0x00 画师
给了一个xml 在文件里看到了host=”app.diagrams.net”
访问该网站导入题目的xml文件，把画布缩小，全选替换颜色，看到了抽象的字符画：
结合该网站名称猜测得到flag为flag{easy_diagram}
0x01 easy_math
eds师傅做的。简单来说就是满足条件的返回true，有些可以算出来24的但是判断为false的单独进列表，其他的返回false。
# coding=utf-8
from pwn import *
context.arch = 'i386'
f = open("list.txt","r")
s = f.read()
lists = eval(s+']')
f.close()
daan = []
def judge_point(num1, num2, op):
if op == "+":
return num1 + num2
elif op == "-":
return num1 - num2
elif op == "*":
return num1 * num2
elif op == "/":
# 避免除零错误
if num2 == 0:
return None
return num1 / num2
def evaluate(expression):
stack = []
for token in expression:
if token.isdigit():
stack.append(float(token))
else:
num2 = stack.pop()
num1 = stack.pop()
result = judge_point(num1, num2, token)
if result is None:
return None
stack.append(result)
return stack[0]
def backtrack(nums):
if len(nums) == 1:
if abs(eval(nums[0]) - 24) == 0: # 如果结果接近24，则返回解
return [nums]
else:
return []
res = []
for i in range(len(nums)):
for j in range(len(nums)):
if i != j:
new_nums = [nums[k] for k in range(len(nums)) if k != i and k != j]
for op in ["+", "-", "*", "/"]:
if (op == "+" or op == "*") and i > j: # 避免重复计算
continue
if op == "/": # 避免除零错误
continue
new_nums.append("(" + str(nums[i]) + op + str(nums[j]) + ")")
sub_res = backtrack(new_nums)
if sub_res:
res.extend(sub_res)
new_nums.pop()
return res
def find_24(nums):
expressions = backtrack(nums)
if expressions:
#return expressions[0] # 返回其中一个满足条件的表达式
print("True",expressions[0])
daan.append(1)
return "True"
elif nums in lists:
print("True","list")
daan.append(1)
return "True"
else:
print("False")
daan.append(0)
return "False"
def makelist():
print(r.recvuntil("["))
m = r.recvuntil(']')
aa = '['+m
s = eval(aa)
print s
return s
# 示例输入
nums = [9, 4, 9, 5]
solution = find_24(nums)
print("Solution:", solution)
#for j in range(30):
"""
r = remote('node1.anna.nssctf.cn',28378)
for i in range(300):
print(i)
calc = makelist()
r.sendline(find_24(calc))
"""
for j in range(100):
r = remote('node1.anna.nssctf.cn',28378)
tmp = 0
for i in range(351):
print(i)
calc = makelist()
r.sendline(find_24(calc))
get = r.recvuntil('!')
log.info(get)
if 'w' == get[-6]:
print("chuole")
f = open("list.txt","a")
