杭电hgame2021 week1

web

Hitchhiking_in_the_Galaxy

http请求头，按照每一步提示增加项

watermelon

f12在调试器中查看project.js,搜索1999

宝藏走私者

http请求走私

GET / HTTP/1.1
 
Host: thief.0727.site
 
GET /secret HTTP/1.1
 
Host:thief.0727.site
 
client-ip:127.0.0.1
 
foo:

智商检测机

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

import requests
 
import json
 
from bs4 import BeautifulSoup
 
from sympy import *
 
numArr = ["0","1","2","3","4","5","6","7","8","9","-","+"]
 
def scan(str1):
 
    newStr = ""
 
    for x in range(0,len(str1)):
 
        if str1[x] in numArr:
 
            newStr += str1[x]
 
    return newStr
 
def getQ(session="session=eyJzb2x2aW5nIjoxfQ.YBfJbQ.L2PH1NyDzVTQcjiJjLR5lqeU4cw"):
 
    headers = {"Cookie":session}
 
    res = requests.get(url="http://r4u.top:5000/api/getQuestion",headers=headers)
 
    return json.loads(res.text)
 
#q = getQ()
 
def anaylaze(q):
 
    q = q['question']
 
    soup = BeautifulSoup(q,"lxml")
 
    xiaxian = soup.msubsup.mo.next_sibling
 
    shangxian = soup.msubsup.mo.next_sibling.next_sibling
 
    a = soup.math.mn
 
    a = a.next_element.next_element.next_element.next_element.next_element.next_element.next_element.next_element
 
    b = soup.math.mn.next_element.next_element.next_element.next_element.next_element.next_element.next_element.next_element.next_element.next_element.next_element.next_element.next_element.next_element
 
    fuhao = soup.math.mn.next_element.next_element.next_element.next_element.next_element.next_element.next_element.next_element.next_element.next_element.next_element.next_element
 
    return [int(scan(str(xiaxian))),int(scan(str(shangxian))),int(scan(str(a))),scan(str(fuhao)),int(scan(str(b)))]
 
#print(anaylaze(q))
 
def calc(arr):
 
    print(arr)
 
    x = symbols('x')
 
    if arr[3] == "+":
 
        answer = integrate(arr[2]*x+arr[4], (x, arr[0], arr[1]))
 
    else:
 
        answer = integrate(arr[2]*x-arr[4], (x, arr[0], arr[1]))
 
    return(round(answer,2))
 
#answer = calc(anaylaze(q))
 
def submit(answer,cookie="session=eyJzb2x2aW5nIjoxfQ.YBfJbQ.L2PH1NyDzVTQcjiJjLR5lqeU4cw"):
 
    data = '{"answer":'+str(answer)+'}'
 
    print(data)
 
    headers = {"Cookie":cookie,"Content-Type":"application/json;charset=UTF-8"}
 
    res = requests.post(url="http://r4u.top:5000/api/verify",data=data,headers=headers)
 
    print(res.text)
 
    newCookie = res.headers['Set-Cookie']
 
    print(newCookie)
 
    return newCookie
 
#submit(answer)
 
def run(cookie):
 
    q = getQ(cookie)
 
    answer = calc(anaylaze(q))
 
    cookie = submit(answer,cookie)
 
    run(cookie)
 
run("session=eyJzb2x2aW5nIjozfQ.YBfbuQ.R7aqFFYJmRgJ7FITfhRqfCKPNCg")

走私者的愤怒

和宝藏走私者一样的考点

re

apacha

图片.png

主要加密流程如上，写出正向代码，然后对着逆

v6l = [ 0x9E3779B9 , 0x3C6EF372, 0xDAA66D2B, 0x78DDE6E4, 0x1715609D, 0xB54CDA56, 0x5384540F]

v7l = [ 0x278DDE6E , 0xF1BBCDC, 0x36A99B4A, 0x1E3779B9, 0x5C55827, 0x2D533695, 0x14E11503]

key = [1, 2, 3, 4]

flag = [0xE74EB323, 0xB7A72836, 0x59CA6FE2, 0x967CC5C1, 0xE7802674, 0x3D2D54E6, 0x8A9D0356, 0x99DCC39C, 0x7026D8ED, 0x6A33FDAD, 0xF496550A, 0x5C9C6F9E, 0x1BE5D04C, 0x6723AE17, 0x5270A5C2, 0xAC42130A, 0x84BE67B2, 0x705CC779, 0x5C513D98, 0xFB36DA2D, 0x22179645, 0x5CE3529D, 0xD189E1FB, 0xE85BD489, 0x73C8D11F, 0x54B5C196, 0xB67CB490, 0x2117E4CA, 0x9DE3F994, 0x2F5AA1AA, 0xA7E801FD, 0xC30D6EAB, 0x1BADDC9C, 0x3453B04A, 0x92A406F9]
 
'''   正向加密代码
flag = b'hgame{aaaaaaaaaaaaaaaaaaaaaaaaaaaa}'
flag = list(flag)
v5 = flag[34]
for i in range(7):

    for j in range(34):

        v5 = flag[j] + ((((v5 >> 5) ^ (4 * flag[j + 1])) + ((16 * v5) ^ (flag[j + 1] >> 3))) ^ ((key[ (j ^ v7l[i] ) & 3 ] ^ v5) + (flag[j + 1] ^ v6l[i])))

        v5 &= 0xffffffff

        flag[j] = v5
 
    v5 = flag[34] + (((key[(34 ^ v7l[i]) & 3] ^ v5) + (flag[0] ^ v6l[i])) ^ (((4 * flag[0]) ^ (v5 >> 5)) + (((16 * v5) ^ (flag[0] >> 3))&0xffffffff)))

    v5 &= 0xffffffff

    flag[34] = v5
'''
 
for x in range(7):
 
    i = 6 - x

    v5 = flag[34]

    flag[34] = v5 - ((((key[(34 ^ v7l[i]) & 3] ^ flag[33]) + (flag[0] ^ v6l[i])) ^ (((4 * flag[0]) ^ (flag[33] >> 5)) + ((16 * flag[33]) ^ (flag[0] >> 3))))&0xffffffff)

    flag[34]&=0xffffffff

    for y in range(34):

        j = 33 - y

        v5 = flag[j]

        flag[j] = v5 - (((((flag[j-1] >> 5) ^ (4 * flag[j + 1])) + ((16 * flag[j-1]) ^ (flag[j + 1] >> 3))) ^ ((key[ (j ^ v7l[i] ) & 3 ] ^ flag[j-1]) + (flag[j + 1] ^ v6l[i])))&0xffffffff)

        flag[j]&=0xffffffff

        if(j==0):

            flag[j] = v5 - (((((flag[34] >> 5) ^ (4 * flag[j + 1])) + ((16 * flag[34]) ^ (flag[j + 1] >> 3))) ^ ((key[ (j ^ v7l[i] ) & 3 ] ^ flag[34]) + (flag[j + 1] ^ v6l[i])))&0xffffffff)

            flag[j]&=0xffffffff
 
print(bytes(flag))

HelloRe

签到题，就是一个异或

pypy

简单的python字节码，对照官方文档写出源码，然后逆

raw_flag = ''
 
cipher = list((raw_flag[6:-1]))
 
length = len(cipher)
 
for i in range(length//2):

    cipher[2*i],cipher[2*i+1] = cipher[2*i+1],cipher[2*i]
 
res=[]
 
for i in range(length):

    res.append(ord(cipher[i])^i)
 
res = bytes(res).hex()
 
res = b'30466633346f59213b4139794520572b45514d61583151576638643a'