_USB_C@p7uRe}

Reverse

[BabyReverse]

去用ida去看print_flag()

1
v3 = [57, 23, 60, 43, 57, 4, 38, 79, 10, 32, 30, 13, 76, 32, 29, 75, 29, 6, 32, 13, 76, 9, 76, 13, 74, 76, 32, 26, 17, 24, 78, 17, 76, 76, 13, 91, 90, 89, 2]
2
s = ''.join(chr(byte ^ 0x7F) for byte in v3)
3
print(s)

FLAG:FhCTF{Y0u_ar3_b4by_r3v3r53_eng1n33r$%&}

[Secret Message]

先用ida打開會發現說雖然他用rand 但因為srand有給種子碼，所以基本上每次執行的時候隨機數都是相同的然後有給flag被加密後的檔案

所以可以來暴力解把可視字元當作flag 之後執行enc flag 如果enc後的結果等於751 那就記錄下來然後繼續往下跑如果enc後的結果等於707 繼續記錄下來到最後就會有flag了

solve

1
from pwn import *
2
seed = [751, 707, 513, 755, 627, 1036, 1005, 109, 682, 674, 252, 671, 247, 259, 439, 526, 318, 574, 742, 135, 709, 731, 495, 872, 436, 827]
3
key = "!\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~"
4
ans = ""
5
origin = ""
6
for i in range(len(seed)):
7
    for j in key:
8
        origin = ans
9
        origin = origin + j
10
        with open("flag", "w") as file:
11
            file.write(origin)
12

13
        r = process(["./enc", "flag"])
14
        gg = r.recvall()
15
        nums = [int(x) for x in gg.decode().split()]
16
        if nums[i] == seed[i]:
17
            ans+=j
18
            break
19

20
print(ans)

[BabyReverse Revenge]

去用ida去看print_flag() v9為加密數值，v4=127是XOR鑰匙，v5=35解密的字串長度用 for 嘗試0~255 分配記憶體儲存解密字串用for進行 XOR 運算之後printf每個可能

1
#include <stdio.h>
2
#include <stdlib.h>
3

4
void print_flag() {
5
    int v9[] = {121, 87, 124, 107, 121, 68, 104, 87, 70, 96, 124, 8, 121, 12, 77, 76, 96,
6
                83, 14, 84, 12, 96, 77, 12, 73, 12, 81, 88, 12, 17, 17, 27, 0, 27, 66};
7
    int length = 35;
8

9
    for (int key = 0; key < 256; ++key) {
10
        char *s = (char *)malloc(length + 1);
11
        if (!s) {
12
            printf("Memory allocation failed\n");
13
            return;
14
        }
15

16
        for (int i = 0; i < length; ++i) {
17
            s[i] = key ^ v9[i];
18
        }
19
        s[length] = '\0';
20

21
        printf("Key %d: %s\n", key, s);
22

23
        free(s);
24
    }
25
}
26

27
int main() {
28
    print_flag();
29
    return 0;
30
}

Flag:FhCTF{Why_C7F3rs_l1k3_r3v3ng3..$?$}

[真。逆向工程]