l = ','+str(calc)
f.write(l)
print(len(lists))
f.close()
#exit()
#r.close()
tmp = 1
break
if tmp == 1:
continue
calc = makelist()
r.sendline(find_24(calc))
print(daan)
r.interactive()
list.txt的名单如下：
[[8, 5, 2, 5],[9, 9, 6, 8],[5, 5, 3, 3],[7, 7, 3, 3],[5, 4, 5, 8],[6, 1, 8, 6],[2, 9, 6, 5],[4, 9, 9, 8]
,[8, 1, 6, 6],[6, 6, 8, 8],[7, 4, 7, 4],[1, 2, 7, 7],[6, 8, 6, 8],[4, 5, 9, 9],[8, 8, 6, 6],[9, 9, 8, 6],[3, 8, 8, 3],[9, 8, 6, 7],[8, 6, 9, 9],[4, 7, 7, 4],[5, 7, 5, 4],[8, 4, 5, 8],[4, 5, 4, 4],[6, 6, 8, 1],[9, 1, 3, 8],[5, 5, 5, 5],[5, 1, 5, 5],[3, 5, 3, 5],[9, 4, 5, 9],[5, 4, 9, 9],[3, 9, 3, 3],[3, 9, 7, 7],[9, 1, 9, 3],[9, 8, 7, 6],[6, 5, 6, 6],[3, 1, 7, 9],[4, 6, 9, 7],[5, 2, 9, 6],[1, 8, 6, 6],[7, 4, 7, 7],[7, 7, 7, 4],[4, 5, 7, 5],[1, 9, 3, 9],[4, 9, 8, 9],[9, 4, 7, 9],[3, 9, 1, 9],[6, 6, 5, 6],[5, 1, 4, 6],[5, 5, 3, 9],[6, 9, 5, 2],[5, 4, 4, 4],[4, 9, 9, 7],[3, 6, 3, 6],[5, 4, 5, 7],[5, 9, 9, 4],[6, 6, 6, 5],[8, 5, 4, 8],[4, 4, 7, 7],[7, 2, 1, 7],[5, 9, 9, 5],[6, 1, 1, 8],[1, 9, 3, 8],[8, 8, 3, 3],[3, 6, 1, 4],[5, 5, 5, 1],[1, 1, 8, 6],[6, 2, 5, 9],[4, 7, 4, 7],[7, 7, 5, 6],[2, 1, 7, 7],[7, 5, 7, 6],[5, 8, 2, 5],[1, 4, 6, 3],[9, 5, 6, 2],[2, 5, 9, 6],[4, 5, 6, 1],[9, 6, 5, 2],[9, 5, 9, 5],[3, 6, 4, 1],[9, 5, 9, 5],[8, 5, 5, 2],[9, 3, 7, 7],[4, 8, 9, 9],[1, 8, 6, 1],[7, 7, 1, 2],[5, 6, 4, 1],[4, 5, 1, 6],[9, 1, 7, 3],[6, 1, 6, 8],[5, 8, 8, 5],[7, 2, 7, 1],[3, 7, 3, 7],[4, 6, 7, 9],[3, 7, 7, 3],[7, 5, 5, 4],[8, 5, 5, 8],[3, 3, 7, 7],[1, 6, 4, 5],[4, 8, 5, 8],[7, 4, 4, 7],[9, 9, 5, 4],[1, 3, 9, 7],[7, 5, 6, 7],[4, 8, 9, 9],[3, 3, 3, 9],[7, 9, 4, 9],[5, 6, 2, 9],[7, 4, 9, 6],[6, 4, 1, 5],[3, 4, 6, 1],[4, 8, 5, 8],[1, 5, 5, 5],[7, 7, 3, 9],[3, 6, 4, 1],[8, 5, 4, 5],[4, 9, 7, 9],[3, 9, 7, 1],[9, 8, 9, 6],[5, 9, 5, 9],[2, 6, 5, 9],[9, 1, 3, 9],[9, 8, 9, 4],[3, 8, 9, 1],[5, 7, 7, 6],[5, 7, 4, 5],[8, 6, 1, 1],[7, 4, 9, 6],[7, 9, 7, 3],[8, 5, 8, 4],[5, 8, 5, 8],[4, 9, 6, 7],[3, 6, 6, 3],[7, 6, 8, 9],[3, 6, 4, 1],[5, 9, 4, 9],[8, 9, 7, 6],[7, 9, 4, 9],[3, 3, 6, 6],[5, 6, 6, 6],[9, 3, 7, 7],[7, 1, 2, 7],[3, 3, 5, 5],[3, 3, 8, 8],[9, 4, 7, 6],[1, 8, 1, 6],[4, 5, 1, 6],[5, 5, 2, 8],[9, 5, 9, 5],[5, 5, 9, 9],[9, 8, 6, 9],[8, 6, 8, 6],[4, 3, 1, 6],[7, 2, 7, 