CTF6
Snowfall
有些题，你用记事本直接打开，发现根本不会得到什么，这就说明有问题了
但是该怎么解决有需要思路。
我们这里用subtimetext打开，但是我是刚下的sublime text 所以编码没开
在设置里面可以调
右下角就可以调了
ctrl+a 全选
发现文字后面是有东西的
我们来查一下
WhiteSpace，是一种只用空白字符(空格，TAB和回车)编程的语言，而其它可见字符统统为注释。
下面这个网站做处理
https://vii5ard.github.io/whitespace/
OK now you can run whitespace code. By the way, the key is H0wt0Pr1ntAWh17e5p4ceC0de.
这个是step1.txt解析
相关知识：
push:将数字压入栈顶
printc:将栈顶元素弹出并以ASCII字符形式输出
dup:复制栈顶元素后压入栈顶
drop:弹出栈顶元素
add:将堆栈最上方的两个元素弹出，二者做加法运算,得到的结果入栈
在试试step2.txt
¡{oÃåÇMÅ°âã,±+`¡·_Ó}ÝFfuÛqYǾZÐq À¸È1_©E¸$ÊEE
$
°s7§µÜ4@ª±@Sz©üª!É5VI#8Ñoã.Ú<M¥ø&ÕÉùZáÿÃeA
î] ¶(IiÚ\{úÏٻʻ¬åÝßM:8>êî¯ÎìZAÅê5òb½]E: ° $ñSµUNúùÆǺ«JQ¹åõ!! ¢U
~N
bflag.txt
2\2w×
第二个的结果 有flag.txt
这个肯定是我们要的，那么这个输出到底是什么，乱码，考虑解压文件，加压之后出来这个flag.txt
但是这个输出的还是有问题，所以我看大家用的是python在实现一边
那我把put ,push 的过程保存一下
push 0
push 55
add
dup
printc
push 175
push 188
push 122
printc
printc
dup
printc
push -136
add
dup
printc
push 0
push 28
printc
dup
printc
push 148
push 103
push 178
push 233
push 4
printc
printc
printc
printc
dup
printc
push 0
push 176
printc
dup
printc
push 0
add
dup
printc
push 0
add
dup
printc
push 0
add
dup
printc
push 0
push 106
push 0
push 0
push 0
printc
printc
printc
printc
dup
printc
push 0
add
dup
printc
push 0
push 0
push 0
push 0
push 0
printc
printc
printc
printc
dup
printc
push 148
push 91
push 162
push 61
push 205
printc
printc
printc
printc
dup
printc
push 163
dup
printc
push -153
add
dup
printc
push 151
add
dup
printc
push 146
push 111
push 123
push 6
printc
printc
printc
dup
printc
push 49
add
dup
printc
push 34
add
dup
printc
push 199
dup
printc
push 77
dup
printc
push 227
push 226
push 176
push 197
printc
printc
printc
dup
printc
push 44
dup
printc
push 96
push 43
push 177
printc
printc
dup
printc
push 65
add
dup
printc
push 125
push 211
push 95
push 25
push 183
printc
printc
printc
printc
dup
printc
push 96
add
dup
printc
push 157
push 117
push 102
push 70
printc
printc
printc
dup
printc
push 62
add
dup
printc
push 89
push 113
push 2
printc
printc
dup
printc
push 90
push 190
push 199
push 134
printc
printc
printc
dup
printc
push 208
dup
printc
push -95
add
dup
printc
push -111
add
dup
printc
push 158
push 134
push 131
push 30
printc
printc
printc
dup
printc
push 200
push 130
push 184
push 192
printc
printc
printc
dup
printc
push -151
add
dup
printc
push 169
push 95
printc
dup
printc
push 69
dup
printc
push 202
push 36
push 184
printc
printc
dup
printc
push -133
add
dup
printc
push 2
dup
printc
push 67
add
dup
printc
push 160
dup
printc
push 36
push 13
printc
dup
printc
push 55
push 115
push 176
push 13
printc
printc
printc
dup
printc
push 181
push 167
printc
dup
printc
push 220
dup
printc
push -76
add
dup
printc
push 159
push 128
push 156
push 24
printc
printc
printc
dup
printc
push 52
dup
printc
push 143
dup
printc
push -79
add
dup
printc
push 64
push 177
push 170
printc
printc
dup
printc
push 169
push 122
push 83
push 129
printc
printc
printc
dup
