1

U2FsdGVkX1/+ydnDPowGbjjJXhZxm2MP2AgI

1

Cute_Rabbit

1
2
3
4
5
6

(╯°□°）╯︵ ┻━┻
50pt

(╯°□°）╯︵ ┻━┻

d4e8e1f4a0f7e1f3a0e6e1f3f4a1a0d4e8e5a0e6ece1e7a0e9f3baa0c4c4c3d4c6fbb9b2b2e1e2b9b9b7b4e1b4b7e3e4b3b2b2e3e6b4b3e2b5b0b6b1b0e6e1e5e1b5fd

1

hex列表：['d4', 'e8', 'e1', 'f4', 'a0', 'f7', 'e1', 'f3', 'a0', 'e6', 'e1', 'f3', 'f4', 'a1', 'a0', 'd4', 'e8', 'e5', 'a0', 'e6', 'ec', 'e1', 'e7', 'a0', 'e9', 'f3', 'ba', 'a0', 'c4', 'c4', 'c3', 'd4', 'c6', 'fb', 'b9', 'b2', 'b2', 'e1', 'e2', 'b9', 'b9', 'b7', 'b4', 'e1', 'b4', 'b7', 'e3', 'e4', 'b3', 'b2', 'b2', 'e3', 'e6', 'b4', 'b3', 'e2', 'b5', 'b0', 'b6', 'b1', 'b0', 'e6', 'e1', 'e5', 'e1', 'b5', 'fd']

1

十进制列表：[212, 232, 225, 244, 160, 247, 225, 243, 160, 230, 225, 243, 244, 161, 160, 212, 232, 229, 160, 230, 236, 225, 231, 160, 233, 243, 186, 160, 196, 196, 195, 212, 198, 251, 185, 178, 178, 225, 226, 185, 185, 183, 180, 225, 180, 183, 227, 228, 179, 178, 178, 227, 230, 180, 179, 226, 181, 176, 182, 177, 176, 230, 225, 229, 225, 181, 253]

1

-128得到ASCII十进制dec列表：[84, 104, 97, 116, 32, 119, 97, 115, 32, 102, 97, 115, 116, 33, 32, 84, 104, 101, 32, 102, 108, 97, 103, 32, 105, 115, 58, 32, 68, 68, 67, 84, 70, 123, 57, 50, 50, 97, 98, 57, 57, 55, 52, 97, 52, 55, 99, 100, 51, 50, 50, 99, 102, 52, 51, 98, 53, 48, 54, 49, 48, 102, 97, 101, 97, 53, 125]

1

最终答案：That was fast! The flag is: DDCTF{922ab9974a47cd322cf43b50610faea5}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38

# @Author：YueXuan
# @Date  ：2024/10/8 22:00

def split_into_hex_pairs(s):
    """将输入字符串切片成每两个字符一组的列表"""
    return [s[i:i+2] for i in range(0, len(s), 2)]

def convert_hex_to_int(hex_pairs):
    """将十六进制列表转换为十进制整数列表"""
    return [int(pair, 16) for pair in hex_pairs]

def adjust_for_ascii(int_values):
    """将整数列表中的值减去128以获取ASCII值"""
    return [value - 128 for value in int_values]

def convert_int_to_str(int_values):
    """将整数列表转换为字符串"""
    return ''.join(chr(value) for value in int_values)

def main(hex_string):
    """主函数，调用上述函数并打印结果"""
    print("字符串长度：%s" % len(hex_string))

    hex_pairs = split_into_hex_pairs(hex_string)
    print("hex列表：%s" % hex_pairs)

    int_values = convert_hex_to_int(hex_pairs)
    print("转化为十进制int列表：%s" % int_values)

    ascii_values = adjust_for_ascii(int_values)
    print("-128得到ASCII十进制dec列表：%s" % ascii_values)

    result_str = convert_int_to_str(ascii_values)
    print('最终答案：%s' % result_str)

if __name__ == '__main__':
    hex_str = 'd4e8e1f4a0f7e1f3a0e6e1f3f4a1a0d4e8e5a0e6ece1e7a0e9f3baa0c4c4c3d4c6fbb9b2b2e1e2b9b9b7b4e1b4b7e3e4b3b2b2e3e6b4b3e2b5b0b6b1b0e6e1e5e1b5fd'
    main(hex_str)

