NSSCTF五题积累（六）

第一轮

1.Crypto

[羊城杯 2020]Simple

#RSA #Crypto

from Crypto.Util.number import *
from Crypto.Cipher import DES
import gmpy2
from secret import flag
import random

key = "abcdefgh"

def des_encrypt(m):
    des = DES.new(key, DES.MODE_ECB)
    res = des.encrypt(m)
    return res

def gen_key():
    p = getPrime(2048)
    q = getPrime(2048)
    n = p * q
    bit = n.bit_length()
    phi_n = (p - 1) * (q - 1)
    num = random.randint(1, 100)
    while True:
        u = getPrime(bit / 4 - num)
        if gmpy2.gcd(u, phi_n) != 1:
            continue
        t = gmpy2.invert(u, phi_n)
        e = bytes_to_long(des_encrypt(long_to_bytes(t)))
        if gmpy2.gcd(e, phi_n) == 1:
            break
    return (n, e)

P = getPrime(1024)
Q = getPrime(1024)
N = P * Q
E = 65537
lcm = gmpy2.lcm(P-1, Q-1)
e1 = gmpy2.invert(getPrime(730), lcm)
e2 = gmpy2.invert(getPrime(730), lcm)
m = bytes_to_long(flag)
c = pow(m, E, N)
print "N = " + str(N)
print "e2 = " + str(e2)
print "c = " + str(c)
_n, _e = gen_key()
_c = pow(e1, _e, _n)
print "_n = " + str(_n)
print "_e = " + str(_e)
print "_c = " + str(_c)

# N = 14922959775784066499316528935316325825140011208871830627653191549546959775167708525042423039865322548420928571524120743831693550123563493981797950912895893476200447083386549353336086899064921878582074346791320104106139965010480614879592357793053342577850761108944086318475849882440272688246818022209356852924215237481460229377544297224983887026669222885987323082324044645883070916243439521809702674295469253723616677245762242494478587807402688474176102093482019417118703747411862420536240611089529331148684440513934609412884941091651594861530606086982174862461739604705354416587503836130151492937714365614194583664241
# e2 = 27188825731727584656624712988703151030126350536157477591935558508817722580343689565924329442151239649607993377452763119541243174650065563589438911911135278704499670302489754540301886312489410648471922645773506837251600244109619850141762795901696503387880058658061490595034281884089265487336373011424883404499124002441860870291233875045675212355287622948427109362925199018383535259913549859747158348931847041907910313465531703810313472674435425886505383646969400166213185676876969805238803587967334447878968225219769481841748776108219650785975942208190380614555719233460250841332020054797811415069533137170950762289
# c = 6472367338832635906896423990323542537663849304314171581554107495210830026660211696089062916158894195561723047864604633460433867838687338370676287160274165915800235253640690510046066541445140501917731026596427080558567366267665887665459901724487706983166070740324307268574128474775026837827907818762764766069631267853742422247229582756256253175941899099898884656334598790711379305490419932664114615010382094572854799421891622789614614720442708271653376485660139560819668239118588069312179293488684403404385715780406937817124588773689921642802703005341324008483201528345805611493251791950304129082313093168732415486813
# _n = 440489238264900860776949063845200558734341182253911040104689726634414488997095518284964514078079911856352824174173937251558842251349762631716798307360995414545464514355957499460396352456341058329671470384493547042182238690727766731554287411757022792467324815342497916894285866240516524768645049867582541899123632009100512965460004548382054578461249990158442675234477122521189649316341623637146867589119951831385717513964941787562068891523060843170463600255518728070958509224053460041184869943038887434435024428311063533345514827827485121055022245800823723487812635502090530820946638405345755666124356919178290008475459419571761406117827422883820901663916276191422633940699113760516149002609672230610575442643822241126824287790055264162725209120192661985259423924307785452001927701323647247782658775780117642900694831475681037634691806232211286493187121464506122012889644137364079403183353774265910554863733455161820449073656744610495110838881353269890437984975607744603113572453211439334880155671730821755361054781243639407912133971530394031933785051770725331242932929244719594830548310768937037042243794551163891451545574837838357398072638709907958216067999891842395376953596940377457308329336524488962532620850237570279134567668379
# _e = 861605654852236668414010386016782729745549477722901970933220380452652052018502113737968204529790495739233258572209422774257139256367928649554562561889013164344608269555777150446651170697255381344437283003508476336814132594917061838422072660017477530465048729471603537912401826065081663165440462979219418291010867656746870617893935758241591032350010782861988742885918015532494020406350897048575155800941991107973433915573030255070411073793489218782862225921465295055907689734413881263179029741870520797816282420230090879687287575328294171448819803530205292587159921154471289747571107461754730577787617451127061265552788125691266357724955508391085485034126227212788895416902189479587194999818764639403752596165043883295506465916277734482380252399557395621566461322664559344483889187037851178431011220134914560438657522787409632677020269086895142488669203469256629173438313487046130238010206678820035631793666627274457756812810094004185303422637897314225624079032617334487815628021058997628511963565055629435278956251869329025544623291223984190562109149316159243565323565271491356378189561005084676592786453581431393651385181326525455441155960432946682976515756161038293313433862078763004704003356983371787414787104076401121444383911561
# _c = 305937839546594439230463861584604201077374759167468410827830943528403007941779658881672477705113617614828611332427199124217887937391378281943856159571057598203709366891547401974326016980711130197275312149966105151573748299654404630150641461765232935912266448303266990247145252052886920248198006212876273661195636104435277145396636985516064154534488750879453474211852461463041960835745695368577903786702607508492658563272121038693371752289017330781719235752018697635304458321008407930986565779826278048082764754367267460637798512780153281325733348999426407049795270044819657399403071013496169060640127279409914638535996355848933378734045908205536540619564723586905257569498716707820544351092379516465943537383422680357333849248129118148543389733395686399565999586899123087310025442994131218237679518267106194962305629529210402269726736072967966518381350920965727690274018080619332676536005722214955949897632990356174168234408837737546230730400434240785496100281815168806724358191550743656843853383646410487436540166360406982096949178466861150173527305369007546917550634679211293496458282787881244581230558011582720632502886494712233308474151958909251857281750741736910202763888790654287328846201724930302778996046434656839999091303411

