CTF | 2022 GZTime's 元旦红包解谜 WriteUp


引言

时间总是过得那么快,这几周忙着各种期末 ddl,直到实验室年底聚餐了才意识到已经年末了。

转眼间 2022 年就到啦!

新年第一篇,先祝大家新年快乐,新的一年里都能 flag 多多,都能有新的收获喵~


跨年的时候听 GZTime 说准备了元旦解谜红包,于是就来瞄了一眼。

严格来说这应该不叫 CTF 吧,不过懒了,就姑且这么归类吧。

题目如下。

TimeAxis, [2022/1/1 1:41]
这是一份元旦红包。
虽然也就只有一些编解码的东西罢了.jpg
有效期大约 2022-01-02 00:00

http://redpack.gz.wtf/2022.bin
After Base64:
http://redpack.gz.wtf/2022.b64.txt

喵喵顺便丢了一份 binary 文件 在这里

之后给出了一系列 hint。

TimeAxis, [2022/1/1 12:54]
HINT 1: 最开始是个 deflate 压缩

TimeAxis, [2022/1/1 15:27]
HINT 2: 第二层是个可以运行的程序,但并不是 binary(

TimeAxis, [2022/1/1 15:44]
HINT 3: 以及有一次会用到 xor 加密

TimeAxis, [2022/1/1 18:08]
HINT 4: malbolge

TimeAxis, [2022/1/1 18:40]
HINT 5: prod[]与后面是分离的

TimeAxis, [2022/1/1 19:44]
HINT 6: 如果你得到了Key,你会知道一定是它的

步骤

Step 1

http://redpack.gz.wtf/2022.bin
After Base64:
http://redpack.gz.wtf/2022.b64.txt

首先拿到一个 二进制文件,或者这个 base64 编码后的文件。

看了下用到了 deflate 压缩(后面 hint 也给了),inflate 一下。

得到的东西长这样……

D'`$#]\~mlGjzhwfv3,+=`LLKm[Z([email protected]!a>O_)([wvo5slTjihmfe+Lbg`ed]\"`_AWV[Tx;QPUNr5KPONGFjD,HAF?>[email protected]?>7};:3W7wv4-,10)M-ml*)(!E%|#"y?w|u;yxwYXtsl2pRhgle+Lbg`ed]\"`_^@\Uy<XQuUTSR43ImMLKDIHGF?cCB;:?>7[|{92V05.R210)o-&J*)('g%${Ay~w=^]sxqputml2poQmf,dLhgf_%cbDCY}]\[T<RvVUT6LpPIHMLEDhHAF?cCB;#?8\<|{321U5u-Q10po'&+*#G'~%$#[email protected]~}|utyxwp6tVlkpi/mfkd*hgfe^c\"`[email protected]=SXWPOsMLKPImGFKJCHGF?c&%[email protected]]7};4X87wv4-,10)M'm%$)(!E%$#"!a}v<zsrqp6Wmrqpih.lkjihg`&d]E[!_^@?UTSw:VONMqQP2HlLEiCgGFE>[email protected]"!=<5Yz210T4ts1*No',%$)(!~D$dc!x}vu;srwp6WVl2johglkd*ba`_^]#a`_XW\[ZYRvVU76LpP2NMLEiCBAFE>bB;:?>=6Z{9870Tu3,P0/.'m+$H(h&%$#[email protected]~}|{ts9wvuWmrqjoh.lkjc)gIedcb[!_X]\UTxXWVO7SLpP2HMFKDhBAF?>b%[email protected]?>7[;43W76v.3,P0/o-&J*j(!~}C#"bx>|utyrq7oWslkjong-edchgfe^]#aC_^]\Uy<;[email protected]>=<A:^!7<5:3Wx05.-,+O/on,+*#Gh&%${zy?}|u]yxwp6tVl2pRh.lNjchg`_%Fb[`YX|\[ZYXWVUTSRQP2HMFEDhHAFE>=a;@9>7<5Yz876/S-s10/.-&J*)i!&}${A!a`|u;yrwvo5slTpong-kMiha'Hdc\"`[email protected]\Uy<;WPUTSRKJOHl/KJIHAF?c=BA:?8\<|{321Uvu3,P0/.'&J*)"'~D$#"!a}|u;yxwYun4rkjih.lNjihg`_%]ba`_^WVz=YRWPt76RQPONGkE-CgGF([email protected]"!7[|{98765.R2r*No-,+$Hi!&}$#[email protected]|uzyxwp6Wmrqpi/mlkjib(Ie^]\"`Y^W{[Z<;WVOsSRQP2NGLEDhHG)(D=aA#9]7<5Y9y1Uvu-,10/(L,%k#(!E%|[email protected]|uzyxwp6tVrkji/Ple+iKgf_%]\a`_^]\UTxXWP8NMLpJINMFEi,BGF?cCB$:^!7<5:3276/S32+*)(L&%*#(!~D$#"yx}|u;\[q7utsrqpi/glkdc)aI_dcb[Z~^@\UTYRv9OTMLpPON0/EJCgA)[email protected]=<;4X870v.32+O)(-,+*#G'&%[email protected]}|{t:rwputml2ponglkd*hJ`edcb[Z~X]\[Tx;:[email protected]?c&BA:?>76Z:9yx65.R2r0/('&J*ji'~%|#"y?`|{tsr8vuWmrqpingf,jiKgf_%cbD`Y}@[email protected]"!76;4X87w5.R2+q).'&J*ji!&}${Aba}v{t:xZpotm3kjih.Oedihg`&G]\a`_X|\[Z<;WPUTSRQJnN0/EJCgGFE>&<`@?>7};:3Wx05.3,P0/.-,%Ij('~%|#"y?w_{zyr8putsrkj0hgfkjc)JI_d]\"ZY}WV[TSRWPtTS54JIHMFjD,BGF?>[email protected]?8\<|43W765u-Q10/o'Kl$)"!E%$#"!a}v<]yxwpunsl2joh.lkjiKa'_G]#aC_^WVzZSRQu8TMRKPImMLEDIBf)E>=B;_?>~<5Y987654321q)M-,+*ji!Ef${Aba}|{zyxwp6nsrk1Rhglkd*hgf_G]#aCBX]VUy<;[email protected]=<;4X81w/S3210)M-,+k)(!E%${z!x>|{]\xqpo5slTjihmfe+LKgf_%cbaZY}@\[TSXWPt76LKJnNG/Ei,HGFED=a;:9>7<;:32V6v4-,P0).