COCTF新生赛WirteUp

点击即送flag

7、无字天书

用HxD打开文件看到

用txt打开文本不显示内容，猜测是类零宽编码

• \u200b 零宽空格
• \u200c 零宽不连字
• \u200d 零宽连字
• \ufeff 零宽无断空格

可以用 Python 直接提取文本里的非标准可见字符

查询得知这种零宽字符隐藏信息的方式通常会把不同的零宽字符映射成二进制

之后可能每 8 位转成ASCII，也有可能base64

于是写代码进行尝试不同组合、、不同编码

import base64
from itertools import permutations

with open('attachment.txt', 'r', encoding='utf-8') as f:
    data = f.read()

zw_chars = [c for c in data if ord(c) in [0x200b, 0x200c, 0x200d, 0xfeff]]
zw_unique = sorted(set(zw_chars))

print(f"检测到的零宽字符种类: {[hex(ord(c)) for c in zw_unique]}")

def try_binary_decode(zero_chars, mapping):
    bits = ''.join(mapping.get(c, '') for c in zero_chars)
    out_bytes = []
    for i in range(0, len(bits), 8):
        byte_bits = bits[i:i+8]
        if len(byte_bits) == 8:
            out_bytes.append(int(byte_bits, 2))
    try:
        return bytes(out_bytes).decode('utf-8', errors='ignore')
    except:
        return None

def try_base64_decode(zero_chars, mapping):
    bits = ''.join(mapping.get(c, '') for c in zero_chars if c in mapping)
    b64_chars = []
    for i in range(0, len(bits), 6):
        chunk = bits[i:i+6]
        if len(chunk) == 6:
            b64_chars.append(chr(int(chunk, 2) + 32)) 
    b64_str = ''.join(b64_chars)
    try:
        return base64.b64decode(b64_str).decode('utf-8', errors='ignore')
    except:
        return None

results = set()

if len(zw_unique) >= 2:
    for zero, one in permutations(zw_unique, 2):
        mapping = {zero: '0', one: '1'}
        res = try_binary_decode(zw_chars, mapping)
        if res:
            results.add(res)
        mapping_rev = {zero: '1', one: '0'}
        res2 = try_binary_decode(zw_chars, mapping_rev)
        if res2:
            results.add(res2)

if len(zw_unique) >= 3:
    for zero, one in permutations(zw_unique, 2):
        mapping = {zero: '0', one: '1'}
        res = try_binary_decode(zw_chars, mapping)
        if res:
            results.add(res)

if len(zw_unique) >= 2:
    for zero, one in permutations(zw_unique, 2):
        mapping = {zero: '0', one: '1'}
        res = try_base64_decode(zw_chars, mapping)
        if res:
            results.add(res)

print("\n===== 可能的解码结果 =====")
for r in results:
    print(r)

最后终端输出即可看到flag

8、静谧之眼

根据题目名可以联想到一个工具SilentEye，使用该工具解密可以获得flag

9、Easier_Zip塔的无尽长廊

加密套娃 Zip 题型，利用脚本进行解密

import os
import subprocess

base_dir = "/Users/xxx/Downloads/misc/Easier_Zip塔的无尽长廊"
os.chdir(base_dir)

filename = "Wakt.zip"
password = open("password.txt").read().strip()
layer = 0

while True:
    layer += 1
    print(f"=== 解压第 {layer} 层 ===")
    subprocess.run(["7z", "x", filename, f"-p{password}", "-y"], stdout=subprocess.DEVNULL)
    
    if os.path.exists("flag.txt"):
        print("\n🎯 找到 flag：")
        print(open("flag.txt").read().strip())
        break

    if os.path.exists("password.txt"):
        password = open("password.txt").read().strip()
        print(f"新密码: {password}")

    if os.path.exists("Wakt.zip"):
        filename = "Wakt.zip"
    else:
        print("没有更多 ZIP，结束")
        break

运行即可得到flag

10、Cat the USB

Wireshark打开可以发现是键盘流量

我们用指令将该字段的数据提取出来

首先给数据加冒号

f=open('usbdata.txt','r')
fi=open('out.txt','w')
while 1:
	a=f.readline().strip()
	if a:
		if len(a)==16:
			out=''
			for i in range(0,len(a),2):
				if i+2 != len(a):
					out+=a[i]+a[i+1]+":"
				else:
					out+=a[i]+a[i+1]
			fi.write(out)
			fi.write('\n')
	else:
		break
fi.close()