其實找到print_flag function後照他的用下來就出來了

1
#include <iostream>
2
#include <cstring>
3
#include <cstdint>
4
using namespace std;
5
void print_flag() {
6
    int i, j, k;
7
    uint64_t v4[7];
8
    uint64_t v6[13];
9
    char v7[10];
10
    char result[57];
11
    v6[0] = 0x30602D1979572B0BLL;
12
    v6[1] = 0x44191E0B2C405607LL;
13
    v6[2] = 0x1B777409180F6D6FLL;
14
    v6[3] = 0x2A0F022A52672416LL;
15
    v6[4] = 0x601B25524E775D7DLL;
16
    v6[5] = 0x2C2D25635B640649LL;
17
    v6[6] = 0x527A4B6640082160LL;
18
    v6[7] = 0x71E2064576E5B5BLL;
19
    v6[8] = 0x342B373625031C69LL;
20
    v6[9] = 0x7C0972711E5E5D23LL;
21
    v6[10] = 0x191D703028635C21LL;
22
    v6[11] = 0x405D1C7E0B601446LL;
23
    v6[12] = 0x62611D4B320D6C78LL;
24
    memcpy(v7, "GQ6,/rqswO", 10);
25
    v4[0] = 0x48633E0137730E24LL;
26
    v4[1] = 0x722D6E6F3E295F53LL;
27
    v4[2] = 0x2738791141693007LL;
28
    v4[3] = 0x7965302D5A09586CLL;
29
    v4[4] = 0x17B38197D691A1ELL;
30
    v4[5] = 0x78097A453D3C5554LL;
31
    v4[6] = 0x182D517B73331FLL;
32
    for (i = 56; i > 0; --i)
33
        *((uint8_t *)v4 + i) ^= *((uint8_t *)v4 + i - 1);
34
    for (j = 0; j < 0x39; ++j)
35
        *((uint8_t *)v4 + j) ^= 0x69;
36
    for (k = 0; k < 0x39; ++k)
37
        *((uint8_t *)v4 + k) ^= *((uint8_t *)v6 + k);
38
    memcpy(result, v4, 56);
39
    cout << result << endl;
40
}
41

42
int main() {
43
    print_flag();
44
    return 0;
45
}

FLAG:FhCTF{Tru3_R3v3rs3?Y0u_m4y_h4v3_s0m3_m1sund3rs74nd!!%^&#}

Osint

[祭]

女巫我會想到北投區 ~~(絕對不是復興高中就在北投)~~ 北投我能想到的景點:(1.北投公園 2.溫泉博物館 ==3.文物館==)

FLAG:FhCTF{112台北市北投區幽雅路32號}

[緣]

google 以圖搜圖加關鍵字 <華山祭典地址> 得到

FhCTF{108台北市萬華區康定路173巷}

Crypto

[Taiwan No.1]

題目有說到，每一個可視字元有獨立的編碼形式我們只要將output縮成一行，利用taiwan-art.py去做成表

taiwan-art.py

1
Secret = open('./Secret.txt', 'rb').read()
2
encode = "~!@#$%^&*()-=[]\\"
3
Taiwan = list(open('./taiwan.txt', 'r').read())
4
SuperPower = 13 * 3 * 7 * 5
5
New_Taiwan = ''
6
for sec in Secret:
7
    for prime in [13, 3, 7, 5]:
8
        for sp in range(SuperPower):
9
            char = Taiwan.pop(0)
10
            if char != "#":
11
                New_Taiwan += char
12
            else:
13
                New_Taiwan += encode[sec % prime]
14
                break
15

16
print(New_Taiwan)

分析一下會發現，他會讀取taiwan.txt，而taiwan.txt要有4的倍數個# 我在Secret.txt中打

1
0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ!"#$%&'()*+,-./:;<=>?@[]^_`{|}~

可以知道所有的可視字元符號，每四個一組，根據輸出值去查表

製表C++（要根據Secret.txt微調修正）

1
#include <iostream>
2
using namespace std;
3
int main()
4
{
5
    string re = "~@@~!~#!@!$@#@%#$~^$%!~~^@!!&~@@*!##(@$$)~%~-!^!=@~@~~!#!!@$@@#~#~$!$!%@%@^#^~~$&!!~*@@!(~#@)!$#-@%$=~^~";
6
    string abc ="ABCDEFGHIJKLMNOPQRSTUVWXYZ";
7
    for(int i=0;i<104;i+=4){
8
        cout<<abc[i/4]<<":"<<re[i]<<re[i+1]<<re[i+2]<<re[i+3]<<"\n";
9
    }
10
    return 0;
11
}

