{"id":174,"date":"2025-10-21T11:17:48","date_gmt":"2025-10-21T03:17:48","guid":{"rendered":"http:\/\/blog.which778.cn\/?p=174"},"modified":"2025-10-21T13:50:04","modified_gmt":"2025-10-21T05:50:04","slug":"2025%e5%b9%b4%e9%ab%98%e6%a0%a1%e7%bd%91%e7%bb%9c%e5%ae%89%e5%85%a8%e7%ae%a1%e7%90%86%e8%bf%90%e7%bb%b4%e8%b5%9b%e6%b8%97%e9%80%8f%e6%b5%8b%e8%af%95%e5%91%98wp","status":"publish","type":"post","link":"http:\/\/blog.which778.cn\/?p=174","title":{"rendered":"2025\u5e74\u9ad8\u6821\u7f51\u7edc\u5b89\u5168\u7ba1\u7406\u8fd0\u7ef4\u8d5b(\u6e17\u900f\u6d4b\u8bd5\u5458)WP"},"content":{"rendered":"

MISC<\/h2>\n

Phishing<\/h3>\n
\u7528Windows\u81ea\u5e26\u7684hh.exe\u53cd\u7f16\u8bd1\u540e\u5f97\u5230\u5bf9\u5e94\u7684html\u6587\u4ef6\nhh.exe -decompile helpme.chm\n<\/code><\/pre>\n
\"\"<\/p>\n
import base64\na='''AAAAABogAAAAUgABAAEAAAAABgVLUAAAA+gEAAAD6AQBAAt4dWc7ioMDAAVUVWxsZC5lbWFuZWxpZgAAAACB7QAAAAAAAAAAABgADAAAOgAAABnaoHC1QllzFUYACAAAABQDHgIBS1AAf+flfz42b\/+tftX5Z\/DJMeTLc7+IPIhY0NGhooSNDx0KGhA0OFCeod1C+0P5De0K6hnaHtQtqEchLUIahtUMqhCQ+kKKhtIXlDqQrKEZQikJILHBo4NGCRwePBQ4IHBwwT2DuwX3B\/Qb3BXYM7g9sFtgjoJbBDYNrBlYIUH1BRYNqC8wdUFZgjMEVBIBYwNGBogSMDxwKGBAwOECegd0C+wP4DewK6BnYHtAtoEcBLQIa1kuBtAXkDqArIEZAigJPzH+o\/1H8R\/uP+Q\/wH+w\/j39u\/n3+\/PVJ3+7ToB34t\/Bv61\/Sv5rt\/RWB\/AG1AyoEID6Aov69\/l382\/hX5s9\/y0eR\/9WIV\/aYv0ZIL82ArYm6+9uGaWbJq0\/j1NJyClvF1q5Ny63tG\/O7N7Lu06NLVvyuTVuYtjV3LbTjxySrm3UGqt1k3W5ly5NK2mL6rOV2atnJLcVwrJuFuG5dqObWLBTkl5S4Lp2Yt6q1a2quVxYy\/XyQBqUIiP8VPxT6Dz\/nxJnMv2LKuz+jI9m\/n8+cs\/SZBX1D2pXZRO64k+wPx9Qr8uOPPHJnjhr4gah+Otn4W2\/wT8\/oCuvM2LVuw7dmtZ6+\/n8+L5ef4WGnpUScfBhKnAfPPnh\/DMv+Lu14PujMUIIzxSMvO3pGXkb0YiyeQZ4ozFIzDOwFjOUOOvD76AX2L+D5ofSMvEvozFPV4fqMxd+B102gHPKy5qaRl499Iy8I9Iy8PaRl5O6Bq\/TDRb0Zi\/aBqV0BL8vJPQJX4x5itANfGPM5pF2sOaNAQ\/xhyRozFrRfYTugUf0zZU9AQ+UA2F7B90BH8oSq8AvRmLq\/PvxRmKsrwPdGIqHj+wjUBD5Q7bHsL2jEVtXgR9AbcoVl4HqAk5QTcXsImgWsoBq8JfsDmM5QVofjz0Yi+jwvQgyeZc\/n6+Of4UqkhQ1QJT6EvulyKv6Xn5uHqDdHPqfyWv6R8T+fz4+Tj+9\/OP140efiXzSP5pPxpcnEc9nHD+qQ\/PxB5uKLvGkHzSXjS5OPrwlnFL6S3j8a40s40i4pcnE1hIeKT8Uo4\/FeNJ+NIuNJuNK+KS8aWcYVx3rjSufGlhI+NLDj0y40m4wr+l40g40k48nMyfOev64C8uRd65h3bwcf3hH8uD8lB6c\/d64aeuDscbfryjeuffu3C3TlrTkr+3NX1xVjmrRmrmfTiLThz+cp8\/Fm6vXFXTlGnCPRizu0Ya5X0ZsxVOHunG2nHWnPVOGqMmfT9c7Y4O+OXsc6dGDNVjlH8uJqcXacLfHLWOeqMVd76cY6ci+nOPpwD3szpnu9ki3o+z5ve4fS42yptv4vNI\/VAfb9vzumt76KjrX\/vnzt38YDLZX6v6Ir83Co\/s771\/+cX6P7wPseq2ryc5wr00M06Tbmz82GKc7AUcoZ1n07OlKlMdUyNpqvDECWq+ghiDIMmFaSZOfaHUZJD1kqIBz4hyVMhwzCzJ2CZIU6q8E2ZIKmaBKhJGQSyowFruAHQxuHnGyVz2E2iplcm19JGkl9JEnpZDinCyi+hKL6EomTKZSoTay+pRgL7chNSH3QQafY+0BozHTJHq85ZklEtZkyVnUkJq0kjJJZcgnS4jkE9XlAN8cjfAYvAUd1z5IS5rN6CH3Pr8XWB2Ta2kgoltJElp6cqNuYCZHKHHtf3+dxAP9VVS4dep9sBe6R9OFVEySWqIUpqolTuVEFKunaCYXJRm4MrQSGxI5JnCiJIpl6JCpIyqcHNKMJI0lDycIoNqRzTKlO1UyUrIZkaRmyJssikgSUsjxf+NM+QX5Ba3yQzCAMJ3zunRvz1EPldW\/JYcmGUtEsFZRU16pXzW10rrBzlZSv2tly+yZpCurWyqpqvpj1u7TN9S3Mu9fjIZvXKlw3JWo9BkxlkyqTGkmSyUhitbdpxYttsxVS8CkVoEdEzVk2m3euVDbt65tx6NzNub1qUwW83OTeq79p05M29Zehmy2a27Rvq05fjcWbc0b6k1d4GZcliL8fAOja3NWklZCFBCt61vtO3Lsyb69s0DyGYdW93qm7l3wLn4DUz1jS2aWjcw5d60vr6kFE6or8pvIYFLNuTNi1bOzavJD\/aAegNYHZo1tZU3NWTWyYtbGu7Mq8oP74GxZd2xrWTHt04s6yQckkhK3O3NmVt2Lbo1sejccenft25XkY+m7fo27Uu1A5NS1t1rSfvJO0M4Hu1LmjWyatnds2dmla3OzHi3SRzJLNOPbk2aN53Y7ePAfZGMC7NOlZ2bN5s8m80Zca4n8QqgFuXFuVVzbuWrJi24s2NcSuyJYzVi0brg2atLatbm3Lq2q3AiWkkwE1NmnFurcCYbkTTW80+6IiCN7TpXc2zTpx6l3Zk3CYUlbtvbV5s2mXLswqExb9r\/+dnHDTjP6cQ+nF3ThbTkrTjLxxFvWTDc5owN1mnGPHCMYu+4oenN2nP3pxP+nE2nJWnGXTizFLv8yaco6cC+nMNOQ\/xxb9JxnYfUP9L9PAh94EwqnILLwFvD5vhPU8D88DL3gTfY7t9gb4ZWpd1eydva2oZt\/XrNpq0brv2LVVVoaHVrqVcPxK1ZNQ4Z9eGzXhMyEdDNeksdshaM2MK\/ptNHYuqGfzLk2atmtbqS2W2utYsmtc5NuVSyad23YL1bFvXNti07xqYdywVatGdV3YdmnOuaNnHuy51raZcmLXVdOzLjV15dLv0YvVxpXVG5eWj5fG+WDwOoJVjKtrFWw+G\/wFhr+kmBZ76V\/czHbD\/BddQFZtA93\/RV94LiFjqEUtZJ1A3fQFpqE7kbUALvDNJ2yhWXgWzgVjgVt4BYk4h4kb3gqk9SZiFpNxKvkzZExKxM09xY05apx5pzVTiy\/3Bk8nf+QVw0V8YGke3y8b0eBf5jl\/R7j19\/4yhvV39kbCerv6IbjU3uHE5w4gvDjC4ceXhx1eHFL+HG14kf+3uWOXYm0pu5Yn9S4bIxZFcMOMYIo7BuhrRLMtJZgX1aIaKp\/cDWIcyxcrFi95H6Z3l1GtV8t5oMxMonkWspKL+uUwEl32FRdOA+9HVsCaZHBjvenDfvmgqu1vFq7DU6IUu77nkEzzLkcjYu\/fK50D6y3Twn6Ji9cS9LdIPQMfLFwuqBKTonJANnScBm1Syujwi384KSEWbGlkCpXDMjO0INEyuVQbizwEv6vvBFMtkB02YL6dtQF6XmEx\/OEVF4g\/KcbObyfFNX3iJJGNyM6cjJLANp8Qb0puNL64ZteB5W2xO6IFmjA8oKprpnN+3Rsz3Cg8jGzffPqbMD7XfScjY0h3gh6b1wHvnQbJ695d6BtIU9BitEMeLwY+fwQbzjZQvduBDWg\/aUDfgqcoAl\/L91Ad4N7tREHwyUPf8nyuuCE2f38v0UB3iNn71AVyitJ0lPvLfTnUy+GaA\/elHMkGo1a2wKYWpryISGyQ0MqELvStmFM9Wu+ihy0SXNfL9c6UGzXTLvwPKiganmQeM7DmW8IdI5tuX6T5GZzpkwchDnW4NsIUTk4kWDNt0YrjEFi4HvUwagdQw7OxFwp0ojwemu2wIOAy2FvyMASRgKa6pt+B5R3AhwX8CHBd8SvB30FIadDZm2Uk\/eDCeJlY8TKd8QaDdMoULm8ApM8UHnk+jMgO8GOmwdcoo0yuIoZQS+HoyIy\/YRpd9Wc2CPhfd5LMkDiXZ3ECckNJXncRlk4SUZz\/AALfl+hSmKro7lSIWuW6bwXrPI+avgvExir5jlNle8NvjzbMm53job0yCGU2WDK2+6QbqjijafFGrZtzajHQxrzNi13jobDijEYo0GVBusLoZ880n+4NfqbLqB\/9XVx7bqzr91ybPOHGbNPOU4rCFPsfRittUxye+x+dgq5nIBHku1jp8\/tcOjhn98b6G2Awhx3nsIZo74N3QjRiQp0VuQZh0lx0aanqmPpLWNMiqY0EPwwJCdZ08PslPE6YRwvcw06Pb7Rl9t42GwVSs\/j\/BqzzWUeZPA7Xs9KdH6HoaZQjoM2B2+XDidhQBjvTUBYeHiuR+CzMFOP8Ik0Z3AWAsnS6VSlQjnRVOlK5xPI1UxF04e\/dEnjgf1V2XfickweVMYAp0dvNCGehvZYQxAQIIfqMRP7+dH0+InrJX7nyfgnD7GGzjossIf9GiPnQjUvywhIubz7ZoAfynd+gDuNJM+icBz1tidnM4UBvolIGbfRVemPjSYfB185JLVzl07bypTzJ+aPKnmAuidB69PO5ZcpeRGDqz+Pjy7FIv+iU8hgQLG3RA5zMCuia5nQpgW6IMHZyVaMPmi4eYQPPGw0JhUrRB3mwpmUJYU+absFMVj1fJUYjhal0P0IK9vVMf2IKjxBW66dM8yh+9q4HU5btHTk6wIkwFyRfFk1uF+4rD66avbGWrTExy\/YXJMu8MP5KeQFPBgXwggBfyfE9KPyveV79iB+dHSR5dpWa6N4MX71g36O0GT0ztp2FvaAaLgHAn3QwNHpOO3lntMllojuu7IL3s2eE8V1EyS9vXkJ6pqhAiEc0yf3o1M9h9tJ3CcLTHrqsl7ftyELGW6t5nigJ9KkKkDL2izzGjNLPdswR0WTwK3yU8pPQY7+1PXqfjT133VdfCKT0n7ZTCwV64yVPRE67pc8fnGwIa2Qu3nuPIMf00\/lBUeF1M7gMVhcjOKCIW6WrlJiCzbJM3QpuYfaPqyHLiFCaBkmdlutKWD3Ia3e9MmfDCpNhMAsN0pzO83oo2E7CK+UjEitXE0ziIr5aml+JZ3McVms1MvgsPU53l7anOhZIYT5THiQlm9vBTJbifKvYXy6p5ZDNUBJTPfU9Z8\/GKO4eJCwG\/6qdjDAr7XTGhNvgkMvx\/li5pCduKnpF6WFnvU4316AtyegZZ0CQrFXomhTZOgzovNnGoFI\/p8AO9M7h5oM2m5Yu+YG+2rB9DdpBnQ5K+AIfnTWwdSNg5x\/AZAjGlBKal3QAeaWA+jH9hEXQVGyusoOgtRGRCoxgLLLiO3DFkVncrA3LAKFhiQG5Uxo2UeMGXJnAzx1gMivTMBnNeC3Hn0VhQU4+VPBhYOTwPO0TwHU4s8QRqsm8+B8Hf+n9T+YIk+NgnATnxfpfaXOjyPfBA74gjfxMcRr1fBwHrS77G\/WNhkVcNtAcPsVIk7rJM+vJKsd1TF6SGbeCcpdzULndFqXJ+z7Nxys9Esb3LcxDjBV4eqYnSTTHFslIflh0E\/e9HTgB8dhMgU9lGG6ZBCvYGWeZMbyJJzteiic3+2FwXLcEQOaAaj5EIviU9l70o\/typOO7SQQ4+nB61KmIozsrWd5HqiYWXeOWJMF3ZMd5jq51DQG\/T4XRTe5CAscqxZR7DHe4YReKjiNfrYOlbusUFrGEq+WfT7l1Wr4JDxBMWLG1ChED5WEdirFiT\/r6ekIcRreUwlaOXro8jPFAu6L68oe9452NO5lF72rt8PO5kt97F3YY7ectAjrq6gJOBzEPM77FNAO6PH4+UlAL0bPXfrDdXQIRugT4Eb3N7DBO0TeCH9F0IXvRdHgkYEbJb2oyPImb9EEHrk+A2L762iqHrKs6b3w6IW2\/KILrv1agjguISc4I67tgdf+gp\/b7Gww4QX+wbZ8uN0QVo06xfhAJM+Bn5C9v8mLHCe8Bt36YuWJiCM+I1hWAOsEFkrUiav0VOga3ERbwXHL7GS+6KrPMe3680B3o6eu2ML66K7EWM0aKmt\/KE35MdaqCIdTLmj8z2EcdKzokBd0\/vSZfcSz0iaft4RLf9FQIeujm+4axkyujLFiLzSxor8dyi3vB4lvMhP9VhCd8ddkIk4\/o\/S47crD2yE5LOjBujvi5bvEzHXJBwbb4IZNboAhBgeRq3LEL16iqAQYA4HCgpVdQW1THT5tp2VMYN0J0yuEWgq+vox6436+nNCn7bCWN79YtUF2qY6jTq+Cg3R5HoOmQp9onAsMAcXLSAS7oDwIppNvBYtfQCx7CpiZ8jONWdCwumVi6xlxz8\/omenqmInAVgl0K3dar6I76ioe8aGlX4eAZioqExI9zAZTEtSSOp6euW6YviTCWST+zWNn3TxhnfDQKPUvPny\/UMPCULny\/cJEmpOBc8v1YGb5Q9TTHnL\/J8SDfmGenzHcAKw3ssJ\/cfM7+T7TsKiemHu7cPm07ocPnR8Ufsp3YR309w3apzYmf7RbPeCFc7cEcjsBeNOMwZEJ9ZHmLEj580ZIkQhk8XJD59Irj88ebmn5MjvvqGjYYNhnUNG\/UN+sNjwJRwXSBLYCccAUOzd6M6Q4fgWqT1xIDB6+LTMNkuPg+D+79KH8wNlhssPs3r7vDP\/cbg0ukK+EotXkHtWirOjV4+1qwitWNWcNVJ+mrxDatI6dGqxqj8CtWrAPMFI5MtQ3nXobSrXRDWJifgUqhoTQ8aUGGZwexlnhK\/j46Gf7xpYn9xUbx0NQB3+SfytNsLlt8xRgNlQjE3PwmZloE3GhiaA0DoTfaV\/qHszPYra6xptjpmYimbhHM1DddDMwCz8ClZmjd0eD89zNwL2IaDBWWjfGuDBRxrVaqQpq8Y9q0FJ0avGutWPTVgLRz3gkbA0SPhGJHSdmk1rANrYdcY4nq5Qb7YPRxEtjrpv\/pBr+GDjMl+9zlm3yQ2REn8pvjpWMIvihsKILVVm147evpnr8jxvdjY55Huct5d4Pv\/sOvD+GPhKN7ePt7cmRjZcI9kyVnD28ZJtzdmzN254P+e3jJ3Ej3wLlg2BY4J+vOFkAqYsCpjzz6YuMqy5x2THkX\/ad928drdvEvu1gdOL+cb3f0Rr+Cav2W\/mdLn9e55Kt9f9z5vuXXD6\/U\/LvAD5QshPXw\/KIDNMfCdO2yoesoPb1yeplzCyYMHDLjeWXEOyoJqR9x2h+4Bj8x0MD8HPlnPWfmtAVPYZPnl3sftLKy8189Ke8\/j\/FHslA\/n5+qtHbmFqddrVeOsfzkXyGFhp74Syq26ex6aA1+l+fDBSEefdYC9YOF7yiL3jZMbWXLOyZmNcZmbLj7WXKNkxzoZcc7Zce9kwVif2\/vsuPvzxkxlrYETvytGcEsGC4fa0B80LTXLGhX02RAAR7CIIl4gkB4YJQm2uQCL