{"id":107,"date":"2025-06-13T10:03:49","date_gmt":"2025-06-13T02:03:49","guid":{"rendered":"http:\/\/blog.which778.cn\/?p=107"},"modified":"2025-08-11T17:15:11","modified_gmt":"2025-08-11T09:15:11","slug":"%e7%b1%b3%e5%a5%bd%e4%bf%a1%e5%ae%89%e6%9d%afctf%e7%ba%bf%e4%b8%8a%e6%8c%91%e6%88%98%e8%b5%9b%e3%80%90writeup%e3%80%91","status":"publish","type":"post","link":"http:\/\/blog.which778.cn\/?p=107","title":{"rendered":"\u7c73\u597d\u4fe1\u5b89\u676fCTF\u7ebf\u4e0a\u6311\u6218\u8d5b\u3010WriteUp\u3011"},"content":{"rendered":"<h2>\u7b7e\u5230<\/h2>\n<p>\u5357\u4eac\u7d2b\u91d1\u5c71<\/p>\n<p><img decoding=\"async\" src=\"\/\/images.weserv.nl\/?url=https:\/\/gitee.com\/which777\/images\/raw\/master\/images\/image-20250523155046901.png\" alt=\"\" \/><\/p>\n<pre><code>flag{118.85,32.07}<\/code><\/pre>\n<h2>Crypto-1<\/h2>\n<p><img decoding=\"async\" src=\"\/\/images.weserv.nl\/?url=https:\/\/gitee.com\/which777\/images\/raw\/master\/images\/image-20250523155111866.png\" alt=\"\" \/><\/p>\n<p>\u5185\u5b58\u6ea2\u51fa<\/p>\n<pre><code>from Crypto.Cipher import DES\nfrom Crypto.Util.Padding import unpad\nimport binascii\n\n# ================== \u914d\u7f6e\u533a ==================\n# \u5bc6\u6587\uff08\u5341\u516d\u8fdb\u5236\u5b57\u7b26\u4e32\uff0c\u957f\u5ea6\u9700\u4e3a16\u7684\u500d\u6570\uff09\nCIPHERTEXT_HEX = &quot;e4bed2ec2a02fa52cb29591c776eee893fe2b2b7072cd389178245b788e46b15a1f14f060f2ba069&quot;\n# \u5df2\u77e5\u5bc6\u94a5\u524d\u7f00\uff085\u5b57\u8282\uff09\nKEY_PREFIX = b&quot;3HUD7&quot;\n# ===========================================\n\ndef pkcs7_unpad(data):\n    try:\n        return unpad(data, DES.block_size, style=&#039;pkcs7&#039;)\n    except Exception:\n        return None\n\ndef try_decrypt(cipher_hex, key):\n    if len(key) != 8:\n        return None\n    try:\n        cipher = DES.new(key, DES.MODE_ECB)\n        ct = binascii.unhexlify(cipher_hex)\n        pt_padded = cipher.decrypt(ct)\n        pt = pkcs7_unpad(pt_padded)\n        if pt is None:\n            return None\n        try:\n            text = pt.decode(&#039;utf-8&#039;)\n            return text, pt\n        except Exception:\n            return None\n    except Exception:\n        return None\n\ndef brute_force(cipher_hex, prefix):\n    results = []\n    total = 256 ** 3\n    print(f&quot;\u5f00\u59cb\u7206\u7834\uff0c\u5bc6\u94a5\u524d\u7f00\uff1a{prefix.decode(errors=&#039;ignore&#039;)}&quot;)\n    for i in range(total):\n        k = prefix + bytes([ (i &gt;&gt; 16) &amp; 0xff, (i &gt;&gt; 8) &amp; 0xff, i &amp; 0xff ])\n        res = try_decrypt(cipher_hex, k)\n        if res:\n            text, pt = res\n            print(f&quot;[\u53d1\u73b0] \u5bc6\u94a5: {k} | \u660e\u6587: {text}&quot;)\n            results.append((k, text, pt))\n        if i % 500000 == 0:\n            print(f&quot;\u8fdb\u5ea6: {i}\/{total}&quot;)\n    return results\n\ndef main():\n    print(&quot;=== DES ECB \u5bc6\u94a5\u7206\u7834\u5de5\u5177 ===&quot;)\n    if len(CIPHERTEXT_HEX) % 16 != 0:\n        print(&quot;\u5bc6\u6587\u957f\u5ea6\u4e0d\u6b63\u786e\uff0c\u9700\u4e3a16\u7684\u500d\u6570\u3002&quot;)\n        return\n    # \u5148\u5c1d\u8bd5\u5df2\u77e5\u7684&quot;3HUD7???