python解

1
stardand={'0':"(~^#",'1':")!~$",'2':"-@!~",'3':"=~@!",'4':"~!#@",'5':"!@$#",'6':"@~%$",'7':"#!^~",'8':"$@~!",'9':"%~!@",'a':"^!^@",'b':"&@~#",'c':"*~!$",'d':"(!@~",'e':")@#!",'f':"-~$@",'g':"=!%#",'h':"~@^$",'i':"!~~~",'j':"@!!!",'k':"#@@@",'l':"$~##",'m':"%!$$",'n':"^@%~",'o':"&~^!",'p':"*!~@",'q':"(@!#",'r':")~@$",'s':"-!#~",'t':"=@$!",'u':"~~%@","v":"!!^#",'w':"@@~$",'x':"#~!~",'y':"$!@!",'z':"%@#@",'A':"~@@~",'B':"!~#!",'C':"@!$@",'D':"#@%#",'E':"$~^$",'F':"%!~~",'G':"^@!!",'H':"&~@@",'I':"*!##",'J':"(@$$",'K':")~%~",'L':"-!^!",'M':"=@~@",'N':"~~!#",'O':"!!@$",'P':"@@#~",'Q':"#~$!",'R':"$!%@","S":"%@^#",'T':"^~~$",'U':"&!!~",'V':"*@@!",'W':"(~#@",'X':")!$#",'Y':"-@%$",'Z':"=~^~",'!':"&~%#",'"':"*!^$",'#':"(@~~",'$':")~!!",'%':"-!@@",'&':"=@##","'":"~~$$",'(':"!!%~",')':"@@^!",'*':"#~~@",'+':"$!!#",',':"%@@$",'-':"^~#~",'.':"&!$!",'/':"*@%@","'":"^!@#",';':"&@#$",'<':"*~$~",'=':"(!%!",'>':")@^@",'?':"-~~#",'@':"=!!$",'[':"~!~!",']':"@~@#",'^':"#!#$",'_':"$@$~",'`':"%~%!",'{':"^~$#",'|':"&!%$",'}':"*@^~",'~':"(~~!"}
2
transform={
3
    v:k for k,v in stardand.items()
4
}
5
message="@!$@&~^!^@%~=!%#)~@$^!^@=@$!~~%@$~##^!^@=@$!!~~~&~^!^@%~-!#~^@$@&~^!^@%~^@$@-!#~&~^!$~##!!^#!~~~^@%~=!%#^@$@=@$!~@^$!~~~-!#~^@$@*~!$~@^$^!^@$~##$~##)@#!^@%~=!%#)@#!&~%#^@$@~!^#)!#~^~~$~@^$)@#!^@$@%!$$^!^@-!#~#@@@^@$@~@^$^!^@-!#~)!~$$@~!=~@!@~%$^@$@(@~~~~$$-!#~^@$@-!#~&~^!^@$@~@^$)@#!)~@$)@#!^@$@^!^@)~@$)@#!^@$@-!#~&~^!%!$$)@#!^@$@)~@$^!^@^@%~(!@~&~^!%!$$^@$@@@~$&~^!)~@$(!@~-!#~^@$@=@$!&~^!^@$@%!$$^!^@#@@@)@#!^@$@=@$!~@^$)@#!^@$@%!$$)@#!-!#~-!#~^!^@=!%#)@#!^@$@$~##&~^!^@%~=!%#^@$@)@#!^@%~&~^!~~%@=!%#~@^$&!$!~!^#)!#~@!$@&~^!^@%~-~$@$~##!~~~*~!$=@$!^@$@%!$$~~%@-!#~=@$!^@$@^@%~&~^!=@$!^@$@&@~#)@#!^@$@-!#~)@#!)@#!^@%~^@$@=@$!~@^$)~@$&~^!~~%@=!%#~@^$^@$@=@$!~@^$)@#!^@$@&~@@&~^!$~##$!@!^@$@)~%~~@^$^!^@$~##^!^@&!$!~!^#)!#~(~#@)@#!^@$@-!#~~@^$^!^@$~##$~##^@$@)~@$!~~~-!#~)@#!^@$@-~$@)~@$&~^!%!$$^@$@=@$!~@^$)@#!^@$@^!^@-!#~~@^$)@#!-!#~&!$!=@~@$!@!^@$@~@^$)@#!^!^@)~@$=@$!^@$@!~~~-!#~^@$@*~!$&~^!$~##(!@~)@#!)~@$^@$@=@$!~@^$^!^@^@%~^@$@=@$!~@^$)@#!-!#~)@#!^@$@-!#~=@$!)@#!)@#!$~##^@$@$~##!~~~%!$$&@~#-!#~&!$!~!^#)!#~@@#~)~@$!~~~-!#~%!$$^!^@=@$!!~~~*~!$^@$@*~!$&~^!)~@$)@#!^@$@-~$@^!^@!~~~$~##!~~~^@%~=!%#&~%#^@$@(~#@)@#!^@$@)~@$)@#!(@!#~~%@!~~~)~@$)@#!^@$@^!^@-!#~-!#~!~~~-!#~=@$!^!^@^@%~*~!$)@#!&!$!~!^#)!#~-@%$&~^!~~%@)~@$^@$@-~$@$~##^!^@=!%#^@$@!~~~-!#~^@$@~@^$)@#!)~@$)@#!^!@#^@$@%!~~~@^$@!$@^~~$%!~~^~$#-!^!!~~~!!^#=~@!(!@~$@$~)!~$^@%~$@$~^~~$~!#@)!~$@@~$=~@!^@%~$@$~^@!!&~^!&~^!(~^#(~^#&~^!&~^!(~^#(~^#(!@~*@^~"
6
result=''
7
for i in range(0,len(message),4):
8
    ans=message[i:i+4]
9
    if ans in transform:
10
        result+=transform[ans]
11
print(result)