-,+$#G'~f${A!~w_u;yxwp6nslkj0nmledcbgf_%cbDZ_^WVz=SRWPtNMLQPOHlL.DIHGF?cCB$:^!=<;:981U54-21*N.'m%$)('~D${c!x>_^tyxqp6WVlqji/glejc)g`Hd]#a`_^@\Uy<XWPt7MLpPO1GFKDhHGF('C<`@"8=<5Yzy10/S32+*).-&J*)i!E%|{A!~w_utyxq7utVrkji/gOe+LKgf_%cba`BX]VUy<XQuUTSR43ImMFKJCHAeE'&<`#9>7<;:981Uvu-,10/(L,%k#(!Ef${"yx>v{t:rZvun4Uqj0nmlkjc)gfHG]#D`Y^W\Uy<[email protected]'CB;:9]7};:3W7wv432+O/.-&J*ji!Efe#[email protected]}|{zyxwp6WVlqjoh.leMib(fHGcb[ZY}|\[ZYR:PtNSLKJnN0/EJCg*F?cC%;:?8\<|432V6/u-Q10/.'&+$)"F&%e{"yx}|ut:xwputm3Tpihmf,jibJ`&^F\a`_X|\[[email protected]'&<`@?!~<5Y981w5.R2r*N.-,+k#(!E}${A!~}v{t:xZpunsl2pongOe+LKgf_%Fba`_^]VzT<XWVOs65KPImML.DhHGFE'&<`:?>76;:3Wx654-,P0).-,+$#G'~}${[email protected]}vuzs9Zvo5Vlqji/mle+LKafedcb[Z~^]\[Z<RvVONMRQPIm0/EJCgGFED=aA:9>7[|{98765.R2+q).'&J*ji'~%|#"y?w_{zyr8vuWVrk1ohmf,jLha'e^Fb[Z_X|V>ZSw:VUNMqQJONMLEDhBGFED=aA#9]~<;:9876/S32r*N.-,%k)"F&%$d"y?wv{tyr8vXWsrk1Rnmle+LKgf_%cbD`YXW\UZSwW9OTSLKoONG/[email protected](>[email protected]?87[543W70T432r0)M-,lk)"Fg%$#zy~w=^]yxqpo5mrkpohmlkd*hgf_Gcb[!_^@?[ZYRv9OTMRQPIm0/EDCBGF?cCB$#?8\<|{321U543sr*N.n,+*)"F&f${Ab~w|uzs9qvonm3kSong-kjc)gIHdcbaZ~^@?UZYRvVUT6LpP2NGkE-CHAF?cCB;#?8\<|{321U5u-Q+*/(-&+*#(!E%${A!a}v<]\rqp6Wmrqpih.lNd*ha`e^cb[!YXW{[T<RvP8TMRQPIHGkEJCBfF('C<`#9>7<5Y9y10/S3,r*N.-&%$#GF&f|{"y?`v{tyr8Yotml2pingfkjc)gfed]b[!_^@VUTxX:VOsSRKJn10FEiCgGFE'&<`:987[549870/St,+*/(L&l$#(!Efe{zy?w_utyxq7onml2poQg-Njchgf_d]#DC_^WVzZSRQPOsS54PINGkKD,HAe(DCBA:^!~<5Y981w543,P0/o-,%*)(!~D$#"bx>|{zs[q7uWsrkj0ngfkjib(f_Gcb[!B^WVzTx;QPUNr54JONGFEi,[email protected]'&<`:"8=<54X87w5.-210/(L,%k#(!E%$#cbx>|u]yxwp6WVlqjoh.ONjiha'[email protected]\[TxXWP8NrLQPONGLEDhHGFE>&<`@9>=6Z:9y10/S32+q)M-&+*#G'&}|{[email protected]~w_utyxq7otmrqji/mlejihg`&dcbDZ_^WVzZSwQVUNMq4JIHMLEi,BAF?>=aA#9]76;:9870/Sts+*)Mn&+*#('~De#"!x}|{t:xwvunml2Sihg-kdiba`&G]\a`_X|?UZSRvVU76LpJOHl/EDCBAeEDCBA#9]=6|49810/.R2r*N.n,%I)('g}C#c!~}v{t:[wvunml2johgle+LKgf_%F\[`_^]VzT<[email protected]?>=a;_9>=<;:981Uv.32+O/.-ml$Hi'&%$#[email protected]}v{tyxwvo5Vrqpi/g-kjibJ`&G]baZY}]\[ZYRWVUNrRQ3IHMLEiI+*F?>b%[email protected]]=<5:32V6/4-Q10/(L,+$#(!E%e#[email protected]}v{t:[wvonm3qpongOe+LKgf_%FE[[email protected]\[TxXWV8NrR43IHGkKDCgA)?>C<`@">76Z:9yx65.R,10/(Lm%$#G'&f|{"y?`_{tyrwp6Wmrqpi/g-kMLhg`&^]\[!_^@?UTSw:VONMq4JIHMLEiIBGF?c=%;_?>7<543Wx05.R2+q/('&J*#"Fg%$#"!x>|ut:[Zvutmlkj0nPOkd*hJ`edcb[Z~^@\UTxXWVU7Mq4JIHMLEiIH*)?>=a;@?>=6Z:9yx65.RQ10/.',%$#Gh~D$#"!x}v<z\r8vutVlkj0QPfejc)gI_d]b[!_^@VzTSRQPtT6LQJIm0/KDCHAF?cCB$#?8\<|{321U5u321*No-,%$#G'g}${z!x>|u]yxwp6WVrk1onPle+iKgf_%]\a`_^]\UTxXWP8NMLpJINMFEiI+*F?cCB$:^>=<|4Xy165.-Qrq/('&Jk)"!&}Cd"!x>v{zyxwp6Wsrkji/mOedihg`&Gc\[`_X|\[Z<;WVUNMq4JIHMLEiCBGF?cC<[email protected]]=6;4381U5u-Q10po'&+*#Gh&}|#"y?}|utyxwp6tVrkj0hglkd*hg`Hd]#[ZY^W{[TYXQVUNrRQPO1Gk.JCHAFE>bBA#9]=<;:zy1U5432r*N.'m+$H('~%$#"!x>|{z\r8vuWsrqpi/gOe+LKgf_%Fb[[email protected]\[TxR:PtNMRKPIm0/EJCg*)?>[email protected]"!7[|:921U5u3,P0/o-,%*)(!~De{zy~w={z\xwp6Wmrqpi/gfkjib(feG]\[!B^WVzZ<;WVOsSR43ImMLK-IBfF?>C<;_?!=6Z4981Uvu3,P0/o-,+$Hi'&%$#[email protected]?