文章

parloo杯2025 wp

逆向

xor

c="qcoq~Vh{e~bccocH^@Lgt{gt|g"
j=1
for i in c:
        print(chr(ord(i)^j),end="")
        j+=1

gogogo

for a3 in range(256):
    encrypted = [
        0xbf,0xb1,0xbd,0xc7,0xce,0x96,0x80,0x98,0x82,0x9a,
        0x7f,0xaf,0xc1,0xb3,0xbf,0xc4,0xcd
    ]
    flag = []
    for i in range(len(encrypted)):
        decrypted = (encrypted[i] - a3 - i % 5) % 256
        flag.append(decrypted)
​
    flag_str = bytes(flag)
    if b'palu{' in flag_str:
        print(flag_str)
        break

web

猫猫银行

注册1和2

2转账负数给1 发现2的余额变成负数

再次转账100000给1即可

palu{d14811a4124344d99b60f3b6c98a59e5}

密码

轮回

import base64
​
def rotate_left(c, n):
    return ((c << n) | (c >> (8 - n))) & 0xFF
​
def samsara_decrypt(cipher, key_word):
    cycle_step = len(key_word) % 6 + 1
    # 第一步:异或key得到phase3的数据
    xor_phase3 = bytes([c ^ key_word[i % len(key_word)] for i, c in enumerate(cipher)])
    # 第二步:循环左移cycle_step位,得到phase2的base85数据
    phase2_encoded = bytes([rotate_left(c, cycle_step) for c in xor_phase3])
    # 第三步:base85解码得到phase1的数据
    phase1 = base64.b85decode(phase2_encoded)
    # 第四步:循环左移cycle_step位,得到原始数据
    plaintext = bytes([rotate_left(c, cycle_step) for c in phase1])
    return plaintext
​
hex_str = "79a6815f9b36193e58ac7996212c216ea16d531f61dcf1fceb15189739bc113699"
cipher = bytes.fromhex(hex_str)
key = b'Bore'
plain = samsara_decrypt(cipher, key)
print("明文:", plain.decode())

循环

ciphertext = bytes.fromhex("110D190E122A7442312B2500070C163927210300280D2720262C19000C3B0439221952440D")
known_plain = b"palu{"
​
plain = list(known_plain)
for i in range(len(known_plain), len(ciphertext)):
    prev_c = ciphertext[i-1]
    prev_p = plain[i-1]
    current_p = prev_c ^ prev_p
    plain.append(current_p)
​
print(bytes(plain).decode('ascii', errors='replace'))

欧几里得

from Crypto.Util.number import long_to_bytes
​
c = 1426774899479339414711783875769670405758108494041927642533743607154735397076811133205075799614352194241060726689487117802867974494099614371033282640015883625484033889861
​
s = 0
current = 1  # 2^(0)
for _ in range(35):
    s += current
    current *= (2**16)
​
found = False
for x in range(65536):
    temp = c - x * s
    if temp < 0:
        continue
    b = long_to_bytes(temp)
    if b.startswith(b'palu{'):
        print("找到flag:", b.decode())
        found = True
        break
if not found:
    print("未找到符合条件的x值。")

RSA

import math
from Crypto.Util.number import long_to_bytes
​
n = 125997816345753096048865891139073286898143461169514858050232837657906289840897974068391106608902082960171083817785532702158298589600947834699494234633846206712414663927142998976208173208829799860130354978308649020815886262453865196867390105038666506017720712272359417586671917060323891124382072599746305448903
e = 65537
c = 16076213508704830809521504161524867240789661063230251272973700316524961511842110066547743812160813341691286895800830395413052502516451815705610447484880112548934311914559776633140762863945819054432492392315491109745915225117227073045171062365772401296382778452901831550773993089344837645958797206220200272941
s = 35935569267272146368441512592153486419244649035623643902985220815940198358146024590300394059909370115858091217597774010493938674472746828352595432824315405933241792789402041405932624651226442192749572918686958461029988244396875361295785103356745756304497466567342796329331150560777052588294638069488836419744297241409127729615544668547101580333420563318486256358906310909703237944327684178950282413703357020770127158209107658407007489563388980582632159120621869165333921661377997970334407786581024278698231418756106787058054355713472306409772260619117725561889350862414726861327985706773512963177174611689685575805282
​
A = s + 2 * (n ** 2)
p_sq_plus_q_sq = math.isqrt(A)
assert p_sq_plus_q_sq ** 2 == A, "A"
B = p_sq_plus_q_sq + 2 * n
sum_pq = math.isqrt(B)
assert sum_pq ** 2 == B, "B"
discriminant = sum_pq ** 2 - 4 * n
sqrt_disc = math.isqrt(discriminant)
assert sqrt_disc ** 2 == discriminant, "Discriminant"
p = (sum_pq + sqrt_disc) // 2
q = (sum_pq - sqrt_disc) // 2
assert p * q == n, "p and q"
phi = (p - 1) * (q - 1)
d = pow(e, -1, phi)
m = pow(c, d, n)
​
print(long_to_bytes(m).decode())

