Table of Contents

一個新手解題的心路歷程，是那麼的樸實無華、處處撞壁。

第一次打MyFirstCTF
說來可笑，我的資歷大概是寶寶，學資安1年但什麼都不會🥺
目標是寫出5題(根本不可能😍😍😍)

Welcome #

謝謝Welcom讓我寫出一題:)
AIS3{Welc0me_to_MYF1rstCTF_2o24!}

Web #

Evil Calculator #

This is a calculator written in Python. It’s a simple calculator, but some function in it is VERY EVIL!! Connection info: http://chals1.ais3.org:5001 Author: TriangleSnake

這題我的思路是透過更改按鈕的值去做Injection，但我不知道要改甚麼🥲

解答 #

我也不知道發生了甚麼，其實我還是不會寫這題，但Chatgpt會
心理湧現了一股暖流，在我撞牆撞到六親不認的時候，是chatgpt挺身而出…

來回丟幾次Error給他之後

AIS3{7RiANG13_5NAK3_I5_50_3Vi1}
謝謝Chatgpt讓我多寫出一題🥰

MISC #

Quantum Nim Heist #

Welcome to the Quantum Nim Heist, where traditional logic intertwines with the enigmatic realm of quantum mechanics to create a Nim game like no other. nc chals1.ais3.org 40004
出題者說只要會打鍵盤就會寫這題
對不起我不會打鍵盤🫠
提示: 不要按照規則走，不要被遊戲規則拘束，不用看code

 ┌──(kali㉿kali)-[~]
 └─$ nc chals1.ais3.org 40004
    +-------------------- welcome --------------------+
    | omg hi!                                         |
    |                                                 |
    | welcome to microchess, the minimal online chess |
    | platform.                                       |
    | i am a super powerful chess AI!                 |
    | can you win against me and get the flag?        |
    +---+--------------- main menu -------------------+
    | 0 | read the rules of the game                  |
    | 1 | start a new game against me                 |
    | 2 | load a saved game                           |
    | 3 | leave                                       |
    +---+---------------------------------------------+
    what would you like to do? 0
    +--------------------- rules ---------------------+
    | since chess is a combinatorial game with quite  |
    | complicated rules, my microchip is too micro to |
    | handle it. instead, we shall play a simplified  |
    | version of it:                                  |
    |                                                 |
    |  - the game starts with a few "piles".          |
    |  - each pile has a positive number of "stones". |
    |  - two players take turns. on each turn, the    |
    |    player should choose a pile and remove any   |
    |    positive number of stones from it.           |
    |  - if all stones have been taken (so no moves   |
    |    can be made), the current player loses and   |
    |    the game ends.                               |
    |                                                 |
    | good luck!                                      |
    +---+--------------- main menu -------------------+
    | 0 | read the rules of the game                  |
    | 1 | start a new game against me                 |
    | 2 | load a saved game                           |
    | 3 | leave                                       |
    +---+---------------------------------------------+
    what would you like to do?

傳統的尼姆遊戲，兩個人輪流拿石頭，一次可以拿1~n顆，但不能跨排拿取，拿走最後一顆的人獲勝。

    +---+-------------- stones info ------------------+
    | 0 | oooooooooooo                                |
    | 1 | ooooooooooooooooooo                         |
    | 2 | ooooooooooooooo                             |
    | 3 | oooooooooooooooooooooooooooo                |
    | 4 | oooooooooooooooooooooooooo                  |
    | 5 | ooooooooooooooooooooooooooo                 |
    | 6 | ooooooooooooo                               |
    +---+--------------- game menu -------------------+
    | 0 | make a move                                 |
    | 1 | save the current game and leave             |
    | 2 | resign the game                             |
    +---+---------------------------------------------+
    it's your turn to move! what do you choose?

在原碼裡可以看到，他只給我們玩先手必輸版，然後叫我們先拿🧐

    def menu():
    print_main_menu()
    choice = input('what would you like to do? ').strip()

    if choice == '0':
        print_rules()

    elif choice == '1':
        game = Game()
        game.generate_losing_game()
        play(game)

    elif choice == '2':
        saved = input('enter the saved game: ').strip()
        game_str, digest = saved.split(':')
        if hash.hexdigest(game_str.encode()) == digest:
            game = Game()
            game.load(game_str)
            play(game)
        else:
            print_error('invalid game provided!')

    elif choice == '3':
        print('omg bye!')
        exit(0)
    
elif choice == '1':
        game = Game()
        game.<b>generate_losing_game()</b>
        play(game)