from Crypto.Util.number import *
import gmpy2
from secret import flag
import random
from Crypto.Cipher import DES

key = "abcdefgh"

def des_encrypt(m):
    des = DES.new(key, DES.MODE_ECB)
    return des.encrypt(m)

# 解密 RSA 密文 c
N = 14922959775784066499316528935316325825140011208871830627653191549546959775167708525042423039865322548420928571524120743831693550123563493981797950912895893476200447083386549353336086899064921878582074346791320104106139965010480614879592357793053342577850761108952933114868444051393460941288494109165159486153060608698217486246173960470535441658750383613015149293771436561419458366421
E = 65537
c = 6472367338832635906896423990323542537663849304314171581554107495210830026660211696089062916158894195561723047864604633460433867838687338370676287160274165915800235253640690510046066541445140501917731026596427080558567366267665887665459901724487706983166070740324307268574128474775026837827907818762764766069631267853742422247229582756256253175941899099898884656334598790711379305490419932664114615010382094572854799421891622789614614720442708271653376485660139560819668239118588069312179293488684403404385715780406937817124588773689921642802703005341324008483201528345805611493251791950304129082313093168732415486813
m = pow(c, pow(E, -1, phi(N)), N)
print("flag:", m)

# 解密 DES 加密的 t (用于生成 e)
def des_encrypt(m):
    des = DES.new(key, DES.MODE_ECB)
    return des.encrypt(m)

t_bytes = long_to_bytes(pow(27188825731727584656624712988703151030126350536157477591935558508817722580343689565924329442151239649607993377452763119541243174650065563589438911911135278704499670302489754540301886312489410648471922645773506837251600244109619850141762795901696503387880058658061490595034281884089265487336373011424883404499124002441860870291233875045675212355287622948427109362925199018383573980726387099817958216067999891842395376953596940377457308329336524488962532620850237570279134567668379
t = int(t_bytes)
e = bytes_to_long(des_encrypt(long_to_bytes(t)))
print("e:", e)

