我好困啊

1
from Crypto.Util.number import long_to_bytes, inverse
2

3
# 挑战中给出的数值
4
p = 71380997427449345634700552609577271052193856747526826598031269184817312570231
5
q = 65531748297495117965939047069388412545623909154912018722160805504300279801251
6
gift1 = 40365143212042701723922505647865230754866250738391105510918441288000789123995
7
gift2 = 10698628345523517254945893573969253712072344217500232111817321788145975103342
8

9
def solve_crt(a1, n1, a2, n2):
10
    """求解同余方程组 x ≡ a1 (mod n1), x ≡ a2 (mod n2)"""
11
    N = n1 * n2
12
    # 使用公式: x = a1*n2*inv(n2,n1) + a2*n1*inv(n1,n2) mod N
13
    # 其中 inv(a, m) 是 a 在模 m 下的乘法逆元
14
    x = (a1 * n2 * inverse(n2, n1) + a2 * n1 * inverse(n1, n2)) % N
15
    return x
16

17
# m 的四种可能同余情况
18
# m 与 (+/-)gift1 模 p 同余
19
# m 与 (+/-)gift2 模 q 同余
20
options = [
21
    (gift1, gift2),
22
    (gift1, -gift2 % q),
23
    (-gift1 % p, gift2),
24
    (-gift1 % p, -gift2 % q)
25
]
26

27
print("正在检查所有4种可能的解：")
28
for res_p, res_q in options:
29
    # 使用中国剩余定理 (Chinese Remainder Theorem) 求解 m
30
    m_candidate = solve_crt(res_p, p, res_q, q)
31
    try:
32
        # 将数字转换回字节，看看它是否是 flag
33
        flag = long_to_bytes(m_candidate)
34
        # 检查结果是否为包含 'flag' 的可打印字符串
35
        if b'flag' in flag:
36
            print(f"[*] 找到 Flag: {flag.decode()}")
37
        else:
38
            print(f"[ ] 不是 Flag: {flag}")
39
    except Exception as e:
40
        print(f"[!] 转换候选值时出错: {e}")

1
正在检查所有4种可能的解：
2
[ ] 不是 Flag: b'YP:\x08gM{\x80\xc0\x9b\xe38\xe1\x86\x81\xe7%\xc8\xae\xce^\x9b^P!\x06\x18\xf0\x92\x87\xf2C\xba"\xba\xe7]\xcbsg\xc0\xf2d\xa3\xc0,\xf6s\'/\x8e\xfd\xdb\xf1\x92\x08\x7f\xe4`\xf4\'s6H'
3
[ ] 不是 Flag: b"5a\x85\x14\xca\xaa\xa4\xce\xcb\xad\x81\xe4\xbb\xd1\xa4Gz\xb6\xa1l\x05\x1c\x00\xccX'\xc4,\xcc\x8f\xfb \xc7Y\xdb\xae\x93\xfc\xf4\xd4?F\xa9\x80C\x84\xd1{\xbec\x02lm\xa3\x85\xbf\xcb\xa0\x1f\xbeJ\x83s\xd0"
4
[ ] 不是 Flag: b'#\xee\xb4\xf3\x9c\xa2\xd6\xb1\xf4\xeeaT%\xb4\xdd\x9f\xab\x12\rbY\x7f]\x83\xc8\xdeU*2Y^\x9eG1\x12\x98,\xfe\xf1\x01\xe7\x1d\xf0\x97\xad\x16\x8aV\x992\xeb\xd4\xa0\xc7|\xbc\xe4\xab\xb3vMX;\xf5'
5
[*] 找到 Flag: flag{Th3_c0rner5t0ne_0f_C2ypt0gr@phy}

1
#!/usr/bin/env python3
2
# -*- coding: utf-8 -*-
3
from pwn import remote, xor
4
from base64 import b64decode
5
import re
6

7
HOST = 'challenge.ilovectf.cn'
8
PORT = 30001
9

10
def parse_b64_from_line_str(line: str) -> str:
11
    """
12
    Parse patterns like: [*] 首次密文(base64):b'...'
13
    Return the inner base64 string (as str), or fallback part after colon.
14
    """
15
    m = re.search(r"b'([^']+)'", line)
16
    if m:
17
        return m.group(1)
18
    # fallback: take after last colon and strip
19
    part = line.split(':', 1)[-1].strip()
20
    # if starts with b' and ends with '
21
    if part.startswith("b'") and part.endswith("'"):
22
        return part[2:-1]
23
    return part
24