看來這是不可能獲勝的遊戲，但令人留意的是，他有一個存檔功能

    +---+-------------- stones info ------------------+
    | 0 | oooooooooooo                                |
    | 1 | ooooooooooooooooooo                         |
    | 2 | ooooooooooooooo                             |
    | 3 | oooooooooooooooooooooooooooo                |
    | 4 | oooooooooooooooooooooooooo                  |
    | 5 | ooooooooooooooooooooooooooo                 |
    | 6 | ooooooooooooo                               |
    +---+--------------- game menu -------------------+
    | 0 | make a move                                 |
    | 1 | save the current game and leave             |
    | 2 | resign the game                             |
    +---+---------------------------------------------+
    it's your turn to move! what do you choose? 1
    you game has been saved! here is your saved game:
    12,19,15,28,26,27,13:7449082e6843011f
    +---+--------------- main menu -------------------+
    | 0 | read the rules of the game                  |
    | 1 | start a new game against me                 |
    | 2 | load a saved game                           |
    | 3 | leave                                       |
    +---+---------------------------------------------+

存檔:
12,19,15,28,26,27,13:7449082e6843011f
他存檔的方式如下:

   elif choice == '1':
           game_str = game.save()
           digest = hash.hexdigest(game_str.encode())
           print('you game has been saved! here is your saved game:')
           print(game_str + ':' + digest)
           return

而讀檔是這樣的:

    elif choice == '2':
        saved = input('enter the saved game: ').strip()
        game_str, digest = saved.split(':')
        if hash.hexdigest(game_str.encode()) == digest:
            game = Game()
            game.load(game_str)
            play(game)
        else:
            print_error('invalid game provided!')

所以我只要讓他讀一個我一定必勝的殘局，就可以讓我破解這題。
看起來，存檔是由game_str和digest構成
嘗試測試了一下

    import myhash
    from game import Game, AIPlayer
    from text import *

    hash = myhash.Hash()

    game_str = "19,28,10,11,19,5,26,2"
    digest = hash.hexdigest(game_str.encode())
    print('you game has been saved! here is your saved game:')
    print(game_str + ':' + digest)

就會發現每次出來的digest都不一樣
所以做個自我測試

    import myhash
    from game import Game, AIPlayer
    from text import *

    hash = myhash.Hash()
    game_str = "19,28,10,11,19,5,26,2"
    digest = hash.hexdigest(game_str.encode())
    print('you game has been saved! here is your saved game:')
    print(game_str + ':' + digest)


    saved = "19,28,10,11,19,5,26,2:ab340a0a7825b340"
    saved.strip()
    game_str, digest = saved.split(':')
    if hash.hexdigest(game_str.encode()) == digest:
        print("correct")
    else:
        print_error('invalid game provided!')

成功地跳出了invalid game provided!
即使是同一組game_str也會生成不同的結果，並且不通過驗證測試
因為我的測試程式會重複呼叫讓他一直生成新的hash秘鑰
但靶機的程式不會，他的秘鑰就一把，至少在那一輪中的都一樣。

但我去問了chatgpt
他說，不能反推…寶寶不會了寶寶想哭

在我撞壁撞到想不做資安的時候…
他給了提示:不需要看原始碼
就是一個WTF
然後發現一直輸入-1就可以拿到flag…

    it's your turn to move! what do you choose? -1
    +--------------------- moved ---------------------+
    | you removed 0 stones from pile 0                |
    +---+-------------- stones info ------------------+
    | 0 | o                                           |
    | 1 | o                                           |
    +--------------------- moved ---------------------+
    | i removed 1 stones from pile 1                  |
    +---+-------------- stones info ------------------+
    | 0 | o                                           |
    +---+--------------- game menu -------------------+
    | 0 | make a move                                 |
    | 1 | save the current game and leave             |
    | 2 | resign the game                             |
    +---+---------------------------------------------+
    it's your turn to move! what do you choose? 0
    which pile do you choose? 0
    how many stones do you remove? 01
    +---------------- congratulations ----------------+
    | you are a true grandmaster of chess! here is    |
    | the flag for you:                               |
    | AIS3{Ar3_y0u_a_N1m_ma57er_0r_a_Crypt0_ma57er?}  |
    +-------------------------------------------------+

好意想不到，但這應該就是出題者想要的效果吧🙃

Three Dimensional Secret #

I shall send printable secrets
Author: ja20nl1n

先說，我不會用wireshark，就現學現賣
說錯了不要笑我

想說是不是照lengh排，越大的就越有可能有東西
上網查之後發現對封包按右鍵–>Follow–>TCP Stream可以看到更多東西
可是就算打開了也是媽咪我看不懂這個可以吃嗎

所以就問了Chatgpt

Google"Gcode“找到這個網站

把程式碼輸進去，旗子就跑出來了

這題好玩
AIS3{b4d1y_tun3d_PriN73r}

Emoji Console #

這題還不錯玩
但就在考對kali的熟悉度
開了虛擬機試了好久才試出來
🐱 ⭐可以看到app.py&所有符號的對應字
🐱 🚩可以知道flag是一個目錄
於是💿 🚩可以進到叫flag的子目錄裡
💿 🚩 😓🤬 🐱 ⭐可以進到子目錄裡+看到裡面有甚麼

