satoooon satoooon8888

## drm.md

      
              4 files
            
          
              0 forks
            
          
              0 comments
            
          
              0 stars
            
          
                satoooon8888
                / drm.md
            
            
              Last active
              June 4, 2023 11:02
            
              
                SECCON Beginners CTF 2023
              
          
    bundleされたhls.jsを見てgetDecryptDataにbreakpointを張る
https://github.com/video-dev/hls.js/blob/f97f561d6cc2ee07d39060897154b70ea38028bd/src/loader/level-key.ts#L112
一回目はパスして、二回目のthis.keyを見るとAESのkeyがわかる

あとはffmpegでmp4を復元する

  
## stats.py
import matplotlib.pyplot as plt

import json
import re
from datetime import datetime


events = json.load(open("./events.json"))

events = sorted(events, key=lambda event:datetime.fromisoformat(event["start"]))

## converter.py
# 記号のみでbashを動かす問題
# 参考:
# https://www.ryotosaito.com/blog/?p=178
# https://www.ryotosaito.com/blog/?p=194

command = input()

payload = R"""
__=$(($$/$$));
___=$(($__+$__));

## patch_libc.sh
#!/bin/bash -ex

LIBC=$(ls * | grep -P '^(libc\.so\.6|libc-.*\.so)$')

LIBC_DBG_DEB="$(~/package/libc-database/identify $LIBC | sed s/libc6_/libc6-dbg_/g).deb"
if [[ ! -e $LIBC_DBG_DEB ]]; then
	wget http://archive.ubuntu.com/ubuntu/pool/main/g/glibc/$LIBC_DBG_DEB
fi
DEBUGID=$(file $LIBC | grep -Po '(?<=BuildID\[sha1\]=)[0-9a-f]{40}')

## solve.py
from pwn import *
import sys
import re

context.terminal = "wterminal"
context.arch = "amd64"

def get_io():
	if len(sys.argv) > 1 and sys.argv[1] == "debug":
		io = gdb.debug(file, command)

## microbit_reciever.py
from microbit import *
import radio


def main():
	max_length = 251
	channel = 64
	radio.config(length=max_length, channel=channel)

	display.show(Image.HAPPY)

## KPC_Python_CheatSheet.html
<head>
<script src="https://cdn.jsdelivr.net/gh/google/code-prettify@master/loader/run_prettify.js"></script>
<style>
pre {
	margin: 3px;
	padding: 2px;
	background-color: #DDDDDD;
}
</style>
</head>
	import matplotlib.pyplot as plt

	import json
	import re
	from datetime import datetime


	events = json.load(open("./events.json"))

	events = sorted(events, key=lambda event:datetime.fromisoformat(event["start"]))
	# 記号のみでbashを動かす問題
	# 参考:
	# https://www.ryotosaito.com/blog/?p=178
	# https://www.ryotosaito.com/blog/?p=194

	command = input()

	payload = R"""
	__=$(($$/$$));
	___=$(($__+$__));
	#!/bin/bash -ex

	LIBC=$(ls * \| grep -P '^(libc\.so\.6\|libc-.*\.so)$')

	LIBC_DBG_DEB="$(~/package/libc-database/identify $LIBC \| sed s/libc6_/libc6-dbg_/g).deb"
	if [[ ! -e $LIBC_DBG_DEB ]]; then
	wget http://archive.ubuntu.com/ubuntu/pool/main/g/glibc/$LIBC_DBG_DEB
	fi
	DEBUGID=$(file $LIBC \| grep -Po '(?<=BuildID\[sha1\]=)[0-9a-f]{40}')
	from pwn import *
	import sys
	import re

	context.terminal = "wterminal"
	context.arch = "amd64"

	def get_io():
	if len(sys.argv) > 1 and sys.argv[1] == "debug":
	io = gdb.debug(file, command)
	from microbit import *
	import radio


	def main():
	max_length = 251
	channel = 64
	radio.config(length=max_length, channel=channel)

	display.show(Image.HAPPY)
	<head>
	<script src="https://cdn.jsdelivr.net/gh/google/code-prettify@master/loader/run_prettify.js"></script>
	<style>
	pre {
	margin: 3px;
	padding: 2px;
	background-color: #DDDDDD;
	}
	</style>
	</head>