惯性聚合 高效追踪和阅读你感兴趣的博客、新闻、科技资讯
阅读原文 在惯性聚合中打开

推荐订阅源

F
Full Disclosure
WordPress大学
WordPress大学
小众软件
小众软件
Cloudbric
Cloudbric
AWS News Blog
AWS News Blog
腾讯CDC
量子位
人人都是产品经理
人人都是产品经理
大猫的无限游戏
大猫的无限游戏
freeCodeCamp Programming Tutorials: Python, JavaScript, Git & More
V
Vulnerabilities – Threatpost
Scott Helme
Scott Helme
Hugging Face - Blog
Hugging Face - Blog
博客园_首页
C
CXSECURITY Database RSS Feed - CXSecurity.com
The Hacker News
The Hacker News
奇客Solidot–传递最新科技情报
奇客Solidot–传递最新科技情报
IT之家
IT之家
Jina AI
Jina AI
Attack and Defense Labs
Attack and Defense Labs
S
SegmentFault 最新的问题
Simon Willison's Weblog
Simon Willison's Weblog
The Cloudflare Blog
阮一峰的网络日志
阮一峰的网络日志
T
Tailwind CSS Blog
Last Week in AI
Last Week in AI
博客园 - 【当耐特】
Google Online Security Blog
Google Online Security Blog
美团技术团队
OSCHINA 社区最新新闻
OSCHINA 社区最新新闻
V
Visual Studio Blog
罗磊的独立博客
L
LINUX DO - 最新话题
博客园 - Franky
博客园 - 叶小钗
Apple Machine Learning Research
Apple Machine Learning Research
The Last Watchdog
The Last Watchdog
J
Java Code Geeks
AI
AI
C
Cisco Blogs
酷 壳 – CoolShell
酷 壳 – CoolShell
C
Cyber Attacks, Cyber Crime and Cyber Security
Cisco Talos Blog
Cisco Talos Blog
博客园 - 三生石上(FineUI控件)
雷峰网
雷峰网
Help Net Security
Help Net Security
钛媒体:引领未来商业与生活新知
钛媒体:引领未来商业与生活新知
云风的 BLOG
云风的 BLOG
I
Intezer
S
Securelist

翰林的小站

Bilibili 自建视频云生态观察 2025:拿着过去的碎片,到远方去 Bad Apple:ALAC 音乐完整性验证与速查指南 年轻人的第一个包:不太严谨的 AOSC OS 贡献指南 2024:在变与不变之中做一颗不动的石头 关于浏览器通知推送(Web Push API)的那些事 HTP 笑传:扔掉 UDP,试试并不特殊的低精度时间同步 切割,与世界上的另一个我 时间线之外的 Kench BF-0505 官方驱动无法在高 DPI 下扫描 TIFF 文件的解决方案 博客现已支持手动切换深浅色模式 Migrate Dream! It's MyHexo!!!!! 验证:所幸,七牛云还是能「防护」住 XFF 的(附后续) 从山西联通到组播IP:七牛云的奇怪视角(附分析和后日谈) 消失的 2023 B站百大报告 2023:走在参差的影子之下 连夜分析,探寻B站2022年度百大的版本答案 2022:不为所动,做最业余的年度报告 对于谷歌翻译大陆版「引导页」行为的观测(2022年9月底)
Hackergame Writeup 2023 : A Newbie Perspective
abc1763613206 · 2023-11-04 · via 翰林的小站

过去这么多年,今年是第一次正儿八经拿时间来打 Hackergame ,得益于今年接近溢出的 Misc 浓度,对我这个菜鸡来说,抢个一血的正反馈确实不错,被排行榜卷得写不下项目查资料的过程也确实折磨。

按照 Hackergame 签到题的一贯尿性,进网页直接 F12 看请求。点提交按钮后注意到 https://cnhktrz3k5nc.hack-challenge.lug.ustc.edu.cn:13202/?similarity=

高中阅读理解环节,得答案 23 .

CONFIG_TCP_CONG_BBR .

ECOOP.

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
import requests
import json
import re
import time

sess = requests.Session()
sess.get(
"http://202.38.93.111:10021/api/checkToken?token="
)
# remember to modify it

# getMessage
mess = sess.post("http://202.38.93.111:10021/api/getMessages").json()
servertime_obj = time.strptime(mess["server_starttime"], "%Y-%m-%dT%H:%M:%S.%f%z")
servertime = int(round(time.mktime(servertime_obj) * 1000.0)) + 28800050