他開了一個flag-printer.py的檔案
所以我只要執行它就可以了
💿 🚩 😓🤬 🐍 ⭐
AIS3{🫵🪡🉐🤙🤙🤙👉👉🚩👈👈}

順帶一題直接取flag會被擋權限
像這樣 🐱 😓🚩

Crypto #

BabyRSA #

這題我沒有寫出來，但在比賽結束之後受到高人題點才知道怎麼寫，覺得超級可惜，故此紀錄。
題目Code:

import random
from Crypto.Util.number import getPrime
from secret import flag
def gcd(a, b):
    while b:
        a, b = b, a % b
    return a

def generate_keypair(keysize):
    p = getPrime(keysize)
    q = getPrime(keysize)
    n = p * q
    phi = (p-1) * (q-1)
    
    e = random.randrange(1, phi)
    g = gcd(e, phi)
    while g != 1:
        e = random.randrange(1, phi)
        g = gcd(e, phi)
    d = pow(e, -1, phi)
    return ((e, n), (d, n))

def encrypt(pk, plaintext):
    key, n = pk
    cipher = [pow(ord(char), key, n) for char in plaintext]
    return cipher

def decrypt(pk, ciphertext):
    key, n = pk
    plain = [chr(pow(char, key, n)) for char in ciphertext]
    return ''.join(plain)

public, private = generate_keypair(512)
encrypted_msg = encrypt(public, flag)
decrypted_msg = decrypt(private, encrypted_msg)

print("Public Key:", public)
print("Encrypted:", encrypted_msg)
# print("Decrypted:", decrypted_msg)

簡單的說，題目會生成兩個512位的質數拿去做RSA運算然後加密密文
比賽的時候都在想說要怎麼才有辦法爆破n，真的有可能做到嗎？
比賽結束之後去問了密碼學專長的學長:

好欸，我怎麼都喜歡在比賽的時候撞沒有洞的牆呢?

解答 #

其實只要把全部可能用到的字丟進去給他加密，在用加密過後的結果去對照密文，找出用了哪些字符就好了，這麼簡單我怎麼沒想到啊啊啊啊啊啊
所以我寫了一個python，把Ascii的32~127全部丟進去加密，在把加密結果存成json。

import random
import json

def encrypt(pk, plaintext):
    key, n = pk
    cipher = [pow(ord(char), key, n) for char in plaintext]
    return cipher

public = (64917055846592305247490566318353366999709874684278480849508851204751189365198819392860386504785643859122396657301225094708026391204100352682992979425763157452255909781003406602228716107905797084217189131716198785709124050278116966890968003294485934472496151582084561439957513571043497031319413889856520421733, 115676743153063753482251273007095369919613374531038288437295760314264647231038870203981488393720761532040569270340726478402172283300622527884543078194060647393394510524980830171230330673500741683492143805583694395504141751460090539868114454005046898551218623342425465650881666420408703144859108346202894384649)
flag = " !#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~"

encrypted_msg = encrypt(public, flag)

encrypt_dist = {char: enc for char, enc in zip(flag, encrypted_msg)}

# 將 encrypt_dist 保存到文件中
with open('encrypt_dist.json', 'w') as f:
    json.dump(encrypt_dist, f, indent=4)

print("Public Key:", public)
print("Encrypted:")
for char, enc in encrypt_dist.items():
    print(f"{char} = {enc}")

print("encrypt_dist has been saved to encrypt_dist.json")

