Ciscn2023 决赛 wp

一个一等一个二等win啦

好多都是赛后复现

量子1

忘了附件丢哪里了 但是跟着给出的脚本 就可以读出各个函数作用
看图写代码 根据要求模拟100w次即可

from qiskit import *

from qiskit.visualization import plot_histogram
# Use Aer's qasm_simulator
simulator = Aer.get_backend('qasm_simulator')
# Create a Quantum Circuit acting on the q register
circuit = QuantumCircuit(2, 2)
# Add a H gate on qubit 0
circuit.h(0)
# Add a CX (CNOT) gate on control qubit 0 and target qubit 1
circuit.cx(0, 1)
# Map the quantum measurement to the classical bits
circuit.measure([0,1], [0,1])
# Execute the circuit on the qasm simulator
job = execute(circuit, simulator, shots=1000)
# Grab results from the job
result = job.result()
# Returns counts
counts = result.get_counts(circuit)
print("\nTotal count for 00 and 11 are:",counts)
# Plot a histogram
plot_histogram(counts)
# Draw the circuit
circuit.draw()

(说是这么说但是上场环境崩了呜呜呜)

Ai1

真的是Ai吗

给出一堆已知的x和y，然后给出x预测y
其实是函数拟合

先画个图

plt.scatter(x, y,s=0.1)
plt.show()

一眼顶针是三次函数加一个三角函数

然后就可以数周期和手动拟合函数啦
但是不太优雅（
猜出函数定义就都好办 使用curve_fit拟合即可

import numpy as np
from scipy.optimize import curve_fit
import matplotlib.pyplot as plt
import math

from numpy import sin
... 省略数据

# 定义拟合函数
def func(x, a, b, c, d, e, f, g):
    return a * x ** 3 + b * x ** 2 + c * x + d + e * np.sin(f * x + g)


def func2(x, a, b, c):
    return a * np.sin(b * x + c)


# 生成数据
x = x_previous
x = np.array(x)
y = y_prev
y = np.array(y)
p0 = [1, 1, 1, 1, 8, 10 * np.pi, 1]
# 拟合曲线
popt, pcov = curve_fit(func, x, y, p0=p0, maxfev=1111111)

x_predict = np.array(x_predict)
print(func(x_predict, *popt))
# 绘制结果
plt.scatter(x, y, s=0.1, label='data')
plt.plot(x, func(x, *popt), label='fit')
plt.plot(x_predict, func(x_predict, *popt), label='predict')
plt.legend()
plt.show()

得到各系数为
[ 2.4 -2.7 -0.75 10. 10. 31.41592654
1.57079633]

完美重合！

然后尝试使用torch训练一个

import torch
import torch.nn as nn
import matplotlib.pyplot as plt
import numpy as np


class MyModel(nn.Module):
    def __init__(self):
        super(MyModel, self).__init__()
        self.fc1 = nn.Linear(1, 32)
        self.fc2 = nn.Linear(32, 64)
        self.fc3 = nn.Linear(64, 32)
        self.fc4 = nn.Linear(32, 1)

    def forward(self, x):
        x = nn.functional.relu(self.fc1(x))
        x = nn.functional.relu(self.fc2(x))
        x = nn.functional.relu(self.fc3(x))
        x = self.fc4(x)
        return x


# 生成训练数据
x_train = x_previous
x_train = torch.tensor(x_train).float().reshape(-1, 1)
y_train = y_prev
y_train = torch.tensor(y_train).float().reshape(-1, 1)
# 初始化模型
model = MyModel()

