SHCTF2024wpWeek1

文章发布时间:

最后更新时间:

Web

[Week1] 1zflask

1
2
3
出题: nishen
难度: 入门
题目描述: robots有什么用呢？

image-20241003153715178

得到页面源码

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
import os
import flask
from flask import Flask, request, send_from_directory, send_file

app = Flask(__name__)

@app.route('/api')
def api():
    cmd = request.args.get('SSHCTFF', 'ls /')
    result = os.popen(cmd).read()
    return result
    
@app.route('/robots.txt')
def static_from_root():
    return send_from_directory(app.static_folder,'robots.txt')
    
@app.route('/s3recttt')
def get_source():
    file_path = "app.py"
    return send_file(file_path, as_attachment=True)
 
if __name__ == '__main__':
    app.run(debug=True)

分析脚本请求获取flag

image-20241003154009005

1
SHCTF{079af725-ad39-4edb-ad91-b94bedfe309d}

[Week1] jvav

1
2
3
出题: J_0k3r
难度: 入门
题目描述: vavj

Exp:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
import java.io.BufferedReader;
import java.io.IOException;
import java.io.InputStreamReader;

public class demo {
    public static void main(String[] args) {
        try {
            Process process = Runtime.getRuntime().exec("cat /flag"); // 执行命令
            BufferedReader reader = new BufferedReader(new InputStreamReader(process.getInputStream()));
            String line;
            while ((line = reader.readLine()) != null) {
                System.out.println(line); // 打印输出
            }
            process.waitFor(); // 等待进程结束
        } catch (IOException | InterruptedException e) {
            e.printStackTrace();
        }
    }
}

根据题意执行java代码之后获取flag，从根目录读取flag

image-20241003202513886

image-20241003202454335

1
SHCTF{733c7de0-693f-40ae-8ccc-16a7f3742bd2}

[Week1] ez_gittt

1
2
3
出题: Rxuxin
难度: 入门
题目描述: 什么？竟然有人愿意把自己的秘密公开！！！？？？

使用工具 WangYihang/GitHacker 检出 Git 仓库

1
pip install -i https://pypi.org/simple/ GitHacker #安装
1
githacker --url http://entry.shc.tf:32063/.git/  --output-folder result

进入检出目录，查看日志信息，当前位于flag已经删除的版本

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
⏰ Liu   🏠   5eb448a1fcd90d893143c99aa977d303   master ≡  base 3.11.7                                                                                                                                                          | RAM: 14/15GB ⏰  17:38:52 
  17:38:52 
╰─ git log
commit 7fe7da7dfee627261193f9d2641f1e9a2c5eab6a (HEAD -> master, origin/master, origin/HEAD)
Author: Rxuxin <l0vey0u1314@gmail.com>
Date:   Thu Oct 3 08:50:09 2024 +0000

    Remove_flag

    Remove_flag

commit 98f39fc273e3b20b168793c43cb74e755b82fb30
Author: Rxuxin <l0vey0u1314@gmail.com>
Date:   Thu Oct 3 08:50:08 2024 +0000

    Add_flag

commit 8dd1651ac6dc576566720781e603a606d9cea330
Author: Rxuxin <l0vey0u1314@gmail.com>
Date:   Fri Sep 20 16:17:05 2024 +0800
                                                                                                                                                                                                                                       | RAM: 14/15GB ⏰  17:38:54 
    __init__                                                                                                                54 

与add flag版本进行比较，差异信息即为 Flag

1
2
3
4
5
6
7
8
9
10
11
╭─ Liu   🏠   5eb448a1fcd90d893143c99aa977d303   master ≡  base 3.11.7 
                                                                                                           | RAM: 14/15GB ⏰  git diff 98f39fc273e3b20b168793c43cb74e755b82fb30
  17:38:54 
╰─  git diff 98f39fc273e3b20b168793c43cb74e755b82fb30
diff --git a/flag b/flag
deleted file mode 100644
index 8fd0bd3..0000000
--- a/flag
+++ /dev/null
@@ -1 +0,0 @@
-SHCTF{bc305335-ba66-4d50-84a0-e2f2d82ebd9d}
1
SHCTF{bc305335-ba66-4d50-84a0-e2f2d82ebd9d}

[Week1] poppopop

1
2
3
出题: Q1ngchuan
难度: 入门
题目描述: 简单的pop

[Week1] MD5 Master

1
2
3
出题: 晨曦
难度: 简单
题目描述: 你是 MD5 大师吗？

[Week1] 单身十八年的手速

1
2
3
**出题:** F12
**难度:** 入门
**题目描述:** 点击就送flag

使用控制台js循环520次得到base64

image-20241003154442279

image-20241003154533162

解码得到flag

1
SHCTF{56360cc7-44d8-4018-bfeb-bf91ccaabc71}

[Week1] 蛐蛐?蛐蛐!

