0x00 画师
给了一个xml 在文件里看到了host=”app.diagrams.net”
访问该网站导入题目的xml文件,把画布缩小,全选替换颜色,看到了抽象的字符画:

结合该网站名称猜测得到flag为flag{easy_diagram}
0x01 easy_math
eds师傅做的。简单来说就是满足条件的返回true,有些可以算出来24的但是判断为false的单独进列表,其他的返回false。
# coding=utf-8 from pwn import * context.arch = 'i386' f = open("list.txt","r") s = f.read() lists = eval(s+']') f.close() daan = [] def judge_point(num1, num2, op): if op == "+": return num1 + num2 elif op == "-": return num1 - num2 elif op == "*": return num1 * num2 elif op == "/": # 避免除零错误 if num2 == 0: return None return num1 / num2 def evaluate(expression): stack = [] for token in expression: if token.isdigit(): stack.append(float(token)) else: num2 = stack.pop() num1 = stack.pop() result = judge_point(num1, num2, token) if result is None: return None stack.append(result) return stack[0] def backtrack(nums): if len(nums) == 1: if abs(eval(nums[0]) - 24) == 0: # 如果结果接近24,则返回解 return [nums] else: return [] res = [] for i in range(len(nums)): for j in range(len(nums)): if i != j: new_nums = [nums[k] for k in range(len(nums)) if k != i and k != j] for op in ["+", "-", "*", "/"]: if (op == "+" or op == "*") and i > j: # 避免重复计算 continue if op == "/": # 避免除零错误 continue new_nums.append("(" + str(nums[i]) + op + str(nums[j]) + ")") sub_res = backtrack(new_nums) if sub_res: res.extend(sub_res) new_nums.pop() return res def find_24(nums): expressions = backtrack(nums) if expressions: #return expressions[0] # 返回其中一个满足条件的表达式 print("True",expressions[0]) daan.append(1) return "True" elif nums in lists: print("True","list") daan.append(1) return "True" else: print("False") daan.append(0) return "False" def makelist(): print(r.recvuntil("[")) m = r.recvuntil(']') aa = '['+m s = eval(aa) print s return s # 示例输入 nums = [9, 4, 9, 5] solution = find_24(nums) print("Solution:", solution) #for j in range(30): """ r = remote('node1.anna.nssctf.cn',28378) for i in range(300): print(i) calc = makelist() r.sendline(find_24(calc)) """ for j in range(100): r = remote('node1.anna.nssctf.cn',28378) tmp = 0 for i in range(351): print(i) calc = makelist() r.sendline(find_24(calc)) get = r.recvuntil('!') log.info(get) if 'w' == get[-6]: print("chuole") f = open("list.txt","a") l = ','+str(calc) f.write(l) print(len(lists)) f.close() #exit() #r.close() tmp = 1 break if tmp == 1: continue calc = makelist() r.sendline(find_24(calc)) print(daan) r.interactive()
list.txt的名单如下:
[[8, 5, 2, 5],[9, 9, 6, 8],[5, 5, 3, 3],[7, 7, 3, 3],[5, 4, 5, 8],[6, 1, 8, 6],[2, 9, 6, 5],[4, 9, 9, 8]
,[8, 1, 6, 6],[6, 6, 8, 8],[7, 4, 7, 4],[1, 2, 7, 7],[6, 8, 6, 8],[4, 5, 9, 9],[8, 8, 6, 6],[9, 9, 8, 6],[3, 8, 8, 3],[9, 8, 6, 7],[8, 6, 9, 9],[4, 7, 7, 4],[5, 7, 5, 4],[8, 4, 5, 8],[4, 5, 4, 4],[6, 6, 8, 1],[9, 1, 3, 8],[5, 5, 5, 5],[5, 1, 5, 5],[3, 5, 3, 5],[9, 4, 5, 9],[5, 4, 9, 9],[3, 9, 3, 3],[3, 9, 7, 7],[9, 1, 9, 3],[9, 8, 7, 6],[6, 5, 6, 6],[3, 1, 7, 9],[4, 6, 9, 7],[5, 2, 9, 6],[1, 8, 6, 6],[7, 4, 7, 7],[7, 7, 7, 4],[4, 5, 7, 5],[1, 9, 3, 9],[4, 9, 8, 9],[9, 4, 7, 9],[3, 9, 1, 9],[6, 6, 5, 6],[5, 1, 4, 6],[5, 5, 3, 9],[6, 9, 5, 2],[5, 4, 4, 4],[4, 9, 9, 7],[3, 6, 3, 6],[5, 4, 5, 7],[5, 9, 9, 4],[6, 6, 6, 5],[8, 5, 4, 8],[4, 4, 7, 7],[7, 2, 1, 7],[5, 9, 9, 5],[6, 1, 1, 8],[1, 9, 3, 8],[8, 8, 3, 3],[3, 6, 1, 4],[5, 5, 5, 1],[1, 1, 8, 6],[6, 2, 5, 9],[4, 7, 4, 7],[7, 7, 5, 6],[2, 1, 7, 7],[7, 5, 7, 6],[5, 8, 2, 5],[1, 4, 6, 3],[9, 5, 6, 2],[2, 5, 9, 6],[4, 5, 6, 1],[9, 6, 5, 2],[9, 5, 9, 5],[3, 6, 4, 1],[9, 5, 9, 5],[8, 5, 5, 2],[9, 3, 7, 7],[4, 8, 9, 9],[1, 8, 6, 1],[7, 7, 1, 2],[5, 6, 4, 1],[4, 5, 1, 6],[9, 1, 7, 3],[6, 1, 6, 8],[5, 8, 8, 5],[7, 2, 7, 1],[3, 7, 3, 7],[4, 6, 7, 9],[3, 7, 7, 3],[7, 5, 5, 4],[8, 5, 5, 8],[3, 3, 7, 7],[1, 6, 4, 5],[4, 8, 5, 8],[7, 4, 4, 7],[9, 9, 5, 4],[1, 3, 9, 7],[7, 5, 6, 7],[4, 8, 9, 9],[3, 3, 3, 9],[7, 9, 4, 9],[5, 6, 2, 9],[7, 4, 9, 6],[6, 4, 1, 5],[3, 4, 6, 1],[4, 8, 5, 8],[1, 5, 5, 5],[7, 7, 3, 9],[3, 6, 4, 1],[8, 5, 4, 5],[4, 9, 7, 9],[3, 9, 7, 1],[9, 8, 9, 6],[5, 9, 5, 9],[2, 6, 5, 9],[9, 1, 3, 9],[9, 8, 9, 4],[3, 8, 9, 1],[5, 7, 7, 6],[5, 7, 4, 5],[8, 6, 1, 1],[7, 4, 9, 6],[7, 9, 7, 3],[8, 5, 8, 4],[5, 8, 5, 8],[4, 9, 6, 7],[3, 6, 6, 3],[7, 6, 8, 9],[3, 6, 4, 1],[5, 9, 4, 9],[8, 9, 7, 6],[7, 9, 4, 9],[3, 3, 6, 6],[5, 6, 6, 6],[9, 3, 7, 7],[7, 1, 2, 7],[3, 3, 5, 5],[3, 3, 8, 8],[9, 4, 7, 6],[1, 8, 1, 6],[4, 5, 1, 6],[5, 5, 2, 8],[9, 5, 9, 5],[5, 5, 9, 9],[9, 8, 6, 9],[8, 6, 8, 6],[4, 3, 1, 6],[7, 2, 7, 