}|^]s9Zvotml2pohmf,Mib(f_Gcb[!B^[email protected]?>b%$:^>7};:3Wx6/4-,P0po-&%*#G'&}|B"yx}|ut:xwputm3Tjohmf,jcb(`H^$E[ZY}W\[TSRvP8TSRQJnN0/EJCgA)E>[email protected]?>=<5Y9216543,Pq/.'&%Ij('~%|#"y?`|{tsr8vXtsl2piQmfkd*hgI_^]#aZ_XW{[=YXWPOsSLQJOHlFEDIHGF?c&%[email protected]]=}5Yzy1054-,P0/(L&l$#('&}C#"!a}v<zsxwpunsl2poQg-Njiha`ed]#DCYXW{UTYXQPtNMq43Im0LKDhHGFE'&<`:"8=<54X87654321q)M-,+*ji!E%${"y?>|u]sxwp6tsrqpoQg-kjiKgf_%FEaZY^]Vz=YXQVUNrRQ3ONMFj-CBGFED=a;:?87[5{9810/St2+0).'Kl$)"'~De#zyx>_{zsrwvun4Uqj0nmlkjc)JI_dc\[!B^WVUy<XWPtT65KJOHMLEi,BGF?>bB;#?8\<;:z870T4ts1*N.-,+k#G'~}${[email protected]~wv{t:[Zpotsl2Sinmlkjiba'H^]\[Z~^@VUTSXQVOsM5KJONGkE-CHAF?cCB;#?8\<|{92765.-Qrq/('&Jk)('~D$dc!x}vu;srwp6tVlkpi/mfkd*hg`Hd]#a`_A]\[TxXQVOs65KJImMFEDhH*)ED=aA:?>76;:981U5432r*N.-m+$H"!~}C#c!~}v{t:[wvonm3qjinmled*Kg`edcb[Z~^@\Uy<XWVOs65QPIHlLKDIBf)(DCB;_9>=<5Y9y10/S32+q/('&J*#"F&fe#"!~w={tsxqp6tsrqji/glejchgf_%cbDZ_^WVz=SRWPtNMLKPImGLEiIHGFE>&<`#?>76;:981U5.3,P0).'K+*ji'~%|#"y?}vutsxqvun4rkSonmlkdihg`&G]b[`_X|\[T<RvP8NSRQJImGFEiI+*@dDC<;:?>7[5{9270/S-2+O/.'m+*)(!E}$#"!xwv<zyxwputsl2pRQmf,dc)gIHdcb[!_^@?UZYRvVUT6Lp3OHMFKDhBAFE>[email protected]"!=<;:3W1w/Sts+*)M'&%$)(!~}${A!xw=u]srqvo5slTpong-Njchgf_d]#DZ_^]VUTx;QPUNrLKPONGFj-CBGFED=a;:?>7<;4Xyx65.R2+q/.'&%Ij('~%|#"y?w_{zyr8von4Uqji/mONd*hgf_Gcb[!_^@[email protected]>=<A:^8=6;4X8xw5.R2r*N.n,%I)(!&%|B"yx>_{zyxwvun4Uqji/gOejc)a`_%cbaZY}WVzZYRWVUTMqQPONMLEiIH*)?>[email protected]"!7[|:921U5u3,P0/o-,%*)(!~De{zy~w=^]yrqpo5Vrqji/g-NMiha'e^Fba`Y^WVzTSwQ9UTMqQPIHGkEDIHGF?cCB$#?8\<|{321U54-s+Op.-&+$)"F&f|#"yx>v^tyxwvon4Uqji/gOejc)gIe^]ba`Y}@\[TSXWPt7SLQPImMFKJIHAF?c=<A:?8\<|{321U5u-,10/(L,l*#G'g%${A!~`|u;yxwYun4rkjih.lNjihg`_%]ba`_^[email protected]$:^>=<|4X87wv.R210/.'&J$j('~D${z!x}v<tyrwvutml2pohg-ejcba'H^]\[Z~^@VUTSXQVOsSRQJONGkE-CHAF?c&[email protected]?>=<5Y92x6/Sts1*No'Kl$)"!E%$#"!a}v<]yxwvonm3kpohglkd*hJfed]#DCY^]\UTxRQVUNr54JnN0/EJCgGFEDCBA#9]7<;4X81w/S-s+O)o-&J*)('g%${A!x}v{ts9wYun4rqji/mONdcha'ed]\[Z~^@\UTYRvVUNMRQJIm0/EJCg*[email protected]?8\}54381U54t,1*)M'm+*)(!Efe{z!x>|{tsxqp6tmrqji/mlkjibJ`&dcbaZY}WVzTx;QVUNSLpJ2NMLKDhHGFE'&<`@?!~<5Y32765.-Q+*/.'&+$)"F&f|{"y?}_{t:xqYo5Vrqjih.lNjiha`ed]#aCY^W\[TxXQVUTSLpP2NMLEiIHAFE>bBA#"8=6Z4921Uvu3,P0p(L&+$#G!g%|{"y?}|u]yxwp6tVrqpoh.ledcbaf_%c\aZYXW{>=SRWPtT6LKJn1MLEDIBfFE'[email protected]?>=<5Y981w54-,Pq).-&%I#('~D$d"!x}|ut:xwvuWmrqjoh.lejc)g`edc\"CY}W?UTSwWVUT6LpP2HMFEDIHAeEDCB$:^>=<|:3W70v.32+O)(-,+*#G!g}|#"!x>|^]sxqputml2pohmlkjc)g`Hd]\[email protected]\[TxR:VOs65QPIHMLEiI+*@dDCB$#?8\}|49810T4-,P*/(-&+$Hi'&%$#[email protected]~w_{zyr8YXtmlk1Rhgfkjc)JI_d]\"ZB^]\[TxXW9ONMLpP2NGLEi,BGF?>b%[email protected][Z4z270/S32r*N.'m+$H('gf|Bz!~wv<zyxZpunsl2poQmfkdcba'_^[email protected]\[TSRvP8NSLQPImGFKJCHGF?cC%$:^>7};:3Wx05.-2+0/(L,lk)(!E}|B"!~}|{t:xqYo5srTSohgle+LKgf_%]b[!Y^]Vz=YRWPt7MRQJnH0LKDhHAF?c&<;@9]=<|43W765u-Q+*/('&+*#G'~}${[email protected]{t:xqvotm3qpohglkd*hg`Hd]#a`_A]\[TxXQVUTSLpP2NMLEiCBAFE>bBA#9]~}5:9810Tu3,Pq).'&+$)(!E%edzy~w=utyrwvun4rTSong-kjchgfed]#D`_XW{[email protected]>=BA:^>7};:3W7wv4-,10)M-,+*#('&}[email protected]}v{t:rwpo5mrqjing-ediba'Hdcb[[email protected]\[TxXWP8Nr54JIHMFjJI+*@d>&<`@?