&quot;\uff08\u95ee\u53f7\uff09\n    test_key = KEY_PREFIX + b&quot;???&quot;\n    res = try_decrypt(CIPHERTEXT_HEX, test_key)\n    if res:\n        text, pt = res\n        print(f&quot;\u76f4\u63a5\u5c1d\u8bd5\u5bc6\u94a5 {test_key} \u6210\u529f\uff0c\u660e\u6587\u4e3a: {text}&quot;)\n    else:\n        print(&quot;\u76f4\u63a5\u5c1d\u8bd5\u5bc6\u94a5\u672a\u6210\u529f\uff0c\u51c6\u5907\u7206\u7834...&quot;)\n        # \u662f\u5426\u8fdb\u884c\u5168\u91cf\u7206\u7834\n        go = input(&quot;\u662f\u5426\u5f00\u59cb\u5168\u91cf\u7206\u7834\u5bc6\u94a5\u540e3\u5b57\u8282\uff1f(y\/n): &quot;).strip().lower()\n        if go == &#039;y&#039;:\n            found = brute_force(CIPHERTEXT_HEX, KEY_PREFIX)\n            if not found:\n                print(&quot;\u672a\u627e\u5230\u53ef\u7528\u5bc6\u94a5\u3002&quot;)\n            else:\n                print(f&quot;\u5171\u627e\u5230{len(found)}\u7ec4\u53ef\u80fd\u7684\u5bc6\u94a5\u548c\u660e\u6587\u3002&quot;)\n        else:\n            print(&quot;\u5df2\u53d6\u6d88\u7206\u7834\u3002&quot;)\n\nif __name__ == &quot;__main__&quot;:\n    main()\n<\/code><\/pre>\n<p>flag{0355e3d4f3951598d7fe1add6081bc1a}<\/p>\n<h2>Crypto-2<\/h2>\n<p>\u538b\u7f29\u5305\u5bc6\u7801\u7206\u7834123456<\/p>\n<p><img decoding=\"async\" src=\"\/\/images.weserv.nl\/?url=https:\/\/gitee.com\/which777\/images\/raw\/master\/images\/image-20250523155336739.png\" alt=\"\" \/><\/p>\n<p>\u6069\u5c3c\u683c\u739b\u5bc6\u7801\u673a Enigma \u673a\u5668\uff1a\u5728\u7ebf\u52a0\u5bc6\u548c\u89e3\u5bc6 - cryptii --- The Enigma machine: Encrypt and decrypt online - cryptii<\/p>\n<p><img decoding=\"async\" src=\"\/\/images.weserv.nl\/?url=https:\/\/gitee.com\/which777\/images\/raw\/master\/images\/image-20250523155352627.png\" alt=\"\" \/><\/p>\n<pre><code>flag{YOUGETITGOODLOCKFORYOU}<\/code><\/pre>\n<h2>WEB-1<\/h2>\n<p>SSTI<\/p>\n<p><img decoding=\"async\" src=\"\/\/images.weserv.nl\/?url=https:\/\/gitee.com\/which777\/images\/raw\/master\/images\/image-20250523135645870.png\" alt=\"\" \/><\/p>\n<p><img decoding=\"async\" src=\"\/\/images.weserv.nl\/?url=https:\/\/gitee.com\/which777\/images\/raw\/master\/images\/image-20250523135637463.png\" alt=\"\" \/><\/p>\n<p>fenjing\u4e00\u628a\u55e6<\/p>\n<p><img decoding=\"async\" src=\"\/\/images.weserv.nl\/?url=https:\/\/gitee.com\/which777\/images\/raw\/master\/images\/fbcea367af2718af056bcb6b92400dc.png\" alt=\"\" \/><\/p>\n<pre><code> flag{45f262f8515a42a85400321eccae7f0b}<\/code><\/pre>\n<h2>WEB-2<\/h2>\n<p>SSRF<\/p>\n<p><img decoding=\"async\" src=\"\/\/images.weserv.nl\/?url=https:\/\/gitee.com\/which777\/images\/raw\/master\/images\/image-20250523143855651.png\" alt=\"\" \/><\/p>\n<p>\u53d1\u73b0\u8fde\u63a5\u4e0d\u4e0a\u8bd5\u8bd58081\u53d1\u73b0\u8fde\u63a5\u6210\u529f<\/p>\n<p><img decoding=\"async\" src=\"\/\/images.weserv.nl\/?url=https:\/\/gitee.com\/which777\/images\/raw\/master\/images\/image-20250523143933827.png\" alt=\"\" \/><\/p>\n<p><img