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28

# -*- coding:utf-8 -*-
# author: mochu7
def hex_str(str):#对字符串进行切片操作，每两位截取
    hex_str_list=[]
    for i in range(0,len(str)-1,2):
        hex_str=str[i:i+2]
        hex_str_list.append(hex_str)
    print("hex列表：%s\n"%hex_str_list)
    hex_to_str(hex_str_list)

def hex_to_str(hex_str_list):
    int_list=[]
    dec_list=[]
    flag=''
    for i in range(0,len(hex_str_list)):#把16进制转化为10进制
        int_str=int('0x%s'%hex_str_list[i],16)
        int_list.append(int_str)
        dec_list.append(int_str-128)#-128得到正确的ascii码
    for i in range(0,len(dec_list)):#ascii码转化为字符串
        flag += chr(dec_list[i])
    print("转化为十进制int列表：%s\n"%int_list)
    print("-128得到ASCII十进制dec列表：%s\n"%dec_list)
    print('最终答案：%s'%flag)

if __name__=='__main__':
    str='d4e8e1f4a0f7e1f3a0e6e1f3f4a1a0d4e8e5a0e6ece1e7a0e9f3baa0c4c4c3d4c6fbb9b2b2e1e2b9b9b7b4e1b4b7e3e4b3b2b2e3e6b4b3e2b5b0b6b1b0e6e1e5e1b5fd'
    print("字符串长度：%s"%len(str))
    hex_str(str)

 1
 2
 3
 4
 5
 6
 7
 8
 9
10

key='d4e8e1f4a0f7e1f3a0e6e1f3f4a1a0d4e8e5a0e6ece1e7a0e9f3baa0c4c4c3d4c6fbb9b2b2e1e2b9b9b7b4e1b4b7e3e4b3b2b2e3e6b4b3e2b5b0b6b1b0e6e1e5e1b5fd'
hex=[]
flag=''
for i in range(0,len(key)-1,2):
    zdh=key[i:i+2]
    hex.append(zdh)
for i in range(len(hex)):
    zdh1=hex[i]
    flag+=chr(int(int(zdh1,16))-128)
print(flag)

1

flag{922ab9974a47cd322cf43b50610faea5}

  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108

127
255
63
191
127
191
63
127
127
255
63
191
63
191
255
127
127
255
63
63
127
191
63
127
127
255
63
255
127
255
63
255
127
255
127
255
127
191
127
63
63
255
191
191
63
255
63
63
127
191
63
127
127
191
63
255
63
255
63
127
127
191
127
191
127
191
127
127
63
255
127
191
127
191
63
191
63
255
127
255
63
255
127
255
127
191
63
191
127
191
127
127
63
255
127
127
127
191
127
63
127
191
63
191
127
191
127
127

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47

# @Author：YueXuan
# @Date  ：2024/10/10 16:56

def read_numbers_from_file(filename):
    """从文件中读取数字列表"""
    with open(filename, 'r') as file:
        numbers = [int(line.strip()) for line in file]
    return numbers

def decode_ttl(numbers):
    """解码数字列表为二进制字符串"""
    binary_str = ''
    mapping = {63: '00', 127: '01', 191: '10', 255: '11'}
    for number in numbers:
        binary_str += mapping[number]
    return binary_str

def binary_to_string(binary_str):
    """将二进制字符串转换为ASCII字符串"""
    text = ''
    for i in range(0, len(binary_str), 8):
        byte = binary_str[i:i+8]
        text += chr(int(byte, 2))
    return text

def main():
    filename = 'out.txt'  # 输入文件名
    output_filename = 'output.txt'  # 输出文件名

    # 从文件读取数字
    numbers = read_numbers_from_file(filename)

    # 解码数字为二进制字符串
    binary_str = decode_ttl(numbers)

    # 将二进制字符串转换为ASCII字符串
    hidden_text = binary_to_string(binary_str)

    # 输出结果
    print("隐藏的文本:", hidden_text)

    # 可选地保存到文件
    with open(output_filename, 'w') as output_file:
        output_file.write(hidden_text)

if __name__ == '__main__':
    main()

