---
# System prepended metadata

title: 浦东杯

---

# 浦东杯

## crack
wireshark直接搜`tcp contains flag`然后追踪流
```
GET /robots.txt HTTP/1.1
Pragma: no-cache
Cache-Control: no-cache
Host: 192.168.32.189
Connection: Keep-alive
Accept-Encoding: gzip,deflate
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.21 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.21
Accept: */*

HTTP/1.1 200 OK
Date: Wed, 08 Aug 2018 07:23:28 GMT
Server: Apache/2.2.15 (CentOS)
Last-Modified: Fri, 25 Nov 2016 21:18:26 GMT
ETag: "1f0-11b-54226a9a90482"
Accept-Ranges: bytes
Content-Length: 283
Connection: close
Content-Type: text/plain; charset=UTF-8

User-agent: *
Disallow: /admin/
Disallow: /cache/
Disallow: /data/
Disallow: /include/
Disallow: /install/
Disallow: /languages/
Disallow: /m/include/
Disallow: /m/theme/
Disallow: /theme/
Disallow: /upgrade/
Disallow: /captcha.php
flag:87b7cb79481f317bde90c116cf36084b
```
## ezcrypto
https://quipqiup.com/
词频分析
> This is your day.This is your celebration., and the flag is ff97f97d5d1cc32d9a5e62c2ee1d2f2c, submit with flag and {}

## rec-1
010editor 打开直接搜Zmxh
![](https://i.imgur.com/4K1D0uD.png)
```
b64 ZmxhZ3tKVUJnQWZ4Yn0=
flag{JUBgAfxb}
```
## ezre
![](https://i.imgur.com/tZYdNPv.png)
```
>>> cip = '|pqvpvvvwrtr!pspr\'sqswtr"|qrw \'&'
>>> len(cip)
32
>>> flag = ''
>>> for i in range(len(cip)):
...     flag += chr(ord(cip[i])^0x44)
...
>>> flag
'845242223606e4746c757306f8563dcb'
>>>
```

## CTF-300
会创建新进程进行自修改，直接动态调试，可以看到为xor，使用测试数据将key还原
```
key = [187, 182, 211, 173, 178, 206, 188, 211, 205, 248, 194]
```
递归进行check，动态调试取出密文。
```
>>> ccc = [0xec,0xd7,0xbd,0xca,0xfe,0xbb,0x8c,0xb2,0x9c,0x92,0xb1]
>>> flag =''
>>> for i in range(len(key)):
...     flag += chr(ccc[i]^key[i])
...
>>> flag
'WangLu0aQjs'
```
## aesenc

![](https://i.imgur.com/IwKxTdT.png)
加密的key在100000和999999之间，
直接爆破，然后解密，看末尾是不是"It is real flag!"
然后得到key，就解密密文，得到一大串base64，
放进cyberchef得到flag的图片
![](https://i.imgur.com/29th5p0.png)


```
# -*- coding: utf-8 -*-
from Crypto.Cipher import AES
import random
import string
table = string.printable

def check(msg):
	for each in msg:
		if each not in table:
			return False
	return True

with open("flag.txt","rb") as f:
	data = f.read()
ddata = data[-16:]
for key in range(100000, 999999):

	key = str(key) + str(key) + str(key)[0:4]

	cipher = AES.new(key, AES.MODE_ECB)
	ct_bytes = cipher.decrypt(ddata)
	if check(ct_bytes):
		print(key)
		print(ct_bytes)
		cipher = AES.new(key, AES.MODE_ECB)
		bbytes = cipher.decrypt(data)
		print(bbytes)

```