1

进注册界面，第一次以为抓包选把isadmin ture了就好

第二次尝试，勾选is admin，有需要invitecode（经典）

2

 p = r**5 + r**4 - r**3 + r**2 - r + 2023
q = r**5 - r**4 + r**3 - r**2 + r + 2023

n = 25066797992811602609904442429968244207814135173233823574561146780193277243588729282392464721760638040595480284865294238118778099149754637586361909432730412493061503054820202744474632665791457r = Real('r')
s = Solver()
s.add(r**10 - r**8 + 2*r**7 - 3*r**6 + 4050*r**5 - 3*r**4 + 2*r**3 - r**2 + 4092529==n)
print(s.check())
print(s.model())
[r = -10962507061290870331]

from Crypto.Util.number import *
# from secret import flag
from sympy import nextprimeflag=b''r = 10962507061290870331
p = r**5 + r**4 - r**3 + r**2 - r + 2023
q = r**5 - r**4 + r**3 - r**2 + r + 2023
p =nextprime(p)
q =nextprime(q)
n = p*q
d = inverse_mod(65537,(p-1)*(q-1))c = 18808483076270941157829928736000549389727451019027515249724024369421942132354537978233676261769285858813983730966871222263698559152437016666829640339912308636169767041243411900882395764607422
def enc(c, n):return ZZ(pow(c, d, n))
print(long_to_bytes(enc(c, n)))

3末心的礼物

binwalk，pyc反编译

exe执行文件分离出pyc反编译

4

c=b'<pH\x86\x1a&"m\xce\x12\x00pm\x97U1uA\xcf\x0c:NP\xcf\x18~l'
key=""
for i in range(5):if i==0:key+=chr(c[i]^ord('c'))if i==1:key+=chr(c[i]^ord('a'))if i==2:key+=chr(c[i]^ord('z'))if i==3:key+=chr(c[i]^ord('y'))if i==4:key+=chr(c[i]^ord('{'))
flag = ""
for i in range(len(c)):if i % 5 == 0:flag += chr(c[i] ^ ord(key[0]))if i % 5 == 1:flag += chr(c[i] ^ ord(key[1]))if i % 5 == 2:flag += chr(c[i] ^ ord(key[2]))if i % 5 == 3:flag += chr(c[i] ^ ord(key[3]))if i % 5 == 4:flag += chr(c[i] ^ ord(key[4]))
print(flag)

5

    res = "GCGCGCTAGCAGGCGTGTCTATGTATACATGGATAAATAAATCAGCAGATGGGCGGATGCGCGGATGCATGGGCGAGCAGATAAATAGGCATATAAATGAATCGATAGATGAGCATATGAATGTATGCGCAGGCGGATAAATCAATGTGTTG"box = "AGCT"for i in range(0, len(res), 4):a1 = (int(box.index(res[i])))a2 = (int(box.index(res[i + 1])))a3 = (int(box.index(res[i + 2])))a4 = (int(box.index(res[i + 3])))c = ((a1 << 6) + (a2 << 4) + (a3 << 2) + a4)print(chr(c), end='')#flag{725008a5e6e65da01c04914c476ae087}