alexCTF sock題目

2019-11-11 07:22:52

字體：大中小

來源：轉載

供稿：網友

alex CTF 一道題目的半解過程

nc 連接返回結果

__________ ______/ ________ /______ _/ ____________ /_ _/____________ ____________/_/ ___________ / / ___________ /

/ /XXXXXXXXXXX/ // /XXXXXXXXXXX/ / / /############/ ############/ / | /XXXXXXXXXXX/ _ _ /XXXXXXXXXXX/ | |___ _ // / /|__ [_ / / X X / / _] | / / / / | [_ / / / _____ / / / __] / / / //||.||.||.||.||// / / / _ / / ||.||.||.||.|| / / _/ / / ||.||.||.||.|| / / _ |||||||||| _/ / …….. / ________________/

Our system system has detected human traffic from your ip! Please PRove you are a bot Question 1 : 108105798751584311773236747225139 - 35165179661324135973895883980449 =

利用程序來返回結果

思路：將nc反彈結果寫在記事本里，然后找到 =所在行，以及兩個數字（題目中的一個數字在兩行里），將計算結果發送給服務器端，然后再打印flag。遇到一個很奇怪的事情：- -！ 當對一個字符串進行查找判斷后再進行分割就找不到字符了

import socketimport resock=socket.socket(socket.AF_INET,socket.SOCK_STREAM)sock.connect(('195.154.53.62',1337))filename='nc.txt'y=''res=''test=''while True: m=sock.recv(100) test=test+m print len(m) if len(m)<60: breakf=open(filename,'a')f.write(test)f.close()f=open(filename,'r')lines=f.readlines()for line in lines: if line.find(":"): try: x,y=line.split(":/n") except: pass if line.count('=')==1: try: line=line.replace('=/n','') line=line.replace(' ', '') line=line.replace('=','') if line.find('+')!=-1: print line.split('+'),'1' a=line.split('+')[0] b=line.split('+')[1] a=y+a res=int(a)+int(b) if line.find('-')!=-1: print line.split('-'),'2' a = line.split('-')[0] b= line.split('-')[1] a=y+a res =int(a) -int(b) if line.find('*')!=-1: print line.split('*'),'3' a = line.split('*')[0] b= line.split('*')[1] a=y+a res = int(a) *int(b) if line.find('/')!=-1: print line.split('/'),'4' a = line.split('/')[0] b= line.split('/')[1] a=y+a res = int(a) / int(b) if line.find('%')!=-1: print line.split('%'),'5' a = line.split('%')[0] b= line.split('%')[1] a=y+a res = int(a) % int(b) print 'asd',a print 'res',res sock.send(str(res)) print sock.recv(2048) print line except Exception, e: print esock.send(str(res))print sock.recv(100)f.close()

參考大牛的 writeup http://www.cnblogs.com/huangjacky/p/3859786.html

找到一位日本友人的代碼，只能說明個人能力太渣 http://kataware.hatenablog.jp/

import socket,telnetlibimport math# common funcs ---def sock(remoteip, remoteport): s = socket.socket(socket.AF_INET, socket.SOCK_STREAM) s.connect((remoteip,remoteport)) return s, s.makefile('rw',bufsize=0)def read_until(f,delim='/n'): data = '' while not data.endswith(delim): data+= f.read(1) return datadef ans(): r= '' # Questionの文字まで読み込む while "Question" not in r: r += f.read(1) print(r) r = '' # Question番號まで読み込む while "/n" not in r: r += f.read(1) print(r) r = '' first = '' second = '' r = read_until(f) print(r) # 問題を読み込む lis = r.split(' ') first = long(lis[0]) ope = lis[1] second = long(lis[2]) # math if ope == "+": ret = int(first + second) elif ope == "-": ret = int(first - second) elif ope== "*": ret = first * second elif ope== "/": ret = math.floor(first/second) elif ope== "%": ret = int(first % second) if ret == int(ret): ret = int(ret) f.write(ret) f.write("/n") print(str(ret)+"/n")# mains, f = sock('195.154.53.62', 1337)r = ''for i in range(10000): ans()

上一篇：poj1182食物鏈

下一篇：HashMap