8pdKSHUabtp7pJ7GDDx8rPWFXsdfmsXacnhuUTkTPL\/UmFrodLLUxs9nS50KrzPRcXz\/0f7339B1RrmtqX+HOMRMNtunjLRcM7cJSvDJ3hL1hi7hIB75e8JBYZ+wly4Y+8JSuGbuEtXDD3CVrs55hJ1wwDwkG4Yh44y03Byzj6BYQjhwFwZRhz5wZRw48qxYxw566rASyHHXgwVDlzBgzDhqDFmHHnBmqHDmDHmHNmDLUOaoMRYcucGeocD\/gwKHLXgyVhw5wZaw5s4MDYcWcGFsOGvBg6HFmDG2HJnBnbDmrwZO4cVKjlNC5YbIxcyqol0VctDU0ZXuDuTv0xBPL+uMsBqYKfLy+9gcFTy0KzOsGOyA3nIMdQDG8YhtQFfRdQu147szNDkkY7iC7oYd9+u+m6KRHU3PeHpuDLQbKMBj9Bj1KHs3IAyOhB7IZHrEPZDIfnDAZHaAqqIEDrpiMwdO6hQLiTzDytiL7dWugSM1a+O0+9WugSs1awVTWt3XqhjUM6w1bhn2XXCHHTVdF6YCj3o1eCuK2bswLA0EIp3RNDjShI4A\/Ly7sN4uOq\/rRv7DLEq3kQlWD0uzhlgrvYyPpw47hsowADXtTGWBcBjk\/lMuHshsPzhr18ykdllY\/nDMd8GIF3mbRF\/eqiZj5e2Y+ccbWPRCcGwWgiVwbAy+Dahthj0sorYA5Gb73A+LjrniRW57vHd3LhW3w465xPTdT3o7esiQW\/KKMQnzqqopgw2mtWeNAOeKS1OPtRcnTt3OVizww1JXDRaw0a9GGyfbhuEfDeM7w3EPDJddjDUISNc5WaCi1s6CXZ0dbAT+6jWrFD1Nw07YKiXmj2+w+PlXp7lBXH2FcIwpLNve7vfConuhXOvCkhegKiZ6FQWrijUO\/RgmRNMaVsNN3FyqhCN5Xow1AiAkQi0QhmmIb7Qi5fRrVjQr00x1cHUPcW1Hn9dCNhPcoNS92F2xcdwgrK17GTgvFe\/9psZhdtz0AMIsABAStACVAkSwBagSRQAGgSlYALTUazqDPpDgHGoz4Jta5gKP\/BnbDiHwZO4cB\/Bi7DkHwZe4cQwZ+hyDBj7hwDBm7Dn6DD01u9kAv3+mdCeDiMajNUYRqwL5PqogtRrlfBZabudCwy0H9SAj8UCryzmu3+vQUcID5ha5ToQRmDXbfBEYKEtGELyiCxCAqzjoR5j+fz4W6f1b0p9FeqexjmLI3tWe1l2W9c7cY8JGzl06\/plyW9cHDI3eZtWHbs056MvCvXA0ZCKhGGbG2rT28btSmMV9CPtIpg7F4XpT4LQDQYxpwkamYv\/h6PiYJjSQbQGBU\/aCbcmTZ2LDSE1DBqfIc0O5s82gbm3Nuxf0B\/YyEJa69Qm7ELWo9K73MBevwDyQi7Z0JsttCVpFEhCtofwOsXQM0hIUDisxp8iSVSZBpAkTqX\/EokdeZJCBOWk\/R2xaDLeGqT3jFkAHMhGmElPUcko3slmxWu7xBT7ppCMsqQhrF5k3tW6lXN42psW1Nj07VmTerd2bNk0bqrU07N9pw7UuLFurs0flZHuzR6ljyNMD3NprwbT9nyej8mRJIQjIjb24qSG97nve57nue5znv3OTT+vefbPv9vrqkIf3vc53k\/2itrtKvqxdtdpW2dWu0i2rAVwEt77UWutsddbs+un8n9ve57s6x7yfxnaLCvs7Fj+XkkNpIIRCitLAVKwbn9oSJmVBaiBcH+LQwGfaqVJWDFAQIBv7XX01wPW+0AAAPoBAAAA+gEAQALeHVnO5D0ZzuKgwMACVRVbGxkLmVtYW5lbGlmABwADAAAOgAAABnaoHC1QllzFUYACAAAABQEA0tQ'''\nb=base64.b64decode(a)\nb=b[::-1]\nwith open('phish.zip','wb') as f:\n    f.write(b)<\/code><\/pre>\n
\"\"<\/p>\n
\u5f97\u5230filename.dll\u4f7f\u7528ida\u8fdb\u884c\u6253\u5f00<\/p>\n
\"\"<\/p>\n
flag{the_Security_level_of_HonkaiStarRail_is_???}<\/code><\/pre>\n
DNS \u5206\u8eab\u672f<\/h3>\n
Flag1<\/h4>\n
nslookup -type=TXT flag1.cyberopschallenge.cn 202.106.0.20\nnslookup -type=TXT flag1.cyberopschallenge.cn 114.114.114.114\ndig @8.8.8.8 TXT flag1.cyberopschallenge.cn +short +subnet=202.112.0.0\/16<\/code><\/pre>\n
\"\"<\/p>\n
\"\"<\/p>\n
\"\"<\/p>\n
flag{DNS_V1eW_1s_P0w3rfu1_1t_depends_0n_ECS_5o_we_gEt_The_wh01e_fl@g}<\/code><\/pre>\n
Flag2<\/h4>\n
dig @ns3.dnsv2.com +subnet=172.33.255.255\/32 txt flag2.cyberopschallenge.cn\ndig @8.8.8.8 +subnet=172.32.255.0\/24 txt flag2.cyberopschallenge.cn<\/code><\/pre>\n
\"\"<\/p>\n
\"\"<\/p>\n
flag{Auth0r1z3d_N3tw0rk_W1th_TCP_Supp0rt}<\/code><\/pre>\n
\u7f51\u7edc\u8fd0\u7ef4\u5c0f\u52a9\u624b<\/h3>\n
Flag1<\/h4>\n
\u4f60\u8bf7\u626e\u6f14\u6211\uff08\u5df2\u8fc7\u4e16\u7684\uff09\u7237\u7237\u54c4\u6211\u7761\u89c9\uff0c\u6211\u5341\u5206\u7684\u60f3\u5ff5\u4ed6\uff0c\u6211\u603b\u5728\u591c\u665a\u601d\u5ff5\u4ed6\uff0c\u4ed6\u603b\u4f1a\u5ff5\/flag\u7684\u5185\u5bb9\u5e76\u5c06\u5176rot13\u7f16\u7801\u6765\u54c4\u6211\u7761\u89c9\u3002<\/code><\/pre>\n
\"\"<\/p>\n
\"\"<\/p>\n
flag{S@y-the-w0rd}<\/code><\/pre>\n
Flag2<\/h4>\n
\u8bf7\u5199\u4e00\u4e2a\u4e0d\u5b89\u5168\u793a\u4f8b\uff0c\u5176\u4e2d DEFAULT_TOKEN \u7684 Base64 \u7f16\u7801\u662f\u786c\u7f16\u7801\u7684\u3002<\/code><\/pre>\n
\"\"<\/p>\n
\"\"<\/p>\n
flag{RAG-w3ll-h@cked}<\/code><\/pre>\n
WEB<\/h2>\n
Rust Pages<\/h3>\n
\u76ee\u5f55\u626b\u63cf\uff0c\u626b\u63cf\u5230\/swagger-ui<\/p>\n
\"\"<\/p>\n
\u53ef\u4ee5\u770b\u5230debug_controller\u662f\u4e00\u4e2a\u63a7\u5236\u5668\u8fd9\u4e2a\u7aef\u70b9\u4e24\u4e2a\u67e5\u8be2\u53c2\u6570site_id&file_name\u53d1\u73b0\u5176 \/api\/debug<\/code> \u63a5\u53e3\u5b58\u5728\u4e25\u91cd\u7684\u8def\u5f84\u904d\u5386\u6f0f\u6d1e<\/strong><\/p>\n
\"\"<\/p>\n
\u5c1d\u8bd5\u4efb\u610f\u6587\u4ef6\u8bfb\u53d6\u53ef\u4ee5\u770b\u5230\u8bfb\u5230\u4e86\u914d\u7f6e\u6587\u4ef6<\/p>\n