跑出來的json大概會長這樣

再讀json檔，讓他去比對用了哪些字符並印出

import json

# 讀取 encrypt_dist 從文件中
with open('encrypt_dist.json', 'r') as f:
    encrypt_dist = json.load(f)

encrypted_list = [59582983136368434856816799733313446746433796034384724221174424464969737874802116129348607979328098841766335449896610931770063087921739964156335144291643702667891887833963756948394265219864837961748202920096128332905237576243643095664147826020400199347355043162641743846198725931842313977049712473768688780204, 95359547394031742813518330673269556403528254059894407470006786975603938062435320319282644182444182438612748874603359501010449113346386193598111715879103479311697744375488228536365895249959983701008182395138745363343749821348881488616739650767615867269542213617639437927373484681942750228038458670913761461906, 46329325300279098651694178842591774415260876326218182283454895682597312145324055490326488805186682301528705330448500034219715636964856131530973835780285303243952273742119154142469279746360304190118988650200422700136950019141246372634642054318988506247030406078971388938494583721698317950574261574174233878465, 99372516099607712778908802720080113062724120782160998443385643772511391370661101893707293382044546993124605549696368316348952556779713164710839853078160450782104255053788389238478472574549113909833434906535103012424826026640284958298083646000213492094244631381094489147645893989473799375006911204994971262513, 76560888147807476608165550435978536197327212318831455594999273843368454289391559274947371380742007729563677938535717707232627424457601159959128489070947748904688640279908482263289424669338790488996485849079890881530740377280113682547250364463080771156212510360194563192123664613212111565777733487081937952558, 12319813533472769541026063795801870849236715810997656653501875874806446093919930377755747066386074676697058702735112064576219731845584108035461434499628574742399407498867908576045220515065246483998134315307132901329833371485817530138131352593805641664023978795298886913968639954517583992930243922021434381738, 96951009388162450018398074248238612521098089563081241061172635732154749686698900516806076917644927142046116130006730586770841058020946718314769404592479949673385387831784647829787593435525861689652400487918043078535385527278516028607916478700007746817161408140805937414915909575928550204945457887011906141614, 1665805297521640119669919457094144711238099413231800824465470812913880572669116305626521524153911904267238129531937952423409222225023467794927666422627082314285814656075569814644205638687105792760533211008966815918943917251927254624389871965679206262024216136163262412286874416732008465838711695063592124435, 38031617734525236754862788270684927634041250565347090806313746312968815507316236887544784308484734926981400017478758364119367924220519253824976349577671434162884831759762106665665138444165001645856871491952279748415831766579735400499998753646766301606966507940299051979075677572064596983713461662607114250263, 64855027109789931203406858899259092299626327163376469398846102754805420506427252072315662287801006608894162707199492268892939811482863649987034183371607590158980649349849687594118554925649076468007225363531072941142253057862686631842080812159597499430107963982315266135241847383726503265496996481889717246182, 38285633551521777138710771085033430239170710707266775875598456653892976969437761922968925746226073683095654278272586779539831402373205526909772633370025848937463033570747721110932401276480992827694564074802181306738438015295515798739406061377284368603543443076476369810597345436481251791260803352288977423573, 90968383857681404242927909477464252602387471219945950453665598772039832078487309149670692874283215437984574695320981806360379096212936326954111131608499584545969103096096842380877613033764006459107764277330135816044808210474597200172673683909558627722941503504083244424751773797618360290613996970960151563724, 95457298055868694391877219138576497445115151186056513418820503159496876268497080831408725541436969299827723238663173668798694515208450035233192338795425824459299174728295661096981248839235055855929604893139239340445385259232905864515397406993189217322907168121716905101208450279521267289056195400878302077398, 52468135911274945777529136529541932989316502665934748207836694395110108517204287366878248216053327656034128346107236076714109214143042824050810182510919475258788845504651287598248217763885663385525333584236650693667648746329707103824387098563158188013686337454772275459145419197015884603853408230553227896407, 34661612116812273325510815885632987773878634626625747042958636362152583931260969561869719786378247664638641161656878412129162010084766438156247296031040184022246208883138926132649114007757242227131459285251878118564710945280013332131793855359773876332415772442620349609897435915019325055421286197078708187352, 52468135911274945777529136529541932989316502665934748207836694395110108517204287366878248216053327656034128346107236076714109214143042824050810182510919475258788845504651287598248217763885663385525333584236650693667648746329707103824387098563158188013686337454772275459145419197015884603853408230553227896407, 72893301186321303683272295658327353212060838237559048917336264819112421968115615005989580760612444279776561566669272155758039717810976344470895667733780292960024364644216982543515945404550612735708418065359731237914621596888496631385879381090937225999965270114589266587955012094766794851372212812150698234716, 67602482196856820166971428403758405739455475263382367621161896414339370625380754447863410276767241406699969322350803814348655243066328706656427717483623041308690996376549835317954286006923639192767262817817435759143930376297271756237829141630002480289781731985465743331200468015517012225741723423203374827341, 44262354102194743351911268289256770008339497245528544280709170541530088518398751380655719846628700171065092804544687718896291531970838072744874705570156704628202662829757806782131182294252555844059856971743311355891113953747318316062265029166813195656690004051327523203179399349334322871113218009692321746302, 52468135911274945777529136529541932989316502665934748207836694395110108517204287366878248216053327656034128346107236076714109214143042824050810182510919475258788845504651287598248217763885663385525333584236650693667648746329707103824387098563158188013686337454772275459145419197015884603853408230553227896407, 17525442355443739006798161136945234538289135293732159010469949341666347513585837371870704355037863634098163883611042121878362686860890223724238562583526550649340086051319234134907577624853632886715848962127706255769976443912657070070366400669740596805962173530384420842637554803041466900119050709458062167550, 44014841046589017601891983719958867760419600204352901036629548332837496204051161377933425345536644034794916246706885620488552830053604204333015893225255398323167834260921720336325397193593333461140140475610284003097590899522403244883330800589948361851693870192559674072749868797979125684663605722325053340834, 