文章 | heStudio

由于脚本迭代太多，之前的教程已经完全不适合现在的脚本的，给使用脚本的用户带来了些许障碍。我们特此根据现有版本的脚本v4.0.x重新撰写教程。

在写新版脚本之前，我们在 QQ 群里里统计了 Android 用户的版本占比，并根据统计的结果作为优化侧重点。，根据统计结果，我们侧重于高版本 Android 的优化，并推出了导致 proot 容器闪退的集成解决方案，使用户更容易的使用脚本。

建议在安装之前，先粗略的阅读一遍教程和文章底部的文档，方便在遇到问题是及时定位到相应的文档。

undefined2024/12/13大约 3 分钟

base92 | ISCTF2024 | Crypto ChaCha20-Poly1305

原题

from Crypto.Cipher import ChaCha20_Poly1305
import os

key = os.urandom(32)
nonce = os.urandom(12)

with open('flag.txt', 'rb') as f:
    plaintext = f.read()

cipher = ChaCha20_Poly1305.new(key=key, nonce=nonce)

ct, tag = cipher.encrypt_and_digest(plaintext)

print(f"Encrypted Flag: {ct.hex()}")
print(f"Tag: {tag.hex()}")
print(f"Nonce: {nonce.hex()}")

with open('key.txt', 'w') as key_file:
    key_file.write(key.hex())

undefined2024/12/10大约 1 分钟

nodejs_ejs模板_原型链污染 | ISCTF2024 | Web ezejs

打开代码附件，映入眼帘的就是标记好的backdoor

// backdoor
app.post("/UserList", (req, res) => {
  user = req.body;
  const blacklist = ["\\u", "outputFunctionName", "localsName", "escape"];
  const hacker = JSON.stringify(user);
  for (const pattern of blacklist) {
    if (hacker.includes(pattern)) {
      res.status(200).json({ message: "hacker!" });
      return;
    }
  }
  copy(users, user);
  res.status(200).json(user);
});

undefined2024/12/10大约 2 分钟

nodejs反序列化漏洞_CVE-2017-5941利用 | ISCTF2024 | Web ezlogin

打开题目环境后会提示

根据题目源码，我们可以找到路径。

app.get("/login", function (req, res) {
  res.render("login");
});

undefined2024/12/10大约 2 分钟

远程Shell漏洞 | ISCTF2024 | Web ezrce

<?php

error_reporting(0);

if (isset($_GET['cmd'])) {
    $cmd = $_GET['cmd'];

    if (preg_match("/flag|cat|ls|echo|php|bash|sh|more| |less|head|tail|[\|\&\>\<]|eval|system|exec|popen|shell_exec/i", $cmd)) {
        die("Blocked by security filter!");
    } else {
        eval($cmd);
    }
} else {
    highlight_file(__FILE__);
}
?>

undefined2024/12/10小于 1 分钟

逆向加密 | ISCTF2024 | Reverse Ezre

把文件拖进 IDA 分析可得以下内容：

程序运行时，会让你输入 flag，并将你输入的文本传给一个加密算法，如果验证和已加密文本v5吻合，则提示Yeah,You get what you want!!!

我们可以观察到，验证结果在v2上，如果v2为True，则通过验证。

undefined2024/12/10大约 1 分钟

PHP反序列化 | ISCTF2024 | Web ezserialize

<?php
error_reporting(0);

class Flag {
    private $flag;

    public function __construct() {
        $this->flag = file_get_contents('/flag');
    }

    public function getFlag() {
        return $this->flag;
    }

    public function __toString() {
        return "You can't directly access the flag!";
    }
}

class User {
    public $username;
    public $isAdmin = false;

    public function __construct($username) {
        $this->username = $username;
    }

    public function __wakeup() {
        if ($this->isAdmin) {
            echo "Welcome, admin! Here's your flag: " . (new Flag())->getFlag();
        } else {
            echo "Hello, " . htmlspecialchars($this->username) . "!";
        }
    }
}

if (isset($_GET['data'])) {
    $data = $_GET['data'];

