0x00 画师

给了一个xml 在文件里看到了host=”app.diagrams.net”

访问该网站导入题目的xml文件,把画布缩小,全选替换颜色,看到了抽象的字符画:

结合该网站名称猜测得到flag为flag{easy_diagram}

0x01 easy_math

eds师傅做的。简单来说就是满足条件的返回true,有些可以算出来24的但是判断为false的单独进列表,其他的返回false。

# coding=utf-8
from pwn import *
context.arch = 'i386'
f = open("list.txt","r")
s = f.read()
lists = eval(s+']')
f.close()
daan = []
def judge_point(num1, num2, op):
    if op == "+":
        return num1 + num2
    elif op == "-":
        return num1 - num2
    elif op == "*":
        return num1 * num2
    elif op == "/":
        # 避免除零错误
        if num2 == 0:
            return None
        return num1 / num2

def evaluate(expression):
    stack = []
    for token in expression:
        if token.isdigit():
            stack.append(float(token))
        else:
            num2 = stack.pop()
            num1 = stack.pop()
            result = judge_point(num1, num2, token)
            if result is None:
                return None
            stack.append(result)
    return stack[0]

def backtrack(nums):
    if len(nums) == 1:
        if abs(eval(nums[0]) - 24) == 0:  # 如果结果接近24,则返回解
            return [nums]
        else:
            return []
    res = []
    for i in range(len(nums)):
        for j in range(len(nums)):
            if i != j:
                new_nums = [nums[k] for k in range(len(nums)) if k != i and k != j]
                for op in ["+", "-", "*", "/"]:
                    if (op == "+" or op == "*") and i > j:  # 避免重复计算
                        continue
                    if op == "/":  # 避免除零错误
                        continue
                    new_nums.append("(" + str(nums[i]) + op + str(nums[j]) + ")")
                    sub_res = backtrack(new_nums)
                    if sub_res:
                        res.extend(sub_res)
                    new_nums.pop()
    return res

def find_24(nums):
    expressions = backtrack(nums)
    if expressions:
        #return expressions[0]  # 返回其中一个满足条件的表达式
        print("True",expressions[0])
        daan.append(1)
        return "True"
    elif nums in lists:
        print("True","list")
        daan.append(1)
        return "True"
    else:
        print("False")
        daan.append(0)
        return "False"

def makelist():
    print(r.recvuntil("["))
    m = r.recvuntil(']')
    aa = '['+m
    s = eval(aa)
    print s

    return s


# 示例输入
nums = [9, 4, 9, 5]
solution = find_24(nums)
print("Solution:", solution)
#for j in range(30):
"""
r = remote('node1.anna.nssctf.cn',28378)


for i in range(300):
    print(i)
    calc = makelist()
    r.sendline(find_24(calc))
"""
for j in range(100):
    r = remote('node1.anna.nssctf.cn',28378)
    tmp = 0
    for i in range(351):
        print(i)
        calc = makelist()
        r.sendline(find_24(calc))
        get = r.recvuntil('!')
        log.info(get)
        if 'w' == get[-6]:
            print("chuole")
            f = open("list.txt","a")
            l = ','+str(calc)
            f.write(l)
            print(len(lists))
            f.close()
            #exit()
            #r.close()
            tmp = 1
            break
    if tmp == 1:
        continue

    calc = makelist()
    r.sendline(find_24(calc))
    print(daan)
    r.interactive()

list.txt的名单如下:

[[8, 5, 2, 5],[9, 9, 6, 8],[5, 5, 3, 3],[7, 7, 3, 3],[5, 4, 5, 8],[6, 1, 8, 6],[2, 9, 6, 5],[4, 9, 9, 8]
,[8, 1, 6, 6],[6, 6, 8, 8],[7, 4, 7, 4],[1, 2, 7, 7],[6, 8, 6, 8],[4, 5, 9, 9],[8, 8, 6, 6],[9, 9, 8, 6],[3, 8, 8, 3],[9, 8, 6, 7],[8, 6, 9, 9],[4, 7, 7, 4],[5, 7, 5, 4],[8, 4, 5, 8],[4, 5, 4, 4],[6, 6, 8, 1],[9, 1, 3, 8],[5, 5, 5, 5],[5, 1, 5, 5],[3, 5, 3, 5],[9, 4, 5, 9],[5, 4, 9, 9],[3, 9, 3, 3],[3, 9, 7, 7],[9, 1, 9, 3],[9, 8, 7, 6],[6, 5, 6, 6],[3, 1, 7, 9],[4, 6, 9, 7],[5, 2, 9, 6],[1, 8, 6, 6],[7, 4, 7, 7],[7, 7, 7, 4],[4, 5, 7, 5],[1, 9, 3, 9],[4, 9, 8, 9],[9, 4, 7, 9],[3, 9, 1, 9],[6, 6, 5, 6],[5, 1, 4, 6],[5, 5, 3, 9],[6, 9, 5, 2],[5, 4, 4, 4],[4, 9, 9, 7],[3, 6, 3, 6],[5, 4, 5, 7],[5, 9, 9, 4],[6, 6, 6, 5],[8, 5, 4, 8],[4, 4, 7, 7],[7, 2, 1, 7],[5, 9, 9, 5],[6, 1, 1, 8],[1, 9, 3, 8],[8, 8, 3, 3],[3, 6, 1, 4],[5, 5, 5, 1],[1, 1, 8, 6],[6, 2, 5, 9],[4, 7, 4, 7],[7, 7, 5, 6],[2, 1, 7, 7],[7, 5, 7, 6],[5, 8, 2, 5],[1, 4, 6, 3],[9, 5, 6, 2],[2, 5, 9, 6],[4, 5, 6, 1],[9, 6, 5, 2],[9, 5, 9, 5],[3, 6, 4, 1],[9, 5, 9, 5],[8, 5, 5, 2],[9, 3, 7, 7],[4, 8, 9, 9],[1, 8, 6, 1],[7, 7, 1, 2],[5, 6, 4, 1],[4, 5, 1, 6],[9, 1, 7, 3],[6, 1, 6, 8],[5, 8, 8, 5],[7, 2, 7, 1],[3, 7, 3, 7],[4, 6, 7, 9],[3, 7, 7, 3],[7, 5, 5, 4],[8, 5, 5, 8],[3, 3, 7, 7],[1, 6, 4, 5],[4, 8, 5, 8],[7, 4, 4, 7],[9, 9, 5, 4],[1, 3, 9, 7],[7, 5, 6, 7],[4, 8, 9, 9],[3, 3, 3, 9],[7, 9, 4, 9],[5, 6, 2, 9],[7, 4, 9, 6],[6, 4, 1, 5],[3, 4, 6, 1],[4, 8, 5, 8],[1, 5, 5, 5],[7, 7, 3, 9],[3, 6, 4, 1],[8, 5, 4, 5],[4, 9, 7, 9],[3, 9, 7, 1],[9, 8, 9, 6],[5, 9, 5, 9],[2, 6, 5, 9],[9, 1, 3, 9],[9, 8, 9, 4],[3, 8, 9, 1],[5, 7, 7, 6],[5, 7, 4, 5],[8, 6, 1, 1],[7, 4, 9, 6],[7, 9, 7, 3],[8, 5, 8, 4],[5, 8, 5, 8],[4, 9, 6, 7],[3, 6, 6, 3],[7, 6, 8, 9],[3, 6, 4, 1],[5, 9, 4, 9],[8, 9, 7, 6],[7, 9, 4, 9],[3, 3, 6, 6],[5, 6, 6, 6],[9, 3, 7, 7],[7, 1, 2, 7],[3, 3, 5, 5],[3, 3, 8, 8],[9, 4, 7, 6],[1, 8, 1, 6],[4, 5, 1, 6],[5, 5, 2, 8],[9, 5, 9, 5],[5, 5, 9, 9],[9, 8, 6, 9],[8, 6, 8, 6],[4, 3, 1, 6],[7, 2, 7, 1],[9, 4, 9, 7],[3, 3, 9, 3],[9, 1, 3, 9],[1, 5, 4, 6],[1, 7, 2, 7],[8, 8, 4, 5],[9, 6, 9, 8],[8, 6, 9, 7],[3, 3, 3, 9],[5, 6, 1, 4],[4, 4, 4, 5],[9, 3, 7, 1],[3, 6, 6, 3],[5, 6, 7, 7],[4, 4, 4, 5],[3, 5, 5, 9],[3, 9, 5, 5],[6, 7, 8, 9],[6, 7, 9, 4],[2, 7, 1, 7],[1, 8, 9, 3],[6, 8, 9, 7],[9, 7, 6, 4],[8, 3, 8, 3],[7, 3, 1, 9],[6, 6, 3, 3],[1, 3, 9, 8],[9, 9, 4, 7],[5, 4, 8, 8],[1, 9, 3, 7],[7, 9, 3, 1],[7, 7, 4, 7],[6, 8, 6, 1],[5, 5, 7, 4],[1, 1, 6, 8],[5, 7, 