printc
push 83
add
dup
printc
push 53
push 201
push 33
push 170
push 159
printc
printc
printc
printc
dup
printc
push 149
push 35
push 73
push 86
push 141
printc
printc
printc
printc
dup
printc
push 111
push 209
push 56
printc
printc
dup
printc
push 218
push 146
push 46
push 227
printc
printc
printc
dup
printc
push 165
push 77
push 60
push 18
printc
printc
printc
dup
printc
push -142
add
dup
printc
push 248
dup
printc
push -210
add
dup
printc
push 175
add
dup
printc
push 18
push 136
push 201
printc
printc
dup
printc
push 231
add
dup
printc
push 90
push 150
printc
dup
printc
push 225
dup
printc
push 30
add
dup
printc
push -60
add
dup
printc
push 101
dup
printc
push 23
dup
printc
push 93
push 238
push 144
push 13
push 65
printc
printc
printc
printc
dup
printc
push -62
add
dup
printc
push 119
add
dup
printc
push 73
push 40
push 136
push 182
printc
printc
printc
dup
printc
push 218
push 105
push 137
printc
printc
dup
printc
push -218
add
dup
printc
push 3
add
dup
printc
push 123
push 92
push 2
printc
printc
dup
printc
push 127
add
dup
printc
push 128
dup
printc
push 137
dup
printc
push 15
push 187
push 217
push 207
printc
printc
printc
dup
printc
push 187
add
dup
printc
push -48
add
dup
printc
push 229
push 172
push 187
printc
printc
dup
printc
push 221
dup
printc
push 58
push 77
push 223
printc
printc
dup
printc
push 62
push 56
printc
dup
printc
push 238
push 234
printc
dup
printc
push -63
add
dup
printc
push 206
dup
printc
push 236
dup
printc
push 197
push 65
push 90
printc
printc
dup
printc
push 242
push 53
push 234
printc
printc
dup
printc
push 189
push 98
printc
dup
printc
push 93
dup
printc
push 1
push 58
push 135
push 69
printc
printc
printc
dup
printc
push 3
add
dup
printc
push 0
push 6
printc
dup
printc
push 1
dup
printc
push 9
dup
printc
push 176
push 128
printc
dup
printc
push 1
push 11
push 7
push 0
printc
printc
printc
dup
printc
push -1
add
dup
printc
push 2
dup
printc
push 34
add
dup
printc
push 6
dup
printc
push 235
add
dup
printc
push 18
push 1
push 7
printc
printc
dup
printc
push 65
add
dup
printc
push 250
push 78
push 85
push 181
push 15
printc
printc
printc
printc
dup
printc
push 249
dup
printc
push 199
push 198
printc
dup
printc
push 185
push 81
push 74
push 171
push 186
printc
printc
printc
printc
dup
printc
push 136
push 245
push 229
push 17
printc
printc
printc
dup
printc
push 0
push 1
push 33
push 33
printc
printc
printc
dup
printc
push 1
add
dup
printc
push -1
add
dup
printc
push 12
add
dup
printc
push 128
dup
printc
push 0
push 85
push 131
push 162
printc
printc
printc
dup
printc
push 1
push 10
push 8
printc
printc
dup
printc
push 125
add
dup
printc
push 78
dup
printc
push -65
add
dup
printc
push 0
push 0
push 98
printc
printc
dup
printc
push 5
dup
printc
push 1
dup
printc
push 16
add
dup
printc
push 19
dup
printc
push 0
dup
printc
push 108
push 0
push 102
printc
printc
dup
printc
push 0
push 103
push 0