# 定义损失函数和优化器
criterion = nn.MSELoss()
optimizer = torch.optim.Adam(model.parameters(), lr=0.01)

# 训练模型
for epoch in range(1000000):
    y_pred = model(x_train)
    loss = criterion(y_pred, y_train)
    optimizer.zero_grad()
    loss.backward()
    optimizer.step()
    if (epoch + 1) % 10000 == 0:
        print('Epoch[{}], loss: {:.6f}'.format(epoch + 1, loss.item()))
        # 可视化拟合结果
        model.eval()
        y_pred = model(x_train)
        plt.scatter(x_train.numpy(), y_train.numpy(), s=0.1, label='Original data')
        # plt.plot(
        #     x_train.numpy(), y_train.numpy(), 'ro', label='Original data')
        plt.plot(x_train.numpy(), y_pred.detach().numpy(), label='Fitted line')
        plt.legend()
        plt.show()
        if loss.item() < 1:
            print(model(torch.tensor(x_predict).float().reshape(-1, 1)).reshape(1, -1).tolist())
            # print(model(torch.tensor(x_predict).float().reshape(1, -1)).tolist())
# 可视化拟合结果
model.eval()
y_pred = model(x_train)
plt.plot(x_train.numpy(), y_train.numpy(), 'ro', label='Original data')
plt.plot(x_train.numpy(), y_pred.detach().numpy(), label='Fitted line')
plt.legend()
plt.show()

print(model(torch.tensor(x_predict).float().reshape(-1, 1)).reshape(1, -1).tolist())

但是

过拟合咯 调不明白 摆了

工控1

傻逼题目
fscan 扫出windows远程桌面
直接链接

看到是win7
账号猜是Administrator
然后输入123456就进去了（我最喜欢的linux密码（

桌面上有flag

预期解是msf打漏洞 但是没有复现环境了

ai2

一个小飞机的图片 让修改10个点导致检测错误

修改一下代码 本地爆破即可

import random
from PIL import Image
import torch
from torchvision import transforms

pixel_num = 10


def Image_check(tmpnet, tmpimg):
    labellist = tmpnet(tmpimg).tolist()[0]
    maxnum = -1000
    loc = 0
    for j in range(len(labellist)):
        if (maxnum < labellist[j]):
            loc = j
            maxnum = labellist[j]
    if (loc == 1):
        return True
    else:
        return False


def Main():
    while (1):
        adv_images = Image.open('./77.jpg').convert('RGB')
        ts = transforms.Compose([transforms.ToTensor()])
        adv_images = ts(adv_images).reshape([1, 3, 32, 32]).tolist()
        t = ""
        for i in range(10):
            pos_x = random.randint(0, 31)
            pos_y = random.randint(0, 31)
            r, g, b = random.random(), random.random(), random.random()
            adv_images[0][0][pos_x][pos_y] = r
            adv_images[0][1][pos_x][pos_y] = g
            adv_images[0][2][pos_x][pos_y] = b
            t += f"{pos_x},{pos_y},{r},{g},{b}|"
        # print(t)
        net = torch.load('./Lenet.pth', map_location='cpu')
        adv_images = torch.tensor(adv_images)
        if (Image_check(net, adv_images)):
            print('flag{test}')
            print(t)
            break
        else:
            print('Point format error!')


if __name__ == '__main__':
    Main()

运气再差1分钟也爆出来了

ai3

哈哈 傻逼ai
谁真做ai啊
捏妈复现找不到附件了

题目给出了一个网络的定义和pt
和一个输出

定义有linear层

然后求逆矩阵乘一下即可
绷不住了

有人拟合了一天loss都没掉下0.1过 导致pwn还丢了好多分

Car Manager

帮pwn爷爷看了个数独

import copy
import random
import re
import sys

sys.setrecursionlimit(100000)  # 发现python默认的递归深度是很有限的


# （默认是1000），因此当递归深度超过999的
# 样子，就会引发这样的一个异常。


def get_next(m: "数独矩阵", x: "空白格行数", y: "空白格列数"):
    """ 功能：获得下一个空白格在数独中的坐标。       
    """
    for next_y in range(y + 1, 9):  # 下一个空白格和当前格在一行的情况
        if m[x][next_y] == 0:
            return x, next_y
    for next_x in range(x + 1, 9):  # 下一个空白格和当前格不在一行的情况
        for next_y in range(0, 9):
            if m[next_x][next_y] == 0:
                return next_x, next_y
    return -1, -1  # 若不存在下一个空白格，则返回 -1，-1


