「WriteUp」2019中南校赛

Misc

---

NC

去吧，里面有一切你需要的。
————————————

把压缩包下载下来，解压出 nc.pcapng 这个文件，用wireshark打开。跟踪TCP流，看到一段base64加密，一段被更改的ascii码，一段字母和数字的组合字符串，base64在线解密后是python的加密代码，那么那段组合字符串就是key经过sha512加密后的密文了。先解出key的值为 1556776194：

import hashlib


find_key = 1558684121-2592000  #到达时间是5月2日，259200是一个月的秒数
b = 'd9b29a82f73b898093be8affe532f082e74080f3a1d6918a33e185f762c19684a0439078b10cb7e23727faa9e8a3fb5a4babf7f793c30fa86d12b67154995c9b'

def hash512(s):
    h = hashlib.sha512()
    h.update(str(s).encode('utf-8'))
    return h.hexdigest()

while True:
    key += 1
    print key
    if hash512(str(key)) == b:
        print 'find'
        break

然后把ascii码与key做异或：

key = 1556776194
ascii = 9711711411111497123787411711277105881039065106111110120104565010884114548682101807369661200453640575
flag = str(ascii ^ key)
print flag

得到flag正确的ascii码，转换后得到flag：

aurora{NJupMiXgZAjonxh82lTr6VRePIEBwavH}

---

SOLIDITY

地址：0x404e55fd733ff8c3009be5106a5f44c1b3a6576b
Ropsten
————————————
根据题目的提示 Ropsten 去Google，找到一个区块链的网站，用地址去查询，看到了一个完成的合同，点进去查看更多，把数据的编码方式改为UTF-8，找到flag：

aurora{d28KhG5EptDcH0OF}

---

HALF

一共有两份哦
————————————
下载压缩包并解压，得到一张png图片，想到LSB隐写，用 Stegsolve--->Data Extract查看，在GBRf发现flag的前半段:

用pngcheck查看发现多余数据：

在kali里用dd命令根据偏移量分离数据：

用winhex打开发现是一个没有文件头部表示的png图片，补全：

得到了两张一模一样的png图片，在kail里用compare命令生成两张图片的对比图：

这么多红线猜测是加了盲水印，用盲水印工具分离水印：

完整的flag：

aurora{EwCuWKbhLY8otr4H}

---

Crypto

---

NAIVE_PRNG0

naive~
nc 140.82.19.20 45123
————————————
这是个猜数字的游戏，猜对了就给flag，数字看似是随机生成的。
一开始懵了好久，多试几次之后发现并不是真正的随机生成，Check next 10 random number 后第一个数 1804289383 就是答案，提交得到flag：

AURORA{broken_to_worst_hahahah}

---

NAIVE_RSA0

RSA?
————————————
这是一道RSA的密码题。
e = 3，我们可以用低加密指数攻击，先读取 cipher 文件获得密文，然后发现明文的三次方比 n 大，但是不是足够大，还原m：

from Crypto.Util.number import getPrime, bytes_to_long, long_to_bytes
import gmpy2

n = 944596184878910952264918828296871870994376550458945115258394945073107584173702035979973230660738361172630327621960496272454672732496422999339318188654471910204601330968390297103022738364727453337362198385251002236960101361661918040202036165339768333589056299376897058446389955288838710764178850224984753171552902646225195393795307799225080145564416518846048866414832903230025434101126213440635358354082571921482391685745196953112907788290024449151917565638975172221794083323226310103637529156335586642493986830583679585356467031606826827617520244699586917709280762416539492052960415875646461061269787826714805415719407221087523366347429333359466431951024125697105154441837446345192967298375846760211673136238685670211601498001633401811874044739557854971459770000139308371923735847079684245824356397244021681401775864249234917997277489502084003352067737512704561828201328136271068595038644102118722181194583347195668067691251053156220840731855978538205474623004325770244550226446024576598163764100913061480432121098722621268264322142727933890359031944994515107982197143613130852528978999516503811882849247180413723888824177891793657425942877252813443777922029275037093577669463729857468663658489607472053947326441347663621496156430849523996631737308378819965464124022271648488670669731106892874845122219171857492966317500709601623125149582459270404072727833367221848174325753417252797977803030663910071000796065921485761373667371881974231117477486326293345034509280337329047492102332373702712930729847860908590140794394632881909406664589754236514946602386985031822790567779817767019958733916063119461518028124370795047368353084536075775490812963807687102200929357009366333899423531761526876744777870474557826455433702707417271531300381976447015421648948070517562896827512141969785080788524266986421079341505034297071816437366004796821184678981587004159684554932368186347162273669162187460727526773012212684766172397948227142470918702258745950888367048702980907081253832252716151478583409465289751306792946525476362073790584748769901990112669651234570224592274776406113846028439177811364161864432548532595676882578421605785138198330175308016530275943081455043217677343220943801192914551421746043508948550034056364914497144799658963343027337311650776739829707498952269704646163521188348922635016117695339877218590073847253055931147657012328054539970661943972262728438050114088791918421154537588547802858806161521544516620844416104046169437332233466602499701081666671571
e = 3
i = 1
c = open("cipher", "rb").read()
cipher = bytes_to_long(c)
print 'n=', n
print 'cipher=', cipher
print '[!]Done!\n'
print '[+]Detecting m...'
while 1:
    m, b = gmpy2.iroot(cipher + i * n, 3)
    if b:
        print '  [-]m is: ' + '{:x}'.format(int(m)).decode('hex')
        break
    i += 1

解出flag：

AURORA{e=3_with_no_padding_ruin_movie_time}