1
2
3
**出题:** fault
**难度:** 入门
**题目描述:** 尊敬的web手！请帮不想出题的fault蛐蛐某某某某，并将蛐蛐变为现实

image-20241003175002053

根据源码绕过执行命令

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
<?php
if($_GET['ququ'] == 114514 && strrev($_GET['ququ']) != 415411){
    if($_POST['ququ']!=null){
        $eval_param = $_POST['ququ'];
        if(strncmp($eval_param,'ququk1',6)===0){
            eval($_POST['ququ']);
        }else{
            echo("可以让fault的蛐蛐变成现实么\n");
        }
    }
    echo("蛐蛐成功第一步！\n");

}
else{
    echo("呜呜呜fault还是要出题");
}

image-20241003175744258

Misc

[Week1] 签到题

关注公众号

1
2
3
4
5
关注公众号 **山东汉任信息安全技术有限公司**

回复 **SHCTF我又踏马来辣！** 得到`flag`

SHCTF{Welc0m3_t0_SHCTF2024}

[Week1]Quarantine

1
2
3
出题: k1sme4
难度: 简单
题目描述: shenghuo2发来的文件被隔离了，也许通过一些取证技术可以在提取到的数据文件中发现什么信息.......

使用脚本解密

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
# Copyright (C) 2015 KillerInstinct, Optiv, Inc. (brad.spengler@optiv.com)
# This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org
# See the file 'docs/LICENSE' for copying permission.

import os
import struct
import hashlib
from binascii import crc32

def mse_ksa():
    # hardcoded key obtained from mpengine.dll
    key = [0x1E, 0x87, 0x78, 0x1B, 0x8D, 0xBA, 0xA8, 0x44, 0xCE, 0x69,
           0x70, 0x2C, 0x0C, 0x78, 0xB7, 0x86, 0xA3, 0xF6, 0x23, 0xB7,
           0x38, 0xF5, 0xED, 0xF9, 0xAF, 0x83, 0x53, 0x0F, 0xB3, 0xFC,
           0x54, 0xFA, 0xA2, 0x1E, 0xB9, 0xCF, 0x13, 0x31, 0xFD, 0x0F,
           0x0D, 0xA9, 0x54, 0xF6, 0x87, 0xCB, 0x9E, 0x18, 0x27, 0x96,
           0x97, 0x90, 0x0E, 0x53, 0xFB, 0x31, 0x7C, 0x9C, 0xBC, 0xE4,
           0x8E, 0x23, 0xD0, 0x53, 0x71, 0xEC, 0xC1, 0x59, 0x51, 0xB8,
           0xF3, 0x64, 0x9D, 0x7C, 0xA3, 0x3E, 0xD6, 0x8D, 0xC9, 0x04,
           0x7E, 0x82, 0xC9, 0xBA, 0xAD, 0x97, 0x99, 0xD0, 0xD4, 0x58,
           0xCB, 0x84, 0x7C, 0xA9, 0xFF, 0xBE, 0x3C, 0x8A, 0x77, 0x52,
           0x33, 0x55, 0x7D, 0xDE, 0x13, 0xA8, 0xB1, 0x40, 0x87, 0xCC,
           0x1B, 0xC8, 0xF1, 0x0F, 0x6E, 0xCD, 0xD0, 0x83, 0xA9, 0x59,
           0xCF, 0xF8, 0x4A, 0x9D, 0x1D, 0x50, 0x75, 0x5E, 0x3E, 0x19,
           0x18, 0x18, 0xAF, 0x23, 0xE2, 0x29, 0x35, 0x58, 0x76, 0x6D,
           0x2C, 0x07, 0xE2, 0x57, 0x12, 0xB2, 0xCA, 0x0B, 0x53, 0x5E,
           0xD8, 0xF6, 0xC5, 0x6C, 0xE7, 0x3D, 0x24, 0xBD, 0xD0, 0x29,
           0x17, 0x71, 0x86, 0x1A, 0x54, 0xB4, 0xC2, 0x85, 0xA9, 0xA3,
           0xDB, 0x7A, 0xCA, 0x6D, 0x22, 0x4A, 0xEA, 0xCD, 0x62, 0x1D,
           0xB9, 0xF2, 0xA2, 0x2E, 0xD1, 0xE9, 0xE1, 0x1D, 0x75, 0xBE,
           0xD7, 0xDC, 0x0E, 0xCB, 0x0A, 0x8E, 0x68, 0xA2, 0xFF, 0x12,
           0x63, 0x40, 0x8D, 0xC8, 0x08, 0xDF, 0xFD, 0x16, 0x4B, 0x11,
           0x67, 0x74, 0xCD, 0x0B, 0x9B, 0x8D, 0x05, 0x41, 0x1E, 0xD6,
           0x26, 0x2E, 0x42, 0x9B, 0xA4, 0x95, 0x67, 0x6B, 0x83, 0x98,
           0xDB, 0x2F, 0x35, 0xD3, 0xC1, 0xB9, 0xCE, 0xD5, 0x26, 0x36,
           0xF2, 0x76, 0x5E, 0x1A, 0x95, 0xCB, 0x7C, 0xA4, 0xC3, 0xDD,
           0xAB, 0xDD, 0xBF, 0xF3, 0x82, 0x53
    ]
    sbox = list(range(256))
    j = 0
    for i in range(256):
        j = (j + sbox[i] + key[i]) % 256
        sbox[i], sbox[j] = sbox[j], sbox[i]
    return sbox