25
def rotate(bs: bytes, s: int) -> bytes:
26
    s %= len(bs)
27
    return bs[s:] + bs[:s]
28

29
def main():
30
    r = remote(HOST, PORT)
31
    # read until the line containing the first cipher
32
    first_cipher_b64 = None
33
    while True:
34
        raw = r.recvline(timeout=5)
35
        if not raw:
36
            break
37
        try:
38
            line = raw.decode('utf-8', errors='ignore')
39
        except:
40
            line = str(raw)
41
        # print(line, end='')  # uncomment to debug
42
        if '首次密文(base64):' in line or '首次密文' in line:
43
            b64 = parse_b64_from_line_str(line)
44
            if b64:
45
                first_cipher_b64 = b64
46
                break
47
            # maybe next line contains the b'...'
48
            nxt_raw = r.recvline(timeout=2)
49
            if not nxt_raw:
50
                break
51
            try:
52
                nxt = nxt_raw.decode('utf-8', errors='ignore')
53
            except:
54
                nxt = str(nxt_raw)
55
            first_cipher_b64 = parse_b64_from_line_str(nxt)
56
            break
57

58
    if not first_cipher_b64:
59
        print("无法读取首次密文，退出。收到的最后输出（utf-8-ignore）:")
60
        print(r.recv(timeout=1).decode('utf-8', errors='ignore'))
61
        return
62

63
    c1 = b64decode(first_cipher_b64)
64
    msg_len = len(c1)
65
    print(f"[+] detected msg_len = {msg_len}")
66
    pad0 = bytes([msg_len]) * msg_len
67

68
    def enc_empty():
69
        r.sendline("1")                 # send menu choice as str; pwntools will encode
70
        # wait prompt (decode stream until prompt appears)
71
        blk = r.recvuntil("请输入要加密的消息".encode(), timeout=3) if isinstance(b"dummy", bytes) else None
72
        # send an empty line (service will treat it as empty input)
73
        r.sendline(b"")
74
        # read until we see the line that contains the ciphertext
75
        while True:
76
            raw = r.recvline(timeout=4)
77
            if not raw:
78
                break
79
            try:
80
                line = raw.decode('utf-8', errors='ignore')
81
            except:
82
                line = str(raw)
83
            if '你的消息已加密(密文):' in line or '你的消息已加密' in line:
84
                return parse_b64_from_line_str(line)
85
        return None
86

87
    print("[*] 请求两次空消息加密以恢复轮转 keystream...")
88
    b64_2 = enc_empty()
89
    if not b64_2:
90
        print("enc_empty failed (1)")
91
        return
92
    b64_3 = enc_empty()
93
    if not b64_3:
94
        print("enc_empty failed (2)")
95
        return
96

97
    c2 = b64decode(b64_2)
98
    c3 = b64decode(b64_3)
99

100
    k2 = xor(c2, pad0)
101
    k3 = xor(c3, pad0)
102

103
    s = None
104
    for shift in range(msg_len):
105
        if rotate(k2, shift) == k3:
106
            s = shift
107
            break
108
    if s is None:
109
        print("无法确定 offset（未找到使 k2 轮转到 k3 的 shift）")
110
        return
111
    print(f"[+] detected offset = {s} (mod {msg_len})")
112

113
    k1 = rotate(k2, (-s) % msg_len)
114
    padded = xor(c1, k1)
115
    pad_len = padded[-1]
116
    if pad_len <= 0 or pad_len > msg_len:
117
        print("[!] padding length 看起来不对，打印 padded (hex):")
118
        print(padded.hex())
119
        return
120

121
    if padded[-pad_len:] != bytes([pad_len]) * pad_len:
122
        print("[!] padding 验证失败，但仍尝试截取前部")
123
    plaintext = padded[:-pad_len]
124
    print("[+] recovered plaintext (bytes):", plaintext)
125
    try:
126
        print("[+] recovered plaintext (utf-8):", plaintext.decode())
127
    except:
128
        pass
129