52468135911274945777529136529541932989316502665934748207836694395110108517204287366878248216053327656034128346107236076714109214143042824050810182510919475258788845504651287598248217763885663385525333584236650693667648746329707103824387098563158188013686337454772275459145419197015884603853408230553227896407, 32463563387229396502994321924065961632284043136468238906625180045736135155253223928723914405824284085442712712337348213915399745045346853697650399659292339726614512642835897683094877670342609027803404027945312939777902664125228095034970967750466928999176126534504349068649205422848461193336320361026425455874, 72893301186321303683272295658327353212060838237559048917336264819112421968115615005989580760612444279776561566669272155758039717810976344470895667733780292960024364644216982543515945404550612735708418065359731237914621596888496631385879381090937225999965270114589266587955012094766794851372212812150698234716, 12179738687529782107447590339149361896936551322934825418520525165858885435598866363152322677187041910693780230742925050834968940508546403788452893248148672885195158450001568668626998159030042932978014971079411358732702590558133373478956077176801426446288446920254354063720982962966912703174841575095158773376, 101125682339799901828662987568918086070282069568379908090074247169217184659644669626554838396604623590909101664987452894437649857681299514293609000818253780343589956828098266778252516930801354335366245918603834198786544373944956666900784678369416240212915856834107510529441463083826031881209805666209335413628, 101403644290884991310189664359755656780537902543354415482434580937410695343294757120985680350019917171639284125327989098680673553323894980248499865788837636944758311200094760909373728675822272584823764964753326309765279310435693879623302965536053211433064599526550676915084290753201910772032395483945950367273, 24333051506853181360030701569319128673885779416125109480872653360245763695810807795571148802002658160356587851857338891650119080260776136984074861612952869696123011417276568821410663401888348228549042676235853145756762295087473309782699704381451505573652641489540319626561348999020895690560418530256831740666, 20222920908058605457111970272150612273139460769260447235596498596781683961010128426184024637706564546340327246191020540223566835757304493325371606037680402571948650998523099138137441154209281794538860160477031997660506452095283151142470607354579609545040759974018408429796935802188551530478970289514572978617, 72893301186321303683272295658327353212060838237559048917336264819112421968115615005989580760612444279776561566669272155758039717810976344470895667733780292960024364644216982543515945404550612735708418065359731237914621596888496631385879381090937225999965270114589266587955012094766794851372212812150698234716, 32184464000490155748453165982143565340499464338829080683417468389784993809512708479494827939476307049612151190695993375700147700844413744001417893095868641387694266647992101758785355055413538046252854525860440227182911367045556141460084455472907278113962890024281663648508886642376786194323597791020547317088, 101125682339799901828662987568918086070282069568379908090074247169217184659644669626554838396604623590909101664987452894437649857681299514293609000818253780343589956828098266778252516930801354335366245918603834198786544373944956666900784678369416240212915856834107510529441463083826031881209805666209335413628, 44014841046589017601891983719958867760419600204352901036629548332837496204051161377933425345536644034794916246706885620488552830053604204333015893225255398323167834260921720336325397193593333461140140475610284003097590899522403244883330800589948361851693870192559674072749868797979125684663605722325053340834, 12179738687529782107447590339149361896936551322934825418520525165858885435598866363152322677187041910693780230742925050834968940508546403788452893248148672885195158450001568668626998159030042932978014971079411358732702590558133373478956077176801426446288446920254354063720982962966912703174841575095158773376, 63634815088527144255090148113948593793648445499224983027630191877159813968754095341812467946868079279626991968747689424489021633678743106301884613005477044402324870044751927862596590687251830485165119422247449722579599610918927243419033509419967393677988976255284611384351411782311379786356079256916831362626, 9304987377904341606117201715658113065608581640101320211543462955469900806281721467187032121463132314663326494170970278379001634044806680348131292368949519512445580695938064509920503814133961673755470696223243390646274004621955993274826096679460577701554059204349111764901921932386091658007427259226167178177, 58828925452729811932976588739787965824652220690551333824296205824127538696058603108169405357158211350616510470513672533759883740745736322687898383422522330915631984810878357007178714597068087752425823728826608887027664209314455243118645386520598961325656254330576959063500755210398248129074822706590225088700, 72893301186321303683272295658327353212060838237559048917336264819112421968115615005989580760612444279776561566669272155758039717810976344470895667733780292960024364644216982543515945404550612735708418065359731237914621596888496631385879381090937225999965270114589266587955012094766794851372212812150698234716, 32184464000490155748453165982143565340499464338829080683417468389784993809512708479494827939476307049612151190695993375700147700844413744001417893095868641387694266647992101758785355055413538046252854525860440227182911367045556141460084455472907278113962890024281663648508886642376786194323597791020547317088, 72893301186321303683272295658327353212060838237559048917336264819112421968115615005989580760612444279776561566669272155758039717810976344470895667733780292960024364644216982543515945404550612735708418065359731237914621596888496631385879381090937225999965270114589266587955012094766794851372212812150698234716, 12179738687529782107447590339149361896936551322934825418520525165858885435598866363152322677187041910693780230742925050834968940508546403788452893248148672885195158450001568668626998159030042932978014971079411358732702590558133373478956077176801426446288446920254354063720982962966912703174841575095158773376, 38031617734525236754862788270684927634041250565347090806313746312968815507316236887544784308484734926981400017478758364119367924220519253824976349577671434162884831759762106665665138444165001645856871491952279748415831766579735400499998753646766301606966507940299051979075677572064596983713461662607114250263, 42674155454878392842592499423860033988264245394501952163129442865919203299671995689679354090226093903765768139477289952989042795959374257614752953563152551974557414325407858919156902405925850703390450181868760242922958259454422450849566085988801215229822701373233313619020572460459663094142218119144686335871, 101125682339799901828662987568918086070282069568379908090074247169217184659644669626554838396604623590909101664987452894437649857681299514293609000818253780343589956828098266778252516930801354335366245918603834198786544373944956666900784678369416240212915856834107510529441463083826031881209805666209335413628, 