I tried typing out the flag for you, but our Astronaut Coleson seems to have changed the terminal’s keyboard layout? He went out to get a big mak so I guess we’re screwed. Whatever, here’s the flag, if you can somehow get it back to normal.
rlk{blpdfp_iajylg_iyi}
首先肯定是一个Keyboard Layout，在这里找到了Colemak English keyboard layout，
stream = fopen("flag.txt", "r+b"); fseek(stream, 0LL, 2); size = ftell(stream); rewind(stream); ptr = malloc(size); if ( ptr ) { if ( fread(ptr, 1uLL, size, stream) == size ) { for ( i = 0LL; i < size; ++i ) ++ptr[i]; fclose(stream); s = fopen("enc.txt", "w"); if ( fwrite(ptr, 1uLL, size, s) == size ) { free(ptr); fclose(s); puts(a38213900m); puts("/*************************************************************************************\\ \n"); puts(" MWAHAAHAHAH SAY GOOD-BYTE TO YOUR FLAG ROMAN FILTH!!!!! >:) "); puts(" OUR ENCRYPTION METHOD IS TOO STRONG TO BREAK. YOU HAVE TO PAY US >:D "); puts(" PAY 18.BTC TO THE ADDRESS 1BEER4MINERSMAKEITRAINCOINSHUNT123 TO GET YOUR FLAG BACK, "); puts(" OR WE SACK ROME AND I TAKE HONORIA'S HAND IN MARRIAGE! SIGNED, ATTILA THE HUN. \n"); puts("/*************************************************************************************\\ \n"); return0; } else { perror("fwrite"); free(ptr); fclose(s); return1; } } else { perror("fread"); free(ptr); fclose(stream); return1; } } else { fwrite("malloc failed\n", 1uLL, 0xEuLL, stderr); fclose(stream); return1; } }
just do the following
1 2
>>> "".join([chr(ord(c)-1) for c in s]) 'sunshine{kN0w_y0u4_r0m@n_hI5t0rY}'
lines = open('wt.txt', 'r').readlines() # This file is separated by lines, in lines with Tab '\t' separated values
lineptr = 0 whileTrue:
w1 = [] for i inrange(8): w1.append([int(x) for x in lines[lineptr+i].strip().split('\t')]) lineptr += 8 w2 = [int(x) for x in lines[lineptr:lineptr+8]] lineptr += 8 w3 = [int(x) for x in lines[lineptr:lineptr+8]] lineptr += 8 w4 = int(lines[lineptr].strip()) lineptr += 2
# print("Loaded w1,w2,w3,w4:", w1, w2, w3, w4)
# 1. bruteforce 0~255. use the bit number to generate a array w0 for i inrange(48,128): w0 = [((i >> j) & 1) for j inrange(8)] w0.reverse() # print(w0)
# print([sum(w1_row[j] * w0[ii] for ii,w1_row in enumerate(w1)) for j in range(8) ])
# step 1: f[] = each row of w1 dot w0 + w2 a = [[w1_row[j] for w1_row in w1] for j inrange(8)] # print(a) f = [max(sum(a[j][ii] * w0[ii] for ii inrange(8)) + w2[j], 0) /100for j inrange(8) ] # step 2: g = f[] * w3 + w4 # print(f) g = sum(f[ii] * w3[ii] for ii inrange(8)) + w4 # print(i, chr(i), g) if g>0: print("found!", i, chr(i), g) # break # break # print("round done=================",lineptr)
if lineptr > len(lines): break """ found! 115 s 1169.5099999999975 found! 117 u 1244.9899999999975 found! 110 n 1216.9899999999998 found! 123 { 1088.8900000000067 found! 110 n 1216.9899999999998 found! 48 0 1041.38 found! 116 t 1144.5200000000004 found! 95 _ 1190.21 found! 113 q 1134.88 found! 117 u 1244.9899999999975 found! 49 1 1066.27 found! 116 t 1144.5200000000004 found! 51 3 1164.6199999999992 found! 95 _ 1190.21 found! 99 c 1127.0799999999995 found! 104 h 1073.5500000000002 found! 52 4 1065.98 found! 116 t 1144.5200000000004 found! 95 _ 1190.21 found! 71 G 1031.12 found! 80 P 1049.33 found! 84 T 1040.75 found! 95 _ 1190.21 found! 108 l 1119.9199999999983 found! 48 0 1041.38 found! 108 l 1119.9199999999983 found! 125 } 1151.75 """