130
    # submit via menu option 2
131
    r.sendline("2")
132
    r.recvuntil("请输入待校验的明文", timeout=3)
133
    r.sendline(plaintext)
134
    # read responses
135
    out = r.recvall(timeout=3)
136
    try:
137
        print(out.decode('utf-8', errors='ignore'))
138
    except:
139
        print(out)
140
    r.close()
141

142
if __name__ == "__main__":
143
    main()

1
(base) ➜  [Week1] Strange Machine python exp.py
2
[+] Opening connection to challenge.ilovectf.cn on port 30001: Done
3
[+] detected msg_len = 16
4
[*] 请求两次空消息加密以恢复轮转 keystream...
5
/Users/chao/tmp/ctf/crypto/[Week1] Strange Machine/exp.py:69: BytesWarning: Text is not bytes; assuming ASCII, no guarantees. See https://docs.pwntools.com/#bytes
6
  r.sendline("1")                 # send menu choice as str; pwntools will encode
7
[+] detected offset = 3 (mod 16)
8
[+] recovered plaintext (bytes): b'Oh,you find it!'
9
[+] recovered plaintext (utf-8): Oh,you find it!
10
/Users/chao/tmp/ctf/crypto/[Week1] Strange Machine/exp.py:131: BytesWarning: Text is not bytes; assuming ASCII, no guarantees. See https://docs.pwntools.com/#bytes
11
  r.sendline("2")
12
/Users/chao/tmp/ctf/crypto/[Week1] Strange Machine/exp.py:132: BytesWarning: Text is not bytes; assuming UTF-8, no guarantees. See https://docs.pwntools.com/#bytes
13
  r.recvuntil("请输入待校验的明文", timeout=3)
14
[+] Receiving all data: Done (68B)
15
[*] Closed connection to challenge.ilovectf.cn port 30001
16
: [*] 这是你的flag: flag{6d8c67e5-c9fe-4eb9-8eb1-806e3821978f}

1
# 挑战中的密文
2
base17_string = "807G6F429C7FA2200F46525G1350AB20G339D2GB7D8"
3

4
# Base17 (17进制) 使用的字符集
5
base17_alphabet = "0123456789ABCDEFG"
6

7
# 将Base17字符串转换为十进制整数
8
decimal_value = 0
9
for char in base17_string:
10
    decimal_value = decimal_value * 17 + base17_alphabet.find(char)
11

12
# 将整数转换为字节，然后用ASCII解码
13
# 首先，计算所需的字节数
14
byte_length = (decimal_value.bit_length() + 7) // 8
15
# 转换为字节
16
byte_string = decimal_value.to_bytes(byte_length, 'big')
17
# 解码得到flag
18
flag = byte_string.decode('ascii')
19

20
print(flag)
21
# 输出: flag{welc0me_t0_?CTF!}

1
# Attempt to recover p and q given n and x = p ^ q, then recover the flag m from c.
2
# This uses a bit-by-bit backtracking reconstruction using constraints from n mod 2^k.
3
# The provided n, e, c, p_q are pasted from the user's problem.
4
from math import ceil, log2
5

6
n = 18061840786617912438996345214060567122008006566608565470922708255493870675991346333993136865435336505071047681829600696007854811200192979026938621307808394735367086257150823868393502421947362103403305323343329530015886676141404847528567199164203106041887980250901224907217271412495658238000428155863230216487699143138174899315041844320680520430921010039515451825289303532974354096690654604842256150621697967106463329359391655215554171614421198047559849727235032270127681416682155240317343037276968357231651722266548626117109961613350614054537118394055824940789414473424585411579459583308685751324937629321503890169493
7
e = 65537
8
c = 17953801553187442264071031639061239403375267544951822039441227630063465978993165328404783737755442118967031318698748459837999730471765908918892704038188635488634468552787554559846820727286284092716064629914340869208385181357615817945878013584555521801850998319665267313161882027213027139165137714815505996438717880253578538572193138954426764798279057176765746717949395519605845713927900919261836299232964938356193758253134547047068462259994112344727081440167173365263585740454211244943993795874099027593823941471126840495765154866313478322190748184566075583279428244873773602323938633975628368752872219283896862671494
9
x = 88775678961253172728085584203578801290397779093162231659217341400681830680568426254559677076410830059833478580229352545860384843730990300398061904514493264881401520881423698800064247530838838305224202665605992991627155227589402516343855527142200730379513934493657380099647739065365753038212480664586174926100
10

