CTF题目 July. 1st 2021

[Easy] [Misc] Tab, Tab, Attack

Using tabcomplete in the Terminal will add years to your life, esp. when dealing with long rambling directory structures and filenames: Addadshashanammu.zip

Hint: After unzip ing, this problem can be solved with 11 button-presses…(mostly Tab)…

下载下来一个.zip文件：Addadshashanammu.zip

解压，运行，一气呵成。

[Easy] [Misc] Magikarp Ground Mission

Do you know how to move between directories and read files in the shell? Start the container, ssh to it, and then ls once connected to begin. Login via ssh as ctf-player with the password, ee388b88

Hint: Finding a cheatsheet for bash would be really helpful!

https://play.picoctf.org/practice/challenge/189?category=5&originalEvent=34&page=1

cat与cd使用教学。

[Medium] [Web] Who are you?

Let me in. Let me iiiiiiinnnnnnnnnnnnnnnnnnnn

http://mercury.picoctf.net:36622/

Hint: It ain’t much, but it’s an RFC https://tools.ietf.org/html/rfc2616

加上这些headers：

User-Agent: PicoBrowser
Host: mercury.picoctf.net:36622
Referer: http://mercury.picoctf.net:36622/
Date: 01 Jul 2018
DNT: 1
X-Forwarded-For: 31.44.224.0
Accept-Language: sv, en

[Medium] [Crypto] Pixelated

I have these 2 images, can you make a flag out of them?

scrambled1.png

scrambled2.png

Hint1: https://en.wikipedia.org/wiki/Visual_cryptography

Hint2: Think of different ways you can “stack” images

下载下来两张图片：

两个图片异或操作，之后让纯白变纯黑。

执行这段Python代码：

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20

from PIL import Image, ImageChops

i1 = Image.open("scrambled1.png")
i2 = Image.open("scrambled2.png")

w, h = i1.size

i3 = Image.new("RGB", (w, h), (255, 255, 255))

i1l = i1.load()
i2l = i2.load()
i3l = i3.load()

for i in range(w):
    for j in range(h):
        i3l[i, j] = (i1l[i, j][0] ^ i2l[i, j][0], i1l[i, j][1] ^
                     i2l[i, j][1], i1l[i, j][2] ^ i2l[i, j][2])
        if i3l[i, j] == (255, 255, 255):
            i3l[i, j] = (0, 0, 0)
i3.show()

[Hard] [Binary] filtered-shellcode

A program that just runs the code you give it? That seems kinda boring… fun

nc mercury.picoctf.net 16610

Hint: Take a look at the calling convention and see how you might be able to setup all the registers

下载下来一个文件：fun

// TODO