浙江工业大学秋季挑战赛wp
这个比赛当天一共有三个比赛要打，这个我们就随便参与一下，打了山东省科技节的比赛，还有NISP。下午正好还是我们学校的军训汇演，就一共拿出来了一个小时做这东西。最后就出了一道杂项，现在倒是有时间看看，顺手整合下网络上有点wp
MISC
Girlfriend's account
jackie的女朋友又偷偷用他的信用卡买东西了，你能算算一共花了多少钱吗？ 我自己的做法是用WPS的大写数字转数字的功能，用哪个做出来了这道题目。在比赛后复盘看了一些大佬的WP，其中白嫖来一个脚本。
import re
import xlrd
data=xlrd.open_workbook("D:\webtest\information.xls")
table = data.sheets()[0]
nrows = table.nrows
price=table.col_values(0, start_rowx=1, end_rowx=5001)
number=table.col_values(1, start_rowx=1, end_rowx=5001)
def num_change(num):
if num=='零':
return 0;
if num=='壹':
return 1;
if num=='贰':
return 2;
if num=='叁':
return 3;
if num=='肆':
return 4;
if num=='陆':
return 6;
if num=='伍':
return 5;
if num=='柒':
return 7;
if num=='捌':
return 8;
if num=='玖':
return 9;
def aoligeiganle(amount):
chinese_num = {'零': 0, '壹': 1, '贰': 2, '叁': 3, '肆': 4, '伍': 5, '陆': 6, '柒': 7, '捌': 8, '玖': 9}
chinese_amount = {'分': 0.01, '角': 0.1, '元': 1, '拾': 10, '佰': 100, '仟': 1000, '圆': 1}
amount_float = 0
if '亿' in amount:
yi = re.match(r'(.+)亿.*', amount).group(1)
amount_yi = 0
for i in chinese_amount:
if i in yi:
amount_yi += chinese_num[yi[yi.index(i) - 1]] * chinese_amount[i]
if yi[-1] in chinese_num.keys():
amount_yi += chinese_num[yi[-1]]
amount_float += amount_yi * 100000000
amount = re.sub(r'.+亿', '', amount, count=1)
if '万' in amount:
wan = re.match(r'(.+)万.*', amount).group(1)
amount_wan = 0
for i in chinese_amount:
if i in wan:
amount_wan += chinese_num[wan[wan.index(i) - 1]] * chinese_amount[i]
if wan[-1] in chinese_num.keys():
amount_wan += chinese_num[wan[-1]]
amount_float += amount_wan * 10000
amount = re.sub(r'.+万', '', amount, count=1)
amount_yuan = 0
for i in chinese_amount:
if i in amount:
if amount[amount.index(i) - 1] in chinese_num.keys():
amount_yuan += chinese_num[amount[amount.index(i) - 1]] * chinese_amount[i]
amount_float += amount_yuan
return amount_float
sum=0
for i in range(0,5000):
sum+=aoligeiganle(price[i])*num_change(number[i])
print(sum)
下面能是我在另一位大佬哪里找到的exalt的公式.....
=SUM(ISNUMBER(SEARCH(TEXT({1,2,3,4,5,6,7,8,9},"[dbnum2]"&{"0亿";"0仟!万";"0佰!万";"0拾!万";"0万";"万!0仟";"万!0佰";"万!0拾";"0元";"0角";"0分"}),IF(ISERR(FIND("万",A2)),"万",)&A2)){1,2,3,4,5,6,7,8,9}10^{8;7;6;5;4;3;2;1;0;-1;-2})
=IF(B3=”壹”,1,IF(B3=”贰”,2,IF(B3=”叁”,3,IF(B3=”肆”,4,IF(B3=”伍”,5,IF(B3=”陆”,6,IF(B3=”柒”,7,IF(B3=”捌”,8,IF(B3=”玖”,9))))))))) </pre>
双目失明，身残志坚
看到这个题目还以为是什么神奇的东西，原来是桥本大辉那一脚，两张图片，同时明显是多了东西，这样应该是图片盲水印，这也符合失明这一点。
Tip ：盲水印脚本：与相关文档，盲水印的题目考察次数倒是蛮多的，还得找题目练一下。
python3命令
python bwmforpy3.py decode original.png blind.png flag.png -oldseed
image<original.png> + image(encoded)<blind.png> -> watermark<flag.png></pre>
然后那张图片是又是盲文，果然是双目失明，身残志坚，这出题人有水平啊。对照盲文对照表可以发现这个flag实际上就是zhejianggongyedaxue.....
RE
菜狗不会，看大佬的吧
三道re: https://www.cnblogs.com/holittech/articles/15335668.html https://www.cnblogs.com/holittech/articles/15335673.html https://www.cnblogs.com/holittech/articles/15335676.html
PWN
菜狗不会，看大佬的吧
https://www.cnblogs.com/LynneHuan/p/15335597.html
Crypto
签到———[网鼎杯 2020 青龙组]（原题）
#!/usr/bin/env python
# -*- coding: utf-8 -*-
from Crypto.Util.number import *
import random
flag=b'flag{******************}'
n = 2 ** 256
flaglong=bytes_to_long(flag)
m = random.randint(2, n-1) | 1
c = pow(m, flaglong, n)
print('m = ' + str(m))
print('c = ' + str(c))
# m = 73964803637492582853353338913523546944627084372081477892312545091623069227301
# c = 21572244511100216966799370397791432119463715616349800194229377843045443048821
其实乍一看你会发现他和RSA加密很像，最后的加密过程为c = pow(m, bytes_to_long(flag), n)
RSA加密就是明文为m，取公钥e和n，密文c=pow(m,e,n)
这边的一个明显区别为，可以理解为flag明文作为RSA加密里面的公钥e进行的求解。
这个在密码学里面是基于离散对数的一种加密，我们在求解明文的时候，也就相当于是求解基于同余运算和原根的一种对数运算。
求解这种问题的话我们用python的sympy模块的discrete_log函数进行求解就可以了。discrete_log(n,c,m)
解题脚本
import sympy
from Crypto.Util.number import *
n = 2 ** 256
m = 73964803637492582853353338913523546944627084372081477892312545091623069227301
c = 21572244511100216966799370397791432119463715616349800194229377843045443048821
flag=sympy.discrete_log(n,c,m)
print(long_to_bytes(flag))
WEB
hellounser
题目先放在这里，解题我还没弄出来先放一个大佬的题解
<?php
class A {
public $var;
public function show(){
echo $this->var;
}
public function __invoke(){
$this->show();
}
}
class B{
public $func;
public $arg;
public function show(){
$func = $this->func;
if(preg_match('/^[a-z0-9]*$/isD', $this->func) || preg_match('/fil|cat|more|tail|tac|less|head|nl|tailf|ass|eval|sort|shell|ob|start|mail|\`|\{|\%|x|\&|\$|\*|\||\<|\"|\'|\=|\?|sou|show|cont|high|reverse|flip|rand|scan|chr|local|sess|id|source|arra|head|light|print|echo|read|inc|flag|1f|info|bin|hex|oct|pi|con|rot|input|\.|log/i', $this->arg)) {
die('No!No!No!');
} else {
include "flag.php";
//There is no code to print flag in flag.php
$func('', $this->arg);
}
}
public function __toString(){
$this->show();
return "<br>"."Nice Job!!"."<br>";
}
}
if(isset($_GET['pop'])){
$aaa = unserialize($_GET['pop']);
$aaa();
}
else{
highlight_file(__FILE__);
}
?>
