world.execute.me

意义不明。

注意到 ANSWER=$(echo '${{ github.event.issue.body }}' | grep -vP 'Question:.*$'),解析到的内容会被运行然后返回。经过测试只要 Issue 内容不包括 Question: 那么 ANSWER 捕获到的就是整个 Issue body,所以直接 Payload: echo $HEART

Screenshot-202403231016

Webshell_pro

HTTP 的返回包是仅 Base32、Base64 编码,没有额外加密,直接用 Wireshark 把各个包抓下来解码一下,可以得到一个 Python 代码以及:

1
2
3
4
FLAG is NOT HERE!!!!!!!!!!!

PASSWORD:
Password-based-encryption

怀疑 Python 代码就是 HTTP 请求 Payload 的加密代码,自己手搓一下解密部分:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
import base64
import libnum
from Crypto.PublicKey import RSA

prikey = """-----BEGIN PRIVATE KEY-----
MIICdgIBADANBgkqhkiG9w0BAQEFAASCAmAwggJcAgEAAoGBAIr+q/k/yLFaOgUjavMXra2bqwMWdGwqwaFVIK7FAjG56ExZAua/pM/HJNA958gq5/N9QVpxr9geQhUgLX2iGYTlfvfxO3EZs6CIZ5/hu932xTozjaTy8yUI8mnXCgMUM4WgFCmvhjMfhlNHo+z4c/xUQgkwbm6ItA4vF0p3GLjVAgMBAAECgYBDsqawT5DAUOHRft6oZ+//jsJMTrOFu41ztrKkbPAUqCesh+4R1WXAjY4wnvY1WDCBN5CNLLIo4RPuli2R81HZ4OpZuiHv81sNMccauhrJrioDdbxhxbM7/jQ6M9YajwdNisL5zClXCOs1/y01+9vDiMDk0kX8hiIYlpPKDwjqQQJBAL6Y0fuoJng57GGhdwvN2c656tLDPj9GRi0sfeeMqavRTMz6/qea1LdAuzDhRoS2Wb8ArhOkYns0GMazzc1q428CQQC6sM9OiVR4EV/ewGnBnF+0p3alcYr//Gp1wZ6fKIrFJQpbHTzf27AhKgOJ1qB6A7P/mQS6JvYDPsgrVkPLRnX7AkEAr/xpfyXfB4nsUqWFR3f2UiRmx98RfdlEePeo9YFzNTvX3zkuo9GZ8e8qKNMJiwbYzT0yft59NGeBLQ/eynqUrwJAE6Nxy0Mq/Y5mVVpMRa+babeMBY9SHeeBk22QsBFlt6NT2Y3Tz4CeoH547NEFBJDLKIICO0rJ6kF6cQScERASbQJAZy088sVY6DJtGRLPuysv3NiyfEvikmczCEkDPex4shvFLddwNUlmhzml5pscIie44mBOJ0uX37y+co3q6UoRQg==
-----END PRIVATE KEY-----
"""

prikey = RSA.import_key(prikey)

def dec_replace(base64_str: str):
base64_str = base64_str.replace("e5Lg^FM5EQYe5!yF&62%V$UG*B*RfQeM", "/")
base64_str = base64_str.replace("n6&B8G6nE@2tt4UR6h3QBt*5&C&pVu8W", "+")
base64_str = base64_str.replace("JXWUDuLUgwRLKD9fD6&VY2aFeE&r@Ff2", "=")
base64_str = base64_str + '=' * (4 - len(base64_str) % 4)
return base64_str

def decrypt(cipher_text, d):
cipher_text = base64.b64decode(dec_replace(cipher_text).encode())
plain_text = b""
for i in range(0, len(cipher_text), 128):
part = cipher_text[i:i+128]
dec = libnum.n2s(pow(libnum.s2n(part), d, n))
plain_text += dec
return plain_text

if __name__ == '__main__':
from Crypto.Util.number import inverse
phi = (int(prikey._p) - 1) * (int(prikey._q) - 1)
d = inverse(int(prikey.d), phi)

import urllib.parse
cipher = urllib.parse.unquote(input().strip())
plain = decrypt(cipher, d)
print(plain)

用 Wireshark 抓点流量出来解解,能够找到:

1
2
G1TUg4bIVOFYi8omV2SQrTa8fzYfboRNN7fV6FJn6%26B8G6nE%402tt4UR6h3QBt%2A5%26C%26pVu8Wbm3O74uCUbwMkvRCYae44TX1ZO8X4w2Nk1igaIZjSQIJ9MMHhD9cn6%26B8G6nE%402tt4UR6h3QBt%2A5%26C%26pVu8WSV5EzikNsyM5c1nlPS8uqw1P2pJuYLaLxloK0x5xhQHDqqAxkuKrBzPn0noQ2bDn6%26B8G6nE%402tt4UR6h3QBt%2A5%26C%26pVu8WlVnGwsfP7YP9PYJXWUDuLUgwRLKD9fD6%26VY2aFeE%26r%40Ff2
b'echo U2FsdGVkX1+SslS2BbHfe3c4/t/KxLaM6ZFlOdbtfMHnG8lepnhMnde40tNOYjSvoErLzy0csL7c5d4TlMntBQ== > /root/FLAG/flag.txt'

用上面得到的密码将其解密(OpenSSL AES)就得到了 Flag。

ctf80

这几种语言的 Polyglot 能找到现成的代码

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
#/*<?php eval('echo "tanji\n";'); __halt_compiler();?> */
#include <stdio.h> /*
print (0 and "Randark_JMT\n" or "rec");
__DATA__ = 1
"""""
__END__
===== . ===== */
#ifdef __cplusplus
char msg[5] = {'C', 'a', 'i', 'n', '\n'};
#else
char msg[9] = {'c', 'r', 'a', 'z', 'y', 'm', 'a', 'n', '\n'};
#endif
int main() { int i; for(i = 0; i < 9; ++i) putchar(msg[i]); return 0;} /*
"""
#*/

Minecraft:SEED

进入 Minecraft 服务器查看后得知,该题只需要得到服务器当前地图的种子便可以得到 Flag。在没有权限的情况下,可以使用一些工具利用建筑物的坐标来破解种子。某个服务器早些时候地图出生点附近就是海,直接造船出海然后沿着海岸线跑图,用不了多久就能得到所需要的东西:

Screenshot-202402191517