>7};:3Wx05432+Op(-,%$Hi'&%$#[email protected]}v{tyxwvo5Vlkjongf,jihg`_%FE[`_X]VzT<RvV8TSLKoO10FEi,BfFE>CBA:^8=6;4X8165432+*No-,%$)"!~De{zy?`_u;yxwp6nsrkj0QPfejc)gI_d]b[!YA]\[[email protected]'&<`#">7<;43W705.3,P0p.-,%$H('g%${Aba}|{zyxwp6tVrqpoh.fedc)afedcb[!_^]\U=Sw:[email protected]&<;@?>76Z{9870T.3,+0/('K+k)"F~}|{"y~w={zy[Zvo5srqpoQgf,dcbgfe^]#aCY}]\[T<[email protected]=<`@98\}|:9876/.R2r0)M'&+$)"F&%ed"y~w=^]yxwvun4rqSing-kjiKgfed]#[Z_^WVUTxRWVUTSLKo2NGLEDCgGF?'C<`@?>~654X87wv4-,10)M-&%*#(!E}${"yxwv<zyxqpon4lkpohg-ejc)g`Hd]\aZ~X]VUZSwQVUTMq4JOHlLEDIHAe?DCB;_?>~<;:3Wx0/S321*p(Lm%$)"F~%|{"y?}_utsxwpo5srkjih.lkjihJI_%cbD`Y^WVUyY;WPt7MRKJIHlFKDIHAe?'=B;:^87<;432V6vu3,Pqp(',+*#G!~%$#zy?w_{zyr8ponsrqj0Qgfkjib(`Hdc\[`Y}@\[TxXWPOs65QJnHlLE-CHAF?c=<;@?>=6Z498765.R21q/('K+*ji!&}${[email protected]/gfed*bJ`ed]b[[email protected]\UySXWPt7MLQJOHlLEJIBAe?DCB;_"876Z:z8165.-Q10/(-&Jk)"!&}C#zb~w|{t:rwpun4Uqjohg-kdcba'e^Fb[!BXW{[Z<;QVONMq4PONGLEDhHGF?'C<`@"8=6;:3W7654321*p(Lm%*#"F~%|{"y?w_{zyxwp6nslkj0nmlkjihJI_%cbDCYX]VzTYXQuUNSLKoOHGkK-,[email protected](D=<`@"!=<;:981U5ut,P*p(L,%$#(!E%$d"y?}vutyrqp6tsrTpoh.Okdibgf_%FE[ZY^]VUySXQPOs65KJOHMLEiI+*FE>=aA#">=65Y9816/4-,P0/.-m+$H(!~}C{"yx>|{ts9wvotsl2poQgf,dcbgfe^]#DZYX|V[[email protected]#">765Yz870T4t,10)M-,+*)i!E%|#"y~w={tsr8potsrkj0Qgfkjib(I_d]\"`B^WVUyYXWPOs65KJImG/EiIBGFE>=<`@?>=<|{92Vwv4-,+O/.'m+$Hi'&}|#"!x>_{zyr8YXtmlk1iQmfed*bJ`ed]b[!BX]\UTx;:PONrRQ3IHGLEiIHAF?c&%A:98\}|49810T4-s+O/.nm+$H"!~}C{z!x}|u;yxwpo5srqpoQgf,dcbgfe^]#DZYX|\>ZSRQu8NSRKJOHl/[email protected]#">765Yz870T4321qp('K%$)('~De{z!x>|^]srwvun4lTji/POkdibgf_%cba`BXW{UTYXWPOs65KPONMFEiIB*@dD&BA:^>7<;4Xy70Tu321*N.-&%$)"F&%edzy~w=utsxwvun4Ukji/mfkdcb(`Hd]\aZ~^]?>[email protected]>=<`#">=<5Y3W16543,P0p.-&J$#"'~De#"!~w={zy[Zvo5srqpoQgf,dcbgfe^]#a`BA]\UyYR:VOs6LQJONMFjJCHGF?cC<[email protected]]=}|:9876/St2+*/.'K+*)i!~Ded"y~w=^]yxwvun4rqSing-kdLha'eGcba`Y}@V[TSw:POsMRKPImM/[email protected]&BA:^>7<;4Xy70T43,r*N.-,+k#(!E%edzy~}|u;yxwYutm3qjoh.fNdc)gfHG]#DZ_XW{[ZYRWVONrRKPONGkKJC+AF?cCB;:?8\<|{92Vwv.-210)Mnm%$#G'&%$d"y?}|ut:xwpXn4rqSRnmf,jLha'e^F\[`_X|V[ZSXQuOTSRKJImM/[email protected]#">765Yzy76/432+Op(',+*)"Fgf${"!x>|{tyrq7XWsrk1Rng-ed*ba`_^]#aZBXW{[Z<Rv9OTMRQPImMFEJCBf)?DC<;:9]~};:9870Tu321*Non&%*)(!E%|d"!x}|ut:xwYutm3qjoh.ledc)gfHdc\"Z_^W{[ZSRQVONrRKPONGkKJC+AF?cC<`#">7[;:z870Tut,10)Mn,%$#Gh&%${zy?w_u;yxq7utsrk1Rngfkd*bg`e^c\"CB^]\UySXQPUNrRQJOHl/[email protected]?c&<`#">765Y9810T4-s+O/.nm+$H('g%${Ab~}|u;yxqYunm3kjihmf,dcba'HGcbaZ~AW\[email protected]&<;:9>7[5{9870Tu-2+O/o-,%$#G!&}C#zb~w|{t:rwputm3kpihg-kdcbgf_%cba`BXW{[email protected]]=<|:981Uvu3,Pqp(Lm+$Hih&%$#zy?`_utyxq7unsrk1oQPlkd*hgIHdcb[!BX]\UTx;:PONr54JINGLKDhB*FE>b<[email protected][;43870T4-s+O/.nm+$H(h~D|d"y?}|^]yxq7otsrqpi/mlNd*hg`H^$\D`_^]Vz=YRQPOsS5QPIHGkKDCgGFED=%;_?8=<5:9810Tut,+0/(Lm+*)"!&%${Abaw|utsr8vuWmrkj0ngf,dcbgf_%cba`BXW{UTYXWPOsSLQJOHlLKDIHAeE'=B;@?