Misc

tiny traffic

打开流量包,导出对象的http里有3个很可疑的文件:flag_wrapper,secret和test
flag_crapper用gz解压出来时flag格式
secret和test是br格式文件,查询后可知br是表示采用 Brotli 算法的编码方式。
于是找到解密网站:https://myl.moe/utils/brotli/
将test解密后得到一串代码,查询知为Protobuf,保存为1.proto
把secret解密后写入文件,安装Protoc执行protoc --decode=PBResponse 1.proto <secret得到:

code: 200
flag_part_convert_to_hex_plz: 15100450
dataList {
  flag_part: "e2345"
  junk_data: "7af2c"
}
dataList {
  flag_part: "7889b0"
  junk_data: "82bc0"
}
flag_part_plz_convert_to_hex: 16453958
flag_last_part: "d172a38dc"

hex解一下得到flag:CISCN{e66a22e23457889b0fb1146d172a38dc}

running_pixel

下载得到一张gif图片,用脚本分离,得到382张图片:

from PIL import Image
img=Image.open('running_pixel.gif')
for i in range(img.n_frames):
    img.seek(i)
    new = Image.new("RGB", img.size)
    new.paste(img)
    new.save('png\\'+str(i)+'.png')

观察可知图片10张一循环,把图片第1帧和第11帧进行逐像素比较发现奇怪的像素点(233,233,233)
进一步研究发现第2帧也有(233,233,233),于是新建一张图,将每一帧有(233,233,233)位置设为黑色,得到一张含有一堆字符的图

因为字符顺序,方向是乱的,于是在每一帧提取后都保存一张图,提取脚本如下:

from PIL import Image
im = Image.new('RGB',(400,400),(255,255,255))
for k in range(0,382):
    img=Image.open("png\\"+str(k)+".png")
    width,height=img.size
    for i in range(0,width):
        for j in range(0,height):
            if img.getpixel((i,j))==(233,233,233):
                im.putpixel((i,j),(0,0,0))
    im.save("out\\"+str(k)+".png")
im.show()

逐个读取得到flag:CISCN{12504d0f-9de1-4b00-87a5-a5fdd0986a00}

隔空传话

data.txt里的数据是PDU短信编码
前4个解密出来部分关键数据

SMSC#
Receipient:+8615030442000
Validity:Rel 4d 
TP_PID:00
TP_DCS:00
TP_DCS-popis:Uncompressed Text
No class
Alphabet:Default

hello,bob!what is the flag?
Length:27
SMSC#
Receipient:+10086
Validity:Not Present
TP_PID:00
TP_DCS:00
TP_DCS-popis:Uncompressed Text
No class
Alphabet:Default

the first part of the flag is the first 8 digits of your phone number
Length:69

SMSC#
Receipient:+8615030442000
Validity:Rel 1h 
TP_PID:00
TP_DCS:08
TP_DCS-popis:Uncompressed Text
No class
Alphabet:UCS2(16)bit

看看你能从这些数据里发现什么?w465
Length:16.5

可知flag前8位为86150304
后面数据解出来为16进制,按照时间戳排序可得到png的16进制,写入文件,发现宽高不对
联想前面的w465,改宽为465,得到flag:CISCN{15030442_b586_4c9e_b436_26def12293e4}

robot

因为是机器人写出的字符串,所以流量包应该会含有带坐标的数据
打开流量包,追踪第一个TCP流,发现有疑似坐标的数据,另存为写脚本提取画出来:

import re
import matplotlib.pyplot as plt
f=open('1.txt','r')
s=f.read()
x=[]
y=[]
zb=re.findall("Value\.\[(\d+),(\d+),0\]",s)
for i in range(len(zb)):
    x.append(int(zb[i][0]))
    y.append(int(zb[i][1]))
plt.plot(x, y, '.')
plt.show()