decoding=\"async\" src=\"\/\/images.weserv.nl\/?url=https:\/\/gitee.com\/which777\/images\/raw\/master\/images\/image-20250523143944290.png\" alt=\"\" \/><\/p>\n<p>flag{4e520a1f-4c9d-4f27-b10d-cbc7d20dfb16}<\/p>\n<h2>MISC-1<\/h2>\n<p><img decoding=\"async\" src=\"\/\/images.weserv.nl\/?url=https:\/\/gitee.com\/which777\/images\/raw\/master\/images\/image-20250523154749858.png\" alt=\"\" \/>'\u53cc\u51fb\u770b\u5230\u4e00\u4e2a\u538b\u7f29\u5305<\/p>\n<p><img decoding=\"async\" src=\"\/\/images.weserv.nl\/?url=https:\/\/gitee.com\/which777\/images\/raw\/master\/images\/image-20250523154802421.png\" alt=\"\" \/><\/p>\n<p>\u63d0\u793a\u56db\u4f4d\u5bc6\u7801<\/p>\n<p><img decoding=\"async\" src=\"\/\/images.weserv.nl\/?url=https:\/\/gitee.com\/which777\/images\/raw\/master\/images\/image-20250523154813821.png\" alt=\"\" \/>\u5bc6\u7801\u4e3a1996<\/p>\n<p><img decoding=\"async\" src=\"\/\/images.weserv.nl\/?url=https:\/\/gitee.com\/which777\/images\/raw\/master\/images\/image-20250523154834595.png\" alt=\"\" \/><\/p>\n<p>\u770b\u5230OurSecret\u9690\u5199\u7279\u5f81<\/p>\n<p><img decoding=\"async\" src=\"\/\/images.weserv.nl\/?url=https:\/\/gitee.com\/which777\/images\/raw\/master\/images\/image-20250523154845898.png\" alt=\"\" \/><\/p>\n<p>\u731c\u6d4b\u5bc6\u7801\u4e3aCTF<\/p>\n<p><img decoding=\"async\" src=\"\/\/images.weserv.nl\/?url=https:\/\/gitee.com\/which777\/images\/raw\/master\/images\/image-20250523154927857.png\" alt=\"\" \/><\/p>\n<p>word\u91cc\u9762\u51fa\u73b0\u63d0\u793aCFRS\uff1fCSRF?<\/p>\n<p><img decoding=\"async\" src=\"\/\/images.weserv.nl\/?url=https:\/\/gitee.com\/which777\/images\/raw\/master\/images\/image-20250523154935992.png\" alt=\"\" \/><\/p>\n<p>[[R[FSFSF]]FSF][[R[FSFSF]]FF] \u4e3a0<\/p>\n<p><img decoding=\"async\" src=\"\/\/images.weserv.nl\/?url=https:\/\/gitee.com\/which777\/images\/raw\/master\/images\/image-20250523154954250.png\" alt=\"\" \/><\/p>\n<p>[C[C[C[SFS]]]][C[C[C[SFS]]]] \u4e3a1 [C[C[C[SFS]]]] \u4e3a1 \u5c06\u5bf9\u5e94\u5b57\u7b26\u66ff\u6362\uff0c\u4e4b\u540e\u8fdb\u884c\u8f6c\u6362<\/p>\n<pre><code>flag{92f38c0023da46433a66e77b2543ec59}<\/code><\/pre>\n<h2>MISC-2<\/h2>\n<p>\u901a\u8fc7 file \u67e5\u770b\u2f42\u4ef6\u7c7b\u578b\u4e3a pcapng\u3002 \u6dfb\u52a0\u540e\u7f00\u901a\u8fc7 wireshark \u6253\u5f00<\/p>\n<p><img decoding=\"async\" src=\"\/\/images.weserv.nl\/?url=https:\/\/gitee.com\/which777\/images\/raw\/master\/images\/image-20250523153949628.png\" alt=\"\" \/><\/p>\n<p>\u53d1\u73b0\u662fUSB\u6d41\u91cf\u76f4\u63a5\u4f7f\u7528\u5de5\u5177\u4e00\u628a\u68ad<\/p>\n<p><img decoding=\"async\" src=\"\/\/images.weserv.nl\/?url=https:\/\/gitee.com\/which777\/images\/raw\/master\/images\/image-20250523154232089.png\" alt=\"\" \/><\/p>\n<p><img decoding=\"async\" src=\"\/\/images.weserv.nl\/?url=https:\/\/gitee.com\/which777\/images\/raw\/master\/images\/image-20250523154627865.png\" alt=\"\" \/><\/p>\n<pre><code>flag{bit43}<\/code><\/pre>\n<h2>Reverse-2<\/h2>\n<p><img