1
2
3
4
5
6

MTEwMTEwMTExMTExMTEwMDExMTEwMTExMTExMTExMTExMTExMTExMTExMTExMTExMTAxMTEwMDAwMDAxMTExMTExMTExMDAxMTAx
MTEwMTEwMTEwMDAxMTAxMDExMTEwMTExMTExMTExMTExMTExMTExMTExMTExMTExMTExMTAxMTExMTExMTExMTExMTEwMTEwMDEx
MTEwMDAwMTAxMTEwMTExMDExMTEwMTExMTExMTAwMDExMTExMTExMTExMDAxMDAxMTAxMTEwMDAwMDExMTExMDAwMDExMTExMTEx
MTEwMTEwMTAwMDAxMTExMDExMTEwMTExMTExMDExMTAxMTExMTExMTEwMTEwMTEwMTAxMTExMTExMTAwMTEwMTExMTExMTExMTEx
MTEwMTEwMTAxMTExMTExMDExMTEwMTExMTAxMDExMTAxMTExMTExMTEwMTEwMTEwMTAxMTAxMTExMTAwMTEwMTExMTExMTExMTEx
MTEwMTEwMTAwMDAxMTAwMDAwMTEwMDAwMDAxMTAwMDExMTAwMDAwMTEwMTEwMTEwMTAxMTEwMDAwMDAxMTExMDAwMDExMTExMTEx

1

python b64steg.py -f flag.txt -s output.txt

1
2
3
4
5
6

110110111111110011110111111111111111111111111111101110000001111111111001101
110110110001101011110111111111111111111111111111111101111111111111110110011
110000101110111011110111111100011111111111001001101110000011111000011111111
110110100001111011110111111011101111111110110110101111111100110111111111111
110110101111111011110111101011101111111110110110101101111100110111111111111
110110100001100000110000001100011100000110110110101110000001111000011111111

1

flag{He1Lo_mi5c~}

1

YnNpZGVzX2RlbGhpe0JQR19pNV9iM3R0M3JfN2g0bl9KUEd9Cg==

1

flag{BPG_i5_b3tt3r_7h4n_JPG}

1

2019456NNULLULL,

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26

a = dIW
b = sSD
c = adE 
d = jVf
e = QW8
f = SA=
g = jBt
h = 5RE
i = tRQ
j = SPA
k = 8DS
l = XiE
m = S8S
n = MkF
o = T9p
p = PS5
q = E/S
r = -sd
s = SQW
t = obW
u = /WS
v = SD9
w = cw=
x = ASD
y = FTa
z = AE7

1
2

大->小:
字符： etaonrhisdluygwmfc.　,bp"k'Hv-ITS?ADMRWPGN!FxBOYjCEzqLQUV;K:J)(134Z0792X5*~86	\

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38

# 定义映射规则
mapping = {
    'a': 'dIW',
    'b': 'sSD',
    'c': 'adE',
    'd': 'jVf',
    'e': 'QW8',
    'f': 'SA=',
    'g': 'jBt',
    'h': '5RE',
    'i': 'tRQ',
    'j': 'SPA',
    'k': '8DS',
    'l': 'XiE',
    'm': 'S8S',
    'n': 'MkF',
    'o': 'T9p',
    'p': 'PS5',
    'q': 'E/S',
    'r': '-sd',
    's': 'SQW',
    't': 'obW',
    'u': '/WS',
    'v': 'SD9',
    'w': 'cw=',
    'x': 'ASD',
    'y': 'FTa',
    'z': 'AE7'
}

# 需要映射的字符串
input_str = "etaonrhisdluygw"

# 进行映射
result = ''.join(mapping[char] for char in input_str)

# 打印结果
print(result)

1

flag{have_a_good_day1}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49

<?php

// 检查是否存在"Login" GET 参数，这通常是提交登录表单后触发的动作
if( isset( $_GET[ 'Login' ] ) ) {

    // 获取POST方式提交的用户名
    $user = $_GET[ 'username' ]; // 注意：这里应当使用 $_POST 而非 $_GET 来获取表单数据，因为登录通常涉及敏感信息，推荐使用 POST 方法

