1
import socket
2

3
HOST = "ctf-2.xeed.run"
4
PORT = 32290
5

6
s = socket.create_connection((HOST, PORT))
7

8
def recv():
9
    data = s.recv(4096)
10
    print(data.decode(errors="ignore"), end="")
11
    return data
12

13
def sendline(x):
14
    if isinstance(x, str):
15
        x = x.encode()
16
    s.sendall(x + b"\n")
17

18
recv()
19

20
s.close()

1
import socket
2
import base64
3
import zlib
4
import re
5
import urllib.request
6
import threading
7

8
HOST = "ctf-2.xeed.run"
9
PORT = 32336
10

11
logos = {
12
    "android": "Android",
13
    "arch": "Arch",
14
    "centos": "CentOS",
15
    "chromeos": "ChromeOS",
16
    "debian": "Debian",
17
    "fedora": "Fedora",
18
    "kali": "Kali",
19
    "macos": "MacOS",
20
    "mint": "Mint",
21
    "nixos": "NixOS",
22
    "opensuse": "OpenSUSE",
23
    "redhat": "Redhat",
24
    "ubuntu": "Ubuntu",
25
    "windows": "Windows",
26
}
27

28
BASE_URL = "https://bili33.top/img/logo/{}.svg"
29

30

31
def download_svg(name):
32
    url = BASE_URL.format(name)
33
    req = urllib.request.Request(url, headers={"User-Agent": "Mozilla/5.0"})
34
    return urllib.request.urlopen(req, timeout=10).read()
35

36

37
def build_refs():
38
    refs = {}
39

40
    for name, answer in logos.items():
41
        svg = download_svg(name)
42

43
        token = base64.b64encode(zlib.compress(svg)).decode()
44

45
        refs[token] = answer
46
        refs[token.rstrip("=")] = answer
47

48
        print(f"[+] loaded {answer}")
49

50
    return refs
51

52

53
def extract_token(text):
54
    candidates = re.findall(r"[A-Za-z0-9+/=]{80,}", text)
55
    if not candidates:
56
        return None
57
    return candidates[-1].strip()
58

59

60
def interactive(sock):
61
    def recv_loop():
62
        while True:
63
            try:
64
                data = sock.recv(4096)
65
                if not data:
66
                    break
67
                print(data.decode(errors="ignore"), end="")
68
            except Exception:
69
                break
70

71
    threading.Thread(target=recv_loop, daemon=True).start()
72

73
    while True:
74
        try:
75
            line = input()
76
            sock.sendall(line.encode() + b"\n")
77
        except (EOFError, KeyboardInterrupt):
78
            break
79

80

81
def main():
82
    refs = build_refs()
83

84
    s = socket.create_connection((HOST, PORT), timeout=10)
85
    s.settimeout(3)
86

87
    buf = b""
88

89
    while True:
90
        try:
91
            data = s.recv(65536)
92
        except socket.timeout:
93
            continue
94

95
        if not data:
96
            break
97

98
        buf += data
99
        text = buf.decode(errors="ignore")
100
        print(text, end="")
101

102
        if "Your answer >>" in text:
103
            token = extract_token(text)
104

105
            if token is None:
106
                print("\n[-] token not found")
107
                break
108

109
            ans = refs.get(token) or refs.get(token.rstrip("="))
110

111
            if ans is None:
112
                print("\n[-] answer not found")
113
                print("[!] token head:", token[:80])
114
                break
115

116
            print(f"\n[+] answer = {ans}")
117
            s.sendall(ans.encode() + b"\n")
118
            buf = b""
119

120
        elif "Your command >>" in text:
121
            print("\n[+] game passed")
122

123
            cmd = "sh"
124
            print(f"[+] send command: {cmd}")
125
            s.sendall(cmd.encode() + b"\n")
126

127
            interactive(s)
128
            break
129

130

131
if __name__ == "__main__":
132
    main()