>7[;:981w/.R21*p(L&+$)('~}C#"bx>|{z\xwp6tVrkpih.lkjihJI_%cbD`Y^WVUySRWVUTMqQP2NGLEiCHAFE>b<$:?8765Y327654-Q10/o-,%Ij('~De{"y~w|{zs9ZYutsl2pRQmf,jibJ`&G]ba`YX|\[ZYXW9ONrLQJOHlLEJIHGF?c=<;:^>=<|4Xy765.R2r0/.'K+*)i!~D$#cyxw=<zsr8Yonsl2ponPled*hJ`_d]#a`[email protected]<;WVUNrLQJOHlLEJIBAe?'=a;:9>=6Z:9876vu-Q10/o-,%$#G!&}C#zb~w|{t:xqvutsrk1onmlkd*bg`_d]#a`BXW{UTYXWPOsSR4JINGkKD,HAe?'C<;@9]=<|:981U5432+O/(',+*#G'&%$d"y?}_{tsxwvo5Vlkjongf,Mib(fH^c\aZ~^@[email protected]#">765Yz870T4t,+O/(-&J*j"!E%${"!~w=^zyxwvun4lTj0hPfed*Kafed]\"`_XW\[TSw:VUNSLQJnHGFKDh+*FE>[email protected]=<;4X876/.3210)(L,+k)('&}C{c!x}|ut:xwYutm3qjoh.ledc)JIedcb[ZY}]\[=<RvP8TSRQJONMLEiIHA)[email protected]=<;4X870v.32+O)o-,+*#G!&%|#"!~w={tsr8potsrkj0nPf,jLhg`&^F\[Z~XW\[TSw:VUNrLKPImG/EiIB*FE>[email protected]>=<54X87654ts+O/.-m%Ij(!~%${Aba}|{zs9wp6nVrqj0nPfkjc)Jf_%cba`BXW{UTYXWPOs6LKJnN0FjJIHG)[email protected]"8=6;:3W7654321*p(Lm%*#"F&f$#"!~}v<tyrwvutml2jingf,jihJI_%cbD`Y^WVUyYXW9ONr54PINGkKDIHAe?'=B;:^87<;432Vwv.3,+O).-,+*#G'~f${zy?}_{tsxwvo5Vlkjongf,Mchg`_%Fb[Z_X|\>=YXWVONr54PIm0/KJCg*FE>=<`:"8=<54Xy765.R2r0/.'K+*j(!~D|#z!~}|u;sr8vo5srTSong-ed*Kg`_%cbD`_X|VUTxXQVUNrR4JINGkKD,HAeE'=B;@?>7[;:981w/.R21*p(L,l*#G!~}|Bc!xwv<]yxwp6tsrqjoh.fNdc)gfHG]#a`BX]VUyYXQPUTSLKPImMLEDCBAeEDCBA#9]=};:981U5ut210)(L&%*)('&}Cdcy?}_{zsxqp6tml2pRQmle+ihgIedcb[!_^WVUZSwW9UNSLKo2NGFEDIBf)?DC<;:9]~};:9870Tu321*N(n,%I)('~%$#"!x>|{zyxwYutm3qjoh.fNdc)gfHG]#[`_X|\[ZYXWVUTSRQP2HMFEDhBGF?c=<`#">7<;43W7wv432+O/.'&%*)"F~%|Bzb~}|uts9wYXnml2poQgfkd*hJI_%]\aZ_X|\U=SwWV8Nr54PIHl/[email protected]@?>=<;:9876v.3,P0p.-&J$)"!E%|#"!~w=^]yxwvun4rqSing-Ndcb(IHdcb[!B^W\UTxXW9ONrLQJOHlFEJIBAeE'C<`@?>=}5Yz8105.R2r0/.'K+*)i!~D$#zb~w=^]srqpo5slkpi/POedcbgf_%cbaZBXW{[[email protected]&<A:?87[;:z870T.3,1*)M-,+k)"F&%|#[email protected]~`_{zs9Zvutmlk1Rhgf,jiKg`&dFb[!_^@?UZYRvPOTMLQJnN0FEi,[email protected]<;:?>7[54X81w/.R21*p(Lm%*#"F&%e#"y?w_uzsxq7XWsrk1ihgle+Lbg`e^]#a`_XWVz=YXWVUTMqQJ2NMLKDhHGF('C<`:"8=<54Xy765.R2r0/.'K+*j(!~D|#z!~}|u;sr8vonslk1RQmle+ihgIedcb[!_^WVUTxXWVONrRKPONMLEiCHAFE>bBA:"8\<|{981U/.32+0)M-m%Ij(!~%${Aba}|{zs9wp6nml2piQmf,jcha`e^$ba`BXW{UTYXWPOs65QJn1GLEDhHG)[email protected]"8=6;:3W7654321*p(Lm%*#"F&%e#"y?w_uzsxq7uWslkj0nmlkjihJI_%cbD`Y^[email protected]"!7<5:3W70v43,P0/.'m%I#"'~}|{A!awv{zs9ZYutsl2poQmlejc)aI_^c\"ZB^]Vz=YRQPOsS5QPIHGkKDCgGFE'C<`@?>=}5Yz8105.R2r0/.'K+*)i!~De#"y?w_{zyxwp6tml2pRQmle+ihgIedcb[!YXW{>ZSXQVOsSRQ32NGk.JIHAFE>bBA:"8\<;:9870/S3sr0)M',%$#G'~f$#[email protected]|uzs9wvunVl2pongfed*hgIH^]b[!_^@?UZYRvPOTMLQJnN0FEiI+*F?>b%;@?>7<;:981Uv43,+*N.nm%$#G'&%$d"y?}vutyrqp6Wsl2Sinmled*bgfe^$b[`_X|\[ZYXWVUTSRQP2NMFKJCBfFEDCBA#9]=<|:981U/.3,1*N.-m+$H(!~}Cd"!~}v<zsxwp6tVrkpi/mlkjihgfed]#[`_^W{[ZSRWVONrRQJ2NGkEDCBf)(>[email protected]?8\<;43W70v.3,P0/.n,+$Hi!&}$#[email protected]~}|u]s9Zpotm3TSoh.Okjiha'eG]\[!_^@Vz=YRQVOsSRQJImM/[email protected]&<A:?87[;:z870T4t2+0).-&Jk)"!~}|B"baw|{t:xwYutm3qjoh.fNdc)g`Hd]#a`Y^W{[email protected]>=aA:?>7<5Y3216/4-,P0/.-m+$H(!~}C#"b~}|u;y[qvutslk1RQmf,jibJfe^c\aZ~XW\[TSw:VUNSLQJn10FEJCg*F?>[email protected]=<;4X870/S-s10/.-&Jk#('&%|{A!~`_{zs9Zvutmlk1Rhgf,Mchgf_^$bDC_XWVzZYRvPOTMLQJnN0FEiC+GFED=a$#?8\<5{3WD

