天权信安&catf1ag网络安全联合公开赛---wp

misc

简单隐写

丢进kali binwalk 分离一下 得到一个加密的压缩包 内含flag.txt

使用jphs无密码得到一个txt

得到password:catf1agcatf1agcatf1ag
解压压缩包得到一串字符串
dbug1bh{KQit_x1o_Z0v_H3u_JU!!!}
凯撒位移一下得到flag

flag:

catf1ag{
   JPhs_w1n_Y0u_G3t_IT!!!}

十位马

打开data文件，发现是十六进制

转成ASCII，发现熟悉字符png，但是是反的

用脚本处理一下

with open('data','r') as f:
	s = f.readlines()[0]
	s = [s[i:i+2] for i in range(0,len(s),2)]
	s = ''.join(s[::-1])
	with open('data.txt','w') as f1:
		f1.write(s)

然后放入010editor保存为二进制文件
用binwalk分离一下

有100张图片，用ps拼接起来

应该是个二维码，添加上定位符

扫描得到flag

flag{
   cbef4c93-5e9c-11ed-8205-666c80085daf}

Web

history

发现grafana版本是8.30，存在任意文件读取漏洞

根据题目history，直接去读取历史命令,发现flag在/home/grafana/下面

直接读取flag

flag:

flag{
   b0e5ab30e5e65284361a94ea1af443ff}

Crypto

疑惑

根据题目名字提示，直接将key1和key2的值做异或，然后拼接即可得到flag

keys1 = "welcome_to_nine-ak_match_is_so_easy_!@!"
keys2 = "20 4 24 5 94 12 2 36 26 6 49 11 68 15 14 114 12 10 43 14 9 43 10 27 31 31 22 45 10 48 58 4 18 10 38 31 14 97 92"
keys2 = keys2.split(' ')
flag = ''
for i in range(len(keys1)):
    flag += chr(ord(keys1[i])^int(keys2[i]))
print(flag)

flag:

catf1ag{
   nine-ak_match_is@very_easy_@/!}

ezrsa

猜测出题者的考点是费马分解，但是不小心给了d，所以直接求m即可
下面给出两种解法
非预期解法

import gmpy2
from Crypto.Util.number import  *
c = 11665709552346194520404644475693304343544277312139717618599619856028953672850971126750357095315011211770308088484683204061365343120233905810281045824420833988717463919084545209896116273241788366262798828075566212041893949256528106615605492953529332060374278942243879658004499423676775019309335825331748319484916607746676069594715000075912334306124627379144493327297854542488373589404460931325101587726363963663368593838684601095345900109519178235587636259017532403848656471367893974805399463278536349688131608183835495334912159111202418065161491440462011639125641718883550113983387585871212805400726591849356527011578
d = 12344766091434434733173074189627377553017680360356962089159282442350343171988536143126785315325155784049041041740294461592715296364871912847202681353107182427067350160760722505537695351060872358780516757652343767211907987297081728669843916949983336698385141593880433674937737932158161117039734886760063825649623992179585362400642056715249145349214196969590250787495038347519927017407204272334005860911299915001920451629055970214564924913446260348649062607855669069184216149660211811217616624622378241195643396616228441026080441013816066477785035557421235574948446455413760957154157952685181318232685147981777529010093
n = 13717871972706962868710917190864395318380380788726354755874864666298971471295805029284299459288616488109296891203921497014120460143184810218680538647923519587681857800257311678203773339140281665350877914208278709865995451845445601706352659259559793431372688075659019308448963678380545045143583181131530985665822655263963917413080872997526445384954610888776917323156325542921415838122754036103689148810677276471252057077595104724365967333418002158480223657363936976281758713027828747277980907153645847605403914070601944617432177385048803228970693240587900504431163155958465431312258451026447435473865563581029300541109
m = pow(c,d,n)
flag = long_to_bytes(m)
print(flag)

预期解法

import gmpy2
from Crypto.Util.number import  *
c = 11665709552346194520404644475693304343544277312139717618599619856028953672850971126750357095315011211770308088484683204061365343120233905810281045824420833988717463919084545209896116273241788366262798828075566212041893949256528106615605492953529332060374278942243879658004499423676775019309335825331748319484916607746676069594715000075912334306124627379144493327297854542488373589404460931325101587726363963663368593838684601095345900109519178235587636259017532403848656471367893974805399463278536349688131608183835495334912159111202418065161491440462011639125641718883550113983387585871212805400726591849356527011578
e = 65537
n = 13717871972706962868710917190864395318380380788726354755874864666298971471295805029284299459288616488109296891203921497014120460143184810218680538647923519587681857800257311678203773339140281665350877914208278709865995451845445601706352659259559793431372688075659019308448963678380545045143583181131530985665822655263963917413080872997526445384954610888776917323156325542921415838122754036103689148810677276471252057077595104724365967333418002158480223657363936976281758713027828747277980907153645847605403914070601944617432177385048803228970693240587900504431163155958465431312258451026447435473865563581029300541109
near_p = gmpy2.iroot(n,2)[0]
while n%near_p !=0:
    near_p = gmpy2.next_prime(near_p)
p = near_p
q = n//p
phi = (q-1)*(p-1)
d = gmpy2.invert(e,phi)
m = pow(c,d,n)
flag = long_to_bytes(m)
print(flag)

 

  
 

flag:

flag{
   3895dfda-67b1-11ed-b784-b07b2568d266}

passwd

将密文69d00d9bc39e01687abf84e98e27c889cf1442b53edba27d3235acbeb7b0ae95直接丢到cmd5解密得到
202211121750

flag:

catf1ag{
   202211121750}

re

遗失的物品

binwalk分离 apk 得到dex文件，发现flag源代码

将其值带入解密RSA得到C=15318
发现代码将flag与c做拼接，并且做了两次hex以及一次base64
然后在resources.arsc文件中发现疑似base64字符串

MzMzNjMzMzMzMzM2MzMzMTMzMzczMzM0MzMzNjMzMzYzMzMzMzMzMTMzMzYzMzMxMzMzNjMzMzczMzM3MzYzMjMzMzYzMzMyMzMzNjMzMzIzMzM2MzMzNDMzMzYzMzM1MzMzNjMzMzMzMzM2MzMzNjMzMzYzMzM2MzMzMzMzMzgzMzMzMzMzNzMzMzMzMzMwMzMzNjMzMzQzMzMzMzMzNDMzMzMzMzM4MzMzMzMzMzUzMzMzMzMzOTMzMzMzMzM0MzMzNjMzMzQzMzMzMzMzMDMzMzMzMzM1MzMzMzMzMzMzMzMzMzMzODMzMzMzMzMwMzMzMzMzMzgzMzMzMzMzNzMzMzYzMzM2MzMzNjMzMzMzMzMzMzMzNTMzMzYzMzM1MzMzMzMzMzAzMzMzMzMzMDMzMzMzMzMyMzMzMzMzMzAzMzM3MzYzNDMzMzMzMzMxMzMzMzMzMzUzMzMzMzMzMzMzMzMzMzMxMzMzMzMzMzg=

按照代码相反顺序解密得到flag

flag:

catf1ag{
   bbdecff870d48594d0538087fc5e0020}

【喜欢之人，只管远去，我只管喜欢。】

转载：https://blog.csdn.net/luochen2436/article/details/128259550