FCTF2025 Personal Writeup

1
// 如果是处理点击坐标的请求
2
if ($_SERVER['REQUEST_METHOD'] === 'POST' && isset($_POST['clicks'])) {
3
    $clicks = json_decode($_POST['clicks'], true);
4

5
    if (!is_array($clicks) || count($clicks) !== 3) {
6
        echo json_encode(['status' => 'error', 'message' => '数据格式不正确']);
7
        exit;
8
    }
9

10
    // 获取图片尺寸
11
    $imagePath = $_SERVER['DOCUMENT_ROOT'] . '/img/lock.jpg';
12
    if (file_exists($imagePath)) {
13
        $imageSize = getimagesize($imagePath);
14
        $imageWidth = $imageSize[0];
15
        $imageHeight = $imageSize[1];
16

17
        // 定义正确的点击区域（以图片百分比表示）
18
        // 格式: [x百分比, y百分比, 允许误差百分比]
19
        $correctAreas = [
20
            [25, 30, 5],  // 第一个点击区域
21
            [50, 60, 5],  // 第二个点击区域
22
            [75, 40, 5]   // 第三个点击区域
23
        ];
24

25
        $allCorrect = true;
26

27
        // 检查所有点击是否都在正确区域内
28
        for ($i = 0; $i < 3; $i++) {
29
            // 获取点击的相对坐标（百分比）
30
            $xPercent = floatval($clicks[$i]['xPercent']);
31
            $yPercent = floatval($clicks[$i]['yPercent']);
32

33
            // 计算正确区域的百分比位置
34
            $correctXPercent = $correctAreas[$i][0];
35
            $correctYPercent = $correctAreas[$i][1];
36
            $errorMarginPercent = $correctAreas[$i][2]; // 误差范围（百分比）
37

38
            // 计算点击位置与正确位置的距离（百分比）
39
            $distancePercent = sqrt(pow($xPercent - $correctXPercent, 2) + pow($yPercent - $correctYPercent, 2));
40

41
            if ($distancePercent > $errorMarginPercent) {
42
                $allCorrect = false;
43
                break;
44
            }
45
        }
46

47
        if ($allCorrect) {
48
            // 所有点都正确
49
            echo json_encode(['status' => 'success', 'message' => '解锁成功！正在跳转...']);
50
        } else {
51
            // 至少有一个点不正确
52
            echo json_encode(['status' => 'error', 'message' => '解锁图案不正确，请重试']);
53
        }
54
    } else {
55
        echo json_encode(['status' => 'error', 'message' => '找不到锁定图片']);
56
    }
57
    exit;
58
}

1
// 获取图片元素
2
const lockImage = document.getElementById("lockImage");
3
const rect = lockImage.getBoundingClientRect();
4
// 定义要模拟点击的 3 个点（百分比坐标）
5
const mockClicks = [
6
  { xPercent: 25, yPercent: 30 }, // 第 1 个正确点
7
  { xPercent: 50, yPercent: 60 }, // 第 2 个正确点
8
  { xPercent: 75, yPercent: 40 }, // 第 3 个正确点
9
];
10
// 模拟点击
11
mockClicks.forEach((point) => {
12
  // 计算实际像素坐标
13
  const x = (point.xPercent / 100) * rect.width;
14
  const y = (point.yPercent / 100) * rect.height;
15
  // 创建并触发点击事件
16
  const clickEvent = new MouseEvent("click", {
17
    clientX: rect.left + x,
18
    clientY: rect.top + y,
19
    bubbles: true,
20
    cancelable: true,
21
  });
22
  lockImage.dispatchEvent(clickEvent);
23
});
24
// 自动解锁
25
document.getElementById("submitBtn").click();

1
#include <stdio.h>
2
#include <string.h>
3

4
int main()
5
{
6
    unsigned char _arr[100] = {
7
    0x46, 0x42, 0x56, 0x45, 0x7F, 0x4C, 0x52, 0x58, 0x41, 0x5A, 0x55, 0x4E, 0x4D, 0x5E, 0x57, 0x50,
8
    0x47, 0x5E, 0x40, 0x58, 0x35, 0x68, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
9
    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
10
    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
11
    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
12
    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
13
    0x00, 0x00, 0x00, 0x00
14
    };
15
    for (int i = 0; i < strlen(_arr); ++i ){
16
        _arr[i] ^= i;
17
        printf("%c", _arr[i]);
18
    }
19
    return 0;
20
}