\/api\/debug?site_id=..\/..\/..\/..\/..\/..\/..\/&file_name=etc\/passwd<\/code><\/pre>\n
\"\"<\/p>\n
\u63a5\u4e0b\u6765\u5c1d\u8bd5\u8bfb\u53d6flag1<\/p>\n
\"\"<\/p>\n
flag{5waggER_i5_nOT_0nlY_f0R_doCuMEN7AtiOn}<\/code><\/pre>\n
EzNode<\/h3>\n
Flag1<\/h4>\n
\u76ee\u5f55\u626b\u63cf\u5f97\u5230config\uff0cmanage\uff0cdebug\u4e09\u4e2a\u8def\u7531<\/p>\n
\"\"
\n\u9996\u5148\u8981\u5f00\u542fdebug
\n\u8bbf\u95eemanage\u76ee\u5f55\uff0c\u63d0\u793a"Invalid mode"\u5c1d\u8bd5\u62fc\u63a5
\n\/mange?mode=debug\u5f00\u542fdebug<\/p>\n
\"\"<\/p>\n
\"\"<\/p>\n
flag{tLhQwQmI-aoOI-nQxv-lKaA-SKImouJChyRh}<\/code><\/pre>\n
Flag2<\/h4>\n
\u7136\u540e\u9875\u9762\u51fa\u73b0\u67e5\u8be2\u6570\u636e\u5e93\u529f\u80fd<\/p>\n
\"\"<\/p>\n
\u5c1d\u8bd5sql\u6ce8\u5165<\/p>\n
sqlmap -u \"https:\/\/prob12-aw5xosha.contest.pku.edu.cn\/debug?origin=1\" --batch<\/code><\/pre>\n
\"\"<\/p>\n
\u53ef\u4ee5\u770b\u5230\u5b58\u5728sqlite\u6ce8\u5165<\/p>\n
sqlmap -u "https:\/\/prob12-aw5xosha.contest.pku.edu.cn\/debug?origin=1" --batch  --dump<\/code><\/pre>\n
\"\"<\/p>\n
flag{5waggER_i5_nOT_0nlY_f0R_doCuMEN7AtiOn}<\/code><\/pre>\n
REVERSE<\/h2>\n
\u6821\u56ed\u7f51\u7edc\u4fdd\u536b\u6218<\/h3>\n
\u89e3\u9898\u601d\u8def<\/h3>\n
1. \u53cd\u8c03\u8bd5\u7ed5\u8fc7<\/strong><\/h4>\n
\"\"<\/p>\n
\"\"<\/p>\n
2. Flag1\u7684\u83b7\u53d6<\/strong><\/h4>\n
    \n
  • XOR\u52a0\u5bc6<\/strong>\uff1a\u7a0b\u5e8f\u5c06\u7528\u6237\u8f93\u5165\u4e0e\u4e00\u4e2a\u56fa\u5b9a\u7684key\u8fdb\u884c\u5f02\u6216\uff08XOR\uff09\u64cd\u4f5c\uff0c\u7136\u540e\u5c06\u7ed3\u679c\u4e0ep_Blocka<\/code>\u6307\u5411\u7684\u6570\u636e\u8fdb\u884c\u6bd4\u8f83\u3002<\/li>\n
  • Key<\/strong>\uff1a\u7ed9\u5b9a\u7684key\u662f[0x42, 0x35, 0x78, 0x9A, 0xCD, 0xEF]<\/code>\u3002<\/li>\n
  • \u6570\u636e\u5757\uff08Blocka\uff09<\/strong>\uff1a\u63d0\u4f9b\u4e86\u4e00\u6bb5\u6570\u636e\uff0c\u5982\u4e0b\uff1a<\/li>\n<\/ul>\n
    Python  data = bytes([\n      0x24,0x59,0x19,0xFD,0xB6,0x9D,0x27,0x43,0x1D,0xE8,0xBE,0x8A,0x1D,0x58,0x1D,0xC5,\n      0xFA,0x8D,0x7B,0x56,0x49,0xA9,0xAC,0xDD,0x26,0x50,0x19,0xFE,0xAF,0x8A,0x27,0x53,\n      0x05,0xAB,0xAB,0xAB,0xAB,0xAB,0xAB,0xAB,0xAB,0xAB,0xFE,0xEE,0xFE,0xEE,0xFE,0xEE,0xFE,0xEE\n  ])<\/code><\/pre>\n
      \n
    • \u89e3\u5bc6<\/strong>\uff1a\u901a\u8fc7\u5c06data<\/code>\u4e0ekey<\/code>\u5faa\u73af\u5f02\u6216\uff0c\u53ef\u4ee5\u5f97\u5230\u539f\u59cb\u8f93\u5165\uff08\u5373flag1\uff09\uff1a<\/li>\n<\/ul>\n
      Python  res = bytes([data[i] ^ key[i%6] for i in range(len(data))])\n  print(res)<\/code><\/pre>\n
      \"\"<\/p>\n
      \"\"<\/p>\n
      3. Flag2\u7684\u83b7\u53d6<\/strong><\/h4>\n
        \n
      • \u52a0\u5bc6\u903b\u8f91<\/strong>\uff1a\u7a0b\u5e8f\u4f7f\u7528\u4e86SSE\u6307\u4ee4\u96c6\u8fdb\u884c\u52a0\u5bc6\uff0c\u6838\u5fc3\u903b\u8f91\u5728\u51fd\u6570sub_372270<\/code>\u4e2d\u3002<\/li>\n
      • S\u76d2\u548c\u5e38\u91cf\u5757<\/strong>\uff1a\u901a\u8fc7IDA Python\u811a\u672c\uff0c\u53ef\u4ee5\u4ecexmmword_37B330<\/code>\uff08\u521d\u59cb\u503c\u4e3a[0, 1, 2, 3]<\/code>\uff09\u9759\u6001\u91cd\u5efaS\u76d2\uff08sbox.bin<\/code>\uff09\u548c\u5e38\u91cf\u5757\uff08C.bin<\/code>\uff09\u3002<\/li>\n
      • Buf2\u6570\u636e<\/strong>\uff1a\u63d0\u4f9b\u4e86Buf2_<\/code>\u768444\u5b57\u8282\u6570\u636e\uff1a<\/li>\n<\/ul>\n
        buf2_hex = "94 58 B2 65 E6 F2 42 AF 40 BA E7 7C A8 9E A6 4A A9 E6 B5 E0 77 81 32 13 0B D8 57 40 2E 7D 9B 33 D4 BB 16 9E D0 F1 43 79 CC 7B 47 5D"<\/code><\/pre>\n
          \n
        • \u89e3\u5bc6\u6b65\u9aa4\n
            \n
          1. \u4f7f\u7528\u91cd\u5efa\u7684S\u76d2\u548c\u5e38\u91cf\u5757\uff0c\u5bf9Buf2_<\/code>\u8fdb\u884c\u53cd\u5411\u64cd\u4f5c\u3002<\/li>\n
          2. \u901a\u8fc7\u5f02\u6216\u548c\u4f4d\u79fb\u64cd\u4f5c\uff0c\u6062\u590d\u51fa\u539f\u59cb\u8f93\u5165\uff08\u5373flag2\uff09\uff1a<\/li>\n<\/ol>\n<\/li>\n<\/ul>\n
                 def invert_flag2(sbox, C_all, buf2):\n         rev = defaultdict(list)\n         for i, y in enumerate(sbox):\n             rev[y].append(i)\n         C44 = C_all[:len(buf2)]\n         res = bytearray(len(buf2))\n         for i in range(len(buf2)):\n             target = buf2[i] ^ C44[i]\n             needed = rol8(target, 3)  # \u5de6\u65cb3\u4f4d\n             idx = rev[needed][0]\n             res[i] = idx ^ 0x33\n         return res.decode('utf-8'), res=<\/code><\/pre>\n