# 解密 DES 加密的 t 用于生成 e
def decrypt_t():
    t_bytes = long_to_bytes(pow(27188825731727584656624712988703151030126350536157477591935558508817722580343689565924329442151239649607993377452763119541243174650065563589438911911135278704499670302489754540301886312489410648471922645773506837251600244109619850141762795901696503387880058658061490595034281884089265487336373011424883404499124002441860870291233875045675212355287622948427109362925199018383573980726387099817958216067999891842395376953596940377457308329336524488962532620850237570279134567668379, 1)
    des = DES.new(key, DES.MODE_ECB)
    return des.decrypt(t_bytes)

t_decrypted = decrypt_t()
print("t:", t_decrypted)

2.Web

[ByteCTF 2019]BabyBlog

#二次注入 #正则RCE #diable_function绕过

3.Misc

[长城杯 2021 院校组]签到

#编码分析 #字符编码ASCII

5a6d78685a3374585a57786a6232316c5833527658324e6f5957356e5932686c626d64695a544639

先hexadecimal再base64

flag{Welcome_to_changchengbe1}

4.Pwn

[WUSTCTF 2020]getshell2

#栈溢出 #ret2syscall #栈

附件：service

题目环境：

直接file+checksec

只开启了栈不可执行，应该是栈溢出题目。

使用ROPgadget

找到了sh地址：0x08048670

直接写死：sh_addr = 0x08048670

栈溢出（Stack Overflow） 漏洞：

• 程序执行完一个函数后，会跳回它被调用的地方，即返回地址（存于栈上）
• 当攻击者输入超长数据后,会覆盖返回地址（Return Address）

• gets()、strcpy() 等属于没有边界检查的函数。

🛠️ 六、完整攻击流程

1. 连接远程服务
2. p = remote(‘ip’, port)

构造 payload

- 填充 28 字节到返回地址位置
- 覆盖返回地址为 `system`
- 提供 fake return 和 `"sh"` 地址

3. 发送 payload

Python

编辑


1p.sendline(payload)

4. 进入交互模式，输入命令

Python

编辑


1p.interactive()  # 之后你就可以输入 ls, cat flag.txt 等

Q1: 为什么不用 "/bin/sh"，而用 "sh"？

很多题目为了简化，只放了 "sh"。

在 Linux 中，system("sh") 和 system("/bin/sh") 效果几乎一样，都能弹 shell。

Q2: 0xdeadbeef 是什么？会 crash 吗？

它只是一个“占位符”，表示“随便填个地址”。

只要你在 system 返回前已经拿到 shell，程序是否 crash 都不影响你读 flag。

Q3: 为什么偏移是 28（0x18+4）？

0x18 = 24 字节是 buffer 大小

+4 是 saved ebp（旧的栈基址指针）

总共 28 字节后，才是返回地址

5.Reverse

[MoeCTF 2021]midpython

#Python #自定义逻辑 #REVERSE

https://cn.bing.com/search?q=pyinstxtractor

这个工具可以将PyInstaller编译的.exe文件反编译回源代码.py文件

python pyinstxtractor.py 文件名

获得大量文件。寻找核心的Midpython.pyc，使用pycdc

key = [
    69,
    70,
    79,
    72,
    88,
    75,
    85,
    127,
    89,
    85,
    74,
    19,
    74,
    122,
    107,
    103,
    75,
    77,
    9,
    73,
    29,
    28,
    67] 
xxor = lambda x, y: x ^ y ^ 11
xoor = lambda x, y: xxor(x, y) ^ 45
xorr = lambda x, y: xoor(x, y) ^ 14
length = len(key)
ipt = input('>>>input your flag:\n>>>')
flag = 1
if len(ipt) == length:
    for i in range(length):
        if xorr(ord(ipt[i]), i) != key[i]:
            flag = 0
flag = 0
if flag == 1:
    print('>>>Right!!')
else:
    print('>>>Wrong!!')