1
import zlib
2
import struct
3

4
# 同时爆破宽度和高度
5
filename = "misc32.png"
6
with open(filename, 'rb') as f:
7
    all_b = f.read()
8
    data = bytearray(all_b[12:29])
9
    n = 4095
10
    for w in range(n):
11
        width = bytearray(struct.pack('>i', w))
12
        for h in range(n):
13
            height = bytearray(struct.pack('>i', h))
14
            for x in range(4):
15
                data[x+4] = width[x]
16
                data[x+8] = height[x]
17
            crc32result = zlib.crc32(data)
18
            #替换成图片的crc
19
            if crc32result == 0xE14A4C0B:
20
                print("宽为：", end = '')
21
                print(width, end = ' ')
22
                print(int.from_bytes(width, byteorder='big'))
23
                print("高为：", end = '')
24
                print(height, end = ' ')
25
                print(int.from_bytes(height, byteorder='big'))

1
#define _GNU_SOURCE
2
#include <err.h>
3
#include <fcntl.h>
4
#include <sched.h>
5
#include <signal.h>
6
#include <stdbool.h>
7
#include <stdint.h>
8
#include <stdio.h>
9
#include <stdlib.h>
10
#include <string.h>
11
#include <sys/capability.h>
12
#include <sys/prctl.h>
13
#include <sys/types.h>
14
#include <sys/wait.h>
15
#include <unistd.h>
16

17
typedef uint64_t randval_t;
18

19
typedef struct main_context_t {
20
    int   pfd[2];
21
    pid_t pid;
22
} main_context_t;
23

24
typedef struct medium_context_t {
25
    int   outfd[2];
26
    pid_t pid;
27
} medium_context_t;
28

29
typedef struct config_t {
30
    size_t count; // 次数
31
    char*  exe;   // 执行程序名
32
} config_t;
33

34
static const config_t* getcfg() {
35
    static config_t config = {.count = 32, .exe = "./sol"};
36
    static bool     init = false;
37

38
    char* buf;
39

40
    if (!init) {
41
        buf = getenv("JUDGER_COUNT");
42
        if (buf != NULL) config.count = atoll(buf);
43

44
        buf = getenv("JUDGER_EXE");
45
        if (buf != NULL) config.exe = buf;
46
    }
47

48
    return &config;
49
}
50

51
static randval_t getrand() {
52
    randval_t val;
53

54
    FILE*  fp;
55
    size_t ret;
56

57
    fp = fopen("/dev/urandom", "r");
58
    if (fp == NULL) err(EXIT_FAILURE, "fopen");
59

60
    ret = fread(&val, sizeof(val), 1, fp);
61
    if (ret != 1) {
62
        fprintf(stderr, "fread() failed: %zu\n", ret);
63
        exit(EXIT_FAILURE);
64
    }
65

66
    fclose(fp);
67

68
    return val;
69
}
70

71
static void judger(const main_context_t* const ctx,
72
                   const randval_t* const      expect) {
73
    ssize_t nread;
74

75
    randval_t actual;
76

77
    if (close(ctx->pfd[1]) == -1) err(EXIT_FAILURE, "close");
78

79
    nread = read(ctx->pfd[0], &actual, sizeof(actual));
80
    if (nread < 0) err(EXIT_FAILURE, "read");
81
    if (nread != sizeof(actual)) {
82
        fprintf(stderr, "read() failed: %zd\n", nread);
83
        exit(EXIT_FAILURE);
84
    }
85

86
    if (actual != *expect) {
87
        fprintf(stderr, "judge: Number not matched.\n");
88
        exit(EXIT_FAILURE);
89
    }
90

91
    if (close(ctx->pfd[0]) == -1) err(EXIT_FAILURE, "close");
92
}
93

94
static void proxy(const main_context_t* const   mainctx,
95
                  const medium_context_t* const proxyctx) {
96
    ssize_t   cnt;
97
    randval_t val;
98

99
    if (close(mainctx->pfd[0]) == -1) err(EXIT_FAILURE, "close");
100
    if (close(proxyctx->outfd[1]) == -1) err(EXIT_FAILURE, "close");
101

102
    cnt = read(proxyctx->outfd[0], &val, sizeof(val));
103
    if (cnt < 0) err(EXIT_FAILURE, "read");
104
    if (cnt != sizeof(val)) {
105
        fprintf(stderr, "read() failed: %zd\n", cnt);
106
        exit(EXIT_FAILURE);
107
    }
108