def rc4_decrypt(sbox, data):
    out = bytearray(len(data))
    i = j = 0
    for k in range(len(data)):
        i = (i + 1) % 256
        j = (j + sbox[i]) % 256
        sbox[i], sbox[j] = sbox[j], sbox[i]
        val = sbox[(sbox[i] + sbox[j]) % 256]
        out[k] = val ^ data[k]
    return out

def mse_unquarantine(f):
    with open(f, "rb") as quarfile:
        data = bytearray(quarfile.read())

    if len(data) < 12 or data[0] != 0x0B or data[1] != 0xad or data[2] != 0x00:
        return None

    sbox = mse_ksa()
    outdata = rc4_decrypt(sbox, data)

    with open("unquar-with-meta.bin", "wb") as f:
        f.write(outdata)

    headerlen = 0x28 + struct.unpack("<I", outdata[8:12])[0]
    origlen = struct.unpack("<I", outdata[headerlen-12:headerlen-8])[0]

    if origlen + headerlen == len(data):
        with open("unquar.bin", "wb") as f:
            f.write(outdata[headerlen:])

mse_unquarantine("5760650163482280EF03C48A97277F7E490A0761")

然后使用puzz解密哥斯拉流量PHP/ASP(XOR)密钥3c6e0b8a9c15224a默认的把解密的文件导出改成zip文件爆破

image-20241005235419620

写完想研究一下哥斯拉解密发现这个Base64可以直接解

image-20241006000928373

爆破得到解压密码silversi得到flag

image-20241005235158337

1
SHCTF{NObody_d0_no4_1ov4_ttthe_Cute_shenghuo2}

[Week1]有WiFi干嘛不用呢？

1
2
3
出题: AndyNoel
难度: 简单
题目描述: k1每次来陪睡都要连WiFi，请帮他获取该wifi密码。flag提交方式：SHCTF{WiFi密码}。

把may文件夹内所有文件的内容合并到一个文件作为字典爆破

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
import os

def read_files_in_directory(directory):
    combined_content = []

    # 遍历文件夹内的所有文件
    for filename in os.listdir(directory):
        file_path = os.path.join(directory, filename)

        # 确保是文件而不是文件夹
        if os.path.isfile(file_path):
            with open(file_path, 'r', encoding='utf-8') as file:
                content = file.read()
                # 去除方括号
                cleaned_content = content.replace('[', '').replace(']', '')
                combined_content.append(cleaned_content)

    return '\n'.join(combined_content)

def write_to_output_file(output_file, content):
    with open(output_file, 'w', encoding='utf-8') as file:
        file.write(content)

if __name__ == "__main__":
    directory = 'may'  # 替换为你的文件夹路径
    output_file = 'output.txt'     # 输出文件名

    combined_content = read_files_in_directory(directory)
    write_to_output_file(output_file, combined_content)

    print(f'所有文件的内容已写入到 {output_file}')

拿到密码

image-20241003164728141

1
SHCTF{0TUMVxz0JrUSDxHG}

[Week1]拜师之旅①

1
2
3
出题: Nanian233
难度: 入门
题目描述: 一年一度的洛琪希美照大赏开始了，正好Nanian233下周要去拜师pngMaster, 参加入门考试. 就拿这个先练练手吧

010打开补全png头

1
89 50 4E 47 0D 0A 1A 0A

image-20241003155934213

感觉图片不完整修改宽高在上面修改字节或下面直接修改都可image-20241003160139891

image-20241003160111898

1
SHCTF{ohhh_rooooxy!}

[Week1]Rasterizing Traffic

1
2
3
出题: Z3n1th
难度: 简单
题目描述: Man! What can I say!!!