xorr(x, y) = xoor(x, y) ^ 14 = ((x ^ y ^ 11) ^ 45) ^ 14

key = [69,70,79,72,88,75,85,127,89,85,74,19,74,122,107,103,75,77,9,73,29,28,67]
#定义一个名为 key 的列表，包含23个整数，这些整数是加密后的密文数据
xxor = lambda x, y: x ^ y ^ 11
xoor = lambda x, y: xxor(x, y) ^ 45
xorr = lambda x, y: xoor(x, y) ^ 14
flag= [] #定义空列表 flag ，用于存储解密后的字符
for i in range(len(key)): #外层循环：遍历 key 列表的每个元素， i 是当前元素的索引
    for x in range(32, 127): #range() 函数左闭右开 # 内层循环：遍历ASCII码32到126的所有可打印字符
        if xorr(x, i) == key[i]:#- 条件判断：如果将当前字符 x 和索引 i 传入 xorr 函数的结果等于 key[i]，即找到了解密当前位置字符的正确ASCII码
            flag.append(chr(x))#如果条件成立，将ASCII码 x 转换为对应字符，添加到 flag 列表
            break #跳出内层循环，继续处理 key 列表的下一个元素
print(''.join(flag))

选择32~126的原因：

ASCII（美国标准信息交换码）将字符分为几个主要范围：

0-31 ：控制字符（不可打印），如换行符（\n）、制表符（\t）、回车符（\r）等，这些字符在屏幕上无法正常显示为可见字符。

32 ：空格字符，是唯一可打印的控制字符。

33-126 ：可打印字符，包括所有常用字符：标点符号（如!、@、#、$等）、数字（0-9）、大写字母（A-Z）、小写字母（a-z）、其他符号（如=、+、-、*等）。