109
    cnt = write(mainctx->pfd[1], &val, sizeof(val));
110
    if (cnt < 0) err(EXIT_FAILURE, "write");
111
    if (cnt != sizeof(val)) {
112
        fprintf(stderr, "write() failed: %zd\n", cnt);
113
        exit(EXIT_FAILURE);
114
    }
115

116
    if (close(mainctx->pfd[1]) == -1) err(EXIT_FAILURE, "close");
117
    if (close(proxyctx->outfd[0]) == -1) err(EXIT_FAILURE, "close");
118

119
    exit(EXIT_SUCCESS);
120
}
121

122
static void userprog(const medium_context_t* const ctx) {
123
    const config_t* cfg;
124

125
    int nullfd;
126

127
    int ret;
128

129
    char* argv[2];
130
    char* envp[1];
131

132
    cfg = getcfg();
133

134
    if (close(ctx->outfd[0]) == -1) err(EXIT_FAILURE, "close");
135
    if (dup2(ctx->outfd[1], STDOUT_FILENO) == -1) err(EXIT_FAILURE, "dup2");
136
    if (close(ctx->outfd[1]) == -1) err(EXIT_FAILURE, "close");
137

138
    nullfd = open("/dev/null", O_RDONLY);
139
    if (nullfd == -1) err(EXIT_FAILURE, "open");
140
    if (dup2(nullfd, STDIN_FILENO) == -1) err(EXIT_FAILURE, "dup2");
141
    if (close(nullfd) == -1) err(EXIT_FAILURE, "close");
142

143
    memcpy(argv, (typeof(argv)){cfg->exe, NULL}, sizeof(argv));
144
    envp[0] = NULL;
145

146
    ret = execve(cfg->exe, argv, envp);
147
    if (ret == -1) err(EXIT_FAILURE, "execve");
148
}
149

150
static void isolate() {
151
    int ret;
152

153
    cap_t       caps;
154
    cap_value_t cap_list[1];
155

156
    ret = unshare(CLONE_NEWUSER);
157
    if (ret == -1) err(EXIT_FAILURE, "unshare");
158

159
    caps = cap_get_proc();
160
    if (caps == NULL) err(EXIT_FAILURE, "cap_get_proc");
161

162
    cap_list[0] = CAP_SYS_PTRACE;
163
    if (cap_set_flag(caps, CAP_INHERITABLE, 1, cap_list, CAP_SET) == -1)
164
        err(EXIT_FAILURE, "cap_set_flag");
165
    if (cap_set_proc(caps) == -1) err(EXIT_FAILURE, "cap_set_proc");
166
    if (cap_free(caps) == -1) err(EXIT_FAILURE, "cap_free");
167

168
    if (prctl(PR_CAP_AMBIENT, PR_CAP_AMBIENT_RAISE, CAP_SYS_PTRACE, 0, 0) == -1)
169
        err(EXIT_FAILURE, "prctl");
170
}
171

172
static void medium(const main_context_t* const mainctx) {
173
    int ret;
174

175
    medium_context_t proxyctx;
176

177
    isolate();
178

179
    ret = pipe(proxyctx.outfd);
180
    if (ret == -1) err(EXIT_FAILURE, "pipe");
181

182
    proxyctx.pid = fork();
183
    switch (proxyctx.pid) {
184
        case -1:
185
            err(EXIT_FAILURE, "fork");
186
        case 0:
187
            proxy(mainctx, &proxyctx);
188
        default:
189
            userprog(&proxyctx);
190
    }
191

192
    exit(EXIT_SUCCESS);
193
}
194

195
static void waitall() { while (wait(NULL) != -1); }
196

197
int main() {
198
    const config_t* cfg; // 配置文件
199

200
    size_t i;
201
    int    ret;
202

203
    main_context_t ctx;
204

205
    randval_t expect;  // 8字节随机数
206

207
    if (prctl(PR_SET_CHILD_SUBREAPER, 1) == -1) err(EXIT_FAILURE, "prctl");
208

209
    cfg = getcfg();
210

211
    for (i = 0; i < cfg->count; i++) { // 进入次数循环
212
        expect = getrand(); // 单轮随机数
213

214
        ret = pipe2(ctx.pfd, O_CLOEXEC);
215
        if (ret == -1) err(EXIT_FAILURE, "pipe2");
216