Step 2

先拿 python 分析一波这个巨长的字符串

s = r"""..."""
print(len(s))
# 13644
x = set(s)
print(x)
x1 = sorted(''.join(x))
print(x1)
print(len(x))
# 94
print(''.join(x1))
# !"#$%&'()*+,-./0123456789:;<=>[email protected][\]^_`abcdefghijklmnopqrstuvwxyz{|}~

看着这堆用到的字符,寻思着是不是 base94 啊……

于是对比了下,base94 的 alphabet 为

!"#$%&\'()*+,-./0123456789:;<=>[email protected][\]^_`abcdefghijklmnopqrstuvwxyz{|}~

看起来是啊,于是拿 basehash 里的 base94 解密一下试试。

可以参考 base全家桶的安装使用方法

from basehash import *
from Crypto.Util.number import bytes_to_long, long_to_bytes

s2 = base94().decode(s)
s3 = long_to_bytes(s2)

with open('4.bin', 'wb') as f:
    f.write(s3)

结果发现这是啥玩意啊,怎么也解释不通啊……

于是暂时摸了。

下午放了 hint ——

第二层是个可以运行的程序,但并不是 binary(

malbolge

Malbolge 是由Ben Olmstead在1998年开发的一种深奥的编程语言,属于公共领域。其名字来自于但丁的《神曲》中的第八层地狱Malebolge,意大利语中意为“邪恶的沟渠”(male bolge)。Malbolge虽然具备图灵完备性,但并非实用的编程语言。Malbolge的特别之处就在于,它被故意设计得极其繁琐难解。

用Malbolge编写的Hello, world程序

以下为Malbolge程序输出“Hello,world”的代码。

(=<`:9876Z4321UT.-Q+*)M'&%$H"!~}|Bzy?=|{z]KwZY44Eq0/{mlk**
hKs_dG5[m_BA{?-Y;;Vb'rR5431M}/[email protected]\6543W10/.R,+O<

via https://zh.wikipedia.org/wiki/Malbolge

干脆直接找了个在线的 Malbolge 执行工具,比如 https://malbolge.doleczek.pl/ 或者 https://www.tutorialspoint.com/execute_malbolge_online.php