moectf{Pyth0n_M@st3r!!}

第二轮

1.Crypto

[HGAME 2022 week1]Matryoshka

#维吉尼亚 #凯撒密码 #摩斯代码

为了学好四六级，协会里某不知名的康师傅决定通过看英文小说来提高自己的英语水平。

可不知道为什么，下载来的小说竟然都被打乱并加密了。

他费尽千辛万苦重要找到了一部分小说的原文，你能帮帮他么？

⠨⠨⠤⠌⠤⠤⠨⠨⠨⠌⠤⠤⠨⠨⠤⠤⠌⠤⠤⠤⠤⠤⠌⠤⠤⠨⠨⠨⠌⠤⠤⠨⠨⠤⠤⠌⠤⠤⠤⠨⠨⠌⠨⠨⠨⠤⠤⠌⠤⠤⠨⠨⠤⠤⠌⠨⠤⠨⠨⠌⠨⠨⠨⠨⠤⠌⠤⠤⠨⠨⠤⠤⠌⠨⠨⠤⠤⠤⠌⠨⠨⠨⠨⠤⠌⠤⠤⠨⠨⠤⠤⠌⠨⠨⠤⠤⠤⠌⠤⠤⠨⠨⠨⠌⠤⠤⠨⠨⠤⠤⠌⠨⠤⠨⠤⠌⠤⠨⠨⠨⠨⠌⠤⠤⠨⠨⠤⠤⠌⠨⠨⠨⠤⠌⠨⠨⠨⠨⠤⠌⠤⠤⠨⠨⠤⠤⠌⠨⠨⠨⠨⠤⠌⠤⠤⠨⠨⠨⠌⠤⠤⠨⠨⠤⠤⠌⠤⠤⠤⠨⠨⠌⠨⠨⠨⠨⠨⠌⠤⠤⠨⠨⠤⠤⠌⠤⠤⠤⠨⠨⠌⠤⠤⠨⠨⠨⠌⠤⠤⠨⠨⠤⠤⠌⠨⠨⠨⠤⠌⠤⠨⠨⠨⠨⠌⠤⠤⠨⠨⠤⠤⠌⠤⠤⠤⠨⠨⠌⠨⠨⠨⠤⠤⠌⠤⠤⠨⠨⠤⠤⠌⠨⠤⠤⠤⠤⠌⠤⠤⠨⠨⠨⠌⠤⠤⠨⠨⠤⠤⠌⠤⠤⠨⠨⠨⠌⠨⠨⠨⠤⠤⠌⠤⠤⠨⠨⠤⠤⠌⠨⠨⠨⠤⠌⠨⠨⠨⠨⠤⠌⠤⠤⠨⠨⠤⠤⠌⠤⠨⠌⠨⠨⠨⠨⠤⠌⠤⠤⠨⠨⠤⠤⠌⠤⠤⠤⠤⠨⠌⠤⠤⠨⠨⠨⠌⠤⠤⠨⠨⠤⠤⠌⠤⠤⠨⠨⠨⠌⠨⠨⠨⠨⠨⠌⠤⠤⠨⠨⠤⠤⠌⠨⠨⠤⠌⠤⠨⠨⠨⠨⠌⠤⠤⠨⠨⠤⠤⠌⠨⠤⠨⠨⠌⠨⠨⠨⠨⠤⠌⠤⠤⠨⠨⠤⠤⠌⠨⠤⠤⠤⠤⠌⠤⠤⠨⠨⠨⠌⠤⠤⠨⠨⠤⠤⠌⠨⠌⠤⠨⠨⠨⠨⠌⠤⠤⠨⠨⠤⠤⠌⠤⠤⠤⠤⠨⠌⠨⠨⠨⠨⠨⠌⠤⠤⠨⠨⠤⠤⠌⠤⠤⠤⠨⠨⠌⠨⠨⠨⠤⠤⠌⠤⠤⠨⠨⠤⠤