    $object = unserialize($data);
    if ($object instanceof User) {
        echo $object;
    } else {
        echo "Invalid object!";
    }
} else {
    highlight_file(__FILE__);
}
?>

undefined2024/12/10大约 1 分钟

费马函数 | ISCTF2024 | Crypto 蓝鲨的费马

原题

import libnum
import gmpy2
from Crypto.Util.number import *

flag=b'ISCTF{********}'
m=bytes_to_long(flag)

p=libnum.generate_prime(1024)
q=libnum.generate_prime(1024)
n=p*q
e=0x10001
c=pow(m,e,n)
d=inverse(e,(p-1)*(q-1))
leak = (d+(pow(p,q,n)+pow(q,p,n)))%n

print("c=", c)
print("n=", n)
print("leak=", leak)

"""
c= 8989289659072309605793417141528767265266446236550650613514493589798432446586991233583435051268377555448062724563967695425657559568596372723980081067589103919296476501677424322525079257328042851349095575718347302884996529329066703597604694781627113384086536158793653551546025090807063130353950841148535682974762381044510423210397947080397718080033363000599995100765708244828566873128882878164321817156170983773105693537799111546309755235573342169431295776881832991533489235535981382958295960435126843833532716436804949502318851112378495533302256759494573250596802016112398817816155228378089079806308296705261876583997
n= 13424018200035368603483071894166480724482952594135293395398366121467209427078817227870501294732149372214083432516059795712917132804111155585926502759533393295089100965059106772393520277313184519450478832376508528256865861027444446718552169503579478134286009893965458507369983396982525906466073384013443851551139147777507283791250268462136554061959016630318688169168797939873600493494258467352326974238472394214986505312411729432927489878418792288365594455065912126527908319239444514857325441614280498882524432151918146061570116187524918358453036228204087993064505391742062288050068745930452767100091519798860487150247
leak= 9192002086528025412361053058922669469031188193149143635074798633855112230489479254740324032262690315813650428270911079121913869290893574897752990491429582640499542165616254566396564016734157323265631446079744216458719690853526969359930225042993006404843355356540487296896949431969541367144841985153231095140361069256753593550199420993461786814074270171257117410848796614931926182811404655619662690700351986753661502438299236428991412206196135090756862851230228396476709412020941670878645924203989895008014836619321109848938770269989596541278600166088022166386213646074764712810133558692545401032391239330088256431881
"""

undefined2024/12/10小于 1 分钟

栈溢出 | ISCTF2024 | PWN girlfriend

打开 IDA，并分析代码。

int __fastcall main(int argc, const char **argv, const char **envp)
{
  _BYTE buf[40]; // [rsp+0h] [rbp-30h] BYREF
  char s1[8]; // [rsp+28h] [rbp-8h] BYREF

  init(argc, argv, envp);
  puts("welcome to isctf2024");
  puts("first i need your team id");
  read(0, buf, 0x30uLL);
  if ( strcmp(s1, "admin") )
  {
    puts("no no no");
    exit(0);
  }
  puts("ok, go on");
  vuln();
  return 0;
}

undefined2024/12/10小于 1 分钟

PHP特性利用 | ISCTF2024 | Web 小蓝鲨的冒险

原题

<?php
error_reporting(0);
highlight_file(__FILE__);
$a = "isctf2024";
$b = $_GET["b"];
@parse_str($b);
echo "小蓝鲨开始闯关，你能帮助他拿到flag吗?<br>";
if ($a[0] != 'QNKCDZO' && md5($a[0]) == md5('QNKCDZO')) {
    $num = $_POST["num"];
    echo "第一关有惊无险！小蓝鲨壮着胆子接着继续往下走！<br>";
    if($num == 2024){
        die("QAQ小蓝鲨误入陷阱，不怕，再接再厉！");
    }
    if(preg_match("/[a-z]/i", $num)){
        die("陷阱太多QAQ");
    }
    if(intval($num,0) == 2024){
        echo "到这了难道还要放弃吗？<br>";
        if (isset($_GET['which'])){
            $which = $_GET['which'];
            echo "小蓝鲨貌似在哪里见过这个陷阱O.o?继续加油，还差最后一步了！";
            switch ($which){
                case 0:
                    print('QAQ');
                case 1:
                case 2:
                    require_once $which.'.php';
                    echo $flag;
                    break;
                default:
                    echo GWF_HTML::error('PHP-0817', 'Hacker NoNoNo!', false);
                    break;
            }
        }
    }
}

undefined2024/12/10大约 2 分钟