执行得到

c82YzKDMqW_Mhs2MzavMiy7Mi82XLsyQzYzNps2vzLguzZLNqcyIzITNrs2DzaLMrc2OzJ7Mqs2JzLIg8J-HvCDwn4etIPCfh7QgZ82mzZvNo8yqzK9hzYLMh82jzYPNiM2FzK_NhcyzdsyMzZnNh8ypZc2lzajMvcyLzYDMpc2azLnMpiDNks2nzYnMmMytzJ7Mq8yqeW_NqMyazI7MlMyJzKHMrsy7zLHNjcy8zZN1zJPNp8yNzazNo8yizLHMo8yjzZbMoMyxINKJzZp0za3MtMy5aMyDzI3Nm82cacyHza7Mjc2QzIHMi8y9zLrMo8y5zK9zzJTMvcyjzJzMq82HIMyAzKDMmcyWzKnMrMyrbcyHzajMhMyNzKLNiGXMhMyRzafMi8y9zYHMo8yYzLrMpsykzZbNmnPMv8yPzYzNr8yRzYHMs82IzYlzzKPMrsylzJzMls2NYc2bzIPNgsy9zIbNrM2vzLHMnc2UzKlnzahlzYHMpcyxzLnMsyjNrM2lzIfMisyDzYLMksyVzKPNls2UzYjMqcyzP82CzJXMncykzZbMs8yszK_MswrNrM2bzILNrs2kzIfMq8yyzZXNls2JCs2kzKx0zL3MvcyvzLrMncyXzKDMvGjNpc2EzarMj8yOzL_NgcyXzJzMqc2OzLrMr82NacyxzYdzzaPMjM2MzYTMvsyezLMgzYbMgs2XzJTNkM2pzL_MsMymbcyGza_Mn8yzzKbMrMyszKTNjmHMucy5zYfMus2Uec2ozYrMkc2vzabMj82XzJvMnSDMhM2pzYLNm8yAzZ3Nlsy7zY7MsWLNpMyNzJPMj8ySzIzNpM2YzKzMsMyXzK_MmMyrZc2pzYbMjM2hzYXMqc2OzLDMsiDMi8ykzJnMvM2WzKZqzajMkM2FzZp1zLTNlXPNpc2LzavMjcyTzZvMuMywzJ7MpMyrzLrMo3TNo82qzYLNnMyWzKogza_Nq82rYc2nzYTMvcyQzJHNm8y1IMyUzIDNr8yPzKXNk8y8zKnMrc2OzZZqzL3Nm82RzZTMnG_MgsygzKBrzJHNqsyKzabNqsyszKTMpc2NzJ7MqmXMj82Lza7NlM2TzYfNls2JIc2bzYLNqs2tzIfMkM2MzY_MnAoK8J-Zg_CfkrXwn4y_8J-OpPCfmqrwn4yP8J-QjvCfpYvwn5qr8J-YhuKchfCflKzwn5qq8J-PjvCfjKrwn5iO8J-MifCfkYnwn4yP8J-QhfCfmIbwn5K18J-QjfCfmI3wn5iN8J-Yh_CfjbTimLrinZPwn42N8J-YhvCfmKHwn5iA4oS58J-QjfCfjqTimIPwn46D8J-Og_CflKrwn5W58J-YoeKchfCflKrwn5iC8J-li_CfjoXimIPwn5GR4piA8J-asPCfj7nwn46k8J-NtfCfmIDinIXwn5W58J-Mj-KMqPCfmI3wn5K18J-MieKYgvCfjojwn5iO8J-QheKYgPCfjbXwn5qw8J-TgvCfmIrwn5iO8J-li-KPqfCfmILwn5qq8J-YgvCfkrXwn5CY8J-YgeKPqfCfjY3wn5iH8J-YhvCfkZHinInwn4y_4piD8J-YivCfmIbimIPwn4-58J-Zg_CfkaPwn5CN8J-UqvCfkI3ij6nwn4214pyF8J-YgvCfjYzwn5iH4pyW4oS58J-aqvCfjI_wn5ih8J-ko_CfkYninZPwn4-58J-QjvCfjL_wn5up8J-YofCfkZHwn5GR8J-OpPCfkZHij6ninInwn4218J-mk_CfkaPwn42O8J-li_CfkZHwn5mD8J-QheKMqPCfjL_wn5Kn8J-MivCfjYzwn46I8J-PjvCfm6nwn4yK8J-asPCfjoPwn5Ss4pyW8J-NtfCfmYPwn5aQ4pyF8J-OpPCfkaPijKjwn5eS8J-Xkg

Step 3

base64 解密一下,当然 alphabet 换成了 A-Za-z0-9-_

s̠̩͘ŏ͌ͫ̋.̋͗.̸̐͌ͦͯ.̭͎̞̪͉̲͒ͩ̈̄ͮ̓͢ 🇼 🇭 🇴 g̪̯ͦ͛ͣa͈̯̳͂̇ͣ̓ͅͅv͙͇̩̌e̥͚̹̦ͥͨ̽̋̀ ͉̘̭̞̫̪͒ͧyo̡̮̻̱͍̼͓ͨ̎̔̉̚u̢̱̣̣͖̠̱̓ͧ̍ͬͣ ҉͚t̴̹ͭh̃̍͛͜i̺̣̹̯̇ͮ̍͐́̋̽ṣ̜̫͇̔̽ ̠̙̖̩̬̫̀ṁ̢͈ͨ̄̍ẹ̘̺̦̤͖͚̄̑ͧ̋̽́s̳͈͉̿̏͌ͯ̑́ṣ̮̥̜̖͍a̱̝͔̩͛̃͂̽̆ͬͯgͨé̥̱̹̳(̣͖͔͈̩̳ͬͥ̇̊̃͂̒̕?̝̤͖̳̬̯̳͂̕
̫̲͕͖͉ͬ͛̂ͮͤ̇
̬ͤt̯̺̝̗̠̼̽̽h̗̜̩͎̺̯͍ͥ̈́ͪ̏̎̿́i̱͇s̞̳ͣ̌͌̈́̾ ̰̦͆̂͗̔͐ͩ̿m̟̳̦̬̬̤͎̆ͯa̹̹͇̺͔y̛̝ͨ͊̑ͯͦ̏͗ ͖̻͎̱̄ͩ͂͛̀͝b̬̰̗̯̘̫ͤ̍̓̏̒̌ͤ͘e̩͎̰̲ͩ͆̌͡ͅ ̤̙̼͖̦̋j͚ͨ̐ͅu̴͕s̸̰̞̤̫̺̣ͥ͋ͫ̍̓͛t̖̪ͣͪ͂͜ ͯͫͫa̵ͧ̈́̽̐̑͛ ̥͓̼̩̭͎͖̔̀ͯ̏j͔̜̽͛͑ô̠̠k̬̤̥͍̞̪̑ͪ̊ͦͪȅ͔͓͇͖͉͋ͮ!͛͂ͪͭ̇̐͌͏̜