⠌⠨⠤⠤⠤⠤⠌⠤⠤⠨⠨⠨⠌⠤⠤⠨⠨⠤⠤⠌⠨⠨⠤⠌⠨⠨⠨⠨⠤⠌⠤⠤⠨⠨⠤⠤⠌⠨⠨⠨⠤⠌⠨⠨⠨⠨⠤⠌⠤⠤⠨⠨⠤⠤⠌⠨⠤⠤⠤⠤⠌⠨⠨⠨⠤⠤⠌⠤⠤⠨⠨⠤⠤⠌⠨⠤⠨⠤⠌⠨⠨⠨⠨⠤⠌⠤⠤⠨⠨⠤⠤⠌⠤⠤⠨⠨⠨⠌⠨⠨⠨⠨⠨⠌⠤⠤⠨⠨⠤⠤⠌⠤⠨⠨⠨⠨⠌⠨⠨⠨⠨⠤⠌⠤⠤⠨⠨⠤⠤⠌⠤⠤⠨⠨⠨⠌⠨⠨⠨⠨⠤⠌⠤⠤⠨⠨⠤⠤⠌⠤⠤⠤⠤⠤⠌⠤⠤⠨⠨⠨⠌⠤⠤⠨⠨⠤⠤⠌⠨⠌⠤⠨⠨⠨⠨⠌⠤⠤⠨⠨⠤⠤⠌⠨⠤⠤⠤⠤⠌⠨⠨⠨⠨⠤⠌⠤⠤⠨⠨⠤⠤⠌⠤⠨⠨⠨⠨⠌⠤⠤⠨⠨⠨⠌⠤⠤⠨⠨⠤⠤⠌⠤⠤⠤⠤⠤⠌⠨⠨⠨⠤⠤⠌⠤⠤⠨⠨⠤⠤⠌⠤⠤⠤⠨⠨⠌⠤⠤⠨⠨⠨⠌⠤⠤⠨⠨⠤⠤⠌⠨⠨⠤⠤⠤⠌⠨⠨⠨⠨⠨⠌⠤⠤⠨⠨⠤⠤⠌⠨⠨⠨⠨⠤⠌⠤⠤⠨⠨⠨⠌⠤⠤⠨⠨⠤⠤⠌⠨⠤⠨⠤⠌⠤⠨⠨⠨⠨⠌⠤⠤⠨⠨⠤⠤⠌⠤⠨⠨⠨⠨⠌⠨⠨⠨⠤⠤⠌⠤⠤⠨⠨⠤⠤⠌⠨⠤⠤⠤⠤⠌⠨⠨⠨⠨⠨⠌⠤⠤⠨⠨⠤⠤⠌⠨⠤⠤⠤⠤⠌⠨⠨⠨⠨⠤⠌⠤⠤⠨⠨⠤⠤⠌⠤⠤⠨⠨⠨⠌⠨⠨⠨⠤⠤⠌⠤⠤⠨⠨⠤⠤⠌⠤⠤⠨⠨⠨⠌⠤⠤⠨⠨⠨⠌⠤⠤⠨⠨⠤⠤⠌⠤⠨⠨⠨⠨⠌⠤⠨⠨⠨⠨⠌⠤⠤⠨⠨⠤⠤⠌⠨⠨⠨⠨⠤⠌⠤⠤⠨⠨⠨⠌⠤⠤⠨⠨⠤⠤⠌⠤⠤⠨⠨⠨⠌⠨⠨⠨⠤⠤⠌⠤⠤⠨⠨⠤⠤⠌⠨⠤⠨⠤⠌⠤⠨⠨⠨⠨⠌⠤⠤⠨⠨⠤⠤⠌⠨⠨⠤⠌⠨⠨⠨⠨⠤⠌⠤⠤⠨⠨⠤⠤⠌⠨⠌⠨⠨⠨⠨⠤⠌⠤⠤⠨⠨⠤⠤⠌⠨⠨⠨⠨⠤⠌⠤⠨⠨⠨⠨⠌⠤⠤⠨⠨⠤⠤⠌⠨⠨⠨⠨⠨⠌⠤⠨⠨⠨⠨⠌⠤⠤⠨⠨⠤⠤⠌⠨⠨⠨⠨⠤⠌⠨⠨⠨⠨⠤⠌⠤⠤⠨⠨⠤⠤⠌⠨⠨⠨⠨⠨⠌⠨⠨⠨⠤⠤⠌⠤⠤⠨⠨⠤⠤⠌⠤⠤⠤⠨⠨⠌⠤⠨⠨⠨⠨⠌⠤⠤⠨⠨⠤⠤⠌⠨⠨⠨⠨⠤⠌⠨⠨⠨⠨⠤⠌⠤⠤⠨⠨⠤⠤⠌⠨⠨⠨⠨⠤⠌⠤⠨⠨⠨⠨

