0%

NISC-CTF-2019

NISC2019 WriteUp

主要做了RE部分,留了一个idea去实现。

flat - RE

逆向简单题,总共5个check,全部满足了就过关。

但是问题在于实际上多解,所以做的很不踏实。这里给出一个可行解:

1
2
3
4
flat % ./flat                                                                             
please input string:
flag{zbbfasfc-cyby-uwud-yrss-yudaqeyevdxr}
you got it !
  • fun_check1 略
  • fun_check2 检查首部flag{
  • fun_check3 检查末尾}
  • fun_check4 检查uuid4格式中的-
  • fun_check5 把数字加17 把小写字母-48 大写字母直接丢弃

脚本如下:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
cont = [74, 50, 50, 54, 49, 67, 54, 51, 45, 51, 73, 50, 73, 45, 69, 71, 69, 52, 45, 73, 66, 67, 67, 45, 73, 69, 52, 49, 65, 53, 73, 53, 70, 52, 72, 66]
res = []
len = 0
avail = "qwertyuiopasdfghjklzxcvbnm1234567890"
for x in cont:
if x == 45:
res.append(chr(x))
continue
a = 0
if chr(x-17) in avail:
res.append(chr(x-17))
a += 1
continue
if chr(x+48) in avail:
res.append(chr(x+48))
a += 1
continue
print(a)

print("".join(res))
print(len)

src_leak

直接给出源码了,莫名的模板元编程,玩C++必备,题目可能还是抄的博客现成代码…

写脚本直接跑就是了

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
from functools import *
import sympy

res = []
args = [963,4396,6666,1999,3141]
x6 = 0
for now in args:
pos = range(now**2, (now+1)**2)
pos = list(filter(lambda x:reduce(lambda x, y: x+y,list(map(int,bin(x)[2:]))) % 2 == 1, pos))[0]
print(pos)
res.append(str(pos))

for x in range(1,10000+1):
if sympy.isprime(x):
x6 += 1

res.append(str(x6))
print("flag{"+"-".join(res)+"}")