217
        ctx.pid = fork();
218

219
        switch (ctx.pid) {
220
            case -1:
221
                err(EXIT_FAILURE, "fork");
222
            case 0:
223
                medium(&ctx);  // 子进程
224
            default:
225
                judger(&ctx, &expect);  // 父进程
226
                waitall();
227
        }
228
    }
229
}

1
static randval_t getrand() {
2
    randval_t val;
3

4
    FILE*  fp;
5
    size_t ret;
6

7
    fp = fopen("/dev/urandom", "r");
8
    if (fp == NULL) err(EXIT_FAILURE, "fopen");
9

10
    ret = fread(&val, sizeof(val), 1, fp);
11
    if (ret != 1) {
12
        fprintf(stderr, "fread() failed: %zu\n", ret);
13
        exit(EXIT_FAILURE);
14
    }
15

16
    fclose(fp);
17

18
    return val;
19
}

1
#define _GNU_SOURCE
2
#include <ctype.h>
3
#include <dirent.h>
4
#include <errno.h>
5
#include <fcntl.h>
6
#include <stdint.h>
7
#include <stdio.h>
8
#include <stdlib.h>
9
#include <string.h>
10
#include <sys/ptrace.h>
11
#include <sys/types.h>
12
#include <sys/user.h>
13
#include <sys/wait.h>
14
#include <time.h>
15
#include <unistd.h>
16

17
// return address after medium(&ctx) in judge main()
18
#define RET_MAIN_AFTER_MEDIUM 0x2030fbULL
19
// expect is local variable at main_rbp - 0x20
20
#define EXPECT_OFF_FROM_MAIN_RBP 0x20ULL
21

22
static int read_file(const char *path, char *buf, size_t sz) {
23
    int fd = open(path, O_RDONLY);
24
    if (fd < 0) return -1;
25
    ssize_t n = read(fd, buf, sz - 1);
26
    close(fd);
27
    if (n <= 0) return -1;
28
    buf[n] = 0;
29
    return 0;
30
}
31

32
static pid_t find_child_once(void) {
33
    char path[128], buf[4096];
34
    snprintf(path, sizeof(path), "/proc/self/task/%d/children", getpid());
35
    if (read_file(path, buf, sizeof(buf)) == 0) {
36
        char *p = buf;
37
        while (*p && isspace((unsigned char)*p)) p++;
38
        if (isdigit((unsigned char)*p)) {
39
            long v = strtol(p, NULL, 10);
40
            if (v > 1) return (pid_t)v;
41
        }
42
    }
43

44
    DIR *d = opendir("/proc");
45
    if (!d) return -1;
46
    pid_t self = getpid();
47
    struct dirent *de;
48
    while ((de = readdir(d)) != NULL) {
49
        if (!isdigit((unsigned char)de->d_name[0])) continue;
50
        pid_t pid = (pid_t)strtol(de->d_name, NULL, 10);
51
        if (pid <= 1 || pid == self) continue;
52
        snprintf(path, sizeof(path), "/proc/%d/status", pid);
53
        if (read_file(path, buf, sizeof(buf)) != 0) continue;
54
        char *pp = strstr(buf, "\nPPid:");
55
        if (!pp) continue;
56
        long ppid = strtol(pp + 6, NULL, 10);
57
        if ((pid_t)ppid == self) {
58
            closedir(d);
59
            return pid;
60
        }
61
    }
62
    closedir(d);
63
    return -1;
64
}
65

66
static pid_t find_child(void) {
67
    struct timespec ts = {0, 1000000};
68
    for (int i = 0; i < 2000; i++) {
69
        pid_t p = find_child_once();
70
        if (p > 0) return p;
71
        nanosleep(&ts, NULL);
72
    }
73
    return -1;
74
}
75

76
static int peek_u64(pid_t pid, uint64_t addr, uint64_t *out) {
77
    errno = 0;
78
    long v = ptrace(PTRACE_PEEKDATA, pid, (void *)(uintptr_t)addr, NULL);
79
    if (v == -1 && errno != 0) return -1;
80
    *out = (uint64_t)(unsigned long)v;
81
    return 0;
82
}
83

84
static int ptrace_get_answer(pid_t pid, uint64_t *answer) {
85
    int st = 0;
86
    struct user_regs_struct regs;
87