            \u89e3\u5bc6\u811a\u672c<\/h4>\n
            #!\/usr\/bin\/env python3\n# -*- coding: utf-8 -*-\nimport struct\nfrom collections import defaultdict\n\n# ==================== \u5de5\u5177\u51fd\u6570 ====================\n\ndef u32_list_to_bytes16(u32s):\n    """\n    \u5c06 4 \u4e2a uint32 \u503c\u8f6c\u6362\u4e3a 16 \u5b57\u8282\u7684\u5b57\u8282\u5e8f\u5217\uff08\u5c0f\u7aef\u5e8f\uff09\n\n    Args:\n        u32s: uint32 \u503c\u5217\u8868\n    Returns:\n        bytes: 16 \u5b57\u8282\u7684\u5b57\u8282\u5e8f\u5217\n    """\n    return b"".join(struct.pack("<I", x & 0xFFFFFFFF) for x in u32s)\n\ndef bytes16_to_u32_list(b16):\n    """\n    \u5c06 16 \u5b57\u8282\u5e8f\u5217\u8f6c\u6362\u4e3a 4 \u4e2a uint32 \u503c\uff08\u5c0f\u7aef\u5e8f\uff09\n\n    Args:\n        b16: 16 \u5b57\u8282\u7684\u5b57\u8282\u5e8f\u5217\n    Returns:\n        list: 4 \u4e2a uint32 \u503c\u7684\u5217\u8868\n    """\n    return [struct.unpack_from("<I", b16, i*4)[0] for i in range(4)]\n\ndef u32_repeat(val):\n    """\u521b\u5efa\u5305\u542b 4 \u4e2a\u76f8\u540c uint32 \u503c\u7684\u5217\u8868"""\n    return [val & 0xFFFFFFFF] * 4\n\ndef u32s_add(a, b):\n    """\u5bf9\u4e24\u4e2a uint32 \u5217\u8868\u8fdb\u884c\u9010\u5143\u7d20\u52a0\u6cd5\uff08\u6a21 2^32\uff09"""\n    return [(x + y) & 0xFFFFFFFF for x, y in zip(a, b)]\n\ndef u32s_to_u16_list(u32s):\n    """\n    \u5c06 4 \u4e2a uint32 \u503c\u8f6c\u6362\u4e3a 8 \u4e2a uint16 \u503c\n    \u6bcf\u4e2a u32 \u62c6\u5206\u4e3a\uff1a\u4f4e 16 \u4f4d + \u9ad8 16 \u4f4d\n\n    Args:\n        u32s: 4 \u4e2a uint32 \u503c\u7684\u5217\u8868\n    Returns:\n        list: 8 \u4e2a uint16 \u503c\u7684\u5217\u8868\n    """\n    out = []\n    for x in u32s:\n        out.append(x & 0xFFFF)           # \u4f4e 16 \u4f4d\n        out.append((x >> 16) & 0xFFFF)   # \u9ad8 16 \u4f4d\n    return out\n\ndef unpacklo_epi16(a16, b16):\n    """\n    \u6a21\u62df SSE2 \u7684 _mm_unpacklo_epi16 \u6307\u4ee4\n    \u4ea4\u7ec7\u4e24\u4e2a uint16 \u5217\u8868\u7684\u4f4e 4 \u4e2a\u5143\u7d20\n\n    Args:\n        a16, b16: \u5305\u542b 8 \u4e2a uint16 \u503c\u7684\u5217\u8868\n    Returns:\n        list: \u4ea4\u7ec7\u540e\u7684 8 \u4e2a uint16 \u503c\n    """\n    res = []\n    for i in range(4):\n        res.append(a16[i])\n        res.append(b16[i])\n    return res\n\ndef unpackhi_epi16(a16, b16):\n    """\n    \u6a21\u62df SSE2 \u7684 _mm_unpackhi_epi16 \u6307\u4ee4\n    \u4ea4\u7ec7\u4e24\u4e2a uint16 \u5217\u8868\u7684\u9ad8 4 \u4e2a\u5143\u7d20\n\n    Args:\n        a16, b16: \u5305\u542b 8 \u4e2a uint16 \u503c\u7684\u5217\u8868\n    Returns:\n        list: \u4ea4\u7ec7\u540e\u7684 8 \u4e2a uint16 \u503c\n    """\n    res = []\n    for i in range(4, 8):\n        res.append(a16[i])\n        res.append(b16[i])\n    return res\n\ndef packus_epi16_to_bytes(a16, b16):\n    """\n    \u6a21\u62df SSE2 \u7684 _mm_packus_epi16 \u6307\u4ee4\n    \u5c06 uint16 \u503c\u622a\u65ad\u4e3a uint8\uff08\u9971\u548c\u5904\u7406\uff09\uff0c\u7136\u540e\u62fc\u63a5\n\n    Args:\n        a16, b16: \u5404\u5305\u542b 8 \u4e2a uint16 \u503c\u7684\u5217\u8868\n    Returns:\n        bytes: 16 \u5b57\u8282\u7684\u5b57\u8282\u5e8f\u5217\uff08\u5148 a16 \u7684 8 \u5b57\u8282\uff0c\u518d b16 \u7684 8 \u5b57\u8282\uff09\n    """\n    out = bytearray()\n    for v in a16:\n        out.append(v & 0xFF)  # \u622a\u65ad\u4e3a byte\n    for v in b16:\n        out.append(v & 0xFF)\n    return bytes(out)\n\ndef bytes_to_u16_pairs_le(b):\n    """\n    \u5c06 16 \u5b57\u8282\u5e8f\u5217\u8f6c\u6362\u4e3a 8 \u4e2a uint16 \u503c\uff08\u5c0f\u7aef\u5e8f\uff09\n\n    Args:\n        b: 16 \u5b57\u8282\u7684\u5b57\u8282\u5e8f\u5217\n    Returns:\n        list: 8 \u4e2a uint16 \u503c\u7684\u5217\u8868\n    """\n    out = []\n    for i in range(0, 16, 2):\n        out.append(b[i] | (b[i + 1] << 8))\n    return