1
public final String decrypt(String str) throws IllegalBlockSizeException, BadPaddingException {
2
    byte[] bytes;
3
    byte[] bytes2;
4
    Object ddd = null;
5
    try {
6
        Class<?> a = Class.forName(d("amF2YS5zZWN1cml0eS5NZXNzYWdlRGlnZXN0"));
7
        Method b = a.getMethod(d("Z2V0SW5zdGFuY2U="), String.class);
8
        Object c = b.invoke(null, d("TUQ1"));
9
        Method e = a.getMethod(d("dXBkYXRl"), byte[].class);
10
        e.invoke(c, key0.getBytes());
11
        Method f = a.getMethod(d("ZGlnZXN0"), new Class[0]);
12
        byte[] k = (byte[]) f.invoke(c, new Object[0]);
13
        Class<?> aa = Class.forName(d("amF2YXguY3J5cHRvLnNwZWMuREVTS2V5U3BlYw=="));
14
        Constructor<?> desKeySpecConstructor = aa.getConstructor(byte[].class);
15
        Object dsk = desKeySpecConstructor.newInstance(k);
16
        Class<?> bb = Class.forName(d("amF2YXguY3J5cHRvLlNlY3JldEtleUZhY3Rvcnk="));
17
        bytes = null;
18
        try {
19
            Method cc = bb.getMethod(d("Z2V0SW5zdGFuY2U="), String.class);
20
            Object keyFactory = cc.invoke(null, "DES");
21
            Method dd = bb.getMethod(d("Z2VuZXJhdGVTZWNyZXQ="), KeySpec.class);
22
            Object key = dd.invoke(keyFactory, dsk);
23
            Class<?> ee = Class.forName(d("amF2YXguY3J5cHRvLnNwZWMuSXZQYXJhbWV0ZXJTcGVj"));
24
            Constructor<?> ff = ee.getConstructor(byte[].class);
25
            Object iv = ff.newInstance(iv0.getBytes());
26
            Class<?> gg = Class.forName(d("amF2YXguY3J5cHRvLkNpcGhlcg=="));
27
            Method hh = gg.getMethod(d("Z2V0SW5zdGFuY2U="), String.class);
28
            Object ddd2 = hh.invoke(null, d("REVTL0NCQy9QS0NTNVBhZGRpbmc="));
29
            try {
30
                Method ii = gg.getMethod(d("aW5pdA=="), Integer.TYPE, Key.class, AlgorithmParameterSpec.class);
31
                ii.invoke(ddd2, 1, key, iv);
32
                Method jj = gg.getMethod(d("ZG9GaW5hbA=="), byte[].class);
33
                bytes2 = (byte[]) jj.invoke(ddd2, str.getBytes());
34
            } catch (Exception e2) {
35
                e = e2;
36
                ddd = ddd2;
37
                e.printStackTrace();
38
                bytes2 = bytes;
39
                ByteString byteString = ByteString.of(bytes2);
40
                return byteString.hex();
41
            }
42
        } catch (Exception e3) {
43
            e = e3;
44
            ddd = null;
45
        }
46
    } catch (Exception e4) {
47
        e = e4;
48
        bytes = null;
49
    }
50
    ByteString byteString2 = ByteString.of(bytes2);
51
    return byteString2.hex();
52
}

1
from Crypto.Cipher import DES
2
from Crypto.Hash import MD5
3
from Crypto.Util.Padding import pad
4
import binascii
5

6
# Given values
7
key0 = "82305002"
8
iv0 = "82505002"
9
plaintext = "whyysqwmstoryhzcontinues"  # This is encrypted in the original code
10

11
# Step 1: Compute MD5 of key0 (16 bytes)
12
md5 = MD5.new()
13
md5.update(key0.encode())
14
md5_digest = md5.digest()
15

16
# Step 2: Take first 8 bytes for DES key
17
des_key = md5_digest[:8]  # DES key must be 8 bytes
18

19
# Step 3: Use first 8 bytes of iv0 for IV
20
iv = iv0.encode()[:8]  # IV must be 8 bytes
21

22
# Step 4: Encrypt the plaintext (DES/CBC/PKCS5Padding)
23
cipher = DES.new(des_key, DES.MODE_CBC, iv)
24
padded_plaintext = pad(plaintext.encode(), 8)  # PKCS5 padding
25
ciphertext = cipher.encrypt(padded_plaintext)
26

27
# Step 5: Get hex representation of ciphertext
28
ciphertext_hex = binascii.hexlify(ciphertext).decode()
29

30
# The flag is "flag{" + ciphertext_hex + "}"
31
flag = f"flag{{{ciphertext_hex}}}"
32
print(flag)

1
from Crypto.Util.number import long_to_bytes # 安装 pycryptodome
2
from gmpy2 import iroot  # 如果安装失败，改用 libnum.nroot
3

4
# Given values
5
n = 63391473280664441274904200586447632651254701180424158427108281651693928841226111518712585495312617412779821462204588428065986005376953783373564926106424797989701648588541831740191002281021705190341030101189048073915563206351313513842348269859235277579119059936460754505010643126116092602365529175094781120103
6
c1 = 4104695764377959780604501077442202266071223727138597085236828687830804860615462560175600544757443131080359063292189768185543992762611748056543485377257384749425514971210253333516944369981180889484277814771362680422755584410126938813918977971380084864154953125
7
hint2 = 204105495489668868091538015576189171569873657713403681343766254180158189896024
8
c2 = 28121558131340982474041738298374018159696174865084105786440297339340785088430587628834203876791752975481488678585552540372105609136359567796041061743937883984968776223417145187563869555955865451402962589066805092577240903705119391097879877855341243248105717369410705538761074189119187539207186087814982669836
9
hint1 = 189568292591813079898832307494711802345451486761183059811078473781028969917672
10

