from hashlib import * import string from pwn import * p=remote("47.93.176.13",32892) context.log_level='debug' p.recvuntil('sha256(XXXX+') end=p.recv(16).decode() p.recvuntil(') == ') sha=p.recvuntil('\n')[:-1].decode() defproof_of_work(end,sha): alp=string.ascii_letters+string.digits for i in alp: for ii in alp: for iii in alp: for iiii in alp: s=(i+ii+iii+iiii+end).encode() if sha256(s).hexdigest()==sha: return i+ii+iii+iiii xxxx=proof_of_work(end,sha) p.recvuntil('Give me XXXX: ') p.sendline(xxxx) p.recvuntil('> ') p.sendline('0') p.recvuntil('Encrypt(rA||rB||B, k) (in hex) is ') hhh=p.recvuntil('\n')[:-1].decode() print(hhh) s1=hhh[:32] s2=hhh[32:64] p.recvuntil('> ') p.sendline(s2+s1) p.recvall()
[-] Unknow Key : 04 [-] Unknow Key : 04 [-] Unknow Key : 01 [-] Unknow Key : 01 [+] Found : 526172211a0700<CAP>c<CAP>f907300000d00000000000000c4527424943500300000002<CAP>a000000<CAP>02b9f9b0530778b5541d33080020000000666c61672<CAP>e<CAP>747874<CAP>b9b<CAP>a013242f3a<CAP>fc<CAP>000b092c229d6e994167c05<CAP>a7<CAP>8708b271f<CAP>fc<CAP>042ae3d251e65536<CAP>f9a<CAP>da87c77406b67d0<CAP>e6316684766<CAP>a86e844d<CAP>c81aa2<CAP>c72c71348d10c4<CAP>c<DEL>3d7b<CAP>00400700 Running as user "root" and group "root". This could be dangerous. [+] Found : 35c535765e50074a
deffunction(n): matrix = [[0] * n for _ inrange(n)] number = 1 left, right, up, down = 0, n - 1, 0, n - 1 while left < right and up < down: # 从左到右 for i inrange(left, right): matrix[up][i] = number number += 1 # 从上到下 for i inrange(up, down): matrix[i][right] = number number += 1 # 从右向左 for i inrange(right, left, -1): matrix[down][i] = number number += 1 for i inrange(down, up, -1): matrix[i][left] = number number += 1 left += 1 right -= 1 up += 1 down -= 1 # n 为奇数的时候，正方形中间会有个单独的空格需要单独填充 if n % 2 != 0: matrix[n // 2][n // 2] = number return matrix f = open('spiral.zip','rb').read() s = function(87) # print(s) s = sum(s,[]) #print(s) f1 = open('fla.zip','wb') arr = [0]*7569 # print(arr) for i inrange(len(s)): arr[i] = f[s[i]-1] #print(arr) # print(arr) for i in arr: print(hex(i)[2:].zfill(2),end='')
from PIL import Image import matplotlib.pyplot as plt IMG = Image.new("RGB", (400,400), (0,0,0)) res = [] for m inrange(382): img = Image.open('./out/out-'+str(m)+'.png').convert('RGB') t = '' for i inrange(400): for j inrange(400): p1 = img.getpixel((i,j)) if p1==(233,233,233): IMG.putpixel((j,i),(255,255,255)) IMG.save('./gif/'+str(m)+'.png') print(len(res)) plt.imshow(IMG) plt.show() IMG.save('flag.png')
import requests import time import re f = open('data.txt') url = 'https://www.smspdu.be/' data = {'action': 'ppdu', 'pdu': '', 'submit': 'Decode'} rep = re.compile(r'<TD>(.*?)</TD>') ff = open('out.txt','a',encoding='utf-8') rr = f.readlines() for i inrange(len(rr)): c = rr[i] data['pdu'] = c.strip() r = requests.post(url,data).text res = re.findall(rep,str(r)) print(c) print(res[20]) ff.write(res[20]+'\n') time.sleep(0.5)
接着根据pdu信息里本身包含的时间信息排序，排起来就是一张png（指的是后面的16进制数据
附上排序脚本
1 2 3 4 5 6 7 8 9 10 11 12 13 14
f = open('data.txt').readlines() f1 = open('out.txt').readlines() res = {} d = {} for i inrange(4,len(f)): l = f[i][42:44][::-1]+f[i][44:46][::-1] res[int(l)] = f1[i-4].strip() print(l) f2 = open('final.txt','a') for i inrange(3924,4938): try: f2.write(res[i]) except: pass
import re from PIL import Image import matplotlib.pyplot as plt f = open('tmp').read() reg = re.compile(r'tgPos.*?]') res = re.findall(reg,f) print(res) print(len(res)) img = Image.new('RGB',(500,500),(255,255,255)) for i in res[:-1]: tmp = eval(i.split('.')[2]) img.putpixel((tmp[0],tmp[1]),(0,0,0)) img.save('flag.png')