1],[9, 4, 9, 7],[3, 3, 9, 3],[9, 1, 3, 9],[1, 5, 4, 6],[1, 7, 2, 7],[8, 8, 4, 5],[9, 6, 9, 8],[8, 6, 9, 7],[3, 3, 3, 9],[5, 6, 1, 4],[4, 4, 4, 5],[9, 3, 7, 1],[3, 6, 6, 3],[5, 6, 7, 7],[4, 4, 4, 5],[3, 5, 5, 9],[3, 9, 5, 5],[6, 7, 8, 9],[6, 7, 9, 4],[2, 7, 1, 7],[1, 8, 9, 3],[6, 8, 9, 7],[9, 7, 6, 4],[8, 3, 8, 3],[7, 3, 1, 9],[6, 6, 3, 3],[1, 3, 9, 8],[9, 9, 4, 7],[5, 4, 8, 8],[1, 9, 3, 7],[7, 9, 3, 1],[7, 7, 4, 7],[6, 8, 6, 1],[5, 5, 7, 4],[1, 1, 6, 8],[5, 7, 6, 7],[6, 8, 9, 9],[7, 7, 4, 4],[6, 9, 9, 8],[1, 6, 8, 1],[7, 3, 7, 3],[5, 8, 4, 8],[9, 3, 5, 5],[6, 4, 7, 9],[9, 6, 7, 4],[1, 3, 4, 6],[4, 6, 3, 1],[7, 9, 6, 4],[5, 5, 1, 5],[7, 6, 5, 7],[9, 6, 4, 7],[5, 5, 8, 8],[5, 3, 5, 9],[8, 4, 5, 5],[7, 4, 5, 5],[4, 1, 3, 6],[9, 3, 9, 1],[4, 7, 9, 9],[7, 6, 4, 9],[2, 8, 5, 5],[8, 9, 9, 6],[8, 6, 6, 1],[5, 8, 4, 5],[1, 7, 7, 2],[7, 9, 4, 6],[3, 5, 5, 3],[9, 3, 1, 7],[9, 3, 1, 9],[7, 7, 2, 1],[5, 9, 5, 3],[9, 3, 1, 9],[7, 6, 9, 8],[8, 4, 8, 5],[9, 5, 5, 9],[3, 8, 3, 8],[7, 6, 7, 5],[6, 2, 9, 5],[9, 8, 4, 9],[6, 4, 1, 3],[4, 9, 9, 5],[6, 7, 4, 9],[3, 1, 6, 4],[7, 9, 9, 4],[9, 7, 8, 6],[5, 9, 6, 2],[8, 3, 3, 8],[1, 5, 6, 4],[7, 3, 3, 7],[8, 3, 1, 9],[8, 9, 3, 1],[4, 4, 5, 4],[8, 6, 6, 8],[3, 7, 9, 1],[9, 9, 5, 5],[7, 9, 9, 4],[4, 5, 8, 8],[8, 3, 3, 8],[5, 5, 8, 4],[4, 9, 7, 6],[3, 8, 3, 8],[4, 7, 5, 5],[6, 9, 4, 7],[6, 1, 8, 1],[9, 5, 9, 4],[9, 4, 6, 7],[1, 6, 6, 8],[6, 3, 4, 1],[1, 6, 8, 6],[2, 6, 9, 5],[6, 6, 1, 8],[8, 6, 7, 9],[7, 5, 4, 5],[5, 1, 6, 4],[5, 2, 5, 8],[4, 8, 5, 5],[7, 9, 6, 8],[9, 5, 5, 3]
,[6, 3, 3, 6],[3, 7, 7, 9],[4, 7, 7, 7],[8, 5, 8, 5],[3, 8, 1, 9],[2, 9, 5, 6],[5, 8, 5, 2],[5, 4, 6, 1],[9, 9, 7, 4],[5, 3, 9, 5],[3, 1, 9, 9],[7, 3, 7, 9],[6, 9, 2, 5],[3, 1, 4, 6],[9, 4, 9, 5],[6, 8, 1, 1],[7, 6, 9, 4],[7, 3, 9, 7],[4, 8, 8, 5],[8, 8, 5, 4],[7, 4, 6, 9],[1, 6, 1, 8],[1, 4, 3, 6],[7, 4, 6, 9],[9, 3, 1, 8],[4, 7, 9, 6],[5, 3, 9, 5],[1, 6, 1, 8],[9, 9, 7, 4],[6, 5, 1, 4],[9, 3, 3, 3],[4, 1, 6, 5],[6, 8, 1, 6],[9, 3, 3, 3],[2, 5, 6, 9],[8, 2, 5, 5],[3, 1, 9, 7],[5, 2, 8, 5],[9, 2, 6, 5],[8, 1, 9, 3],[7, 7, 6, 5],[8, 4, 9, 9],[9, 2, 5, 6],[6, 4, 9, 7],[8, 8, 5, 5],[4, 5, 8, 5],[5, 3, 5, 3],[9, 3, 8, 1],[8, 1, 6, 1],[6, 8, 8, 6],[6, 7, 7, 5],[2, 