翻转几下即可得到字符串为:easy_robo_xx
md5加密得到flag:CISCN{d4f1fb80bc11ffd722861367747c0f10}

Crypto

rsa

flag被分成三部分,第一个部分e=3可爆破k开次方根,第二个部分共模攻击,第三个部分为已知p的高位攻击的Coppersmith攻击
第一部分:

from gmpy2 import*    #python第三方库
from Crypto.Util.number import long_to_bytes

n = 123814470394550598363280518848914546938137731026777975885846733672494493975703069760053867471836249473290828799962586855892685902902050630018312939010564945676699712246249820341712155938398068732866646422826619477180434858148938235662092482058999079105450136181685141895955574548671667320167741641072330259009
c = 19105765285510667553313898813498220212421177527647187802549913914263968945493144633390670605116251064550364704789358830072133349108808799075021540479815182657667763617178044110939458834654922540704196330451979349353031578518479199454480458137984734402248011464467312753683234543319955893

i=0
while 1:
    if(iroot(c+i*n,3)[1]==1):           #或者 iroot(c-i*n,3)
        print(long_to_bytes(iroot(c+i*n,3)[0]))
        break
    i=i+1

第二部分:

from Crypto.Util.number import long_to_bytes
from gmpy2 import *

n = 111381961169589927896512557754289420474877632607334685306667977794938824018345795836303161492076539375959731633270626091498843936401996648820451019811592594528673182109109991384472979198906744569181673282663323892346854520052840694924830064546269187849702880332522636682366270177489467478933966884097824069977
c1 = 54995751387258798791895413216172284653407054079765769704170763023830130981480272943338445245689293729308200574217959018462512790523622252479258419498858307898118907076773470253533344877959508766285730509067829684427375759345623701605997067135659404296663877453758701010726561824951602615501078818914410959610
c2 = 91290935267458356541959327381220067466104890455391103989639822855753797805354139741959957951983943146108552762756444475545250343766798220348240377590112854890482375744876016191773471853704014735936608436210153669829454288199838827646402742554134017280213707222338496271289894681312606239512924842845268366950
e1 = 17
e2 = 65537

s = gcdext(e1,e2)

m = pow(c1,s[1],n)*pow(c2,s[2],n)%n

print(long_to_bytes(m))

第三部分:

from sage.all import *
import binascii

n = 113432930155033263769270712825121761080813952100666693606866355917116416984149165507231925180593860836255402950358327422447359200689537217528547623691586008952619063846801829802637448874451228957635707553980210685985215887107300416969549087293746310593988908287181025770739538992559714587375763131132963783147

cipher = 59213696442373765895948702611659756779813897653022080905635545636905434038306468935283962686059037461940227618715695875589055593696352594630107082714757036815875497138523738695066811985036315624927897081153190329636864005133757096991035607918106529151451834369442313673849563635248465014289409374291381429646

e2 = 65537
pbits = 512
p4 = 7117286695925472918001071846973900342640107770214858928188419765628151478620236042882657992902
kbits = pbits - p4.nbits()
print(p4.nbits())
p4 = p4 << kbits
PR.<x> = PolynomialRing(Zmod(n))
f = x + p4
roots = f.small_roots(X=2 ^ kbits, beta=0.4)
# rint roots
if roots:
    p = p4 + int(roots[0])
    print("p: ", hex(int(p)))
    assert n % p == 0
    q = n / int(p)
    print("q: ", hex(int(q)))
    print(gcd(p, q))
    phin = (p - 1) * (q - 1)
    print(gcd(e2, phin))
    d = inverse_mod(e2, phin)
    flag = pow(cipher, d, n)
    flag = hex(int(flag))[2:-1]
    print(flag)

解出来text为:
b" \nO wild West Wind, thou breath of Autumn's being,\nThou, from whose unseen presence the leaves dead\nAre driven, like ghosts from an enchanter fleeing,\nYellow, and black, and pale, and hectic red,\nPestilence-stricken multitudes: O thou,\nWho chariotest to their dark wintry bed\n"
对其md5得到flag:CISCN{3943e8843a19149497956901e5d98639}


现在、你眼中看到了什么?