6, 7],[6, 8, 9, 9],[7, 7, 4, 4],[6, 9, 9, 8],[1, 6, 8, 1],[7, 3, 7, 3],[5, 8, 4, 8],[9, 3, 5, 5],[6, 4, 7, 9],[9, 6, 7, 4],[1, 3, 4, 6],[4, 6, 3, 1],[7, 9, 6, 4],[5, 5, 1, 5],[7, 6, 5, 7],[9, 6, 4, 7],[5, 5, 8, 8],[5, 3, 5, 9],[8, 4, 5, 5],[7, 4, 5, 5],[4, 1, 3, 6],[9, 3, 9, 1],[4, 7, 9, 9],[7, 6, 4, 9],[2, 8, 5, 5],[8, 9, 9, 6],[8, 6, 6, 1],[5, 8, 4, 5],[1, 7, 7, 2],[7, 9, 4, 6],[3, 5, 5, 3],[9, 3, 1, 7],[9, 3, 1, 9],[7, 7, 2, 1],[5, 9, 5, 3],[9, 3, 1, 9],[7, 6, 9, 8],[8, 4, 8, 5],[9, 5, 5, 9],[3, 8, 3, 8],[7, 6, 7, 5],[6, 2, 9, 5],[9, 8, 4, 9],[6, 4, 1, 3],[4, 9, 9, 5],[6, 7, 4, 9],[3, 1, 6, 4],[7, 9, 9, 4],[9, 7, 8, 6],[5, 9, 6, 2],[8, 3, 3, 8],[1, 5, 6, 4],[7, 3, 3, 7],[8, 3, 1, 9],[8, 9, 3, 1],[4, 4, 5, 4],[8, 6, 6, 8],[3, 7, 9, 1],[9, 9, 5, 5],[7, 9, 9, 4],[4, 5, 8, 8],[8, 3, 3, 8],[5, 5, 8, 4],[4, 9, 7, 6],[3, 8, 3, 8],[4, 7, 5, 5],[6, 9, 4, 7],[6, 1, 8, 1],[9, 5, 9, 4],[9, 4, 6, 7],[1, 6, 6, 8],[6, 3, 4, 1],[1, 6, 8, 6],[2, 6, 9, 5],[6, 6, 1, 8],[8, 6, 7, 9],[7, 5, 4, 5],[5, 1, 6, 4],[5, 2, 5, 8],[4, 8, 5, 5],[7, 9, 6, 8],[9, 5, 5, 3]
,[6, 3, 3, 6],[3, 7, 7, 9],[4, 7, 7, 7],[8, 5, 8, 5],[3, 8, 1, 9],[2, 9, 5, 6],[5, 8, 5, 2],[5, 4, 6, 1],[9, 9, 7, 4],[5, 3, 9, 5],[3, 1, 9, 9],[7, 3, 7, 9],[6, 9, 2, 5],[3, 1, 4, 6],[9, 4, 9, 5],[6, 8, 1, 1],[7, 6, 9, 4],[7, 3, 9, 7],[4, 8, 8, 5],[8, 8, 5, 4],[7, 4, 6, 9],[1, 6, 1, 8],[1, 4, 3, 6],[7, 4, 6, 9],[9, 3, 1, 8],[4, 7, 9, 6],[5, 3, 9, 5],[1, 6, 1, 8],[9, 9, 7, 4],[6, 5, 1, 4],[9, 3, 3, 3],[4, 1, 6, 5],[6, 8, 1, 6],[9, 3, 3, 3],[2, 5, 6, 9],[8, 2, 5, 5],[3, 1, 9, 7],[5, 2, 8, 5],[9, 2, 6, 5],[8, 1, 9, 3],[7, 7, 6, 5],[8, 4, 9, 9],[9, 2, 5, 6],[6, 4, 9, 7],[8, 8, 5, 5],[4, 5, 8, 5],[5, 3, 5, 3],[9, 3, 8, 1],[8, 1, 6, 1],[6, 8, 8, 6],[6, 7, 7, 5],[2, 5, 5, 8],[6, 3, 6, 3],[7, 4, 9, 9],[1, 6, 5, 4],[8, 3, 9, 1],[9, 7, 4, 6],[7, 9, 1, 3],[6, 1, 3, 4],[1, 9, 9, 3],[6, 7, 5, 7],[1, 9, 9, 3],[6, 7, 5, 7],[7, 1, 7, 2],[6, 3, 1, 4],[4, 9, 5, 9],[8, 9, 6, 9],[6, 1, 3, 4],[6, 9, 8, 7],[9, 4, 8, 9],[3, 1, 8, 9],[3, 5, 9, 5],[8, 9, 6, 7],[2, 7, 7, 1],[8, 9, 4, 9],[9, 4, 9, 8],[9, 4, 9, 8],[6, 1, 4, 3],[9, 4, 9, 8],[9, 7, 3, 1],[5, 9, 2, 6],[1, 6, 3, 4],[2, 7, 7, 1],[4, 5, 5, 8],[6, 8, 7, 9],[9, 8, 3, 1],[9, 6, 2, 5],[5, 4, 8, 5],[5, 4, 1, 6],[9, 5, 3, 5],[1, 7, 9, 3],[9, 5, 3, 5],[5, 8, 5, 4],[4, 5, 5, 8],[4, 5, 5, 8],[1, 4, 6, 5],[2, 5, 8, 5],[4, 7, 6, 9],[5, 9, 2, 6],[4, 6, 5, 1],[9, 7, 6, 8],[9, 4, 9, 8],[8, 7, 9, 6],[2, 7, 7, 1],[9, 1, 8, 3],[8, 5, 5, 4],[5, 5, 9, 3]