11
# helper functions
12
def bits_of(n):
13
    return n.bit_length()
14

15
BITS = max(bits_of(n), bits_of(x))
16
mask_cache = [(1<<i)-1 for i in range(BITS+2)]
17

18
n_bits = n.bit_length()
19

20
# Precompute n mod 2^k values to compare quickly
21
n_mods = [n & mask_cache[k] for k in range(BITS+1)]
22

23
# We'll reconstruct p and q LSB to MSB.
24
x_bits = [(x>>i)&1 for i in range(BITS)]
25

26
# We'll maintain partial product array: product_mod = current partial product mod 2^k
27
# To update efficiently when we set bit k for p or q, we add contributions p_k * (q_partial) << k and q_k * (p_partial) << k and p_k*q_k << (2k) but latter won't affect modulo 2^{k+1} until 2k < k+1 (i.e. never), so we only need to consider cross-terms.
28
# Simpler (and safe): compute product from known bits each time, since BITS ~ 2048 worst-case but actual p and q ~1024 bits; computing convolution each step is okay.
29

30
from functools import lru_cache
31

32
@lru_cache(None)
33
def compute_partial_product(p_bits_tuple, q_bits_tuple):
34
    # p_bits_tuple and q_bits_tuple are tuples of bits (LSB..MSB known length k)
35
    k = len(p_bits_tuple)
36
    P = 0
37
    Q = 0
38
    for i, b in enumerate(p_bits_tuple):
39
        if b:
40
            P |= (1<<i)
41
    for i, b in enumerate(q_bits_tuple):
42
        if b:
43
            Q |= (1<<i)
44
    return (P * Q) & ((1<<k)-1)
45

46
# backtracking
47
from collections import deque
48

49
def recover_p_q(n, x):
50
    B = x.bit_length()
51
    # We'll try to find p and q with up to B bits, but actual primes may have fewer; allow up to n.bit_length()
52
    max_bits = n.bit_length()//2 + 2  # rough bound
53
    max_bits = max(B, max_bits)
54
    # Start with empty bits
55
    stack = deque()
56
    # state: (i, p_bits_tuple, q_bits_tuple)
57
    stack.append((0, (), ()))
58
    attempt = 0
59
    while stack:
60
        i, p_bits, q_bits = stack.pop()
61
        attempt += 1
62
        if attempt % 100000 == 0:
63
            print(f'Attempts {attempt}, depth {i}')
64
        if i >= max_bits:
65
            # constructed enough bits, try forming integers and check full product == n
66
            P = sum((bit<<idx) for idx, bit in enumerate(p_bits))
67
            Q = sum((bit<<idx) for idx, bit in enumerate(q_bits))
68
            if P*Q == n:
69
                return P, Q
70
            continue
71
        xi = x_bits[i] if i < len(x_bits) else 0
72
        # possible bit pairs (a,b) with a xor b == xi
73
        candidates = []
74
        if xi == 0:
75
            candidates = [(0,0),(1,1)]
76
        else:
77
            candidates = [(0,1),(1,0)]
78
        for a,b in candidates:
79
            new_p = p_bits + (a,)
80
            new_q = q_bits + (b,)
81
            # compute partial product modulo 2^{i+1}
82
            prod_mod = compute_partial_product(new_p, new_q)
83
            if prod_mod != (n & ((1<<(i+1))-1)):
84
                continue
85
            # otherwise push next
86
            stack.append((i+1, new_p, new_q))
87
    return None, None
88