🙃💵🌿🎤🚪🌏🐎🥋🚫😆✅🔬🚪🏎🌪😎🌉👉🌏🐅😆💵🐍😍😍😇🍴☺❓🍍😆😡😀ℹ🐍🎤☃🎃🎃🔪🕹😡✅🔪😂🥋🎅☃👑☀🚰🏹🎤🍵😀✅🕹🌏⌨😍💵🌉☂🎈😎🐅☀🍵🚰📂😊😎🥋⏩😂🚪😂💵🐘😁⏩🍍😇😆👑✉🌿☃😊😆☃🏹🙃👣🐍🔪🐍⏩🍵✅😂🍌😇✖ℹ🚪🌏😡🤣👉❓🏹🐎🌿🛩😡👑👑🎤👑⏩✉🍵🦓👣🍎🥋👑🙃🐅⌨🌿💧🌊🍌🎈🏎🛩🌊🚰🎃🔬✖🍵🙃🖐✅🎤👣⌨🗒🗒

上面好多奇妙的 Unicode 字符,下面很明显是 emoji-aes,那么 key 是啥呢?

会不会藏在这堆 Unicode 里啊?仔细看了看,没有啊……

又在想,是 joke?不是。

WHO?不是。

突然一想,草, 那不就是他嘛!是 GZTime (还注意大小写呢

cHJvZFsvGQddFBVwexVDZg4VeFZjFXgSVRVscHsWeXR7FRREc3pWbk16SU5tQQpqclZTUk5IY1pPVwpib1dlQhwq

Step 4

继续 base64 解密

prod[/..]..p{.Cf..xVc.x.U.lp{.yt{..DszVnMzINmA
jrVSRNHcZOW
boWeB.*

嗯?这是什么?

输出了 . 是因为那不是 ASCII 可打印字符,hexdump 看一眼。

00000000  70 72 6f 64 5b 2f 19 07 5d 14 15 70 7b 15 43 66  |prod[/..]..p{.Cf|
00000010  0e 15 78 56 63 15 78 12 55 15 6c 70 7b 16 79 74  |..xVc.x.U.lp{.yt|
00000020  7b 15 14 44 73 7a 56 6e 4d 7a 49 4e 6d 41 0a 6a  |{..DszVnMzINmA.j|
00000030  72 56 53 52 4e 48 63 5a 4f 57 0a 62 6f 57 65 42  |rVSRNHcZOW.boWeB|
00000040  1c 2a                                            |.*|

HINT 5: prod[]与后面是分离的

prod 是啥???

production?生产环境?不像。

问了下 GZTime,说是乘积,也就是 $\LaTeX$ 里的 $\prod$

于是想着是不是后面那堆是乘上前面这个数,或者相除再或者怎么着。

那怎么读取的呢?是当成一整个 byte,bytes 转 int 还是?

先不管吧,写个脚本都试试。

import base64

s = "cHJvZFsvGQddFBVwexVDZg4VeFZjFXgSVRVscHsWeXR7FRREc3pWbk16SU5tQQpqclZTUk5IY1pPVwpib1dlQhwq"
r = base64.b64decode(s)
print(r)
x = r.split(b']')[1]
prod = r.split(b']')[0].split(b'[')[1]
print(x)
print(prod)
prod = int.from_bytes(prod, byteorder='big')
y = int.from_bytes(x, byteorder='big')
print(prod, y)
z = y * prod
d = bytes.fromhex(hex(z)[2:])
print(d)
print(base64.b64encode(d))

结果跑出来唯一一个没报错的,看上去啥也不是……

最后很迷茫,问了一下。

具体上应该是那三个 bytes 逐字节相乘。

prod = 0x07*0x19*0x2f
# 8225

也就是 0x2021,噢,就是这个啦!

这个后面也放了 hint

HINT 6: 如果你得到了Key,你会知道一定是它的

那最后咋弄?还有个 hint 没用到。

HINT 3: 以及有一次会用到 xor 加密

好,终于有都是可打印字符的了。

44PZ5bF/5YvB5Y2t5MPZ6XTZ55dRZwNlZhnLa+JSvrrohBznw+BNwDb=

Step 5

换表 base64,或者说是 ROT13 + base64

「愿与你同行的2022星光相随」

好耶!终于出了!

爱啦!

小结

虽然但是,怎么这么套啊,这做得咋心情跌宕起伏的……

好想打 GZTime 啊(

顺便,看了下是二血,总共也只有两解 hhh

不过毕竟是很小范围的解谜,也就这样啦。

感谢 GZTime 的出题,辛苦了(贴贴!


最后,2022 啦,祝大家新年快乐喵~

新的一年里师傅们也要多多带带喵喵呀!


水完了,继续赶期末 ddl 去了,喵呜!

(溜了溜了喵~


文章作者: MiaoTony
版权声明: 本博客所有文章除特别声明外,均采用 CC BY-NC-SA 4.0 许可协议。转载请注明来源 MiaoTony !
评论
  目录