def value(m: "数独矩阵", x: "空白格行数", y: "空白格列数"):
    """ 功能：返回符合"每个横排和竖排以及
              九宫格内无相同数字"这个条件的有效值。
    """
    i, j = x // 3, y // 3
    grid = [m[i * 3 + r][j * 3 + c] for r in range(3) for c in range(3)]
    v = set([x for x in range(1, 10)]) - set(grid) - set(m[x]) - \
        set(list(zip(*m))[y])
    return list(v)


def start_pos(m: "数独矩阵"):
    """ 功能：返回第一个空白格的位置坐标"""
    for x in range(9):
        for y in range(9):
            if m[x][y] == 0:
                return x, y
    return False, False  # 若数独已完成，则返回 False, False


def try_sudoku(m: "数独矩阵", x: "空白格行数", y: "空白格列数"):
    """ 功能：试着填写数独 """
    for v in value(m, x, y):
        m[x][y] = v
        next_x, next_y = get_next(m, x, y)
        if next_y == -1:  # 如果无下一个空白格
            return True
        else:
            end = try_sudoku(m, next_x, next_y)  # 递归
            if end:
                return True
            m[x][y] = 0  # 在递归的过程中，如果数独没有解开，
            # 则回溯到上一个空白格


def sudoku(m):
    x, y = start_pos(m)
    try_sudoku(m, x, y)
    return m


def nmsl(s):
    m = [[0 for i in range(9)] for j in range(9)]
    t = re.findall(".{3}", s)
    for pos in t:
        x = ord(pos[0]) - ord("a")
        y = ord(pos[1]) - ord('A')
        z = int(pos[2])
        m[x][y] = z
    t = copy.deepcopy(m)
    m = sudoku(m)
    print(m)
    import numpy
    m = numpy.array(m) - numpy.array(t)
    print(m)
    flag=""
    for i in range(9):
        for j in range(9):
            if m[i][j] != 0:
                flag+=(f"{chr(i + ord('a'))}{chr(j + ord('A'))}{m[i][j]}")
    print(flag.encode())


if __name__ == "__main__":
    nmsl("aA5aC7aH1bA9bD1bE4bF6bH5bI2cA4cG3cI8dD6dF4dH3dI7eD5eE7eI1fC4fG9gF7hA3hG1iC6iD8iE1iF9iH4")
    # m = [
    #     [6, 0, 0, 1, 0, 0, 7, 0, 8],
    #     [0, 0, 0, 8, 0, 0, 2, 0, 0],
    #     [2, 3, 8, 0, 5, 0, 1, 0, 0],
    #     [0, 0, 0, 0, 4, 0, 0, 9, 2],
    #     [0, 0, 4, 3, 0, 8, 6, 0, 0],
    #     [3, 7, 0, 0, 1, 0, 0, 0, 0],
    #     [0, 0, 3, 0, 7, 0, 5, 2, 6],
    #     [0, 0, 2, 0, 0, 4, 0, 0, 0],
    #     [9, 0, 7, 0, 0, 6, 0, 0, 4]
    # ]
    #
    # sudoku(m)

""" 数独结果如下：
[
    [6, 9, 5, 1, 2, 3, 7, 4, 8], 
    [7, 4, 1, 8, 6, 9, 2, 5, 3], 
    [2, 3, 8, 4, 5, 7, 1, 6, 9], 
    [8, 1, 6, 7, 4, 5, 3, 9, 2], 
    [5, 2, 4, 3, 9, 8, 6, 7, 1], 
    [3, 7, 9, 6, 1, 2, 4, 8, 5], 
    [4, 8, 3, 9, 7, 1, 5, 2, 6], 
    [1, 6, 2, 5, 8, 4, 9, 3, 7], 
    [9, 5, 7, 2, 3, 6, 8, 1, 4]
]
"""