IceCTF2018-Lost-in-the-forest

Question

fz.zip

Solution

發現左個奇怪既file /home/hkr/.bash_history

git
exit
cd root
pwd
ls
ls -la
exit
cat /etc/hostname
exit
cat /etc/hostname
exit
cat /eyc/hostname
cat /etc/hostname
echo Centos >> /etc/hostname
bash
echo Centos > /etc/hostname
bash
exit
cd ~/.i3
cd ~
ls
pwd
cd ..
ls
cd .i3
pwd
ls -a
cd ~/.i3
cd
ls
ls -a
pwd
cd ..
ls
ls -a
cd ..
ls
ls -a
cd etc
ls
ls -a
cd i3
ls
cd
ls
ls -a
mkdir .i3
ls
ls -a
ls
ls -a
cd Documents/
ls
mv config ~/.i3
ls
cd ..
ls
ls -a
cd .i3
ls
cd
cd documents
cd Documents/
ls
cd
ls
cd .i3
ls
sudo subl config
cd
ls
cd Pictures/
ls
pwd
cd ..
ls
ls 0a
ls -a
cd bin
ls
cd
ls
cd
ls
ls -a
cd .bashrc
sudo subl .bashrc
sudo subl .bash_aliases
ls
brightness
ls
sudo echo 200 > brightness
sudo su
cd
cd Downloads
wget https://gist.githubusercontent.com/Glitch-is/bc49ee73e5413f3081e5bcf5c1537e78/raw/c1f735f7eb36a20cb46b9841916d73017b5e46a3/eRkjLlksZp
cd
ls
sudo subl .bash_aliases
backlight
brightrness
brightness
ls
cd
command-list
alias-list
alias-list
alias-list
sudo subl .bashrc
sudo subl .bash_aliases
i3-config
alias-list
brightness
i3-config
alias-list
sudo subl .bashrc
alias-list
sudo subl .bashrc
alias-list
bash_aliases
. ~/.bash_aliases
sudo subl .bash_welcome
sudo subl .bash_todo
alias-list
todo
to-do
edit-todo
to-do
cd
alias-list
edit-todo
cd Downloads
ls -a
mv eRkjLlksZp tool.py
cat .bash_aliases
sudo subl .bash_aliases
alias-list
cat .bash_aliases
ls -a
sudo apt-get install libc6:i386 libncurses5:i386 libstdc++6:i386 lib32z1 libbz2-1.0:i386
javac -version
sudo apt update
apt list --upgradable
javac -version
sudo apt install oracle-java8-installer
javac -version
sudo apt install oracle-java8-set-default
ls
cd bin
ls
./studio.sh
ls
cd android
cd Android/
ls
cd ..
ls
cd ..
cd
./studio.sh
cd ..
ls
cd ..
ls
cd /mnt
ls
cd
cd Downloads
./tool.py ../secret > ../hzpxbsklqvboyou
ls -a
cd ..
ls
cd usr/
ls
cd bin
ls
ls ..
ls
cd ..
ls
cd locals
cd local
ls
cd android-studio/
ls
cd
shred secret
ls
ls -a
sudo subl .bash_aliases
android-studio
ls
ls Documents/
ls
cd Documents/
ls
cd ..
cd Downloads/
rm tool.py
ls
ls
cd
ls
git
sudo apt install git
git config --global user.name "skuli"
git config --global user.email "sheep.man@fake.com"
ls -a
cat .gitconfig
cd Documents/
ls
mkdir projects
ls
cd projects
pwd
cd ..
cd Downloads/
cd java/
ls
cd jre1.8.0_171/
ls
cd bin/
ls
cd ..
cd jre1.8.0_171/
ls
cat README
cd ..
ls
cd ..
ls
cd local/
ls
cd bin/
ls
ls
cd 3840x2160/
ls
cd ..
cd .
cd ..
ls -al
cd .local/
ls
cd share/
ls
ls
cd Write/
ls
sudo chmod +x INSTALL
ls
sudo ./INSTALL
sudo chmod -x INSTALL
cat INSTALL
ls
./Write
ls
cd ..
ls
sudo rm write209.tar.gz
sudo rm -R Write/
ls
cd ..
ls
ls
ls -al
grep / "howdy" 2> /dev/null
cd ..
grep -r "howdy" 2> /dev/null
ls /lib/security/
cd /lib/security/
ls
ls -al
tree
cd howdy/
ls
./cli
./cli.py
ls
exit

有個奇怪既 tools link

https://gist.githubusercontent.com/Glitch-is/bc49ee73e5413f3081e5bcf5c1537e78/raw/c1f735f7eb36a20cb46b9841916d73017b5e46a3/eRkjLlksZp

#!/usr/bin/python3
import sys
import base64

def encode(filename):
    with open(filename, "r") as f:
        s = f.readline().strip()
        return base64.b64encode((''.join([chr(ord(s[x])+([5,-1,3,-3,2,15,-6,3,9,1,-3,-5,3,-15] * 3)[x]) for x in range(len(s))])).encode('utf-8')).decode('utf-8')[::-1]*5

if __name__ == "__main__":
    print(encode(sys.argv[1]))

同場加映一個奇怪既file /home/hkr/hzpxbsklqvboyou

8NHY25mYthGfs5ndwx2Zk1lcaFGc4pWdVZFQoJmT8NHY25mYthGfs5ndwx2Zk1lcaFGc4pWdVZFQoJmT8NHY25mYthGfs5ndwx2Zk1lcaFGc4pWdVZFQoJmT8NHY25mYthGfs5ndwx2Zk1lcaFGc4pWdVZFQoJmT8NHY25mYthGfs5ndwx2Zk1lcaFGc4pWdVZFQoJmT

似是而非既 base64..

好似係用條script encode出黎架喎 , 咁調番轉黎寫囉…

def decode():
	enc = base64.b64decode("8NHY25mYthGfs5ndwx2Zk1lcaFGc4pWdVZFQoJmT"[::-1])
	mDict = ([5,-1,3,-3,2,15,-6,3,9,1,-3,-5,3,-15] * 3)
	plain = ""
	for x in range(len(enc)):
		plain += chr(ord(enc[x]) - mDict[x])
	print plain
decode()