push 97
push 0
printc
printc
printc
printc
dup
printc
push 46
dup
printc
push -46
add
dup
printc
push 116
push 0
push 120
push 0
push 116
printc
printc
printc
printc
dup
printc
push 25
push 0
push 0
push 0
printc
printc
printc
dup
printc
push 1
push 10
push 20
push 0
printc
printc
printc
dup
printc
push 92
push 50
push 0
printc
printc
dup
printc
push 151
dup
printc
push 119
push 148
push 50
printc
printc
dup
printc
push 96
add
dup
printc
push 21
push 1
printc
dup
printc
push 6
dup
printc
push -5
add
dup
printc
push 0
dup
printc
push 32
add
dup
printc
push 0
dup
printc
push 0
push 0
push 0
printc
printc
dup
printc
push 0
dup
printc
end
使用的python 脚本也是遵循一定的格式的
直接给别人的代码了
import re
from queue import LifoQueue
with open("test.txt", "r") as f:
data = f.read()
data = data.splitlines()
stack = LifoQueue()
ret = ""
for line in data:
if "push" in line:
num = int(re.findall("push (.*?)$", line)[0])
stack.put(num)
elif line == "add":
stack.put(stack.get() + stack.get())
elif line == "dup":
num = stack.get()
stack.put(num)
stack.put(num)
elif line == "drop":
stack.get()
elif line == "printc":
asc = chr(stack.get())
# print(asc, end="")
ret += asc
# save file
bin_data = ret.encode("latin1")
with open("1.7z", "wb") as f:
f.write(bin_data)
test.txt ：
得到一个压缩包
然后用step1.txt得到的密码来打开，一般的逻辑
H0wt0Pr1ntAWh17e5p4ceC0de
解压之后打开
可以看到空白格
但是输出啥也没有，把栈操作复制一下，命名test2.txt
里面是没有printc的也就没东西输出了
改一下代码：
还是别人的，等会我就研究一下自己写一个出来
import re
from queue import LifoQueue
with open("test2.txt", "r") as f:
data = f.read()
data = data.splitlines()
stack = LifoQueue()
ret = ""
for line in data:
if "push" in line:
num = int(re.findall("push (.*?)$", line)[0])
stack.put(num)
elif line == "add":
stack.put(stack.get() + stack.get())
elif line == "dup":
num = stack.get()
stack.put(num)
stack.put(num)
elif line == "drop":
asc = chr(stack.get())
print(asc, end="")
然后输出得到
关于代码：
总得来说代码很简单，储存操作信息，然后根据操作信息写出代码，
读的方式为一行一行的读，一行作为一个字符串
然后开始遍历每一行数据，因为是字符串的缘故，判断字符串是否有相关操作，然后调用stack的相关函数
对于拿到数字，也是一种处理
push操作才会操作数字，我的写法是
这里的意思是：
对printc储存的数据进行编码以Latin1的形式
Latin1是ISO-8859-1的别名，有些环境下写作Latin-1。ISO-8859-1编码是单字节编码，向下兼容ASCII，其编码范围是0x00-0xFF，0x00-0x7F之间完全和ASCII一致，0x80-0x9F之间是控制字符，0xA0-0xFF之间是文字符号。
当然这也是根据我们输出的数据而定
处理前:
7z¼¯' é²g° j Í=¢[£
î] ¶(IiÚ \{úÏٻʻ¬åÝßM:8>êî¯ÎìZAÅê5òb½]E: ° $ñSµUNúùÆǺ«JQ¹åõ!! ¢U
b f l a g . t x t
2\2w×
这个输出但是又跟直接在网站输出一样哎，那我是不是直接可以将网站的数据复制之后，然后只用处加密就可以了，变成压缩包就好了呢，当然这个python存在的意义也很多，也让我们认识到了一些操作方式
主要了解这个whitespqce吧，是一个很不错的加密的程序
game1
先试试，看看F12
检查下代码：
这里有base64的字样注意
看看控制台呀，请求啊这种
然后在负载中看到有点不一样的了。出来呢了分数和一个字母
我们在来试试
ZM没变，等于号缺少了一个
很有是是字母或者字母=？
或者跟等于没关系
然后我们在之前看到这里是用base64做编码的
我们试试
那估计是想分数最大才会出来flag
我们看一下直接325 base64编码
而MzI1==解密也是325
那么我就想==可能是附加物了
然后开始试到99999，sign为OTk5OTk=
ok我们换种方式看看这道题
更好找规律
值的话，就设置一下然后发送看看有没效果出来得慢慢的
网站被黑
拿到网站，提示说留了后门
用御剑扫一下吧看看是那个链接
http://114.67.175.224:18574/shell.php
打开是需要密码的
我在相应中或者抓包的一些都没有看到什么线索
那只能用bur爆破了
通过根据网页的设置来设置爆破模块的东西
flag{4c336a7df875f0064e187b514fc9f568}
