[原创]看雪.深信服 2021 KCTF 春季赛第二题南冥神功 WP-CTF对抗-看雪-安全社区|安全招聘|kanxue.com

[原创]看雪.深信服 2021 KCTF 春季赛第二题南冥神功 WP

2021-5-11 15:45 3834

[原创]看雪.深信服 2021 KCTF 春季赛第二题南冥神功 WP

poyoten

2021-5-11 15:45

3834

此题应该属于迷宫类的题目。要求是从开始处走遍预定的路径，且走过的路径点不能重复走，相邻两次的位置行和列的变化均不能超过1格。每个输入字符可以走迷宫两步。思路是通过找到迷宫路径，然后反推输入，最后得到flag。
迷宫是9*10的：

0x53, 0x00, 0x01, 0x00, 0x00, 0x01, 0x00, 0x00, 0x01, 0x01, 
0x01, 0x01, 0x00, 0x00, 0x01, 0x00, 0x00, 0x01, 0x00, 0x00, 
0x00, 0x00, 0x01, 0x00, 0x01, 0x01, 0x01, 0x01, 0x01, 0x00, 
0x00, 0x01, 0x01, 0x00, 0x01, 0x00, 0x00, 0x01, 0x00, 0x00, 
0x00, 0x00, 0x01, 0x00, 0x00, 0x01, 0x00, 0x00, 0x01, 0x01, 
0x01, 0x01, 0x00, 0x01, 0x01, 0x01, 0x00, 0x01, 0x00, 0x01, 
0x00, 0x00, 0x01, 0x01, 0x01, 0x01, 0x00, 0x01, 0x00, 0x01, 
0x00, 0x01, 0x01, 0x00, 0x00, 0x01, 0x00, 0x01, 0x00, 0x01, 
0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x01, 0x01, 0x00, 0x00

0x53是开始处，0的表示可以走的路径点。
不难看出，有效路径为：

反算就简单了：

table = '0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ'
row = 0
col = 0
path = [(0,1),(1,2),(2,1),(2,0),(3,0),(4,0),(4,1),(5,2),(6,1),(6,0),(7,0),(8,0),(8,1),(8,2),(7,3),(7,4),(8,4),(8,5),(7,6),(6,6),(5,6),(4,6),(3,6),(3,5),(4,4),(4,3),(3,3),(2,3),(1,3),(0,3),(0,4),(1,5),(1,6),(0,6),(0,7),(1,8),(1,9),(2,9),(3,9),(3,8),(4,7),(5,8),(6,8),(7,8),(8,8),(8,9),]
def get_choice(r,c):
  global row,col
  if r-row == 0:
    if c-col == -1:
      row,col = r,c
      return 4
    elif c-col == 1:
      row,col = r,c
      return 1
  elif r-row == -1:
    if c == col and row&1 == 0:
      row,col = r,c
      return 5
    elif c == col and row&1 == 1:
      row,col = r,c
      return 0
    elif c != col and row&1 == 1:
      row,col = r,c
      return 5
    elif c != col and row&1 == 0:
      row,col = r,c
      return 0
  elif r-row == 1:
    if c == col and row&1 == 1:
      row,col = r,c
      return 2
    elif c == col and row&1 == 0:
      row,col = r,c
      return 3
    elif c != col and row&1 == 0:
      row,col = r,c
      return 2
    elif c != col and row&1 == 1:
      row,col = r,c
      return 3
  else:
    print 'err'
 
def run(idx,n1,n2):
    for i in range(36):
      if (idx+i/6)%6 == n2 and 5-((idx+i)%6) == n1:
        return table[i]
 
def main():
  l = []
  for r,c in path:
    l.append(get_choice(r,c))
  flag = ''
  for i in range(len(l)/2):
    flag += run(i,l[2*i],l[2*i+1])
  print flag
 
if __name__ == '__main__':
  main()