2020-巅峰极客

ctf 7 minutes read (About 1095 words)

2020-巅峰极客

re

virus

简单的迷宫题，开始先输入四个数选择地图顺序，然后输入以wasd组成的操作序列，用-隔开，每一个序列都会有长度限制，对应了四个迷宫不同的路线长度，所以把迷宫找出来就解出来了

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
maze1

|||||||||||||||

|||||||||||||||

|||||||||||||||

||s………|||

|||||||||||.|||

||d||||||||.|||

||.||||||||.|||

||.||||||||.|||

||……….|||

|||||||||||||||

start (3,2) a2=1

dddddddddsssssaaaaaaaaawww

len=26

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
maze2

|||||||||||||||||||

||s|||||||||||||d||

||..|||||||||||..||

|||..|||||||||..|||

||||..|||||||..||||

|||||..|||||..|||||

||||||..|||..||||||

|||||||..|..|||||||

||||||||…||||||||

|||||||||||||||||||

start (1,2) a2=2

sdsdsdsdsdsdsddwdwdwdwdwdwdw

len=28

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
maze3

|||||||||||||||

||………s|||

||.||||||||||||

||.||||||||||||

||.||||||||||||

||.||||||||||||

||.||||||||||||

||.||||||||||||

||………d|||

|||||||||||||||

start (1,B) a2=3

aaaaaaaaasssssssddddddddd

len=25

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
maze4

|||||||||||||||

|||||||||||||||

|||||||||||||||

|||……….||

|||.||||||||.||

|||.||||||||.||

|||.||||||||.||

|||.||||||||.||

|||s||||||||d||

|||||||||||||||

start (8,3) a2=4

wwwwwdddddddddsssss

len=19

长度顺序为19 25 26 28，所以对应的结果如下：

4312-wwwwwdddddddddsssss-aaaaaaaaasssssssddddddddd-dddddddddsssssaaaaaaaaawww-sdsdsdsdsdsdsddwdwdwdwdwdwdw

套上flag即可

fu!k_py

这题也比较简单，没什么好说的，解压得到的pyc文件没有任何修改，可以直接uncompyle

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
(lambda __g, __print: [ [ (lambda __after: [ (lambda __after: (__print('Error len!'), (exit(), __after())[1])[1] if len(input) != 87 else __after())(lambda : [ [ [ [ (lambda __after: (__print('Error fmt!'), (exit(0), __after())[1])[1] if fmt1 != 'flag{' or fmt2 != '}' else __after())(lambda : (d.append(context[0:9]), (d.append(context[9:18]), (d.append(context[18:27]), (d.append(context[27:36]), (d.append(context[36:45]), (d.append(context[45:54]), (d.append(context[54:63]), (d.append(context[63:72]), (d.append(context[72:81]), [ [ [ [ [ [ [ [ [ [ [ [ [ [ [ [ [ [ [ [ [ [ [ [ [ [ [ (lambda __after: (__print('Error!'), (exit(), __after())[1])[1] if d[0][2] != '5' or d[0][3] != '3' else __after())(lambda : (lambda __after: (__print('Error!'), (exit(), __after())[1])[1] if d[1][0] != '8' or d[1][7] != '2' else __after())(lambda : (lambda __after: (__print('Error!'), (exit(), __after())[1])[1] if d[2][1] != '7' or d[2][4] != '1' or d[2][6] != '5' else __after())(lambda : (lambda __after: (__print('Error!'), (exit(), __after())[1])[1] if d[3][0] != '4' or d[3][5] != '5' or d[3][6] != '3' else __after())(lambda : (lambda __after: (__print('Error!'), (exit(), __after())[1])[1] if d[4][1] != '1' or d[4][4] != '7' or d[4][8] != '6' else __after())(lambda : (lambda __after: (__print('Error!'), (exit(), __after())[1])[1] if d[5][2] != '3' or d[5][3] != '2' or d[5][7] != '8' else __after())(lambda : (lambda __after: (__print('Error!'), (exit(), __after())[1])[1] if d[6][1] != '6' or d[6][3] != '5' or d[6][8] != '9' else __after())(lambda : (lambda __after: (__print('Error!'), (exit(), __after())[1])[1] if d[7][2] != '4' or d[7][7] != '3' else __after())(lambda : (lambda __after: (__print('Error!'), (exit(), __after())[1])[1] if d[8][5] != '9' or d[8][6] != '7' else __after())(lambda : (lambda __after: (__print('Error!'), (exit(), __after())[1])[1] if check(h1) != 45 or check(h2) != 45 or check(h3) != 45 or check(h4) != 45 or check(h5) != 45 or check(h6) != 45 or check(h7) != 45 or check(h8) != 45 or check(h9) != 45 else __after())(lambda : (lambda __after: (__print('Error!'), (exit(), __after())[1])[1] if check(l1) != 45 or check(l2) != 45 or check(l3) != 45 or check(l4) != 45 or check(l5) != 45 or check(l6) != 45 or check(l7) != 45 or check(l8) != 45 or check(l9) != 45 else __after())(lambda : (lambda __after: (__print('Error!'), (exit(), __after())[1])[1] if check(k1) != 45 or check(k2) != 45 or check(k3) != 45 or check(k4) != 45 or check(k5) != 45 or check(k6) != 45 or check(k7) != 45 or check(k8) != 45 or check(k9) != 45 else __after())(lambda : (lambda __after: (__print('Error!'), (exit(), __after())[1])[1] if check1(h1) != 1 or check1(h2) != 1 or check1(h3) != 1 or check1(h4) != 1 or check1(h5) != 1 or check1(h6) != 1 or check1(h7) != 1 or check1(h8) != 1 or check1(h9) != 1 else __after())(lambda : (lambda __after: (__print('Error!'), (exit(), __after())[1])[1] if check1(l1) != 1 or check1(l2) != 1 or check1(l3) != 1 or check1(l4) != 1 or check1(l5) != 1 or check1(l6) != 1 or check1(l7) != 1 or check1(l8) != 1 or check1(l9) != 1 else __after())(lambda : (lambda __after: (__print('Error!'), (exit(), __after())[1])[1] if check1(k1) != 1 or check1(k2) != 1 or check1(k3) != 1 or check1(k4) != 1 or check1(k5) != 1 or check1(k6) != 1 or check1(k7) != 1 or check1(k8) != 1 or check1(k9) != 1 else __after())(lambda : (__print('Yes! You got it!'), __after())[1]))))))))))))))) 