5, 5, 8],[6, 3, 6, 3],[7, 4, 9, 9],[1, 6, 5, 4],[8, 3, 9, 1],[9, 7, 4, 6],[7, 9, 1, 3],[6, 1, 3, 4],[1, 9, 9, 3],[6, 7, 5, 7],[1, 9, 9, 3],[6, 7, 5, 7],[7, 1, 7, 2],[6, 3, 1, 4],[4, 9, 5, 9],[8, 9, 6, 9],[6, 1, 3, 4],[6, 9, 8, 7],[9, 4, 8, 9],[3, 1, 8, 9],[3, 5, 9, 5],[8, 9, 6, 7],[2, 7, 7, 1],[8, 9, 4, 9],[9, 4, 9, 8],[9, 4, 9, 8],[6, 1, 4, 3],[9, 4, 9, 8],[9, 7, 3, 1],[5, 9, 2, 6],[1, 6, 3, 4],[2, 7, 7, 1],[4, 5, 5, 8],[6, 8, 7, 9],[9, 8, 3, 1],[9, 6, 2, 5],[5, 4, 8, 5],[5, 4, 1, 6],[9, 5, 3, 5],[1, 7, 9, 3],[9, 5, 3, 5],[5, 8, 5, 4],[4, 5, 5, 8],[4, 5, 5, 8],[1, 4, 6, 5],[2, 5, 8, 5],[4, 7, 6, 9],[5, 9, 2, 6],[4, 6, 5, 1],[9, 7, 6, 8],[9, 4, 9, 8],[8, 7, 9, 6],[2, 7, 7, 1],[9, 1, 8, 3],[8, 5, 5, 4],[5, 5, 9, 3]
根据所有true和false的规律，得到疑似二进制如下：
[1, 0, 1, 0, 0, 1, 1, 1, 0, 0, 1, 0, 1, 0, 0, 1, 1, 0, 1, 0, 1, 0, 0, 1, 1, 0, 1, 0, 0, 0, 0, 1, 1, 0, 1, 0, 1, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 1, 0, 0, 1, 1, 1, 0, 0, 1, 0, 0, 1, 1, 1, 0, 0, 1, 0, 1, 0, 0, 1, 1, 0, 1, 0, 1, 0, 0, 1, 1, 0, 1, 0, 0, 0, 0, 1, 1, 0, 1, 0, 1, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 1, 0, 0, 1, 1, 1, 1, 0, 1, 1, 0, 0, 1, 1, 0, 1, 0, 0, 0, 0, 1, 1, 0, 1, 1, 0, 0, 0, 1, 1, 1, 0, 0, 0, 0, 0, 1, 1, 0, 0, 0, 0, 0, 0, 1, 1, 0, 1, 1, 1, 0, 0, 1, 1, 1, 0, 0, 1, 0, 0, 1, 1, 0, 0, 0, 1, 0, 0, 1, 1, 0, 1, 0, 0, 0, 0, 1, 0, 1, 1, 0, 1, 0, 1, 1, 0, 0, 0, 1, 0, 0, 1, 1, 0, 0, 1, 1, 0, 0, 1, 1, 0, 0, 0, 1, 0, 0, 1, 1, 0, 0, 1, 1, 0, 0, 0, 1, 0, 1, 1, 0, 1, 0, 0, 1, 1, 0, 1, 0, 0, 0, 0, 1, 1, 0, 1, 1, 0, 0, 0, 1, 1, 0, 1, 0, 1, 0, 1, 1, 0, 0, 1, 0, 0, 0, 0, 1, 0, 1, 1, 0, 1, 0, 1, 1, 0, 0, 0, 0, 1, 0, 0, 1, 1, 0, 0, 1, 1, 0, 0, 1, 1, 0, 0, 0, 1, 0, 0, 1, 1, 1, 0, 0, 1, 0, 0, 1, 0, 1, 1, 0, 1, 0, 1, 1, 0, 0, 1, 0, 0, 0, 1, 1, 0, 0, 1, 0, 1, 0, 1, 1, 0, 0, 1, 0, 1, 0, 1, 1, 0, 0, 1, 0, 0, 0, 1, 1, 0, 0, 0, 1, 1, 0, 0, 1, 1, 0, 1, 1, 0, 0, 0, 1, 1, 0, 1, 0, 0, 0, 0, 1, 1, 0, 1, 1, 1, 0, 0, 1, 1, 1, 0, 0, 0, 0, 0, 1, 1, 0, 0, 1, 0, 0, 1, 1, 0, 0, 0, 1, 0, 0, 1, 1, 0, 0, 0, 0, 1, 0, 1, 1, 1, 1, 1, 0, 1]
直接hex()得：
0x29ca6a686a88ce4e53534354467b34363830373931342d626662662d343635642d613331392d6465656463363437383262617d
转十进制字符得：
NSSCTF{46807914-bfbf-465d-a319-deedc64782ba}