1],[9, 4, 9, 7],[3, 3, 9, 3],[9, 1, 3, 9],[1, 5, 4, 6],[1, 7, 2, 7],[8, 8, 4, 5],[9, 6, 9, 8],[8, 6, 9, 7],[3, 3, 3, 9],[5, 6, 1, 4],[4, 4, 4, 5],[9, 3, 7, 1],[3, 6, 6, 3],[5, 6, 7, 7],[4, 4, 4, 5],[3, 5, 5, 9],[3, 9, 5, 5],[6, 7, 8, 9],[6, 7, 9, 4],[2, 7, 1, 7],[1, 8, 9, 3],[6, 8, 9, 7],[9, 7, 6, 4],[8, 3, 8, 3],[7, 3, 1, 9],[6, 6, 3, 3],[1, 3, 9, 8],[9, 9, 4, 7],[5, 4, 8, 8],[1, 9, 3, 7],[7, 9, 3, 1],[7, 7, 4, 7],[6, 8, 6, 1],[5, 5, 7, 4],[1, 1, 6, 8],[5, 7, 6, 7],[6, 8, 9, 9],[7, 7, 4, 4],[6, 9, 9, 8],[1, 6, 8, 1],[7, 3, 7, 3],[5, 8, 4, 8],[9, 3, 5, 5],[6, 4, 7, 9],[9, 6, 7, 4],[1, 3, 4, 6],[4, 6, 3, 1],[7, 9, 6, 4],[5, 5, 1, 5],[7, 6, 5, 7],[9, 6, 4, 7],[5, 5, 8, 8],[5, 3, 5, 9],[8, 4, 5, 5],[7, 4, 5, 5],[4, 1, 3, 6],[9, 3, 9, 1],[4, 7, 9, 9],[7, 6, 4, 9],[2, 8, 5, 5],[8, 9, 9, 6],[8, 6, 6, 1],[5, 8, 4, 5],[1, 7, 7, 2],[7, 9, 4, 6],[3, 5, 5, 3],[9, 3, 1, 7],[9, 3, 1, 9],[7, 7, 2, 1],[5, 9, 5, 3],[9, 3, 1, 9],[7, 6, 9, 8],[8, 4, 8, 5],[9, 5, 5, 9],[3, 8, 3, 8],[7, 6, 7, 5],[6, 2, 9, 5],[9, 8, 4, 9],[6, 4, 1, 3],[4, 9, 9, 5],[6, 7, 4, 9],[3, 1, 6, 4],[7, 9, 9, 4],[9, 7, 8, 6],[5, 9, 6, 2],[8, 3, 3, 8],[1, 5, 6, 4],[7, 3, 3, 7],[8, 3, 1, 9],[8, 9, 3, 1],[4, 4, 5, 4],[8, 6, 6, 8],[3, 7, 9, 1],[9, 9, 5, 5],[7, 9, 9, 4],[4, 5, 8, 8],[8, 3, 3, 8],[5, 5, 8, 4],[4, 9, 7, 6],[3, 8, 3, 8],[4, 7, 5, 5],[6, 9, 4, 7],[6, 1, 8, 1],[9, 5, 9, 4],[9, 4, 6, 7],[1, 6, 6, 8],[6, 3, 4, 1],[1, 6, 8, 6],[2, 6, 9, 5],[6, 6, 1, 8],[8, 6, 7, 9],[7, 5, 4, 5],[5, 1, 6, 4],[5, 2, 5, 8],[4, 8, 5, 5],[7, 9, 6, 8],[9, 5, 5, 3]
,[6, 3, 3, 6],[3, 7, 7, 9],[4, 7, 7, 7],[8, 5, 8, 5],[3, 8, 1, 9],[2, 9, 5, 6],[5, 8, 5, 2],[5, 4, 6, 1],[9, 9, 7, 4],[5, 3, 9, 5],[3, 1, 9, 9],[7, 3, 7, 9],[6, 9, 2, 5],[3, 1, 4, 6],[9, 4, 9, 5],[6, 8, 1, 1],[7, 6, 9, 4],[7, 3, 9, 7],[4, 8, 8, 5],[8, 8, 5, 4],[7, 4, 6, 9],[1, 6, 1, 8],[1, 4, 3, 6],[7, 4, 6, 9],[9, 3, 1, 8],[4, 7, 9, 6],[5, 3, 9, 5],[1, 6, 1, 8],[9, 9, 7, 4],[6, 5, 1, 4],[9, 3, 3, 3],[4, 1, 6, 5],[6, 8, 1, 6],[9, 3, 3, 3],[2, 5, 6, 9],[8, 2, 5, 5],[3, 1, 9, 7],[5, 2, 8, 5],[9, 2, 6, 5],[8, 1, 9, 3],[7, 7, 6, 5],[8, 4, 9, 9],[9, 2, 5, 6],[6, 4, 9, 7],[8, 8, 5, 5],[4, 5, 8, 5],[5, 3, 5, 3],[9, 3, 8, 1],[8, 1, 6, 1],[6, 8, 8, 6],[6, 7, 7, 5],[2, 