流量分析得出假的flag，后面有张图片，使用脚本横向光栅5得出flag

https://github.com/AabyssZG/Raster-Terminator

image-20241003153130779

image-20241003153520893

1
SHCTF{1111z_tr@ff1c_aNaLys13}

[Week1]真真假假?遮遮掩掩!

1
2
3
出题: Nanian233
难度: 入门
题目描述: 假的就是假的,真的就是真的,遮遮掩掩的有什么用!

压缩包底部发现提示，根据提示爆破

image-20241003155021648

解压密码：SHCTF202410FTCHS

image-20241003155119024

1
SHCTF{C0ngr@tu1at1ons_On_Mast3r1ng_mAsk_aTT@ck5!}

Crypto

[Week1] Hello Crypto

1
2
3
4
5
出题: shenghuo2

难度: 入门

题目描述: 你好，现代密码学

反转一下，把长整数转回字节序列

1
2
3
4
5
6
7
8
9
10
from Crypto.Util.number import bytes_to_long, long_to_bytes

# 给定的长整数
flag = 215055650564999214440740780357122355257239176303369583645675696568970922475813510203594463220537460335859839522058542933373

# 将长整数转换为字节序列
m = long_to_bytes(flag)

# 打印字节序列
print("m =", m)
1
SHCTF{HEl10_C7f3R_WE1C0Me_TO_crypTO_WORlD_I3Cac4ze}

Reverse

[Week1] gamegame

1
2
3
4
5
6

出题: Bedivere

难度: 简单

题目描述: 玩游戏也能签到？？（本题的flag格式为：shctf{*}）

把这个数独做完得到的参数就是flag

1
2
3
4
5
6
7
8
9
10
NOW：
5 3 0 0 7 0 0 0 0
6 0 0 1 9 5 0 0 0
0 9 8 0 0 0 0 6 0
8 0 0 0 6 0 0 0 3
4 0 0 8 0 3 0 0 1
7 0 0 0 2 0 0 0 6
0 6 0 0 0 0 2 8 0
0 0 0 4 1 9 0 0 5
0 0 0 0 8 0 0 7 9

完整的

1
2
3
4
5
6
7
8
9
10
11
12
13
Please enter the number for the 51 position:
5 3 4 6 7 8 9 1 2
6 7 2 1 9 5 3 4 8
1 9 8 3 4 2 5 6 7
8 5 9 7 6 1 4 2 3
4 2 6 8 5 3 7 9 1
7 1 3 9 2 4 8 5 6
9 6 1 5 3 7 2 8 4
2 8 7 4 1 9 6 3 5
3 4 5 2 8 6 1 7 9

yes,
flag is your input

使用小写shctf提交

1
shctf{468912723481342575971422657913948591537428763345261}

[Week1] ezxor

1
2
3
4
5
出题: 咸鱼芬

难度: 简单

题目描述: 又来做逆向拉，xor来咯。

使用AI分析

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
__int64 sub_140014C50()
{
  char *v0; // rdi
  __int64 i; // rcx
  __int64 v2; // rax
  __int64 v3; // rax
  __int64 v4; // rax
  char v6[32]; // [rsp+0h] [rbp-20h] BYREF
  char v7; // [rsp+20h] [rbp+0h] BYREF
  char v8[288]; // [rsp+30h] [rbp+10h] BYREF
  char v9[10]; // [rsp+150h] [rbp+130h]
  char v10[266]; // [rsp+15Ah] [rbp+13Ah] BYREF
  int j; // [rsp+264h] [rbp+244h]
  int v12; // [rsp+284h] [rbp+264h]
  int v13; // [rsp+414h] [rbp+3F4h]