11
# Step 1: Calculate a + b
12
sum_ab_squared = hint1 + hint2
13
sum_ab, exact = iroot(sum_ab_squared, 2)
14
if not exact:
15
    print("Error: hint1 + hint2 is not a perfect square.")
16
    exit()
17

18
# Step 2: Calculate a and b
19
a = hint1 // sum_ab
20
b = hint2 // sum_ab
21

22
# Verify a and b
23
if a * sum_ab != hint1 or b * sum_ab != hint2:
24
    print("Error: Calculated a and b do not match hints.")
25
    exit()
26

27
print(f"[+] Found a = {a}, b = {b}")
28

29
# Step 3: Small exponent attack (e=3)
30
# Check if m1^3 < n (no modulo operation)
31
m1, exact = iroot(c1, 3)
32
if not exact:
33
    print("Error: c1 is not a perfect cube.")
34
    exit()
35

36
# Step 4: Verification
37
m2_calculated = a * m1 + b
38
c2_calculated = pow(m2_calculated, 3, n)
39
if c2_calculated != c2:
40
    print("Error: Verification failed. m1 may be incorrect.")
41
    exit()
42

43
# Step 5: Convert m1 to flag
44
flag = long_to_bytes(m1)
45
print(f"[+] Recovered flag: {flag.decode()}")

1
int sub_411C00()
2
{
3
  int result; // eax
4
  char v1; // [esp+0h] [ebp-22Ch]
5
  char v2; // [esp+0h] [ebp-22Ch]
6
  int i; // [esp+D0h] [ebp-15Ch]
7
  char Str1[108]; // [esp+DCh] [ebp-150h] BYREF
8
  char Str[108]; // [esp+148h] [ebp-E4h] BYREF
9
  char Str2[108]; // [esp+1B4h] [ebp-78h] BYREF
10
  int v7; // [esp+220h] [ebp-Ch]
11

12
  __CheckForDebuggerJustMyCode(&unk_41C029);
13
  v7 = sub_41127B();
14
  strcpy(Str2, "GAPNkFl^PJGQJ_YHEEx~d");
15
  j_memset(&Str2[22], 0, 0x4Eu);
16
  sub_4110E1("请输入 flag: ", v1);
17
  sub_411037("%s", (char)Str);
18
  sub_411122(Str, v7, (int)Str1);
19
  if ( !j_strcmp(Str1, Str2) )
20
    result = sub_4110E1(asc_417B60, v2);
21
  else
22
    result = sub_4110E1(asc_417B6C, v2);
23
  for ( i = 0; i < 30; ++i )
24
  {
25
    free(*(&Block + i));
26
    result = i + 1;
27
  }
28
  return result;
29
}

1
int __cdecl main_0(int argc, const char **argv, const char **envp)
2
{
3
  FILE *v3; // eax
4
  char v5; // [esp+0h] [ebp-19Ch]
5
  char v6; // [esp+0h] [ebp-19Ch]
6
  size_t v7; // [esp+10h] [ebp-18Ch]
7
  int v8; // [esp+DCh] [ebp-C0h]
8
  int v9; // [esp+E8h] [ebp-B4h]
9
  char *v10; // [esp+F4h] [ebp-A8h]
10
  size_t Size; // [esp+100h] [ebp-9Ch]
11
  char *Destination; // [esp+10Ch] [ebp-90h]
12
  char Buffer[7]; // [esp+130h] [ebp-6Ch] BYREF
13
  char v14[97]; // [esp+137h] [ebp-65h] BYREF
14

15
  __CheckForDebuggerJustMyCode(&unk_41C009);
16
  sub_4110DC("LET'S GO!!!\n", v5);
17
  v3 = _acrt_iob_func(0);
18
  fgets(Buffer, 100, v3);
19
  v7 = strcspn(Buffer, "\n");
20
  if ( v7 >= 0x64 )
21
    j____report_rangecheckfailure();
22
  Buffer[v7] = 0;
23
  Destination = (char *)malloc(8u);
24
  strncpy_s(Destination, 8u, Buffer, 7u);
25
  Destination[7] = 0;
26
  Size = j_strlen(Buffer) - 7 + 1;
27
  v10 = (char *)malloc(Size);
28
  strcpy_s(v10, Size, v14);
29
  v9 = sub_411361(Destination, 4);
30
  v8 = sub_4110BE(v10);
31
  if ( v9 == 1 && v8 == 1 )
32
    sub_4110DC("right\n", v6);
33
  else
34
    sub_4110DC("Nooooo\n", v6);
35
  free(Destination);
36
  free(v10);
37
  system("pause");
38
  return 0;
39
}