v16 = __readfsqword(0x28u); puts("\nMay Jupiter strike you down Caeser before you seize the treasury!! You will have to tear me apart"); puts("for me to tell you the flag to unlock the Roman Treasury and fund your civil war. I, Lucius Caecilius"); puts("Metellus, shall not let you pass until you get this password right. (or threaten to kill me-)\n"); stream = fopen("palatinepackflag.txt", "r"); fseek(stream, 0LL, 2); n = ftell(stream) + 1; fseek(stream, 0LL, 0); v10 = n - 1LL; v3 = 16 * ((n + 15LL) / 0x10uLL); while ( v6 != &v6[-(v3 & 0xFFFFFFFFFFFFF000LL)] ) ; v4 = alloca(v3 & 0xFFF); if ( (v3 & 0xFFF) != 0 ) *(_QWORD *)&v6[(v3 & 0xFFF) - 8] = *(_QWORD *)&v6[(v3 & 0xFFF) - 8]; s = v6; fgets(v6, n, stream); flipBits((__int64)s, n); v12 = expand(s, (unsignedint)n); v13 = expand(v12, (unsignedint)(2 * n)); ptr = (void *)expand(v13, (unsignedint)(4 * n)); for ( i = 0; i < 8 * n; ++i ) putchar(*((unsigned __int8 *)ptr + i)); putchar(10); v15 = fopen("flag.txt", "wb"); fwrite(ptr, 1uLL, 8 * n, v15); fclose(v15); return0; }
defmain(): print("\nMay Jupiter strike you down Caeser before you seize the treasury!! You will have to tear me apart") print("for me to tell you the flag to unlock the Roman Treasury and fund your civil war. I, Lucius Caecilius") print("Metellus, shall not let you pass until you get this password right. (or threaten to kill me-)\n") try: withopen("palatinepackflag.txt", "rb") as file: file.seek(0, 2) file_size = file.tell() file.seek(0, 0) n = file_size + 1 s = bytearray(n) file.readinto(s) s = s[:file_size] + b'\x00'# Ensure null-terminated except FileNotFoundError: print("Error: palatinepackflag.txt not found") return # Process the data flipped = flipBits(s) expanded1 = expand(flipped) expanded2 = expand(expanded1) expanded3 = expand(expanded2) # Output results sys.stdout.buffer.write(expanded3) sys.stdout.buffer.write(b'\n') withopen("flag.txt", "wb") as out_file: out_file.write(expanded3)
type|name|tbl_name|rootpage|sql table|data|data|2|CREATE TABLE xx (a integer,b blob)
type：表的类型，通常是table或index。
name：表的名称。
tbl_name：表的名称，通常与name相同。
rootpage：表在数据库文件中的根页号。
sql：创建表的SQL语句。
具体的使用和hacktricks上写的是相通的。
具体到本题中，可以999 union select 1,tbl_name,sql,4 from sqlite_master where type='table' --也可以知道表名flag,CREATE TABLE flag ( id INTEGER PRIMARY KEY AUTOINCREMENT, flag TEXT NOT NULL UNIQUE )
[i95] Maimi
TRIVIAL pwn
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16
intvuln() { __int64 v1[8]; // [rsp+0h] [rbp-50h] BYREF int v2; // [rsp+40h] [rbp-10h] int v3; // [rsp+4Ch] [rbp-4h]