89
p, q = recover_p_q(n, x)
90
if p is None:
91
    print("Failed to recover p and q.")
92
else:
93
    if p*q != n:
94
        p, q = q, p  # swap maybe
95
    print("Recovered p and q. Checking primality...")
96
    print("p bitlen:", p.bit_length(), "q bitlen:", q.bit_length())
97
    # compute private exponent d
98
    from math import gcd
99
    phi = (p-1)*(q-1)
100
    def inv(a, m):
101
        # modular inverse
102
        return pow(a, -1, m)
103
    d = inv(e, phi)
104
    # recover m
105
    m = pow(c, d, n)
106
    # convert to bytes
107
    def long_to_bytes(n):
108
        s = hex(n)[2:]
109
        if len(s)%2:
110
            s = '0'+s
111
        return bytes.fromhex(s)
112
    flag = long_to_bytes(m)
113
    print("Flag:", flag)

1
from Crypto.Cipher import AES
2
from Crypto.Util.number import long_to_bytes
3
from binascii import unhexlify
4

5
# 题目给出的数据
6
xor_output = 91749376808341004327450956291130629671202939702313462998246826182668975563684
7
last_ciphertext_hex = b'8f325d5b5c5454680628fa08746d67cf'
8
msg = b'Welcome to ?CTF! , I hope you can have fun!!!!!!'
9

10
# --- 第一步：恢复密钥 (Key) ---
11

12
# 将大数分割为高128位和低128位
13
# 高128位 (hint_upper)
14
hint_upper_long = xor_output >> 128
15
# 低128位 (hint_lower ^ key)
16
xor_lower_long = xor_output & ((1 << 128) - 1)
17

18
# key = hint_upper ^ (hint_lower ^ key)
19
key_long = hint_upper_long ^ xor_lower_long
20
key = long_to_bytes(key_long, 16)
21

22
print(f"✅ Recovered Key: {key.hex()}")
23

24
# --- 第二步：逆向 CBC 解密链 ---
25

26
# 准备明文块和最后一块密文
27
p1 = msg[0:16]
28
p2 = msg[16:32]
29
p3 = msg[32:48]
30
c3 = unhexlify(last_ciphertext_hex)
31

32
# 创建一个 ECB 模式的解密器，用于解密单个区块
33
# 注意：虽然原始模式是 CBC，但我们手动进行 XOR，所以只需要核心的块解密功能，即 ECB
34
decrypter = AES.new(key, AES.MODE_ECB)
35

36
# 异或操作辅助函数
37
def xor_bytes(a, b):
38
    return bytes(x ^ y for x, y in zip(a, b))
39

40
# 1. 求 C2
41
decrypted_c3 = decrypter.decrypt(c3)
42
c2 = xor_bytes(decrypted_c3, p3)
43

44
# 2. 求 C1
45
decrypted_c2 = decrypter.decrypt(c2)
46
c1 = xor_bytes(decrypted_c2, p2)
47

48
# 3. 求 iv (flag_content)
49
decrypted_c1 = decrypter.decrypt(c1)
50
iv = xor_bytes(decrypted_c1, p1)
51

52
# 组装最终的 flag
53
flag = b'flag{' + iv + b'}'
54
print(f"🚩 Final Flag: {flag.decode()}")

1
✅ Recovered Key: 9b39ce9c46e63788507896d6c16f2d33
2
🚩 Final Flag: flag{CBc_Us3s_Iv!=ECb}

1
Variable  Value
2

3
Kernel Base  0xf80003e06000
4
DTB  0x187000
5
Symbols  file:///Users/chao/miniconda3/lib/python3.13/site-packages/volatility3/symbols/windows/ntkrnlmp.pdb/3844DBB920174967BE7AA4A2C20430FA-2.json.xz
6
Is64Bit  True
7
IsPAE  False
8
layer_name  0 WindowsIntel32e
9
memory_layer  1 FileLayer
10
KdDebuggerDataBlock  0xf80003ff70a0
11
NTBuildLab  7601.17514.amd64fre.win7sp1_rtm.
12
CSDVersion  1
13
KdVersionBlock  0xf80003ff7068
14
Major/Minor  15.7601
15
MachineType  34404
16
KeNumberProcessors  2
17
SystemTime  2025-10-02 17:19:03+00:00
18
NtSystemRoot  C:\Windows
19
NtProductType  NtProductWinNt
20
NtMajorVersion  6
21
NtMinorVersion  1
22
PE MajorOperatingSystemVersion  6
23
PE MinorOperatingSystemVersion  1
24
PE Machine  34404
25
PE TimeDateStamp  Sat Nov 20 09:30:02 2010