    // 获取POST方式提交的密码，并使用md5函数对其进行哈希加密（注意：MD5已经不再安全，应使用更安全的加密算法如bcrypt）
    $pass = $_GET[ 'password' ]; // 同上，此处应改为 $_POST['password']
    $pass = md5( $pass ); // 这里假设密码在数据库中是以MD5形式存储的

    // 创建SQL查询语句，检查数据库中是否存在匹配的用户名和密码
    $query  = "SELECT * FROM `users` WHERE user = '$user' AND password = '$pass';";

    // 执行SQL查询，连接数据库并处理潜在错误
    $result = mysqli_query($GLOBALS["___mysqli_ston"],  $query ) or die( 
        '<pre>' . 
        ((is_object($GLOBALS["___mysqli_ston"])) ? mysqli_error($GLOBALS["___mysqli_ston"]) : 
        (($___mysqli_res = mysqli_connect_error()) ? $___mysqli_res : false)) . 
        '</pre>'
    );

    // 检查查询结果是否成功且只有一条记录匹配（意味着用户名和密码正确）
    if( $result && mysqli_num_rows( $result ) == 1 ) {

        // 获取匹配用户的详细信息
        $row = mysqli_fetch_assoc( $result );
        
        // 提取用户头像URL
        $avatar = $row["avatar"];

        // 登录成功，构造欢迎消息并显示用户头像
        $html .= "<p>Welcome to the password protected area {$user}</p>";
        $html .= "<img src=\"{$avatar}\" />"; // 显示用户的头像图片

    } else {

        // 登录失败，输出错误提示信息
        $html .= "<pre><br />Username and/or password incorrect.</pre>";

    }

    // 关闭数据库连接
    ((is_null($___mysqli_res = mysqli_close($GLOBALS["___mysqli_ston"]))) ? false : $___mysqli_res);

} // 结束 if(isset($_GET['Login']))

?>

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35

<?php

if( isset( $_GET[ 'Login' ] ) ) {
	// Sanitise username input
	$user = $_GET[ 'username' ];
	$user = ((isset($GLOBALS["___mysqli_ston"]) && is_object($GLOBALS["___mysqli_ston"])) ? mysqli_real_escape_string($GLOBALS["___mysqli_ston"],  $user ) : ((trigger_error("[MySQLConverterToo] Fix the mysql_escape_string() call! This code does not work.", E_USER_ERROR)) ? "" : ""));

	// Sanitise password input
	$pass = $_GET[ 'password' ];
	$pass = ((isset($GLOBALS["___mysqli_ston"]) && is_object($GLOBALS["___mysqli_ston"])) ? mysqli_real_escape_string($GLOBALS["___mysqli_ston"],  $pass ) : ((trigger_error("[MySQLConverterToo] Fix the mysql_escape_string() call! This code does not work.", E_USER_ERROR)) ? "" : ""));
	$pass = md5( $pass );

	// Check the database
	$query  = "SELECT * FROM `users` WHERE user = '$user' AND password = '$pass';";
	$result = mysqli_query($GLOBALS["___mysqli_ston"],  $query ) or die( '<pre>' . ((is_object($GLOBALS["___mysqli_ston"])) ? mysqli_error($GLOBALS["___mysqli_ston"]) : (($___mysqli_res = mysqli_connect_error()) ? $___mysqli_res : false)) . '</pre>' );

	if( $result && mysqli_num_rows( $result ) == 1 ) {
		// Get users details
		$row    = mysqli_fetch_assoc( $result );
		$avatar = $row["avatar"];

		// Login successful
		$html .= "<p>Welcome to the password protected area {$user}</p>";
		$html .= "<img src=\"{$avatar}\" />";
	}
	else {
		// Login failed
		sleep( 2 ); // 当登录验证失败时界面将睡眠 2 秒
		$html .= "<pre><br />Username and/or password incorrect.</pre>";
	}

	((is_null($___mysqli_res = mysqli_close($GLOBALS["___mysqli_ston"]))) ? false : $___mysqli_res);
}

?>

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43

<?php

if( isset( $_GET[ 'Login' ] ) ) {
	// Check Anti-CSRF token
	checkToken( $_REQUEST[ 'user_token' ], $_SESSION[ 'session_token' ], 'index.php' );