Caesar：21; Vigenère:hgame

先盲文解密看看

发现解密后开头不太对：

试着反转一下再解密

46,66,42,75,66,45,46,6E,6D,4C,73,36,44,33,73,69,59,74,4C,36,58,32,70,34,69,4E,30,63,64,53,6C,79,6B,6D,39,72,51,4E,39,6F,4D,53,31,6A,6B,73,39,72,4B,32,52,36,6B,4C,38,68,6F,72,30,3D

16进制特征。

str='46,66,42,75,66,45,46,6E,6D,4C,73,36,44,33,73,69,59,74,4C,36,58,32,70,34,69,4E,30,63,64,53,6C,79,6B,6D,39,72,51,4E,39,6F,4D,53,31,6A,6B,73,39,72,4B,32,52,36,6B,4C,38,68,6F,72,30,3D'
for i in str:
    str=str.replace(',','')
print(str)

466642756645466E6D4C73364433736959744C3658327034694E306364536C796B6D3972514E396F4D53316A6B7339724B3252366B4C38686F72303D

FfBufEFnmLs6D3siYtL6X2p4iN0cdSlykm9rQN9oMS1jks9rK2R6kL8hor0=

然而直接base解码并不成功。

根据题目提示：维吉尼亚密码的key是hgame。不妨先试一下，因为解完末端依旧是=号，然后再base64可能性大一点。

YzBibXZnaHl6X3swUmF6X2d4eG0wdGhrem9fMG9iMG1fdm9rY2N6dF8hcn0=

c0bmvghyz_{0Raz_gxxm0thkzo_0ob0m_vokcczt_!r}

根据题目：凯撒21位

h0gralmde_{0Wfe_lccr0ympet_0tg0r_atphhey_!w}

最后栅栏密码解密：

hgame{Welc0me_t0_the_w0rld_0f_crypt0graphy!}

2.Web

[SWPUCTF 2021 新生赛]include

#PHP伪协议 #PHP #文件包含

构造：?file=php://filter/read=convert.base64-encode/resource=flag.php

PD9waHANCiRmbGFnPSdOU1NDVEZ7OTdiYWY3MmUtMDg0ZS00MGIwLWFmYzEtMWE2NzAxOWFkODA2fSc7

NSSCTF{97baf72e-084e-40b0-afc1-1a67019ad806}

3.Misc

[NISACTF 2022]huaji？

#图片隐写 #压缩包分析 #图片分离

binwalk提取文件：

一个加密zip内含flag

接下来找解压密码。原图片应该还有未发掘信息。

6374665f4e4953415f32303232

ctf_NISA_2022。解压

flag{Nls@_FumYEnnOjy}

4.Pwn

[WUSTCTF 2020]getshell2

#栈溢出 #ret2syscall #栈

附件：service

题目环境：

直接file+checksec

只开启了栈不可执行，应该是栈溢出题目。

使用ROPgadget

找到了sh地址：0x08048670

直接写死：sh_addr = 0x08048670

栈溢出（Stack Overflow） 漏洞：

• 程序执行完一个函数后，会跳回它被调用的地方，即返回地址（存于栈上）
• 当攻击者输入超长数据后,会覆盖返回地址（Return Address）

• gets()、strcpy() 等属于没有边界检查的函数。

🛠️ 六、完整攻击流程

1. 连接远程服务
2. p = remote(‘ip’, port)

构造 payload

- 填充 28 字节到返回地址位置
- 覆盖返回地址为 `system`
- 提供 fake return 和 `"sh"` 地址

3. 发送 payload

Python

编辑


1p.sendline(payload)

4. 进入交互模式，输入命令

Python

编辑


1p.interactive()  # 之后你就可以输入 ls, cat flag.txt 等

Q1: 为什么不用 "/bin/sh"，而用 "sh"？

很多题目为了简化，只放了 "sh"。

在 Linux 中，system("sh") 和 system("/bin/sh") 效果几乎一样，都能弹 shell。

Q2: 0xdeadbeef 是什么？会 crash 吗？

它只是一个“占位符”，表示“随便填个地址”。

只要你在 system 返回前已经拿到 shell，程序是否 crash 都不影响你读 flag。

Q3: 为什么偏移是 28（0x18+4）？

0x18 = 24 字节是 buffer 大小

+4 是 saved ebp（旧的栈基址指针）

总共 28 字节后，才是返回地址

5.Reverse

[SWPUCTF 2021 新生赛]非常简单的逻辑题

#Python #语言逆向 #逆向技术

flag = 'xxxxxxxxxxxxxxxxxxxxx'
s = 'wesyvbniazxchjko1973652048@$+-&*<>'#s是一个字符集，包含34个字符
result = ''
for i in range(len(flag)):#对于flag中的每个字符，执行以下操作
    s1 = ord(flag[i])//17
    s2 = ord(flag[i])%17
    result += s[(s1+i)%34]+s[-(s2+i+1)%34]# 结果字符串result添加两个字符：
print(result)
# result = 'v0b9n1nkajz@j0c4jjo3oi1h1i937b395i5y5e0e$i'
#给了个结果，让我们逆向原本的flag

# 已知的加密结果
result = 'v0b9n1nkajz@j0c4jjo3oi1h1i937b395i5y5e0e$i'
# 字符集
s = 'wesyvbniazxchjko1973652048@$+-&*<>'
# 逆向解密过程
flag = ''
# 遍历result中的每两个字符
for i in range(0, len(result), 2):
    # 获取当前两个字符
    c1 = result[i]
    c2 = result[i+1]
    # 计算字符在s中的索引
    idx1 = s.index(c1)
    idx2 = s.index(c2)
    # 计算实际的s1和s2
    # 对于第一个字符：idx1 = (s1 + i//2) % 34
    # 对于第二个字符：idx2 = (34 - (s2 + i//2 + 1) % 34) % 34
    # 注意：第二个字符的索引计算是因为s[-(s2+i+1)%34]相当于s[(34 - (s2+i+1)%34) % 34]
    pos = i // 2
    # 计算s1的可能值
    s1 = (idx1 - pos) % 34
    # 计算s2的可能值
    # 因为 idx2 = (34 - (s2 + pos + 1) % 34) % 34
    # 所以 (s2 + pos + 1) % 34 = (34 - idx2) % 34
    # 所以 s2 = (34 - idx2 - pos - 1) % 34
    s2 = (34 - idx2 - pos - 1) % 34
    # 计算原始字符的ASCII值
    ascii_val = s1 * 17 + s2
    # 将ASCII值转换为字符
    flag_char = chr(ascii_val)
    # 添加到flag中
    flag += flag_char
print(f"解密得到的flag: {flag}")

NSSCTF{Fake_RERE_QAQ}