1
(base) ➜  forensics vol -f memory.raw windows.pstree
2
Volatility 3 Framework 2.26.2
3

4
PID  PPID  ImageFileName  Offset(V)  Threads  Handles  SessionId  Wow64  CreateTime  ExitTime  Audit  Cmd  Path
5

6
4  0  System  0xfa800905c840  90  556  N/A  False  2025-10-02 15:07:27.000000 UTC  N/A  -  -  -
7
* 232  4  smss.exe  0xfa800a263b30  3  33  N/A  False  2025-10-02 15:07:27.000000 UTC  N/A  \Device\HarddiskVolume1\Windows\System32\smss.exe  \SystemRoot\System32\smss.exe  \SystemRoot\System32\smss.exe
8
304  288  csrss.exe  0xfa800aff3860  9  444  0  False  2025-10-02 15:07:28.000000 UTC  N/A  \Device\HarddiskVolume1\Windows\System32\csrss.exe  -  -
9
344  288  wininit.exe  0xfa800b55cb30  3  76  0  False  2025-10-02 15:07:28.000000 UTC  N/A  \Device\HarddiskVolume1\Windows\System32\wininit.exe  -  -
10
* 468  344  lsm.exe  0xfa800c04d190  11  238  0  False  2025-10-02 15:07:29.000000 UTC  N/A  \Device\HarddiskVolume1\Windows\System32\lsm.exe  C:\Windows\system32\lsm.exe  C:\Windows\system32\lsm.exe
11
* 460  344  lsass.exe  0xfa800b093b30  8  877  0  False  2025-10-02 15:07:29.000000 UTC  N/A  \Device\HarddiskVolume1\Windows\System32\lsass.exe  C:\Windows\system32\lsass.exe  C:\Windows\system32\lsass.exe
12
* 444  344  services.exe  0xfa800b079440  12  215  0  False  2025-10-02 15:07:29.000000 UTC  N/A  \Device\HarddiskVolume1\Windows\System32\services.exe  C:\Windows\system32\services.exe  C:\Windows\system32\services.exe
13
** 640  444  svchost.exe  0xfa800b182290  8  295  0  False  2025-10-02 15:07:29.000000 UTC  N/A  \Device\HarddiskVolume1\Windows\System32\svchost.exe  C:\Windows\system32\svchost.exe -k RPCSS  C:\Windows\system32\svchost.exe
14
** 1568  444  SearchIndexer.  0xfa800af3eb30  13  683  0  False  2025-10-02 15:07:36.000000 UTC  N/A  \Device\HarddiskVolume1\Windows\System32\SearchIndexer.exe  C:\Windows\system32\SearchIndexer.exe /Embedding  C:\Windows\system32\SearchIndexer.exe
15
*** 2204  1568  SearchProtocol  0xfa800a193360  8  277  0  False  2025-10-02 17:18:30.000000 UTC  N/A  \Device\HarddiskVolume1\Windows\System32\SearchProtocolHost.exe  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe15_ Global\UsGthrCtrlFltPipeMssGthrPipe15 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"   C:\Windows\system32\SearchProtocolHost.exe
16
*** 1836  1568  SearchFilterHo  0xfa800b1d79c0  5  93  0  False  2025-10-02 17:18:30.000000 UTC  N/A  \Device\HarddiskVolume1\Windows\System32\SearchFilterHost.exe  "C:\Windows\system32\SearchFilterHost.exe" 0 508 512 520 65536 516   C:\Windows\system32\SearchFilterHost.exe
17
** 1304  444  svchost.exe  0xfa800a145b30  7  107  0  False  2025-10-02 15:11:00.000000 UTC  N/A  \Device\HarddiskVolume1\Windows\System32\svchost.exe  -  -
18
** 2392  444  svchost.exe  0xfa800b6eb8c0  10  367  0  False  2025-10-02 15:07:37.000000 UTC  N/A  \Device\HarddiskVolume1\Windows\System32\svchost.exe  C:\Windows\System32\svchost.exe -k LocalServicePeerNet  C:\Windows\System32\svchost.exe
19