	// Sanitise username input
	$user = $_GET[ 'username' ];
	$user = stripslashes( $user );
	$user = ((isset($GLOBALS["___mysqli_ston"]) && is_object($GLOBALS["___mysqli_ston"])) ? mysqli_real_escape_string($GLOBALS["___mysqli_ston"],  $user ) : ((trigger_error("[MySQLConverterToo] Fix the mysql_escape_string() call! This code does not work.", E_USER_ERROR)) ? "" : ""));

	// Sanitise password input
	$pass = $_GET[ 'password' ];
	$pass = stripslashes( $pass );
	$pass = ((isset($GLOBALS["___mysqli_ston"]) && is_object($GLOBALS["___mysqli_ston"])) ? mysqli_real_escape_string($GLOBALS["___mysqli_ston"],  $pass ) : ((trigger_error("[MySQLConverterToo] Fix the mysql_escape_string() call! This code does not work.", E_USER_ERROR)) ? "" : ""));
	$pass = md5( $pass );

	// Check database
	$query  = "SELECT * FROM `users` WHERE user = '$user' AND password = '$pass';";
	$result = mysqli_query($GLOBALS["___mysqli_ston"],  $query ) or die( '<pre>' . ((is_object($GLOBALS["___mysqli_ston"])) ? mysqli_error($GLOBALS["___mysqli_ston"]) : (($___mysqli_res = mysqli_connect_error()) ? $___mysqli_res : false)) . '</pre>' );

	if( $result && mysqli_num_rows( $result ) == 1 ) {
		// Get users details
		$row    = mysqli_fetch_assoc( $result );
		$avatar = $row["avatar"];

		// Login successful
		$html .= "<p>Welcome to the password protected area {$user}</p>";
		$html .= "<img src=\"{$avatar}\" />";
	}
	else {
		// Login failed
		sleep( rand( 0, 3 ) );
		$html .= "<pre><br />Username and/or password incorrect.</pre>";
	}

	((is_null($___mysqli_res = mysqli_close($GLOBALS["___mysqli_ston"]))) ? false : $___mysqli_res);
}

// Generate Anti-CSRF token
generateSessionToken();

?>

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96

<?php

if( isset( $_POST[ 'Login' ] ) ) {
	// Check Anti-CSRF token
	checkToken( $_REQUEST[ 'user_token' ], $_SESSION[ 'session_token' ], 'index.php' );

	// Sanitise username input
	$user = $_POST[ 'username' ];
	$user = stripslashes( $user );
	$user = ((isset($GLOBALS["___mysqli_ston"]) && is_object($GLOBALS["___mysqli_ston"])) ? mysqli_real_escape_string($GLOBALS["___mysqli_ston"],  $user ) : ((trigger_error("[MySQLConverterToo] Fix the mysql_escape_string() call! This code does not work.", E_USER_ERROR)) ? "" : ""));

	// Sanitise password input
	$pass = $_POST[ 'password' ];
	$pass = stripslashes( $pass );
	$pass = ((isset($GLOBALS["___mysqli_ston"]) && is_object($GLOBALS["___mysqli_ston"])) ? mysqli_real_escape_string($GLOBALS["___mysqli_ston"],  $pass ) : ((trigger_error("[MySQLConverterToo] Fix the mysql_escape_string() call! This code does not work.", E_USER_ERROR)) ? "" : ""));
	$pass = md5( $pass );

	// Default values
	$total_failed_login = 3;
	$lockout_time       = 15;
	$account_locked     = false;

	// Check the database (Check user information)
	$data = $db->prepare( 'SELECT failed_login, last_login FROM users WHERE user = (:user) LIMIT 1;' );
	$data->bindParam( ':user', $user, PDO::PARAM_STR );
	$data->execute();
	$row = $data->fetch();

	// Check to see if the user has been locked out.
	if( ( $data->rowCount() == 1 ) && ( $row[ 'failed_login' ] >= $total_failed_login ) )  {
		// User locked out.  Note, using this method would allow for user enumeration!
		//$html .= "<pre><br />This account has been locked due to too many incorrect logins.</pre>";