75918055185950026238164530295762591705002247585433355113315303142207464051952569831664550604622541858093495062851840811257603174544255151597115446984458237694842739071530518936317606199598953518976167711716762043806043449827887577909963803673508838826582484003687958862302989732473748700329398645880243054148, 52468135911274945777529136529541932989316502665934748207836694395110108517204287366878248216053327656034128346107236076714109214143042824050810182510919475258788845504651287598248217763885663385525333584236650693667648746329707103824387098563158188013686337454772275459145419197015884603853408230553227896407, 42674155454878392842592499423860033988264245394501952163129442865919203299671995689679354090226093903765768139477289952989042795959374257614752953563152551974557414325407858919156902405925850703390450181868760242922958259454422450849566085988801215229822701373233313619020572460459663094142218119144686335871, 52468135911274945777529136529541932989316502665934748207836694395110108517204287366878248216053327656034128346107236076714109214143042824050810182510919475258788845504651287598248217763885663385525333584236650693667648746329707103824387098563158188013686337454772275459145419197015884603853408230553227896407, 47953002091054578020381201294163023730809574731463958773592358719441988187452655748118051277286650853337305718192021972814357369747332979634917684999259838316305009239963225119133204824897098152777119627043881500966537112886938182847527574241215915396651397126350467492479189194162628876529519538265140143596, 101403644290884991310189664359755656780537902543354415482434580937410695343294757120985680350019917171639284125327989098680673553323894980248499865788837636944758311200094760909373728675822272584823764964753326309765279310435693879623302965536053211433064599526550676915084290753201910772032395483945950367273, 52468135911274945777529136529541932989316502665934748207836694395110108517204287366878248216053327656034128346107236076714109214143042824050810182510919475258788845504651287598248217763885663385525333584236650693667648746329707103824387098563158188013686337454772275459145419197015884603853408230553227896407, 107340541989905757204370662416845552037146078905222935505789033122562501577684655501092154588544305605078885306044047839464564901594898750722560559313996616820973286189602827331851868376927628179028545097753144658073207307785378721899783095713473789007231709234504050418717400729711972350669632384570468096830, 43967923748936484351732805873555964174712775706889811180819474140612599586161884530658035908721232399384729457223641995556425707839305124083600738135036620220298476686325110132022730675370888898063942501477522619906479683016701151321856269078215479158146009655223314957908787521092587379267241203076718674092, 24333051506853181360030701569319128673885779416125109480872653360245763695810807795571148802002658160356587851857338891650119080260776136984074861612952869696123011417276568821410663401888348228549042676235853145756762295087473309782699704381451505573652641489540319626561348999020895690560418530256831740666, 20472445493228441292721090614657967895462252302228260568752427996680563809601852655319833688134475798137834395223726607334321531235376774219216055134601030184130917876549113091114144486261794932716233808194664233936783735663266743029212488020840969559603523111887524998658108503660068448898570323437482810017, 72893301186321303683272295658327353212060838237559048917336264819112421968115615005989580760612444279776561566669272155758039717810976344470895667733780292960024364644216982543515945404550612735708418065359731237914621596888496631385879381090937225999965270114589266587955012094766794851372212812150698234716, 64855027109789931203406858899259092299626327163376469398846102754805420506427252072315662287801006608894162707199492268892939811482863649987034183371607590158980649349849687594118554925649076468007225363531072941142253057862686631842080812159597499430107963982315266135241847383726503265496996481889717246182, 52468135911274945777529136529541932989316502665934748207836694395110108517204287366878248216053327656034128346107236076714109214143042824050810182510919475258788845504651287598248217763885663385525333584236650693667648746329707103824387098563158188013686337454772275459145419197015884603853408230553227896407, 75918055185950026238164530295762591705002247585433355113315303142207464051952569831664550604622541858093495062851840811257603174544255151597115446984458237694842739071530518936317606199598953518976167711716762043806043449827887577909963803673508838826582484003687958862302989732473748700329398645880243054148, 12708160939460449797746334640370189741594393156198590130563300705594742285274155378452384449752817944962371880018673966875751948953034846634284138305820292201281595210265881917297911731564408181887226462606892964361033320116765426523499831287478314065882300932476595216136350756971622192468975464823677154324, 52745488365658861485519010696623986434656675831322149607647058389953842185045922621964255927212518970223978973817292179059730382537814695353016058702226289640834171560498112170760826276332972100423555174686162215383841925656596984188536350046664199627214379076416024495451320834231863438007383528385204646269, 8855798603366167912634233401398286651752671525801140525178611090639905433230380535711326462952071294452556819384200831430822862220907470038589552641363759764881881084119960616686113091264272665290715332905431138686504873774368450566561688814993821800992967990682116846800657243011069696481920893909247794983, 96951009388162450018398074248238612521098089563081241061172635732154749686698900516806076917644927142046116130006730586770841058020946718314769404592479949673385387831784647829787593435525861689652400487918043078535385527278516028607916478700007746817161408140805937414915909575928550204945457887011906141614, 3085377115073481737487767519304315808353144937670566256348398664810936964565637157736537945459712875615504238408907602974507381828272609303797146395233485026377776965939508974096385939172942695211339651597248692728550782246178293579153110379844451779466255357619524290412118137515779354431956948078394927940, 48345447683174081443502925378502329908064423944850311779861406407783604557812792515281621715817536127803162311234459315836524837064977025182379655213338205159741266326939713833052921255157742860610743189155260503439836583887313584730345974553768985184119012533854386867355018502198395672167297716386558437643, 2943509185067047938273565758747957807917637430462018374124947856251091022696853505230975399503014099411245162812979057344198094444949853114144790397928000334361276864689352349519363636219566973775714458213611238774130167222835759501223813455853370320854862131109567941072112035263351158877256955712543549605, 76560888147807476608165550435978536197327212318831455594999273843368454289391559274947371380742007729563677938535717707232627424457601159959128489070947748904688640279908482263289424669338790488996485849079890881530740377280113682547250364463080771156212510360194563192123664613212111565777733487081937952558]
# 從 encrypt_dist 中建立 encrypted_dict
encrypted_dict = {value: char for char, value in encrypt_dist.items()}