    for __g['k9'] in [context[60] + context[61] + context[62] + context[69] + context[70] + context[71] + context[78] + context[79] + context[80]] ][0] 

    for __g['k8'] in [context[57] + context[58] + context[59] + context[66] + context[67] + context[68] + context[75] + context[76] + context[77]] ][0] 

    for __g['k7'] in [context[54] + context[55] + context[56] + context[63] + context[64] + context[65] + context[72] + context[73] + context[74]] ][0] 

    for __g['k6'] in [context[33] + context[34] + context[35] + context[42] + context[43] + context[44] + context[51] + context[52] + context[53]] ][0] 

    for __g['k5'] in [context[30] + context[31] + context[32] + context[39] + context[40] + context[41] + context[48] + context[49] + context[50]] ][0] 

    for __g['k4'] in [context[27] + context[28] + context[29] + context[36] + context[37] + context[38] + context[45] + context[46] + context[47]] ][0] 

    for __g['k3'] in [context[6] + context[7] + context[8] + context[15] + context[16] + context[17] + context[24] + context[25] + context[26]] ][0] 

    for __g['k2'] in [context[3] + context[4] + context[5] + context[12] + context[13] + context[14] + context[21] + context[22] + context[23]] ][0] 

    for __g['k1'] in [context[0] + context[1] + context[2] + context[9] + context[10] + context[11] + context[18] + context[19] + context[20]] ][0] 
for __g['l9'] in [context[8] + context[17] + context[26] + context[35] + context[44] + context[53] + context[62] + context[71] + context[80]] ][0] 
 for __g['l8'] in [context[7] + context[16] + context[25] + context[34] + context[43] + context[52] + context[61] + context[70] + context[79]] ][0] 
 for __g['l7'] in [context[6] + context[15] + context[24] + context[33] + context[42] + context[51] + context[60] + context[69] + context[78]] ][0] 
 for __g['l6'] in [context[5] + context[14] + context[23] + context[32] + context[41] + context[50] + context[59] + context[68] + context[77]] ][0] 
 for __g['l5'] in [context[4] + context[13] + context[22] + context[31] + context[40] + context[49] + context[58] + context[67] + context[76]] ][0] 
 for __g['l4'] in [context[3] + context[12] + context[21] + context[30] + context[39] + context[48] + context[57] + context[66] + context[75]] ][0] 
 for __g['l3'] in [context[2] + context[11] + context[20] + context[29] + context[38] + context[47] + context[56] + context[65] + context[74]] ][0] 
 for __g['l2'] in [context[1] + context[10] + context[19] + context[28] + context[37] + context[46] + context[55] + context[64] + context[73]] ][0] 
 for __g['l1'] in [context[0] + context[9] + context[18] + context[27] + context[36] + context[45] + context[54] + context[63] + context[72]] ][0] 
 for __g['h9'] in [context[72:81]] ][0] 
 for __g['h8'] in [context[63:72]] ][0] 
 for __g['h7'] in [context[54:63]] ][0] 
 for __g['h6'] in [context[45:54]] ][0] 
 for __g['h5'] in [context[36:45]] ][0] 
 for __g['h4'] in [context[27:36]] ][0] 
 for __g['h3'] in [context[18:27]] ][0] 
 for __g['h2'] in [context[9:18]] ][0] 
 for __g['h1'] in [context[0:9]] ][0]
 )[1])[1])[1])[1])[1])[1])[1])[1])[1]) 
 for **g['d'] in [[]] ][0]  for __g['context'] in [input[5:-1]] ][0]  for __g['fmt2'] in [input[(-1)]] ][0]  for __g['fmt1'] in [input[0:5]] ][0])  for __g['input'] in [raw_input('Input your flag:')] ][0] if __name** == '**main**' else **after())(lambda : None)  for __g['check1'], check1.__name** in [(lambda arg: (lambda **l: [ (lambda __after: 0 if len(list(set(__l['arg']))) != 9 else 1)(lambda : None) for __l['arg'] in [arg] ][0])({}), 'check1')] ][0]  for __g['check'], check.__name** in [(lambda arg: (lambda **l: [ sum(map(int, __l['arg'])) for __l['arg'] in [arg] ][0])({}), 'check')] ][0])(globals(), __import**('**builtin**', level=0).**dict**['print'])

代码可读性很差，但是可以大概了解一下信息，一共输入81位，某些特定的位数上的数字是确定的，其中定义了一些变量，可以很轻易看出来分别是行、列和九宫格，两个check也很清晰，查每行每列每个九宫格有无重复数字，查和是否为45，这很显然是一个数独，直接解就可以了。

2020-全国工业互联网安全技术技能大赛 2020-ciscn 西北赛区分区赛

Comments

Your browser is out-of-date!

Update your browser to view this website correctly. Update my browser now

×