decoding=\"async\" src=\"\/\/images.weserv.nl\/?url=https:\/\/gitee.com\/which777\/images\/raw\/master\/images\/b1de9f0f29944aadfb80ff56fb5e579.png\" alt=\"\" \/><\/p>\n<p><img decoding=\"async\" src=\"\/\/images.weserv.nl\/?url=https:\/\/gitee.com\/which777\/images\/raw\/master\/images\/fb29eddc5b96085406bf7038099f9aa.png\" alt=\"\" \/><\/p>\n<p><img decoding=\"async\" src=\"\/\/images.weserv.nl\/?url=https:\/\/gitee.com\/which777\/images\/raw\/master\/images\/5679a99f5b398785f81146a1c9ac5e2.png\" alt=\"\" \/><\/p>\n<p><strong>\u5c0f\u7aef\u5e8f key<\/strong><img decoding=\"async\" src=\"\/\/images.weserv.nl\/?url=https:\/\/gitee.com\/which777\/images\/raw\/master\/images\/8d22c74c7885a4aa538dd19ccc03360.png\" alt=\"\" \/><\/p>\n<p><img decoding=\"async\" src=\"\/\/images.weserv.nl\/?url=https:\/\/gitee.com\/which777\/images\/raw\/master\/images\/10e8126366363e9458210b268aed274.png\" alt=\"\" \/><\/p>\n<p>flag{Revers1ng_1s_Fun!}<\/p>\n<h2>Reverse-1<\/h2>\n<p>\u7a0b\u5e8f\u662f\u7528install4j \u6253\u5305\u7684\uff0c\u52a8\u6001\u8c03\u8bd5<\/p>\n<p><img decoding=\"async\" src=\"\/\/images.weserv.nl\/?url=https:\/\/gitee.com\/which777\/images\/raw\/master\/images\/c17fb796aa0a9e16c0aed0b8b487a50.png\" alt=\"\" \/><\/p>\n<p>temp \u76ee\u5f55\u52a0\u8f7d jar \u5305<\/p>\n<p><img decoding=\"async\" src=\"\/\/images.weserv.nl\/?url=https:\/\/gitee.com\/which777\/images\/raw\/master\/images\/261c0f269cbfb4f9c6de50c365d1f86.png\" alt=\"\" \/><\/p>\n<p><img decoding=\"async\" src=\"\/\/images.weserv.nl\/?url=https:\/\/gitee.com\/which777\/images\/raw\/master\/images\/38f993d3eda6f86215a4292bb81a9b0.png\" alt=\"\" \/><\/p>\n<p><img decoding=\"async\" src=\"\/\/images.weserv.nl\/?url=https:\/\/gitee.com\/which777\/images\/raw\/master\/images\/0e06d40d59d1a53dc3e873f65414e1e.png\" alt=\"\" \/><\/p>\n<pre><code> flag{afb94494b9fe826f46c6f331199a3300}<\/code><\/pre>\n<h2>PWN2<\/h2>\n<p>32 \u4f4d\u4fdd\u62a4\u5168\u5173<\/p>\n<p><img decoding=\"async\" src=\"\/\/images.weserv.nl\/?url=https:\/\/gitee.com\/which777\/images\/raw\/master\/images\/0dbd1e02a0f6c93a5e80518f2cbd48c.png\" alt=\"\" \/>\u9996\u5148\u662f\u5411\u6808\u4e2dpush\u4e00\u4e2a\u5b57\u7b26\u4e32\uff0c\u7136\u540e\u8f93\u51fa\u8be5\u5b57\u7b26\u4e32\u540e\u518d\u5411\u6808\u4e2d\u8f93\u51650x3c\u4e2a\u5b57\u7b26\u3002\u6ce8\u610f\u5728read\u7684\u65f6\u5019\u5e76\u6ca1\u6709\u8bbe\u7f6eecx\uff0c\u6240\u4ee5\u8fd9\u4e2a\u65f6\u5019ecx\u4ecd\u7136\u7b49\u4e8eesp\uff0c\u6240\u4ee5\u5c31\u662f\u76f4\u63a5\u5411\u6808\u4e0a\u5199\u51650x3c\u4e2a\u5b57\u7b26\u3002<\/p>\n<p>\u5f88\u660e\u663e\u6709\u6808\u6ea2\u51fa<br \/>\n\u5c06\u6808\u62ac\u53470x14\u540e\u76f4\u63a5ret\uff0c\u8fd9\u91ccret\u7684\u503c\u5c31\u662f\u6700\u5f00\u59cbpush\u7684_exit\uff0c\u6240\u4ee5\u6211\u4eec\u53ef\u4ee5\u76f4\u63a5\u8986\u76d6\u8fd4\u56de\u5730\u5740\u3002\u7531\u4e8e\u6ca1\u6709\u5f00\u542fNX\u4fdd\u62a4\uff0c\u6240\u4ee5\u53ef\u4ee5\u5148\u6cc4\u6f0f\u6808\u5730\u5740\uff0c\u7136\u540e\u76f4\u63a5\u5f80\u6808\u4e0a\u5199\u5165shellcode\u5373\u53ef\u3002<br \/>\n\u6ce8\u610f\u5230\u6700\u5f00\u59cb\u7684\u65f6\u5019\u662f\u628aesp\u7684\u503c\u7ed9push\u5230\u4e86\u6808\u4e2d\uff0c\u800c\u4e14\u521a\u597d\u5728_exit\u540e\u9762\u3002<br \/>\n\u6240\u4ee5\u6211\u4eec\u53ef\u4ee5\u5148\u5c06\u8fd4\u56de\u5730\u5740_exit\u7ed9\u8986\u76d6\u4e3a0x08048087\uff0c\u8fd9\u6837\u5c31\u4f1a\u518d\u4e00\u6b21\u8c03\u7528read\u51fd\u6570\uff0c\u800c\u8fd9\u91ccecx\u662f\u7b49\u4e8eesp\u7684<br \/>\n\u90a3\u4e48\u5c31\u53ef\u4ee5\u6cc4\u6f0f\u6808\u5730\u5740\u4e86\uff0c\u7136\u540e\u518d\u5411\u6808\u4e0a\u5199\u5165shellcode\u5e76\u8fd4\u56de\u5230\u6808\u4e0a\u6267\u884c\u5373\u53ef\u3002<\/p>\n<p><img decoding=\"async\" src=\"\/\/images.weserv.nl\/?url=https:\/\/gitee.com\/which777\/images\/raw\/master\/images\/0dbd1e02a0f6c93a5e80518f2cbd48c-1747992874906-17.png\" alt=\"\" \/><\/p>\n<p><img decoding=\"async\" src=\"\/\/images.weserv.nl\/?url=https:\/\/gitee.com\/which777\/images\/raw\/master\/images\/dae06d487361824fe8b5ce27bffb667.png\" alt=\"\" \/><\/p>\n<p><img decoding=\"async\" src=\"\/\/images.weserv.nl\/?url=https:\/\/gitee.com\/which777\/images\/raw\/master\/images\/203135cbf6a3cafeded1cef7b61a644.png\" alt=\"\" \/><\/p>\n<pre><code>flag{4f546000e0-a30e-4bff-ed1c-c73828db4a}<\/code><\/pre>\n<button class=\"simplefavorite-button\" data-postid=\"107\" data-siteid=\"1\" data-groupid=\"1\" data-favoritecount=\"0\" style=\"\">\u6536\u85cf <i class=\"sf-icon-star-empty\"><\/i><\/button>","protected":false},"excerpt":{"rendered":"<p>\u7b7e\u5230 \u5357\u4eac\u7d2b\u91d1\u5c71 flag{118.85,32.07} Crypto-1 \u5185\u5b58\u6ea2\u51fa from Crypto.Cipher impo &#8230;<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"emotion":"","emotion_color":"","title_style":"","license":"","footnotes":""},"categories":[10],"tags":[12,13,14],"class_list":["post-107","post","type-post","status-publish","format-standard","hentry","category-ctf","tag-ctf","tag-wp","tag-14"],"_links":{"self":[{"href":"http:\/\/blog.which778.cn\/index.php?rest_route=\/wp\/v2\/posts\/107","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/blog.which778.cn\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/blog.which778.cn\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/blog.which778.cn\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/blog.which778.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=107"}],"version-history":[{"count":1,"href":"http:\/\/blog.which778.cn\/index.php?rest_route=\/wp\/v2\/posts\/107\/revisions"}],"predecessor-version":[{"id":108,"href":"http:\/\/blog.which778.cn\/index.php?rest_route=\/wp\/v2\/posts\/107\/revisions\/108"}],"wp:attachment":[{"href":"http:\/\/blog.which778.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=107"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/blog.which778.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=107"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/blog.which778.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=107"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}