# 解密過程
decrypted_message = ''.join(encrypted_dict[value] for value in encrypted_list)
print(decrypted_message)

就可以讓他跑出flag:
@)!,^=AIS3{NeverUseTheCryptographyLibraryImplementedYourSelf}-=1#&

Reverse #

The Long Print #

這題出題者說去看成大的社課影片，看完就會做了，但我看了兩次，我還是不會做。
但這是我第一次點開reverse的題目，並學習怎麼用IDA，也算是有所收穫吧。
很感謝出題者說用IDA Decompile就會出來了，才能把我騙去碰Reverse。

我的解題思路 #

int __fastcall main(int argc, const char **argv, const char **envp)
{
  unsigned int v4; // [rsp+4h] [rbp-Ch]
  int i; // [rsp+8h] [rbp-8h]
  int j; // [rsp+Ch] [rbp-4h]

  puts("Hope you have enough time to receive my flag:");
  for ( i = 0; i <= 23; i += 2 )
  {
    v4 = *(_DWORD *)&secret[4 * i] ^ key[*(unsigned int *)&secret[4 * i + 4]];
    for ( j = 0; j <= 3; ++j )
    {
      sleep(0x3674u);
      printf("%c", v4);
      v4 >>= 8;
      fflush(_bss_start);
    }
  }
  puts("\rOops! Where is the flag? I am sure that the flag is already printed!");
  return 0;
}

真的是第一次學IDA
Tab可以Decompile
按變數名稱可以看他宣告的內容
shift+e可以匯出變數的值
是不是把變數的值抓出來，再自己寫一個程式去跑就可以印出flag
於是:

#include <stdio.h>
#include <stdint.h>

// Define the secret and key arrays
unsigned char secret[] = {
    0x46, 0x41, 0x4B, 0x45, 0x0B, 0x00, 0x00, 0x00, 0x7B, 0x68,
    0x6F, 0x6F, 0x0A, 0x00, 0x00, 0x00, 0x72, 0x61, 0x79, 0x5F,
    0x02, 0x00, 0x00, 0x00, 0x73, 0x74, 0x72, 0x69, 0x08, 0x00,
    0x00, 0x00, 0x6E, 0x67, 0x73, 0x5F, 0x06, 0x00, 0x00, 0x00,
    0x69, 0x73, 0x5F, 0x61, 0x05, 0x00, 0x00, 0x00, 0x6C, 0x77,
    0x61, 0x79, 0x07, 0x00, 0x00, 0x00, 0x73, 0x5F, 0x61, 0x6E,
    0x04, 0x00, 0x00, 0x00, 0x5F, 0x75, 0x73, 0x65, 0x09, 0x00,
    0x00, 0x00, 0x66, 0x75, 0x6C, 0x5F, 0x00, 0x00, 0x00, 0x00,
    0x63, 0x6F, 0x6D, 0x6D, 0x01, 0x00, 0x00, 0x00, 0x61, 0x6E,
    0x7A, 0x7D, 0x03, 0x00, 0x00, 0x00
};

unsigned char key[] = {
    0x01, 0x10, 0x01, 0x3A, 0x0D, 0x1B, 0x4C, 0x4C, 0x2D, 0x00,
    0x0B, 0x3A, 0x40, 0x4F, 0x45, 0x00, 0x1A, 0x32, 0x04, 0x31,
    0x1D, 0x16, 0x2D, 0x3E, 0x31, 0x0A, 0x12, 0x2C, 0x03, 0x11,
    0x3E, 0x0D, 0x2C, 0x00, 0x1A, 0x0C, 0x32, 0x14, 0x1D, 0x04,
    0x00, 0x31, 0x00, 0x1A, 0x07, 0x08, 0x18, 0x76
};

int main(int argc, const char **argv, const char **envp) {
    unsigned int v4;
    int i, j;
    
    puts("Hope you have enough time to receive my flag:");
    for (i = 0; i < 24; i++) {
        // XOR 4 bytes from secret with 4 bytes from key
        v4 = *((unsigned int *)(secret + 4 * i)) ^ *((unsigned int *)(key + 4 * i));
        // Print each byte of the resulting integer
        for (j = 0; j < 4; ++j) {
            printf("%c", v4 & 0xFF);
            v4 >>= 8;
        }
    }
    puts("\nOops! Where is the flag? I am sure that the flag is already printed!");

    return 0;
}

當然，這個方法沒有成功，他只會跑出一對亂碼，我還在這裡糾結是不是我的程式碼寫錯了糾結超級久。

大佬的解法 #

17.一到直接去找大佬Demo給我看，看完覺得難怪我寫不出來，真的不可能寫出來。
在此紀錄大佬的Demo步驟

1. 開IDA #

2. Decompile #

3. 發現他偷睡覺 #

我們要讓它不睡覺
要怎麼才能讓他不睡覺呢
要改sleep()的變數
在IDA中雖然不能改程式碼，但能改Byte值

4. 改sleep()的變數 #

先鎖定他

跟IDA說我要改

原本是3674 Hex會變成7463

所以我只要改成0100即可(改成1秒)

如圖
改完之後要apply一下

會跳出視窗按ok

5. 存檔在kali裡面跑 #

接下來就可以把檔案拖到kali裡執行

AIS3{You_are_the_master_of_time_management !!!!?

最終結果 #

其實還是有解到5題，算是有達到一開始設的小目標?
但沒有很開心，因為有些題目只差臨門一腳感覺好可惜
期待官方盡快開放分享Writeup，好想知道那些跟鬼一樣的題目都是怎麼被解開的
謝謝Ais3，今年的午餐便當很好吃，飲料零食也讓我覺得很滿足
謝謝出題者們，希望明年的題目可以簡單一點
身為一個初學者，還是希望既然是「我的第一個CTF」
還是希望有讓人成功、獲得成就感的感覺
題目可以有更好的鑑別度、可以全部都標示難易度、~~可以出多一點Easy~~
在此放上排球少年中貓又教練的名言

明年再接再厲🫠🫠🫠🫠

Welcome #

Web #

Evil Calculator #

解答 #

MISC #

Quantum Nim Heist #

Three Dimensional Secret #

Emoji Console #

Crypto #

BabyRSA #

解答 #

Reverse #

The Long Print #

我的解題思路 #

大佬的解法 #

1. 開IDA #

2. Decompile #

3. 發現他偷睡覺 #

4. 改sleep()的變數 #

5. 存檔 在kali裡面跑 #

最終結果 #

5. 存檔在kali裡面跑 #