C++解

1
#include <iostream>
2
#include <string>
3
#include <unordered_map>
4
using namespace std;
5
int main() {
6
    unordered_map<char, string> encode_map = {
7
        {'0', "(~^#"}, {'1', ")!~$"}, {'2', "-@!~"}, {'3', "=~@!"}, {'4', "~!#@"},
8
        {'5', "!@$#"}, {'6', "@~%$"}, {'7', "#!^~"}, {'8', "$@~!"}, {'9', "%~!@"},
9
        {'a', "^!^@"}, {'b', "&@~#"}, {'c', "*~!$"}, {'d', "(!@~"}, {'e', ")@#!"},
10
        {'f', "-~$@"}, {'g', "=!%#"}, {'h', "~@^$"}, {'i', "!~~~"}, {'j', "@!!!"},
11
        {'k', "#@@@"}, {'l', "$~##"}, {'m', "%!$$"}, {'n', "^@%~"}, {'o', "&~^!"},
12
        {'p', "*!~@"}, {'q', "(@!#"}, {'r', ")~@$"}, {'s', "-!#~"}, {'t', "=@$!"},
13
        {'u', "~~%@"}, {'v', "!!^#"}, {'w', "@@~$"}, {'x', "#~!~"}, {'y', "$!@!"},
14
        {'z', "%@#@"}, {'A', "~@@~"}, {'B', "!~#!"}, {'C', "@!$@"}, {'D', "#@%#"},
15
        {'E', "$~^$"}, {'F', "%!~~"}, {'G', "^@!!"}, {'H', "&~@@"}, {'I', "*!##"},
16
        {'J', "(@$$"}, {'K', ")~%~"}, {'L', "-!^!"}, {'M', "=@~@"}, {'N', "~~!#"},
17
        {'O', "!!@$"}, {'P', "@@#~"}, {'Q', "#~$!"}, {'R', "$!%@"}, {'S', "%@^#"},
18
        {'T', "^~~$"}, {'U', "&!!~"}, {'V', "*@@!"}, {'W', "(~#@"}, {'X', ")!$#"},
19
        {'Y', "-@%$"}, {'Z', "=~^~"}, {'!', "&~%#"}, {'"', "*!^$"}, {'#', "(@~~"},
20
        {'$', ")~!!"}, {'%', "-!@@"}, {'&', "=@##"}, {'\'', "~~$$"}, {'(', "!!%~"},
21
        {')', "@@^!"}, {'*', "#~~@"}, {'+', "$!!#"}, {',', "%@@$"}, {'-', "^~#~"},
22
        {'.', "&!$!"}, {'/', "*@%@"}, {':', "^!@#"}, {';', "&@#$"}, {'<', "*~$~"},
23
        {'=', "(!%!"}, {'>', ")@^@"}, {'?', "-~~#"}, {'@', "=!!$"}, {'[', "~!~!"},
24
        {']', "@~@#"}, {'^', "#!#$"}, {'_', "$@$~"}, {'`', "%~%!"}, {'{', "^~$#"},
25
        {'|', "&!%$"}, {'}', "*@^~"}, {'~', "(~~!"}
26
    };
27
    unordered_map<string, char> decode_map;
28
    for (const auto& pair : encode_map) {
29
        decode_map[pair.second] = pair.first;
30
    }
31
