2024 蜀道山高校公益联赛_misc

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18

>nc64.exe gz.imxbt.cn 20742

  _____ _                           _        _  __        __
 | ____| | ___ _ __ ___   ___ _ __ | |_ __ _| | \ \      / /_ _ _ __ ___
 |  _| | |/ _ \ '_ ` _ \ / _ \ '_ \| __/ _` | |  \ \ /\ / / _` | '__/ __|
 | |___| |  __/ | | | | |  __/ | | | || (_| | |   \ V  V / (_| | |  \__ \
 |_____|_|\___|_| |_| |_|\___|_| |_|\__\__,_|_|    \_/\_/ \__,_|_|  |___/


欢迎来到元素战争！
游戏即将开始...

请选择你的元素（1. 金, 2. 木, 3. 水, 4. 火, 5. 土）：2
你的选择是: 木
敌人的选择是：火
木生火，玩家恢复生命！
你的血量：11，敌人的血量：9
请选择你的元素（1. 金, 2. 木, 3. 水, 4. 火, 5. 土）：

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37

import socket
import time
import random

HOST = 'gz.imxbt.cn'
PORT = 20748

def choose_num():
    return f"{random.randint(1,5)}\n"

def main():
    with socket.socket(socket.AF_INET, socket.SOCK_STREAM) as s:
        s.connect((HOST, PORT))
        print("已连接到服务器")

        while True:
            response = s.recv(1024).decode('utf-8')
            print(f"服务器：{response}")



            if "请选择你的元素" in response:
                choose = choose_num()
                print(f"发送随机选择：{choose.strip()}")
                s.sendall(choose.encode('utf-8'))

            for line in response.splitlines():
                if "敌人的血量：" in line:
                    enemy_blood = int(line.split("敌人的血量：")[1])
  
                    # print(f"enemy_blood：{enemy_blood}")
                    if enemy_blood < 1:
                        print("敌人血量小于1,战斗结束")
                        break
            time.sleep(0.1)
if __name__ == "__main__":
    main()

1
2
3
4
5
6
7
8

发送随机选择：2
服务器：
你的选择是: 木
敌人的选择是：土
木克土，玩家获胜！
你的血量：23，敌人的血量：0
你获得了胜利！敌人已被击败！
欢迎拿到flag:LZSDS{a485c47f-0b8e-4cce-8e16-d27cf0c8104e}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57

package server;

import java.nio.charset.StandardCharsets;
import java.security.Security;
import java.util.Base64;
import javax.crypto.Cipher;
import javax.crypto.spec.SecretKeySpec;
import org.bouncycastle.jce.provider.BouncyCastleProvider;
/* loaded from: CustomEncryptor.class */
public class CustomEncryptor {
    static {
        Security.addProvider(new BouncyCastleProvider());
    }

    public static String encryptSM4(String key, String content) {
        try {
            byte[] keyBytes = generateKeyBytes(key, 16);
            SecretKeySpec secretKey = new SecretKeySpec(keyBytes, "SM4");
            Cipher cipher = Cipher.getInstance("SM4/ECB/PKCS5Padding", "BC");
            cipher.init(1, secretKey);
            byte[] encryptedBytes = cipher.doFinal(content.getBytes(StandardCharsets.UTF_8));
            return Base64.getEncoder().encodeToString(encryptedBytes);
        } catch (Exception e) {
            throw new RuntimeException("Encryption error: " + e.getMessage(), e);
        }
    }

    private static byte[] generateKeyBytes(String key, int length) {
        byte[] keyBytes = new byte[length];
        byte[] inputKeyBytes = key.getBytes(StandardCharsets.UTF_8);
        System.arraycopy(inputKeyBytes, 0, keyBytes, 0, Math.min(inputKeyBytes.length, length));
        return keyBytes;
    }

    public static String encryptAES(String key, String content) {
        return encrypt(content, key, "AES", 16);
    }

    public static String encryptBlowfish(String key, String content) {
        return encrypt(content, key, "Blowfish", 16);
    }

    private static String encrypt(String content, String key, String algorithm, int keySize) {
        try {
            byte[] keyBytes = new byte[keySize];
            byte[] inputKeyBytes = key.getBytes(StandardCharsets.UTF_8);
            System.arraycopy(inputKeyBytes, 0, keyBytes, 0, Math.min(inputKeyBytes.length, keySize));
            SecretKeySpec secretKey = new SecretKeySpec(keyBytes, algorithm);
            Cipher cipher = Cipher.getInstance(algorithm + "/ECB/PKCS5Padding");
            cipher.init(1, secretKey);
            byte[] encryptedBytes = cipher.doFinal(content.getBytes(StandardCharsets.UTF_8));
            return Base64.getEncoder().encodeToString(encryptedBytes);
        } catch (Exception e) {
            throw new RuntimeException("Encryption error: " + e.getMessage(), e);
        }
    }
}

1
2
3
4
5
6
7
8
9

whoami

ls -alt

ls flag/

base64 flag/flag.zip

cat flag/hint.txt

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18

root

total 5492
drwx------ 18 root root    4096 Nov  6 15:26 ..
drwxr-xr-x  3 root root    4096 Nov  4 17:22 .
drwxr-xr-x  2 root root    4096 Nov  4 17:22 flag
-rw-r--r--  1 root root 5610013 Nov  4 16:28 SimpleHttpServer.jar

flag.zip
hint.txt

UEsDBBQACQAIABSGZFkAAAAAAAAAACsAAAAIACkAZmxhZy50eHRVVAkABWiKKGeQGitndXgLAAEE
AAAAAAQAAAAAeGwJAAcUAwAAAADtgXBFs0Lb8F43+KxCxq77A+Zya0CyhPRERubzgNwf5fF5GVjt
ntPQZe8hy0s4qLAhBXW42FAs5Xhw4lBLBwiHHE6JOQAAACsAAABQSwECFAMUAAkACAAUhmRZhxxO
iTkAAAArAAAACAAcAAAAAAAAAAAA7YEAAAAAZmxhZy50eHRVVAkABWiKKGeQGitndXgLAAEEAAAA
AAQAAAAAUEsFBgAAAAABAAEAUgAAAJgAAAAAAA==

密码为执行命令（按照时间排序）的首字母的组合重复三次，比如执行了（id,whoami），那么密码就为iwiwiw