根据所有true和false的规律,得到疑似二进制如下:

[1, 0, 1, 0, 0, 1, 1, 1, 0, 0, 1, 0, 1, 0, 0, 1, 1, 0, 1, 0, 1, 0, 0, 1, 1, 0, 1, 0, 0, 0, 0, 1, 1, 0, 1, 0, 1, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 1, 0, 0, 1, 1, 1, 0, 0, 1, 0, 0, 1, 1, 1, 0, 0, 1, 0, 1, 0, 0, 1, 1, 0, 1, 0, 1, 0, 0, 1, 1, 0, 1, 0, 0, 0, 0, 1, 1, 0, 1, 0, 1, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 1, 0, 0, 1, 1, 1, 1, 0, 1, 1, 0, 0, 1, 1, 0, 1, 0, 0, 0, 0, 1, 1, 0, 1, 1, 0, 0, 0, 1, 1, 1, 0, 0, 0, 0, 0, 1, 1, 0, 0, 0, 0, 0, 0, 1, 1, 0, 1, 1, 1, 0, 0, 1, 1, 1, 0, 0, 1, 0, 0, 1, 1, 0, 0, 0, 1, 0, 0, 1, 1, 0, 1, 0, 0, 0, 0, 1, 0, 1, 1, 0, 1, 0, 1, 1, 0, 0, 0, 1, 0, 0, 1, 1, 0, 0, 1, 1, 0, 0, 1, 1, 0, 0, 0, 1, 0, 0, 1, 1, 0, 0, 1, 1, 0, 0, 0, 1, 0, 1, 1, 0, 1, 0, 0, 1, 1, 0, 1, 0, 0, 0, 0, 1, 1, 0, 1, 1, 0, 0, 0, 1, 1, 0, 1, 0, 1, 0, 1, 1, 0, 0, 1, 0, 0, 0, 0, 1, 0, 1, 1, 0, 1, 0, 1, 1, 0, 0, 0, 0, 1, 0, 0, 1, 1, 0, 0, 1, 1, 0, 0, 1, 1, 0, 0, 0, 1, 0, 0, 1, 1, 1, 0, 0, 1, 0, 0, 1, 0, 1, 1, 0, 1, 0, 1, 1, 0, 0, 1, 0, 0, 0, 1, 1, 0, 0, 1, 0, 1, 0, 1, 1, 0, 0, 1, 0, 1, 0, 1, 1, 0, 0, 1, 0, 0, 0, 1, 1, 0, 0, 0, 1, 1, 0, 0, 1, 1, 0, 1, 1, 0, 0, 0, 1, 1, 0, 1, 0, 0, 0, 0, 1, 1, 0, 1, 1, 1, 0, 0, 1, 1, 1, 0, 0, 0, 0, 0, 1, 1, 0, 0, 1, 0, 0, 1, 1, 0, 0, 0, 1, 0, 0, 1, 1, 0, 0, 0, 0, 1, 0, 1, 1, 1, 1, 1, 0, 1]

直接hex()得:

0x29ca6a686a88ce4e53534354467b34363830373931342d626662662d343635642d613331392d6465656463363437383262617d

转十进制字符得:

NSSCTF{46807914-bfbf-465d-a319-deedc64782ba}