misc
简单隐写
丢进kali binwalk 分离一下 得到一个加密的压缩包 内含flag.txt
使用jphs无密码得到一个txt
得到password:catf1agcatf1agcatf1ag
解压压缩包得到一串字符串dbug1bh{KQit_x1o_Z0v_H3u_JU!!!}
凯撒位移一下得到flag
flag:
catf1ag{JPhs_w1n_Y0u_G3t_IT!!!}
十位马
打开data文件，发现是十六进制
转成ASCII，发现熟悉字符png，但是是反的
用脚本处理一下
with open('data','r') as f:
s = f.readlines()[0]
s = [s[i:i+2] for i in range(0,len(s),2)]
s = ''.join(s[::-1])
with open('data.txt','w') as f1:
f1.write(s)
然后放入010editor保存为二进制文件
用binwalk分离一下
有100张图片，用ps拼接起来
应该是个二维码，添加上定位符
扫描得到flag
flag{cbef4c93-5e9c-11ed-8205-666c80085daf}
Web
history
发现grafana版本是8.30，存在任意文件读取漏洞
根据题目history，直接去读取历史命令,发现flag在/home/grafana/下面
直接读取flag
flag:
flag{b0e5ab30e5e65284361a94ea1af443ff}
Crypto
疑惑
根据题目名字提示，直接将key1和key2的值做异或，然后拼接即可得到flag
keys1 = "welcome_to_nine-ak_match_is_so_easy_!@!"
keys2 = "20 4 24 5 94 12 2 36 26 6 49 11 68 15 14 114 12 10 43 14 9 43 10 27 31 31 22 45 10 48 58 4 18 10 38 31 14 97 92"
keys2 = keys2.split(' ')
flag = ''
for i in range(len(keys1)):
flag += chr(ord(keys1[i])^int(keys2[i]))
print(flag)
flag:
catf1ag{nine-ak_match_is@very_easy_@/!}
ezrsa
猜测出题者的考点是费马分解，但是不小心给了d，所以直接求m即可
下面给出两种解法非预期解法
import gmpy2
from Crypto.Util.number import *
c = 11665709552346194520404644475693304343544277312139717618599619856028953672850971126750357095315011211770308088484683204061365343120233905810281045824420833988717463919084545209896116273241788366262798828075566212041893949256528106615605492953529332060374278942243879658004499423676775019309335825331748319484916607746676069594715000075912334306124627379144493327297854542488373589404460931325101587726363963663368593838684601095345900109519178235587636259017532403848656471367893974805399463278536349688131608183835495334912159111202418065161491440462011639125641718883550113983387585871212805400726591849356527011578
d = 12344766091434434733173074189627377553017680360356962089159282442350343171988536143126785315325155784049041041740294461592715296364871912847202681353107182427067350160760722505537695351060872358780516757652343767211907987297081728669843916949983336698385141593880433674937737932158161117039734886760063825649623992179585362400642056715249145349214196969590250787495038347519927017407204272334005860911299915001920451629055970214564924913446260348649062607855669069184216149660211811217616624622378241195643396616228441026080441013816066477785035557421235574948446455413760957154157952685181318232685147981777529010093
n = 13717871972706962868710917190864395318380380788726354755874864666298971471295805029284299459288616488109296891203921497014120460143184810218680538647923519587681857800257311678203773339140281665350877914208278709865995451845445601706352659259559793431372688075659019308448963678380545045143583181131530985665822655263963917413080872997526445384954610888776917323156325542921415838122754036103689148810677276471252057077595104724365967333418002158480223657363936976281758713027828747277980907153645847605403914070601944617432177385048803228970693240587900504431163155958465431312258451026447435473865563581029300541109
m = pow(c,d,n)
flag = long_to_bytes(m)
print(flag)
预期解法
import gmpy2
from Crypto.Util.number import *
c = 11665709552346194520404644475693304343544277312139717618599619856028953672850971126750357095315011211770308088484683204061365343120233905810281045824420833988717463919084545209896116273241788366262798828075566212041893949256528106615605492953529332060374278942243879658004499423676775019309335825331748319484916607746676069594715000075912334306124627379144493327297854542488373589404460931325101587726363963663368593838684601095345900109519178235587636259017532403848656471367893974805399463278536349688131608183835495334912159111202418065161491440462011639125641718883550113983387585871212805400726591849356527011578
e = 65537
n = 13717871972706962868710917190864395318380380788726354755874864666298971471295805029284299459288616488109296891203921497014120460143184810218680538647923519587681857800257311678203773339140281665350877914208278709865995451845445601706352659259559793431372688075659019308448963678380545045143583181131530985665822655263963917413080872997526445384954610888776917323156325542921415838122754036103689148810677276471252057077595104724365967333418002158480223657363936976281758713027828747277980907153645847605403914070601944617432177385048803228970693240587900504431163155958465431312258451026447435473865563581029300541109
near_p = gmpy2.iroot(n,2)[0]
while n%near_p !=0:
near_p = gmpy2.next_prime(near_p)
p = near_p
q = n//p
phi = (q-1)*(p-1)
d = gmpy2.invert(e,phi)
m = pow(c,d,n)
flag = long_to_bytes(m)
print(flag)
flag:
flag{3895dfda-67b1-11ed-b784-b07b2568d266}
passwd
将密文69d00d9bc39e01687abf84e98e27c889cf1442b53edba27d3235acbeb7b0ae95直接丢到cmd5解密得到202211121750
flag:
catf1ag{202211121750}
re
遗失的物品
binwalk分离 apk 得到dex文件，发现flag源代码
将其值带入解密RSA得到C=15318
发现代码将flag与c做拼接，并且做了两次hex以及一次base64
然后在resources.arsc文件中发现疑似base64字符串
MzMzNjMzMzMzMzM2MzMzMTMzMzczMzM0MzMzNjMzMzYzMzMzMzMzMTMzMzYzMzMxMzMzNjMzMzczMzM3MzYzMjMzMzYzMzMyMzMzNjMzMzIzMzM2MzMzNDMzMzYzMzM1MzMzNjMzMzMzMzM2MzMzNjMzMzYzMzM2MzMzMzMzMzgzMzMzMzMzNzMzMzMzMzMwMzMzNjMzMzQzMzMzMzMzNDMzMzMzMzM4MzMzMzMzMzUzMzMzMzMzOTMzMzMzMzM0MzMzNjMzMzQzMzMzMzMzMDMzMzMzMzM1MzMzMzMzMzMzMzMzMzMzODMzMzMzMzMwMzMzMzMzMzgzMzMzMzMzNzMzMzYzMzM2MzMzNjMzMzMzMzMzMzMzNTMzMzYzMzM1MzMzMzMzMzAzMzMzMzMzMDMzMzMzMzMyMzMzMzMzMzAzMzM3MzYzNDMzMzMzMzMxMzMzMzMzMzUzMzMzMzMzMzMzMzMzMzMxMzMzMzMzMzg=
按照代码相反顺序解密得到flag
flag:
catf1ag{bbdecff870d48594d0538087fc5e0020}
【喜欢之人，只管远去，我只管喜欢。】