星际空间站

非预期了

/file/download?path=/proc/self/environ

直接拿到flag

misc

日志

import re
​
log_data = """
[1970-01-01 08:00:00] System boot sequence initiated
[1970-01-01 08:00:00] SYSTEM ALERT: Time anomaly detected at 00000000fe ns
[1970-01-01 08:00:00] SYSTEM ALERT: Time anomaly detected at 10000000ef ns
[1970-01-01 08:00:00] SYSTEM ALERT: Time anomaly detected at 20000000e2 ns
[1970-01-01 08:00:00] SYSTEM ALERT: Time anomaly detected at 30000000fb ns
[1970-01-01 08:00:00] SYSTEM ALERT: Time anomaly detected at 40000000f5 ns
[1970-01-01 08:00:00] SYSTEM ALERT: Time anomaly detected at 50000000da ns
[1970-01-01 08:00:00] SYSTEM ALERT: Time anomaly detected at 60000000e6 ns
[1970-01-01 08:00:00] SYSTEM ALERT: Time anomaly detected at 70000000e7 ns
[1970-01-01 08:00:00] SYSTEM ALERT: Time anomaly detected at 80000000fd ns
[1970-01-01 08:00:00] SYSTEM ALERT: Time anomaly detected at 90000000d1 ns
[1970-01-01 08:00:00] SYSTEM ALERT: Time anomaly detected at 100000000e7 ns
[1970-01-01 08:00:00] SYSTEM ALERT: Time anomaly detected at 110000000fd ns
[1970-01-01 08:00:00] SYSTEM ALERT: Time anomaly detected at 120000000d1 ns
[1970-01-01 08:00:00] SYSTEM ALERT: Time anomaly detected at 130000000cf ns
[1970-01-01 08:00:00] SYSTEM ALERT: Time anomaly detected at 140000000d1 ns
[1970-01-01 08:00:00] SYSTEM ALERT: Time anomaly detected at 150000000dd ns
[1970-01-01 08:00:00] SYSTEM ALERT: Time anomaly detected at 160000000ef ns
[1970-01-01 08:00:00] SYSTEM ALERT: Time anomaly detected at 170000000e3 ns
[1970-01-01 08:00:00] SYSTEM ALERT: Time anomaly detected at 180000000fe ns
[1970-01-01 08:00:00] SYSTEM ALERT: Time anomaly detected at 190000000e2 ns
[1970-01-01 08:00:00] SYSTEM ALERT: Time anomaly detected at 200000000eb ns
[1970-01-01 08:00:00] SYSTEM ALERT: Time anomaly detected at 210000000d1 ns
[1970-01-01 08:00:00] SYSTEM ALERT: Time anomaly detected at 220000000c8 ns
[1970-01-01 08:00:00] SYSTEM ALERT: Time anomaly detected at 230000000e2 ns
[1970-01-01 08:00:00] SYSTEM ALERT: Time anomaly detected at 240000000ef ns
[1970-01-01 08:00:00] SYSTEM ALERT: Time anomaly detected at 250000000e9 ns
[1970-01-01 08:00:00] SYSTEM ALERT: Time anomaly detected at 260000000d1 ns
[1970-01-01 08:00:00] SYSTEM ALERT: Time anomaly detected at 270000000cd ns
[1970-01-01 08:00:00] SYSTEM ALERT: Time anomaly detected at 280000000e6 ns
[1970-01-01 08:00:00] SYSTEM ALERT: Time anomaly detected at 290000000ef ns
[1970-01-01 08:00:00] SYSTEM ALERT: Time anomaly detected at 300000000e0 ns
[1970-01-01 08:00:00] SYSTEM ALERT: Time anomaly detected at 310000000e9 ns
[1970-01-01 08:00:00] SYSTEM ALERT: Time anomaly detected at 320000000eb ns
[1970-01-01 08:00:00] SYSTEM ALERT: Time anomaly detected at 330000000d1 ns
[1970-01-01 08:00:00] SYSTEM ALERT: Time anomaly detected at 340000000c3 ns
[1970-01-01 08:00:00] SYSTEM ALERT: Time anomaly detected at 350000000eb ns
[1970-01-01 08:00:00] SYSTEM ALERT: Time anomaly detected at 360000000af ns
[1970-01-01 08:00:00] SYSTEM ALERT: Time anomaly detected at 370000000af ns
[1970-01-01 08:00:00] SYSTEM ALERT: Time anomaly detected at 380000000f3 ns
[1970-01-01 08:00:00] System entering chronostasis mode
"""
​
hex_values = re.findall(r"Time anomaly detected at [0-9a-fA-F]*([0-9a-fA-F]{2}) ns", log_data)
print("提取的十六进制值:", hex_values)
flag_chars = []
for hex_val in hex_values:
    decoded_char = int(hex_val, 16) ^ 0x8E
    flag_chars.append(decoded_char)
​
flag = bytes(flag_chars).decode("ascii")
print("解码结果:", flag)

topSecret

在pdf中找到:

cGFsdXtZb3VfcmVfYV9yZWFsXzUwd30==

palu{You_re_a_real_50w}

截图

本来要打国际赛,但是晚上8点才开始,所以下午打了一会儿parloo

压缩包都没下载,应急响应没法写,但是这比赛一共也才只花了几个小时去打而已

题目比较简单,没啥意思

许可协议:  CC BY 4.0