88
    if (ptrace(PTRACE_ATTACH, pid, NULL, NULL) != 0) return -1;
89
    if (waitpid(pid, &st, 0) < 0) {
90
        ptrace(PTRACE_DETACH, pid, NULL, NULL);
91
        return -1;
92
    }
93

94
    int ok = -1;
95
    if (ptrace(PTRACE_GETREGS, pid, NULL, &regs) == 0) {
96
        uint64_t frame = (uint64_t)regs.rbp;
97

98
        // Walk frame-pointer chain. The proxy child still keeps:
99
        // main -> medium -> proxy/read/fork frames.
100
        // The medium frame has return address 0x2030fb, and its saved rbp is main_rbp.
101
        for (int depth = 0; depth < 12; depth++) {
102
            uint64_t saved_rbp = 0, ret_addr = 0;
103
            if (frame < 0x10000) break;
104
            if (peek_u64(pid, frame, &saved_rbp) != 0) break;
105
            if (peek_u64(pid, frame + 8, &ret_addr) != 0) break;
106

107
            if (ret_addr == RET_MAIN_AFTER_MEDIUM) {
108
                uint64_t main_rbp = saved_rbp;
109
                if (peek_u64(pid, main_rbp - EXPECT_OFF_FROM_MAIN_RBP, answer) == 0)
110
                    ok = 0;
111
                break;
112
            }
113

114
            if (saved_rbp <= frame || saved_rbp - frame > 0x100000) break;
115
            frame = saved_rbp;
116
        }
117
    }
118

119
    ptrace(PTRACE_DETACH, pid, NULL, NULL);
120
    return ok;
121
}
122

123
int main(void) {
124
    uint64_t answer = 0;
125
    pid_t child = find_child();
126
    if (child > 0) {
127
        ptrace_get_answer(child, &answer);
128
    }
129
    write(STDOUT_FILENO, &answer, sizeof(answer));
130
    return 0;
131
}

1
key = b"r1ckY_15_4_n3k0!"
2

3
ct = bytes([
4
    0xa3, 0xc0, 0xfc, 0xb3, 0xc8, 0xd6, 0xfa, 0xba,
5
    0x65, 0x39, 0x26, 0x88, 0xc4, 0x99, 0x3f, 0x2a,
6
    0x65, 0xbb, 0x75, 0x0a, 0x7a, 0x12, 0xac, 0xe3,
7
    0xa0, 0x15, 0x32, 0x4c, 0xe9, 0x2d, 0xc4, 0xd6,
8
    0x91, 0xf6, 0x0a, 0x9d, 0x92, 0xa3, 0x57, 0x51,
9
    0x22, 0xf7, 0xf0, 0x81, 0x55, 0xa9, 0xba, 0x87,
10
    0x21, 0x13, 0xf9, 0x49, 0xca, 0x02, 0x8f, 0x41,
11
])
12

13
DELTA = 0x9E3779B9
14
MASK = 0xFFFFFFFF
15

16
def u32be(b):
17
    return int.from_bytes(b, "big")
18

19
def p32be(x):
20
    return x.to_bytes(4, "big")
21

22
def tea_decrypt_block(v0, v1, k):
23
    s = (DELTA * 32) & MASK
24

25
    for _ in range(32):
26
        v1 = (v1 - (((v0 << 4) + k[2]) ^ (v0 + s) ^ ((v0 >> 5) + k[3]))) & MASK
27
        v0 = (v0 - (((v1 << 4) + k[0]) ^ (v1 + s) ^ ((v1 >> 5) + k[1]))) & MASK
28
        s = (s - DELTA) & MASK
29

30
    return v0, v1
31

32
k = [u32be(key[i:i + 4]) for i in range(0, 16, 4)]
33

34
out = b""
35

36
for i in range(0, len(ct), 8):
37
    v0 = u32be(ct[i:i + 4])
38
    v1 = u32be(ct[i + 4:i + 8])
39
    a, b = tea_decrypt_block(v0, v1, k)
40
    out += p32be(a) + p32be(b)
41

42
print("[raw]")
43
print(out)
44

45
pad = out[-1]
46
flag = out[:-pad]
47

48
print("[flag]")
49
print(flag.decode())