关于HTB-THM连不上

Zsm published on 2025-04-28 included in 靶场

主要问题

梯子配置

这里是mac系统，linux应该是类似的，win自己挂到linux虚拟机或者是梯子开局域网模式即可
clashorv2rayN都会有一个端口开放，我是直接暴露出去的，记得开系统代理即可

能源大赛2025

Zsm published on 2025-04-23 included in CTF

前言

最近期中考试没怎么刷题来着，复现复现没参加的比赛吧～

题目

simpleSignin

task.py

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14


from Crypto.Util.number import *
from gmpy2 import *
import os

flag = b'xxx'
p = next_prime(bytes_to_long(os.urandom(128)))
q = next_prime(bytes_to_long(os.urandom(128)))
r = next_prime(q)
n = p * q * r
e = 0x10001
print(f"n = {n}")
print(f"c = {pow(bytes_to_long(flag), e, n)}")
print(f"gift1 = {p % (2**10)}")
print(f"gift2 = {(p >> 20) % 2 ** 800}")

拿到题就知道这玩意是copper，好像比赛当天还有人在群里问来着，有点意思(，简单分析一下
gift1->低10位
gift2->右移20位后的低800位
我们可以认为已知了低820位，那10位可以爆破，那么前面直接copper求出

UCSCCTF2025

Zsm published on 2025-04-20 included in CTF

前言

高铁一个小时速通

题目

XR4

task.py

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34


import base64
import random
from secret import flag
import numpy as np
def init_sbox(key):
    s_box = list(range(256))
    j = 0
    for i in range(256):
        j = (j + s_box[i] + ord(key[i % len(key)])) % 256
        s_box[i], s_box[j] = s_box[j], s_box[i]
    return s_box
def decrypt(cipher, box):
    res = []
    i = j = 0
    cipher_bytes = base64.b64decode(cipher)
    for s in cipher_bytes:
        i = (i + 1) % 256
        j = (j + box[i]) % 256
        box[i], box[j] = box[j], box[i]
        t = (box[i] + box[j]) % 256
        k = box[t]
        res.append(chr(s ^ k))
    return (''.join(res))
def random_num(seed_num):
    random.seed(seed_num)
    for i in range(36):
        print(chr(int(str(random.random()*10000)[0:2]) ^ (data[i])))

if __name__ == '__main__':
    ciphertext = "MjM184anvdA="
    key = "XR4"
    box = init_sbox(key)
    a=decrypt(ciphertext, box)
    random_num(int(a))

有一说一，懒得写，gpt梭哈了 exp.py

TGCTF2025

Zsm published on 2025-04-14 included in CTF

前言

rank33，感觉自己还是太菜了，放一部分的wp

题目

crypto

AAAAAAAA·真·签到｜solved by zsm

task

1
2
3
4
5
6


给你flag签个到好了
UGBRC{RI0G!O04_5C3_OVUI_DV_MNTB}
诶，我的flag怎么了？？？？
好像字母对不上了
我的签到怎么办呀，急急急
听说福来阁好像是TGCTF开头的喔

思路就是先对照，然后对一下思路？UGBRC和TGCTF进行比较，位移是-1,0,1…，猜测每个增加1，搓个脚本 exp.py

Study nodejs 「5」

Zsm published on 2025-04-09 included in Nodejs

nodejs实现定时任务

用node-schedule这个模组去实现定时任务然后这边实现自动登录校园网的(，首先先bp抓个包，发现里面东西有点多，就写了一堆配置文件，然后包成docker去定时发送

Xyctf2025

Zsm published on 2025-04-07 included in CTF

前言

25年开始以来打的最高质量的密码了？

题目

Division

抢了个血，怪不好意思的 task.py

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37


import random 
print('----Welcome to my division calc----')
print('''
menu:
      [1]  Division calc
      [2]  Get flag
''')
while True:
    choose = input(': >>> ')
    if choose == '1':
        try:
            denominator = int(input('input the denominator: >>> '))
        except:
            print('INPUT NUMBERS')
            continue
        nominator = random.getrandbits(32)
        if denominator == '0':
            print('NO YOU DONT')
            continue
        else:
            print(f'{nominator}//{denominator} = {nominator//denominator}')
    elif choose == '2':
        try:
            ans = input('input the answer: >>> ')
            rand1 = random.getrandbits(11000)
            rand2 = random.getrandbits(10000)
            correct_ans = rand1 // rand2
            if correct_ans == int(ans):
                print('WOW')
                with open('flag', 'r') as f:
                    print(f'Here is your flag: {f.read()}')
            else:
                print(f'NOPE, the correct answer is {correct_ans}')
        except:
            print('INPUT NUMBERS')
    else:
        print('Invalid choice')

第一时间拿到就知道是mt19937预测随机数，1里面输入1就可以拿到每次的随机数从而预测了 exp.py