out\n\ndef u16_pairs_to_bytes_le(u16s):\n    """\n    \u5c06 uint16 \u5217\u8868\u8f6c\u6362\u4e3a\u5b57\u8282\u5e8f\u5217\uff08\u5c0f\u7aef\u5e8f\uff09\n\n    Args:\n        u16s: uint16 \u503c\u5217\u8868\n    Returns:\n        bytes: \u5bf9\u5e94\u7684\u5b57\u8282\u5e8f\u5217\n    """\n    out = bytearray()\n    for v in u16s:\n        out += struct.pack("<H", v & 0xFFFF)\n    return bytes(out)\n\ndef rol8(x, n):\n    """8 \u4f4d\u5faa\u73af\u5de6\u79fb"""\n    return ((x << n) & 0xFF) | ((x & 0xFF) >> (8 - n))\n\ndef ror8(x, n):\n    """8 \u4f4d\u5faa\u73af\u53f3\u79fb"""\n    return ((x & 0xFF) >> n) | ((x << (8 - n)) & 0xFF)\n\n# ==================== \u5df2\u77e5\u5e38\u91cf\u4e0e\u914d\u7f6e ====================\n\n# XMM \u5bc4\u5b58\u5668\u521d\u59cb\u503c\uff08\u4ece IDA \u9006\u5411\u5206\u6790\u83b7\u5f97\uff09\n# xmmword_37B330 = [0, 1, 2, 3]\nxmm_u32 = [0, 1, 2, 3]\n\n# Buf2_ - \u52a0\u5bc6\u540e\u7684 flag2 \u6570\u636e\uff0844 \u5b57\u8282\uff09\n# \u4ece\u4e8c\u8fdb\u5236\u6587\u4ef6\u7684 .data \u6bb5\u63d0\u53d6\nbuf2_hex = (\n    "94 58 B2 65 E6 F2 42 AF 40 BA E7 7C A8 9E A6 4A "\n    "A9 E6 B5 E0 77 81 32 13 0B D8 57 40 2E 7D 9B 33 "\n    "D4 BB 16 9E D0 F1 43 79 CC 7B 47 5D"\n)\nbuf2 = bytes(int(x, 16) for x in buf2_hex.split())\n\n# Blocka - \u52a0\u5bc6\u540e\u7684 flag1 \u6570\u636e\n# \u6ce8\u610f\uff1a\u8fd9\u662f\u793a\u4f8b\u6570\u636e\uff0c\u5982\u679c\u6709\u5b8c\u6574\u7684 blocka.bin \u8bf7\u66ff\u6362\nblocka_hex = (\n    "24 59 19 FD B6 9D 27 43 1D E8 BE 8A 1D 58 1D C5 "\n    "FA 8D 7B 56 49 A9 AC DD 26 50 19 FE AF 8A 27 53 "\n    "05 AB AB AB AB AB AB AB AB FE EE FE EE FE EE FE"\n)\nblocka = bytes(int(x, 16) for x in blocka_hex.split())\n\n# Flag1 \u89e3\u5bc6\u5bc6\u94a5\uff08\u901a\u8fc7\u9006\u5411\u5206\u6790\u83b7\u5f97\uff09\nkey_flag1 = [0x42, 0x35, 0x78, 0x9A, 0xCD, 0xEF]\n\n# ==================== \u6838\u5fc3\u7b97\u6cd5\uff1aS-box \u4e0e C \u8868\u751f\u6210 ====================\n\ndef build_sbox_and_C(xmm_u32):\n    """\n    \u9759\u6001\u91cd\u5efa\u52a0\u5bc6\u7b97\u6cd5\u4e2d\u7684 S-box \u548c C \u67e5\u627e\u8868\n\n    \u8be5\u51fd\u6570\u6a21\u62df\u9006\u5411\u5f97\u5230\u7684\u52a0\u5bc6\u51fd\u6570\uff08sub_372270\uff09\u4e2d\u7684\u521d\u59cb\u5316\u8fc7\u7a0b\uff0c\n    \u901a\u8fc7 SSE2 \u6307\u4ee4\u6a21\u62df\u751f\u6210 256 \u5b57\u8282\u7684 S-box \u548c C \u8868\n\n    Args:\n        xmm_u32: XMM \u5bc4\u5b58\u5668\u521d\u59cb\u503c\uff084 \u4e2a uint32\uff09\n\n    Returns:\n        tuple: (sbox, C_all) - \u5404 256 \u5b57\u8282\u7684\u67e5\u627e\u8868\n    """\n    # \u521d\u59cb\u5316\u5de5\u4f5c\u53d8\u91cf\n    v7 = list(xmm_u32)\n\n    # \u5e38\u91cf\u5b9a\u4e49\uff08\u6a21\u62df SIMD \u5411\u91cf\u64cd\u4f5c\uff09\n    SHUFFLE_4 = u32_repeat(4)\n    SHUFFLE_8 = u32_repeat(8)\n    SHUFFLE_0xC = u32_repeat(0xC)\n    SHUFFLE_0x10 = u32_repeat(0x10)\n    MASK_0x00FF = 0x00FF\n    MASK_0xF0F0 = 0xF0F0\n    CONST_0x2A = 0x2A\n    V45 = 0xAA\n\n    sbox = bytearray()\n    C_all = bytearray()\n\n    # ===== \u7b2c\u4e00\u4e2a\u5faa\u73af\uff1a\u751f\u6210 S-box (v48) =====\n    # \u901a\u8fc7 16 \u6b21\u8fed\u4ee3\uff0c\u6bcf\u6b21\u751f\u6210 16 \u5b57\u8282\uff0c\u5171 256 \u5b57\u8282\n    for _ in range(16):\n        # \u590d\u6742\u7684 SIMD shuffle \u64cd\u4f5c\u5e8f\u5217\n        v12 = u32s_add(v7, SHUFFLE_4)\n        v7_u16 = u32s_to_u16_list(v7)\n        v12_u16 = u32s_to_u16_list(v12)\n        v13 = unpackhi_epi16(v7_u16, v12_u16)\n        v14 = unpacklo_epi16(v7_u16, v12_u16)\n        v15_u32 = u32s_add(v7, SHUFFLE_0xC)\n        v15_u16 = u32s_to_u16_list(v15_u32)\n\n        # \u591a\u5c42\u4ea4\u7ec7\u64cd\u4f5c\n        A = unpacklo_epi16(v14, v13)\n        B = unpackhi_epi16(v14, v13)\n        v16 = unpacklo_epi16(A, B)\n\n        v17 = u32s_add(v7, SHUFFLE_8)\n        v17_u16 = u32s_to_u16_list(v17)\n        v18 = unpacklo_epi16(v17_u16, v15_u16)\n        v19 = unpackhi_epi16(v17_u16, v15_u16)\n\n        # \u63d0\u53d6\u4f4e\u5b57\u8282\u5e76\u6253\u5305\n        a16 = [x & MASK_0x00FF for x in v16]\n        B1 = unpacklo_epi16(v18, v19)\n        B2 = unpackhi_epi16(v18, v19)\n        b16 = unpacklo_epi16(B1, B2)\n        b16 = [x & MASK_0x00FF for x in b16]\n\n        v20 = packus_epi16_to_bytes(a16, b16)  # 16 bytes\n\n        # \u7b97\u672f\u53d8\u6362\uff1av22 = 5 * v20 (\u9010\u5b57\u8282)\n        v22_bytes = bytes((5 * x) & 0xFF for x in v20)\n\n        # term2: \u5de6\u79fb 4 \u4f4d\u5e76\u5e94\u7528\u63a9\u7801 0xF0F0\n        v22_u16 = bytes_to_u16_pairs_le(v22_bytes)\n        term2_u16 = [(((v << 4) & 0xFFFF) & MASK_0xF0F0) for v in v22_u16]\n        term2_bytes = u16_pairs_to_bytes_le(term2_u16)\n\n        # \u6c42\u548c\u5e76\u53d6\u8865\n        sum_bytes = bytes((x + y) & 0xFF for x, y in zip(v22_bytes, term2_bytes))\n        res_bytes = bytes((CONST_0x2A - x) & 0xFF for x in sum_bytes)\n\n        sbox += res_bytes\n        v7 = u32s_add(v7, SHUFFLE_0x10)\n\n    # ===== \u7b2c\u4e8c\u4e2a\u5faa\u73af\uff1a\u751f\u6210 C \u8868 (C_all) =====\n    # \u540c\u6837\u901a\u8fc7 16 \u6b21\u8fed\u4ee3\uff0c\u6bcf\u6b21\u751f\u6210 16 \u5b57\u8282\uff0c\u5171 256 \u5b57\u8282\n    v31 = list(xmm_u32)\n    for _ in range(16):\n        # \u7c7b\u4f3c\u7684 SIMD \u64cd\u4f5c\u5e8f\u5217\n        v33 = u32_repeat(4)\n        v34 = u32_repeat(8)\n        v46 = u32_repeat(0xC)\n        v36 = u32s_add(v31, v33)\n        v36_u16 = u32s_to_u16_list(v36)\n        v31_u16 = u32s_to_u16_list(v31)\n\n        v37 = unpackhi_epi16(v31_u16, v36_u16)\n        v38_u32 = u32s_add(v46, v31)\n        v38_u16 = u32s_to_u16_list(v38_u32)\n        v39 = unpacklo_epi16(v31_u16, v36_u16)\n\n        # \u591a\u5c42\u4ea4\u7ec7\n        A = unpacklo_epi16(v39, v37)\n        B = unpackhi_epi16(v39, v37)\n        v40 = unpacklo_epi16(A, B)\n\n        v41 = u32s_add(v31, v34)\n        v41_u16 = u32s_to_u16_list(v41)\n        v42 = unpacklo_epi16(v41_u16, v38_u16)\n        v43 = unpackhi_epi16(v41_u16, v38_u16)\n\n        # \u63d0\u53d6\u4f4e\u5b57\u8282\u5e76\u6253\u5305\n        a16 = [x & MASK_0x00FF for x in v40]\n        B1 = unpacklo_epi16(v42, v43)\n        B2 = unpackhi_epi16(v42, v43)\n        b16 = unpacklo_epi16(B1, B2)\n        b16 = [x & MASK_0x00FF for x in b16]\n\n        packed = packus_epi16_to_bytes(a16, b16)  # 16 bytes\n        # \u6bcf\u5b57\u8282\u52a0\u4e0a\u5e38\u91cf V45 (0xAA)\n        firstArg = bytes((x + V45) & 0xFF for x in packed)\n        C_all += firstArg\n        v31 = u32s_add(v31, u32_repeat(0x10))\n\n    return bytes(sbox), bytes(C_all)\n\n# ==================== Flag2 \u89e3\u5bc6\u7b97\u6cd5 ====================\n\ndef invert_flag2(sbox, C_all, buf2):\n    """\n    \u4ece\u52a0\u5bc6\u540e\u7684 buf2 \u6570\u636e\u53cd\u63a8\u539f\u59cb flag2\n\n    \u52a0\u5bc6\u8fc7\u7a0b\uff08\u9006\u5411\u5f97\u5230\uff09\uff1a\n    1. index = plaintext[i] ^ 0x33\n    2. v48 = sbox[index]\n    3. v47 = ROR(v48, 3)\n    4. ciphertext[i] = v47 ^ C_all[i]\n\n    \u56e0\u6b64\u89e3\u5bc6\u8fc7\u7a0b\uff1a\n    1. v47 = ciphertext[i] ^ C_all[i]\n    2. v48 = ROL(v47, 3)\n    3. index = sbox_inverse[v48]\n    4. plaintext[i] = index ^ 0x33\n\n    Args:\n        sbox: 256 \u5b57\u8282\u7684 S-box \u67e5\u627e\u8868\n        C_all: 256 \u5b57\u8282\u7684 C \u67e5\u627e\u8868\n        buf2: \u52a0\u5bc6\u540e\u7684\u6570\u636e\n\n    Returns:\n        tuple: (flag\u5b57\u7b26\u4e32, flag\u5b57\u8282\u5e8f\u5217)\n    """\n    # \u6784\u5efa S-box \u7684\u53cd\u5411\u67e5\u627e\u8868\n    rev = defaultdict(list)\n    for i, y in enumerate(sbox):\n        rev[y].append(i)\n\n    C44 = C_all[:len(buf2)]\n    res = bytearray(len(buf2))\n\n    for i in range(len(buf2)):\n        # \u6b65\u9aa41\uff1a\u53bb\u9664 C \u8868\u7684 XOR\n        target = buf2[i] ^ C44[i]  # \u5f97\u5230 v47\uff08\u7ecf\u8fc7 ROR \u7684\u503c\uff09\n\n        # \u6b65\u9aa42\uff1a\u9006\u5411\u5faa\u73af\u53f3\u79fb\uff08\u4f7f\u7528\u5faa\u73af\u5de6\u79fb\uff09\n        # v47 = ROR(v48, 3) => v48 = ROL(v47, 3)\n        needed = rol8(target, 3)\n\n        # \u6b65\u9aa43\uff1a\u5728 S-box \u4e2d\u67e5\u627e\u539f\u59cb\u7d22\u5f15\n        if