[原创]2021KCTF秋季赛偶遇棋痴-CTF对抗-看雪-安全社区|安全招聘|kanxue.com

[原创]2021KCTF秋季赛偶遇棋痴

发表于: 2021-11-26 01:23 15497

[原创]2021KCTF秋季赛偶遇棋痴

ThTsOd

2021-11-26 01:23

15497

flag长度14，拆分出半个字节
图片描述
将flag输入，z为标记

找到字符串，随手在github上搜了一下

发现是lambda演算

查看f21K9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6*7K9q4)9J5k6i4N6A6K9$3W2H3k6h3c8A6j5g2)9J5k6h3!0J5k6#2)9J5c8Y4N6A6K9$3W2Q4x3V1k6Q4x3U0g2o6c8g2)9J5y4e0W2n7i4K6t1#2c8e0k6Q4x3U0g2n7b7#2)9J5y4e0V1@1i4K6t1#2c8e0N6Q4x3U0g2m8c8g2)9J5y4e0V1%4i4@1g2r3i4@1u0o6i4K6S2o6i4@1f1#2i4@1p5@1i4@1p5%4i4@1f1^5i4K6R3%4i4@1t1@1i4@1f1@1i4@1u0m8i4K6R3$3i4@1f1^5i4@1p5%4i4@1p5K6
解析serialization::archive，这里最后一项数输入1以结束程序

观察到前16组数据有规律，(\n\f\x((n)f)(f)x) 重复加上\f\xx)结尾，猜测是输入数字
最后一组是程序输入
将 (\n\f\x((n)f)(f)x) 替换为 i
将 i\f\xx) 替换为 i(space)
同时发现中间有其他重复的结构，也可以替换，其中z是标记，保留
统计连续i的数量

观察结果，发现有点规律
图片描述
处理数据

得到0756469697B7C416D626461663D7
结合之前flag处理，这里交换endian
图片描述
pediy{Lambda6}

#include<stdio.h>
int main(){
    int id;
    int type;
    while(1){
        scanf("%d",&id);
        scanf("%d",&type);
        switch(type){
            case 0:{
                int ch;
                int unk;
                scanf("%d%d",&ch,&unk);
                printf("\\%c",ch);
                break;
            }
            case 1:{
                printf("(");
                break;
            }
            case 2:{
                int ch;
                scanf("%d",&ch);
                printf("%c)",ch);
            }
        }
        int zero;
        scanf("%d",&zero);
        if(zero != 0){
            break;
        }
    }
}

#include<stdio.h>

int main(){

int id;

int type;

while(1){

scanf("%d",&id);

scanf("%d",&type);

switch(type){

case 0:{

int ch;

int unk;

scanf("%d%d",&ch,&unk);

printf("\\%c",ch);

break;

}

case 1:{

printf("(");

break;

}

case 2:{

int ch;

scanf("%d",&ch);

printf("%c)",ch);

}

int zero;

scanf("%d",&zero);

if(zero != 0){

break;

}

f=open("s.txt")
text=f.read()
f.close()
 
count = 0
for i in range(len(text)):
    if(text[i] == 'i'):
        count +=1
    else:
        if(count>0):
            print(count,end=' ')
        if(text[i]=='z'):
            print()
        count = 0
print(count)