然后还原成键位

normalKeys = {
	"04":"a", "05":"b", "06":"c", "07":"d", "08":"e",
	"09":"f", "0a":"g", "0b":"h", "0c":"i", "0d":"j",
	"0e":"k", "0f":"l", "10":"m", "11":"n", "12":"o",
	 "13":"p", "14":"q", "15":"r", "16":"s", "17":"t",
	  "18":"u", "19":"v", "1a":"w", "1b":"x", "1c":"y",
		"1d":"z","1e":"1", "1f":"2", "20":"3", "21":"4",
		"22":"5", "23":"6","24":"7","25":"8","26":"9",
		"27":"0","28":"<RET>","29":"<ESC>","2a":"<DEL>", "2b":"\t",
		"2c":"<SPACE>","2d":"-","2e":"=","2f":"[","30":"]","31":"\\",
		"32":"<NON>","33":";","34":"'","35":"<GA>","36":",","37":".",
		"38":"/","39":"<CAP>","3a":"<F1>","3b":"<F2>", "3c":"<F3>","3d":"<F4>",
		"3e":"<F5>","3f":"<F6>","40":"<F7>","41":"<F8>","42":"<F9>","43":"<F10>",
		"44":"<F11>","45":"<F12>"}
shiftKeys = {
	"04":"A", "05":"B", "06":"C", "07":"D", "08":"E",
	"09":"F", "0a":"G", "0b":"H", "0c":"I", "0d":"J",
	 "0e":"K", "0f":"L", "10":"M", "11":"N", "12":"O",
	  "13":"P", "14":"Q", "15":"R", "16":"S", "17":"T",
		"18":"U", "19":"V", "1a":"W", "1b":"X", "1c":"Y",
		"1d":"Z","1e":"!", "1f":"@", "20":"#", "21":"$",
		 "22":"%", "23":"^","24":"&","25":"*","26":"(","27":")",
		 "28":"<RET>","29":"<ESC>","2a":"<DEL>", "2b":"\t","2c":"<SPACE>",
		 "2d":"_","2e":"+","2f":"{","30":"}","31":"|","32":"<NON>","33":"\"",
		 "34":":","35":"<GA>","36":"<","37":">","38":"?","39":"<CAP>","3a":"<F1>",
		 "3b":"<F2>", "3c":"<F3>","3d":"<F4>","3e":"<F5>","3f":"<F6>","40":"<F7>",
		 "41":"<F8>","42":"<F9>","43":"<F10>","44":"<F11>","45":"<F12>"}
output = []
keys = open('out.txt')
for line in keys:
	try:
		if line[0]!='0' or (line[1]!='0' and line[1]!='2') or line[3]!='0' or line[4]!='0' or line[9]!='0' or line[10]!='0' or line[12]!='0' or line[13]!='0' or line[15]!='0' or line[16]!='0' or line[18]!='0' or line[19]!='0' or line[21]!='0' or line[22]!='0' or line[6:8]=="00":
			continue
		if line[6:8] in normalKeys.keys():
			output += [[normalKeys[line[6:8]]],[shiftKeys[line[6:8]]]][line[1]=='2']
		else:
			output += ['[unknown]']
	except:
		pass

keys.close()

flag=0
print("".join(output))
for i in range(len(output)):
	try:
		a=output.index('<DEL>')
		del output[a]
		del output[a-1]
	except:
		pass

for i in range(len(output)):
	try:
		if output[i]=="<CAP>":
			flag+=1
			output.pop(i)
			if flag==2:
				flag=0
		if flag!=0:
			output[i]=output[i].upper()
	except:
		pass

print ('output :' + "".join(output))

将中间多余部分去除可以得到flag

coctf{USB_1s_intersting}

11、Emo_Zip

根据题目提示，猜测是已知明文爆破

七、Blockchain

1、Password Checker

观察网页源码可以得到信息

RPC Endpoint: http://ctf.ctbu.edu.cn:33819/rpc

合约地址: 0x5FbDB2315678afecb367f032d93F642f64180aa3

ABI:

[{
  "inputs": [{"internalType": "string", "name": "attempt", "type": "string"}],
  "name": "check",
  "outputs": [{"internalType": "bool", "name": "", "type": "bool"}],
  "stateMutability": "pure",
  "type": "function"
}]

因为check 是pure，查询得知，把flag常量存在合约代码中进行比较非常常见

决定直接下载字节码进行反编译得到合约的 EVM 字节码

curl -s http://ctf.ctbu.edu.cn:33819/rpc \
  -H 'Content-Type: application/json' \
  -d '{
    "jsonrpc":"2.0",
    "id":1,
    "method":"eth_getCode",
    "params":["0x5FbDB2315678afecb367f032d93F642f64180aa3","latest"]
  }'