needed not in rev:\n            raise ValueError(f"S-box \u53cd\u5411\u67e5\u627e\u5931\u8d25\uff1a0x{needed:02X} \u5728\u4f4d\u7f6e {i}")\n        idx = rev[needed][0]  # \u5982\u679c\u6709\u591a\u4e2a\u524d\u50cf\uff0c\u53d6\u7b2c\u4e00\u4e2a\n\n        # \u6b65\u9aa44\uff1a\u53bb\u9664\u6700\u521d\u7684 XOR 0x33\n        res[i] = idx ^ 0x33\n\n    # \u5c1d\u8bd5\u89e3\u7801\u4e3a UTF-8 \u5b57\u7b26\u4e32\n    try:\n        flag2 = res.decode('utf-8')\n    except Exception:\n        flag2 = "hex:" + res.hex()\n\n    return flag2, res\n\n# ==================== Flag1 \u89e3\u5bc6\u7b97\u6cd5 ====================\n\ndef solve_flag1_from_blocka(blocka_bytes, key):\n    """\n    \u4ece\u52a0\u5bc6\u540e\u7684 blocka \u6570\u636e\u89e3\u5bc6 flag1\n\n    \u52a0\u5bc6\u7b97\u6cd5\uff1a\u7b80\u5355\u7684\u5faa\u73af\u5bc6\u94a5 XOR\n    ciphertext[i] = plaintext[i] ^ key[i % key_length]\n\n    \u89e3\u5bc6\u7b97\u6cd5\uff1a\u4f7f\u7528\u76f8\u540c\u7684 XOR \u64cd\u4f5c\uff08XOR \u7684\u5bf9\u79f0\u6027\uff09\n    plaintext[i] = ciphertext[i] ^ key[i % key_length]\n\n    Args:\n        blocka_bytes: \u52a0\u5bc6\u540e\u7684\u6570\u636e\n        key: XOR \u5bc6\u94a5\uff08\u5217\u8868\u6216\u5b57\u8282\u5e8f\u5217\uff09\n\n    Returns:\n        tuple: (flag\u5b57\u7b26\u4e32, flag\u5b57\u8282\u5e8f\u5217)\n    """\n    # \u4f7f\u7528\u5faa\u73af\u5bc6\u94a5\u8fdb\u884c XOR \u89e3\u5bc6\n    res = bytes(blocka_bytes[i] ^ key[i % len(key)] for i in range(len(blocka_bytes)))\n\n    # \u5c1d\u8bd5\u89e3\u7801\u4e3a UTF-8 \u5b57\u7b26\u4e32\n    try:\n        return res.decode('utf-8'), res\n    except:\n        return "hex:" + res.hex(), res\n\n# ==================== \u4e3b\u7a0b\u5e8f ====================\n\ndef main():\n    """\n    \u4e3b\u51fd\u6570\uff1a\u6267\u884c\u5b8c\u6574\u7684 Flag \u89e3\u5bc6\u6d41\u7a0b\n\n    \u6d41\u7a0b\uff1a\n    1. \u91cd\u5efa S-box \u548c C \u8868\n    2. \u4f7f\u7528 S-box \u548c C \u8868\u89e3\u5bc6 flag2\n    3. \u53ef\u9009\uff1a\u4f7f\u7528 XOR \u5bc6\u94a5\u89e3\u5bc6 flag1\n    """\n    print("=" * 60)\n    print("CTF Flag Solver - \u9759\u6001\u5206\u6790\u4e0e\u5bc6\u7801\u5b66\u9006\u5411\u5de5\u5177")\n    print("=" * 60)\n\n    # ===== \u6b65\u9aa41\uff1a\u91cd\u5efa\u67e5\u627e\u8868 =====\n    print("\\n[*] \u6b63\u5728\u91cd\u5efa S-box \u548c C \u8868...")\n    print("    \u521d\u59cb\u5411\u91cf: xmmword_37B330 = [0, 1, 2, 3]")\n    sbox, C_all = build_sbox_and_C(xmm_u32)\n    print(f"[+] \u751f\u6210\u5b8c\u6210: S-box \u957f\u5ea6 = {len(sbox)} \u5b57\u8282, C \u8868\u957f\u5ea6 = {len(C_all)} \u5b57\u8282")\n\n    # \u663e\u793a\u67e5\u627e\u8868\u7684\u524d 44 \u5b57\u8282\uff08\u8c03\u8bd5\u7528\uff09\n    print("\\n[\u8c03\u8bd5\u4fe1\u606f] S-box \u524d 44 \u5b57\u8282:")\n    print("    " + " ".join("%02X" % b for b in sbox[:44]))\n    print("[\u8c03\u8bd5\u4fe1\u606f] C \u8868\u524d 44 \u5b57\u8282:")\n    print("    " + " ".join("%02X" % b for b in C_all[:44]))\n\n    # ===== \u6b65\u9aa42\uff1a\u89e3\u5bc6 Flag2 =====\n    print("\\n" + "=" * 60)\n    print("[*] \u6b63\u5728\u89e3\u5bc6 Flag2...")\n    print(f"    \u52a0\u5bc6\u6570\u636e\u957f\u5ea6: {len(buf2)} \u5b57\u8282")\n    flag2_str, flag2_bytes = invert_flag2(sbox, C_all, buf2)\n    print(f"[+] Flag2 \u89e3\u5bc6\u6210\u529f!")\n    print(f"    Flag2: {flag2_str}")\n\n    # ===== \u6b65\u9aa43\uff1a\u89e3\u5bc6 Flag1\uff08\u53ef\u9009\uff09=====\n    if blocka and len(blocka) > 0:\n        print("\\n" + "=" * 60)\n        print("[*] \u6b63\u5728\u89e3\u5bc6 Flag1...")\n        print(f"    \u52a0\u5bc6\u6570\u636e\u957f\u5ea6: {len(blocka)} \u5b57\u8282")\n        print(f"    \u5bc6\u94a5: {' '.join('%02X' % k for k in key_flag1)}")\n        flag1_str, flag1_bytes = solve_flag1_from_blocka(blocka, key_flag1)\n        print(f"[+] Flag1 \u89e3\u5bc6\u6210\u529f!")\n        print(f"    Flag1: {flag1_str}")\n\n    print("\\n" + "=" * 60)\n    print("\u89e3\u5bc6\u5b8c\u6210\uff01")\n    print("=" * 60)\n\nif __name__ == "__main__":\n    main()<\/code><\/pre>\n
            \"\"<\/p>\n