5, 5, 8],[6, 3, 6, 3],[7, 4, 9, 9],[1, 6, 5, 4],[8, 3, 9, 1],[9, 7, 4, 6],[7, 9, 1, 3],[6, 1, 3, 4],[1, 9, 9, 3],[6, 7, 5, 7],[1, 9, 9, 3],[6, 7, 5, 7],[7, 1, 7, 2],[6, 3, 1, 4],[4, 9, 5, 9],[8, 9, 6, 9],[6, 1, 3, 4],[6, 9, 8, 7],[9, 4, 8, 9],[3, 1, 8, 9],[3, 5, 9, 5],[8, 9, 6, 7],[2, 7, 7, 1],[8, 9, 4, 9],[9, 4, 9, 8],[9, 4, 9, 8],[6, 1, 4, 3],[9, 4, 9, 8],[9, 7, 3, 1],[5, 9, 2, 6],[1, 6, 3, 4],[2, 7, 7, 1],[4, 5, 5, 8],[6, 8, 7, 9],[9, 8, 3, 1],[9, 6, 2, 5],[5, 4, 8, 5],[5, 4, 1, 6],[9, 5, 3, 5],[1, 7, 9, 3],[9, 5, 3, 5],[5, 8, 5, 4],[4, 5, 5, 8],[4, 5, 5, 8],[1, 4, 6, 5],[2, 5, 8, 5],[4, 7, 6, 9],[5, 9, 2, 6],[4, 6, 5, 1],[9, 7, 6, 8],[9, 4, 9, 8],[8, 7, 9, 6],[2, 7, 7, 1],[9, 1, 8, 3],[8, 5, 5, 4],[5, 5, 9, 3]
根据所有true和false的规律,得到疑似二进制如下:
[1, 0, 1, 0, 0, 1, 1, 1, 0, 0, 1, 0, 1, 0, 0, 1, 1, 0, 1, 0, 1, 0, 0, 1, 1, 0, 1, 0, 0, 0, 0, 1, 1, 0, 1, 0, 1, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 1, 0, 0, 1, 1, 1, 0, 0, 1, 0, 0, 1, 1, 1, 0, 0, 1, 0, 1, 0, 0, 1, 1, 0, 1, 0, 1, 0, 0, 1, 1, 0, 1, 0, 0, 0, 0, 1, 1, 0, 1, 0, 1, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 1, 0, 0, 1, 1, 1, 1, 0, 1, 1, 0, 0, 1, 1, 0, 1, 0, 0, 0, 0, 1, 1, 0, 1, 1, 0, 0, 0, 1, 1, 1, 0, 0, 0, 0, 0, 1, 1, 0, 0, 0, 0, 0, 0, 1, 1, 0, 1, 1, 1, 0, 0, 1, 1, 1, 0, 0, 1, 0, 0, 1, 1, 0, 0, 0, 1, 0, 0, 1, 1, 0, 1, 0, 0, 0, 0, 1, 0, 1, 1, 0, 1, 0, 1, 1, 0, 0, 0, 1, 0, 0, 1, 1, 0, 0, 1, 1, 0, 0, 1, 1, 0, 0, 0, 1, 0, 0, 1, 1, 0, 0, 1, 1, 0, 0, 0, 1, 0, 1, 1, 0, 1, 0, 0, 1, 1, 0, 1, 0, 0, 0, 0, 1, 1, 0, 1, 1, 0, 0, 0, 1, 1, 0, 1, 0, 1, 0, 1, 1, 0, 0, 1, 0, 0, 0, 0, 1, 0, 1, 1, 0, 1, 0, 1, 1, 0, 0, 0, 0, 1, 0, 0, 1, 1, 0, 0, 1, 1, 0, 0, 1, 1, 0, 0, 0, 1, 0, 0, 1, 1, 1, 0, 0, 1, 0, 0, 1, 0, 1, 1, 0, 1, 0, 1, 1, 0, 0, 1, 0, 0, 0, 1, 1, 0, 0, 1, 0, 1, 0, 1, 1, 0, 0, 1, 0, 1, 0, 1, 1, 0, 0, 1, 0, 0, 0, 1, 1, 0, 0, 0, 1, 1, 0, 0, 1, 1, 0, 1, 1, 0, 0, 0, 1, 1, 0, 1, 0, 0, 0, 0, 1, 1, 0, 1, 1, 1, 0, 0, 1, 1, 1, 0, 0, 0, 0, 0, 1, 1, 0, 0, 1, 0, 0, 1, 1, 0, 0, 0, 1, 0, 0, 1, 1, 0, 0, 0, 0, 1, 0, 1, 1, 1, 1, 1, 0, 1]
直接hex()得:
0x29ca6a686a88ce4e53534354467b34363830373931342d626662662d343635642d613331392d6465656463363437383262617d
转十进制字符得:
NSSCTF{46807914-bfbf-465d-a319-deedc64782ba}