		// Calculate when the user would be allowed to login again
		$last_login = $row[ 'last_login' ];
		$last_login = strtotime( $last_login );
		$timeout    = strtotime( "{$last_login} +{$lockout_time} minutes" );
		$timenow    = strtotime( "now" );

		// Check to see if enough time has passed, if it hasn't locked the account
		if( $timenow > $timeout )
			$account_locked = true;
	}

	// Check the database (if username matches the password)
	$data = $db->prepare( 'SELECT * FROM users WHERE user = (:user) AND password = (:password) LIMIT 1;' );
	$data->bindParam( ':user', $user, PDO::PARAM_STR);
	$data->bindParam( ':password', $pass, PDO::PARAM_STR );
	$data->execute();
	$row = $data->fetch();

	// If its a valid login...
	if( ( $data->rowCount() == 1 ) && ( $account_locked == false ) ) {
		// Get users details
		$avatar       = $row[ 'avatar' ];
		$failed_login = $row[ 'failed_login' ];
		$last_login   = $row[ 'last_login' ];

		// Login successful
		$html .= "<p>Welcome to the password protected area <em>{$user}</em></p>";
		$html .= "<img src=\"{$avatar}\" />";

		// Had the account been locked out since last login?
		if( $failed_login >= $total_failed_login ) {
			$html .= "<p><em>Warning</em>: Someone might of been brute forcing your account.</p>";
			$html .= "<p>Number of login attempts: <em>{$failed_login}</em>.<br />Last login attempt was at: <em>${last_login}</em>.</p>";
		}

		// Reset bad login count
		$data = $db->prepare( 'UPDATE users SET failed_login = "0" WHERE user = (:user) LIMIT 1;' );
		$data->bindParam( ':user', $user, PDO::PARAM_STR );
		$data->execute();
	}
	else {
		// Login failed
		sleep( rand( 2, 4 ) );

		// Give the user some feedback
		$html .= "<pre><br />Username and/or password incorrect.<br /><br/>Alternative, the account has been locked because of too many failed logins.<br />If this is the case, <em>please try again in {$lockout_time} minutes</em>.</pre>";

		// Update bad login count
		$data = $db->prepare( 'UPDATE users SET failed_login = (failed_login + 1) WHERE user = (:user) LIMIT 1;' );
		$data->bindParam( ':user', $user, PDO::PARAM_STR );
		$data->execute();
	}

	// Set the last login time
	$data = $db->prepare( 'UPDATE users SET last_login = now() WHERE user = (:user) LIMIT 1;' );
	$data->bindParam( ':user', $user, PDO::PARAM_STR );
	$data->execute();
}

// Generate Anti-CSRF token
generateSessionToken();

?>

1

.. .-.. --- ...- . -.-- --- ..-

1

ILOVEYOU

1
2
3
4

姓名：张三 
生日：19900315

key格式为key{xxxxxxxxxx}

1

flag{zs1990315}

1
2

在一次RSA密钥对生成中，假设p=473398607161，q=4511491，e=17
求解出d作为flga提交

1
2
3
4
5
6

import gmpy2
p = 473398607161
q = 4511491
e = 17
d = int(gmpy2.invert(e, (p-1)*(q-1)))
print(d)

1

125631357777427553

1
2
3
4
5
6
7
8
9

import hashlib   
for i in range(32,127):
    for j in range(32,127):
        for k in range(32,127):
            m=hashlib.md5()
            m.update('TASC'+chr(i)+'O3RJMV'+chr(j)+'WDJKX'+chr(k)+'ZM')
            des=m.hexdigest()
            if 'e9032' in des and 'da' in des and '911513' in des:
                print des

1
2
3
4
5
6
7
8
9

import hashlib   
for i in range(32,127):
    for j in range(32,127):
        for k in range(32,127):
            m=hashlib.md5()
            m.update('TASC'.encode('UTF-8')+chr(i).encode('UTF-8')+'O3RJMV'.encode('UTF-8')+chr(j).encode('UTF-8')+'WDJKX'.encode('UTF-8')+chr(k).encode('UTF-8')+'ZM'.encode('UTF-8'))
            des=m.hexdigest()
            if 'e9032' in des and 'da' in des and '911513' in des:
                print(des)

1

e9032994dabac08080091151380478a2