    string encoded_message = "@!$@&~^!^@%~=!%#)~@$^!^@=@$!~~%@$~##^!^@=@$!!~~~&~^!^@%~-!#~^@$@&~^!^@%~^@$@-!#~&~^!$~##!!^#!~~~^@%~=!%#^@$@=@$!~@^$!~~~-!#~^@$@*~!$~@^$^!^@$~##$~##)@#!^@%~=!%#)@#!&~%#^@$@~!^#)!#~^~~$~@^$)@#!^@$@%!$$^!^@-!#~#@@@^@$@~@^$^!^@-!#~)!~$$@~!=~@!@~%$^@$@(@~~~~$$-!#~^@$@-!#~&~^!^@$@~@^$)@#!)~@$)@#!^@$@^!^@)~@$)@#!^@$@-!#~&~^!%!$$)@#!^@$@)~@$^!^@^@%~(!@~&~^!%!$$^@$@@@~$&~^!)~@$(!@~-!#~^@$@=@$!&~^!^@$@%!$$^!^@#@@@)@#!^@$@=@$!~@^$)@#!^@$@%!$$)@#!-!#~-!#~^!^@=!%#)@#!^@$@$~##&~^!^@%~=!%#^@$@)@#!^@%~&~^!~~%@=!%#~@^$&!$!~!^#)!#~@!$@&~^!^@%~-~$@$~##!~~~*~!$=@$!^@$@%!$$~~%@-!#~=@$!^@$@^@%~&~^!=@$!^@$@&@~#)@#!^@$@-!#~)@#!)@#!^@%~^@$@=@$!~@^$)~@$&~^!~~%@=!%#~@^$^@$@=@$!~@^$)@#!^@$@$~##)@#!^@%~-!#~)@#!-!#~^@$@&~^!-~$@^@$@(!@~)@#!-!#~*!~@)@#!)~@$^!^@=@$!!~~~&~^!^@%~&!$!~!^#)!#~~@@~$~##$~##^@$@*!~@^!^@=@$!~@^$-!#~^@$@^!^@)~@$)@#!^@$@-!#~)@#!)@#!^@%~^@$@=@$!~@^$)~@$&~^!~~%@=!%#~@^$^@$@=@$!~@^$)@#!^@$@*!~@)~@$!~~~-!#~%!$$^@$@&~^!-~$@^@$@-~$@^!^@=@$!)@#!&!$!~!^#)!#~!!@$~~%@)~@$^@$@@@~$!~~~$~##$~##-!#~^@$@^!^@)~@$)@#!^@$@^!^@$~##!~~~=!%#^@%~)@#!(!@~^@$@=@$!~@^$)~@$&~^!~~%@=!%#~@^$^@$@=@$!~@^$)@#!^@$@&~@@&~^!$~##$!@!^@$@)~%~~@^$^!^@$~##^!^@&!$!~!^#)!#~(~#@)@#!^@$@-!#~~@^$^!^@$~##$~##^@$@)~@$!~~~-!#~)@#!^@$@-~$@)~@$&~^!%!$$^@$@=@$!~@^$)@#!^@$@^!^@-!#~~@^$)@#!-!#~&!$!=@~@$!@!^@$@~@^$)@#!^!^@)~@$=@$!^@$@!~~~-!#~^@$@*~!$&~^!$~##(!@~)@#!)~@$^@$@=@$!~@^$^!^@^@%~^@$@=@$!~@^$)@#!-!#~)@#!^@$@-!#~=@$!)@#!)@#!$~##^@$@$~##!~~~%!$$&@~#-!#~&!$!~!^#)!#~@@#~)~@$!~~~-!#~%!$$^!^@=@$!!~~~*~!$^@$@*~!$&~^!)~@$)@#!^@$@-~$@^!^@!~~~$~##!~~~^@%~=!%#&~%#^@$@(~#@)@#!^@$@)~@$)@#!(@!#~~%@!~~~)~@$)@#!^@$@^!^@-!#~-!#~!~~~-!#~=@$!^!^@^@%~*~!$)@#!&!$!~!^#)!#~-@%$&~^!~~%@)~@$^@$@-~$@$~##^!^@=!%#^@$@!~~~-!#~^@$@~@^$)@#!)~@$)@#!^!@#^@$@%!~~~@^$@!$@^~~$%!~~^~$#-!^!!~~~!!^#=~@!(!@~$@$~)!~$^@%~$@$~^~~$~!#@)!~$@@~$=~@!^@%~$@$~^@!!&~^!&~^!(~^#(~^#&~^!&~^!(~^#(~^#(!@~*@^~";
32
    string decoded_message;
33
    for (size_t i = 0; i < encoded_message.length(); i += 4) {
34
        string encoded_char = encoded_message.substr(i, 4);
35
        if (decode_map.count(encoded_char) > 0) {
36
            decoded_message += decode_map[encoded_char];
37
        }
38
    }
39
    cout << "Decoded message: " << decoded_message << endl;
40
    return 0;
41
}