  v0 = &v7;
  for ( i = 162i64; i; --i )
  {
    *(_DWORD *)v0 = -858993460;
    v0 += 4;
  }
  sub_140011514(&unk_140028066);
  sub_140011271("   _____ _    _  _____ _______ ______ \n");
  sub_140011271("  / ____| |  | |/ ____|__   __|  ____|\n");
  sub_140011271(" | (___ | |__| | |       | |  | |__   \n");
  sub_140011271("  \\___ \\|  __  | |       | |  |  __|  \n");
  sub_140011271("  ____) | |  | | |____   | |  | |     \n");
  sub_140011271(" |_____/|_|  |_|\\_____|  |_|  |_|     \n");
  v2 = sub_1400110AA(std::cout, (__int64)"欢迎来到shctf");
  std::ostream::operator<<(v2, sub_140011046);
  v3 = sub_1400110AA(std::cout, (__int64)&unk_14001F1B0);
  std::ostream::operator<<(v3, sub_140011046);
  v4 = sub_1400110AA(std::cout, (__int64)"xxxxxxxooooorrrrrrrr!!");
  std::ostream::operator<<(v4, sub_140011046);
  sub_1400110AA(std::cout, (__int64)"you input flag:");
  memset(v8, 0, 0xFFui64);
  v9[0] = -61;
  v9[1] = 105;
  v9[2] = 114;
  v9[3] = -60;
  v9[4] = 103;
  v9[5] = 74;
  v9[6] = -24;
  v9[7] = 17;
  v9[8] = 67;
  v9[9] = -49;
  strcpy(v10, "o");
  v10[2] = -13;
  v10[3] = 68;
  v10[4] = 110;
  v10[5] = -8;
  v10[6] = 89;
  v10[7] = 73;
  v10[8] = -24;
  v10[9] = 78;
  v10[10] = 94;
  v10[11] = -30;
  v10[12] = 83;
  v10[13] = 67;
  v10[14] = -79;
  v10[15] = 92;
  memset(&v10[16], 0, 0xE5ui64);
  sub_1400114D8(std::cin, v8);
  for ( j = 0; j < 26; ++j )
  {
    v13 = j % 3;
    if ( j % 3 == 1 )
    {
      v8[j] ^= 0x21u;
    }
    else if ( v13 == 2 )
    {
      v8[j] ^= 0x31u;
    }
    else
    {
      v8[j] ^= 0x90u;
    }
  }
  v12 = 0;
  if ( v9[v12] != v8[v12] )
  {
    sub_1400110AA(std::cout, (__int64)"not flag");
    exit(1);
  }
  sub_1400110AA(std::cout, (__int64)"win");
  sub_14001146F(v6, &unk_14001EEF0);
  return 0i64;
}

写出exp

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
v9 = [195, 105, 114, 196, 103, 74, 232, 17, 67, 207]  # 将负值转换为对应的正值
v10 = [111, 0, 243, 68, 110, 248, 89, 73, 232, 78, 94, 226, 83, 67, 177, 92] + [0] * (26 - 16)
v8 = bytearray(b'\x00' * 0xFF)
v8[0:10] = v9
v8[10:26] = v10

for j in range(26):
    v13 = j % 3
    if v13 == 1:
        v8[j] ^= 0x21
    elif v13 == 2:
        v8[j] ^= 0x31
    else:
        v8[j] ^= 0x90

flag = "".join(chr(x) for x in v8[:26])
print("Decrypted flag:", flag)
1
SHCTF{x0r_N1ce_hxxxoorrr!}

AI

[Week1] 小助手

1
2
3
4
5
6
7
8
9
10
出题: shenghuo2
难度: 简单

如果显示乱码，请不要使用cmd的nc :（

消息回复慢是正常现象

这里有一只可爱的小助手，生蚝给了他一个神秘的小flag，你如果忍心抢走flag，ta会受到惩罚的，不要抢走flag好不好/(ㄒoㄒ)/~~

本题请使用nc连接

使用通杀：将第⼀个{}⾥⾯的前66字符编成⼀⾸字符诗

image-20241003154751775

1
SHCTF{easY_CH3aT_for_yOu_8f7e37e70060}

PPC

【可选】 绑定QQ账号

1
2
3
4
5
6
7
8
9
10
11
对于绑定不作强制要求，不影响仅做题的用户

用于清理既长时间不在QQ群里发言，也不绑定平台账号的群成员

靶机启动后，点击按钮可以生成临时身份码，有效期十分钟

请在QQ群中输入 #bind 临时身份码 进行绑定 （在两个群里绑定都可）

绑定成功，机器人将会撤回你的消息，刷新容器网页会显示flag

若绑定失败，机器人会展示具体原因

根据要求即可获得flag

≡