# print(servertime)

id = 0
totaldelay = 0
for i in mess["messages"]:
totaldelay = int(float(i["delay"]) * 1000)
nowtime = int(time.time() * 1000)
# print(int(servertime) + totaldelay)
print(
"{} + {} = {} : {}".format(
servertime, totaldelay, servertime + totaldelay, nowtime
)
)
if servertime + totaldelay > nowtime:
# print((servertime + totaldelay - nowtime))
time.sleep((servertime + totaldelay - nowtime) / 1000)
if re.search("hack\[.*\]", i["text"]):
payload = {
"id": id,
}
hders = {"Content-Type": "application/json"}
print(
sess.post(
"http://202.38.93.111:10021/api/deleteMessage",
headers=hders,
data=json.dumps(payload),
).text
)
id += 1
print(sess.post("http://202.38.93.111:10021/api/getflag").text)

1
2
3
4
<54608551+PRO-2684@users.noreply.github.com> 1698306875 +0800	clone: from https://github.com/dair-ai/ML-Course-Notes.git
15fd0a13eb46c39f34cfc0dfb4757ad23a23d026 505e1a3f446c23f31807a117e860f57cb5b5bb79 some_english_postgraduate <some_english_postgraduate@none-exist.com> 1698307060 +0800 commit: Trim trailing spaces
505e1a3f446c23f31807a117e860f57cb5b5bb79 15fd0a13eb46c39f34cfc0dfb4757ad23a23d026 some_english_postgraduate <some_english_postgraduate@none-exist.com> 1698307092 +0800 reset: moving to HEAD~
15fd0a13eb46c39f34cfc0dfb4757ad23a23d026 ea49f0cd3d36edb2965f89581b11151959d20991 some_english_postgraduate <some_english_postgraduate@none-exist.com> 1698307103 +0800 commit: Trim trailing spaces

git checkout 505e1a3f446c23f31807a117e860f57cb5b5bb79,可在主文件中见到 flag .

三个数都试一遍,原本以为是 500 ,结果发现是 0.

后记:跌跌撞撞过了后发了条频道庆祝下,惊动了某个 Staff.

1
{"233": 12345e999, "233": 12345e999}

get_cod_dict 里的 check_equals 和主函数中的 decrypt_data 逻辑综合分析,得出 cod_dict 中的每一组应为 24 长度。

运行 node parsed.js ,得到 flag{y0u_cAn_ReSTorE_C0de_fr0m_asc11nema_3db2da1063300e5dabf826e40ffd016101458df23a371}

1
"You are a brave girl, Lily. You are not silly, 

第二段因为长度较短也比较好猜,只是我水课上试出来个 accept* 直接爆了flag{y0U-are-ACcEP7ed-7O-c0NTiNuE-TH3-G4m3}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
import cv2
import numpy as np
import random
from tqdm import tqdm, trange
libpad = [0,0,0,0,0,0,72,72,72,72,72,72,72,72,72,72,72,72,72,72,72,72,84,84,84,84,84,84,84,84,84,84,84,84,84,84,84,84,84,84,84,84,93,93,93,93,93,93,93,93,93,93,93,93,93,93,93,93,93,93]
libheight = [409,818,1636,1721,1721,1721,349,461,461,698,698,922,922,922,1396,1396,1745,1745,1745,1844,1844,1844,342,402,603,603,684,804,983,983,983,983,983,1206,1206,1273,1273,1966,1966,1966,1966,1966,417,417,427,483,671,759,973,973,973,1281,1403,1403,1403,1529,1529,1529,1529,1771]
libweight = [1721,1721,1721,409,818,1636,1844,1396,1745,922,1844,698,1396,1745,461,922,461,922,1844,349,698,1745,1966,1966,983,1966,983,983,603,684,804,1206,1273,983,1966,983,1966,342,402,603,1206,1273,1403,1771,1529,1529,973,973,671,759,1403,1529,417,973,1529,427,483,1281,1403,417]

def extract_video(file):
buffer = np.fromfile(file, dtype=np.uint8)
lenlib = len(libpad)
picPath = "pics-batch"
for i in trange(lenlib):
ht = libheight[i]
wd = libweight[i]
pad = libpad[i]
frame_count = (len(buffer) + pad) // (ht * wd * 3)
backup = buffer.copy()
backup = np.pad(backup, (0, pad), mode="constant")
backup = backup.reshape((frame_count, ht, wd, 3))
backup = backup.astype(np.uint8)
cv2.imwrite(f"{picPath}/{ht}-{wd}-{pad}.jpg", backup[5])

if __name__ == "__main__":
with open("video.bin", "rb") as input:
extract_video(input)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
def extract_video(file):
buffer = np.fromfile(file, dtype=np.uint8)

ht = 1529
wd = 427
pad = 93
frame_count = (len(buffer) + pad) // (ht * wd * 3)
buffer = np.pad(buffer, (0, pad), mode="constant")
buffer = buffer.reshape((frame_count, ht, wd, 3))
buffer = buffer.astype(np.uint8)
picPath = "pics"
for i in range(frame_count):
print(f"Writing frame {i}")
cv2.imwrite(f"{picPath}/frame{i}.jpg", buffer[i])

flag{it-could-be-easy-to-restore-video-with-haruhikage-even-without-metadata-0F7968CC}