FLAG:FhCTF{Liv3d_1n_T41w3n_Goo00oo00d}

MISC

[Welcome]

[Survey]

就是表單

[INDEX 與 RULES 的差集]

到index中發現xorkey 但是在經過base64 decode後是FhCTF{H3l1o <-- part 1/2 在rules中發現

1
<!-- crypt value -->
2
<!-- 192b741219293d0209041200000000000000000000030000 -->

再去解xor 其一解：

1
import base64
2
base64_something = "RmhDVEZ7SDNsMW8gPC0tIHBhcnQgMS8y"
3
crypt_value_hex = "192b741219293d0209041200000000000000000000030000"
4
xorkey = base64.b64decode(base64_something)
5
crypt_value = bytes.fromhex(crypt_value_hex)
6
repeated_xorkey = (xorkey * ((len(crypt_value) // len(xorkey)) + 1))[:len(crypt_value)]
7
second_bytes = bytes(a ^ b for a, b in zip(crypt_value, repeated_xorkey))
8
second = second_bytes.decode('utf-8', errors='ignore')
9
print(xorkey,second)

其二解：

1
import base64
2
from pwn import *
3
base64_something = "RmhDVEZ7SDNsMW8gPC0tIHBhcnQgMS8y"
4
crypt_value_hex = "192b741219293d0209041200000000000000000000030000"
5
xorkey = base64.b64decode(base64_something)
6
crypt_value = bytes.fromhex(crypt_value_hex)
7
print(xor(xorkey, crypt_value))

出來了第二段：b'_C7F_Ru1e5} <-- part 2/2'

FLAG:FhCTF{H3l1ob'_C7F_Ru1e5}

Thanks for reading!

FhCTF writeup

Sat Jun 08 2024

1994 words · 16 minutes

Daily writeup

FhCTF writeup

前言

Writeup

Web

[穿越檔案的旅人]

[A Web]

[Gotcha]

[BMI 計算機]

[Login]

[上鎖了！？]

[Information]

[Information Ultimate]

[Information Revenge]

[Baking Store]

[Baking Store Revenge]

Forensics

[MitM 攻擊者]

[Hex Dumb Dumb]

[Do you know packet?]

Reverse

[BabyReverse]

[Secret Message]

[BabyReverse Revenge]

[真。逆向工程]

Osint

[祭]

[緣]

Crypto

[Taiwan No.1]

MISC

[Welcome]

[Survey]

[INDEX 與 RULES 的差集]

FhCTF writeup