** 1060  444  svchost.exe  0xfa800b8a8960  13  317  0  False  2025-10-02 15:09:31.000000 UTC  N/A  \Device\HarddiskVolume1\Windows\System32\svchost.exe  C:\Windows\System32\svchost.exe -k secsvcs  C:\Windows\System32\svchost.exe
20
** 1496  444  sppsvc.exe  0xfa800b84b060  4  151  0  False  2025-10-02 15:09:31.000000 UTC  N/A  \Device\HarddiskVolume1\Windows\System32\sppsvc.exe  C:\Windows\system32\sppsvc.exe  C:\Windows\system32\sppsvc.exe
21
** 776  444  svchost.exe  0xfa800b21c060  28  558  0  False  2025-10-02 15:07:29.000000 UTC  N/A  \Device\HarddiskVolume1\Windows\System32\svchost.exe  C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted  C:\Windows\System32\svchost.exe
22
*** 1428  776  dwm.exe  0xfa800b4e09b0  3  85  1  False  2025-10-02 15:07:30.000000 UTC  N/A  \Device\HarddiskVolume1\Windows\System32\dwm.exe  "C:\Windows\system32\Dwm.exe"  C:\Windows\system32\Dwm.exe
23
** 264  444  svchost.exe  0xfa800b2bc060  22  663  0  False  2025-10-02 15:07:29.000000 UTC  N/A  \Device\HarddiskVolume1\Windows\System32\svchost.exe  C:\Windows\system32\svchost.exe -k NetworkService  C:\Windows\system32\svchost.exe
24
*** 3048  264  rdpclip.exe  0xfa800a234b30  8  169  1  False  2025-10-02 16:48:56.000000 UTC  N/A  \Device\HarddiskVolume1\Windows\System32\rdpclip.exe  rdpclip  C:\Windows\system32\rdpclip.exe
25
** 1128  444  wmpnetwk.exe  0xfa800b76a060  13  416  0  False  2025-10-02 15:07:36.000000 UTC  N/A  \Device\HarddiskVolume1\Program Files\Windows Media Player\wmpnetwk.exe  "C:\Program Files\Windows Media Player\wmpnetwk.exe"  C:\Program Files\Windows Media Player\wmpnetwk.exe
26
** 1516  444  svchost.exe  0xfa800b6b6b30  25  350  0  False  2025-10-02 15:07:37.000000 UTC  N/A  \Device\HarddiskVolume1\Windows\System32\svchost.exe  C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation  C:\Windows\system32\svchost.exe
27
** 944  444  svchost.exe  0xfa800b287b30  18  506  0  False  2025-10-02 15:07:29.000000 UTC  N/A  \Device\HarddiskVolume1\Windows\System32\svchost.exe  C:\Windows\system32\svchost.exe -k LocalService  C:\Windows\system32\svchost.exe
28
** 1232  444  taskhost.exe  0xfa800b44f420  9  222  1  False  2025-10-02 15:07:29.000000 UTC  N/A  \Device\HarddiskVolume1\Windows\System32\taskhost.exe  "taskhost.exe"  C:\Windows\system32\taskhost.exe
29
** 724  444  svchost.exe  0xfa800a8a1350  24  613  0  False  2025-10-02 15:07:29.000000 UTC  N/A  \Device\HarddiskVolume1\Windows\System32\svchost.exe  C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted  C:\Windows\System32\svchost.exe
30
*** 1860  724  audiodg.exe  0xfa800a172060  7  128  0  False  2025-10-02 17:18:44.000000 UTC  N/A  \Device\HarddiskVolume1\Windows\System32\audiodg.exe  C:\Windows\system32\AUDIODG.EXE 0x5f4  C:\Windows\system32\AUDIODG.EXE
31
** 564  444  svchost.exe  0xfa800b0f2270  10  355  0  False  2025-10-02 15:07:29.000000 UTC  N/A  \Device\HarddiskVolume1\Windows\System32\svchost.exe  C:\Windows\system32\svchost.exe -k DcomLaunch  C:\Windows\system32\svchost.exe
32
** 820  444  svchost.exe  0xfa800b23a9e0  37  1078  0  False  2025-10-02 15:07:29.000000 UTC  N/A  \Device\HarddiskVolume1\Windows\System32\svchost.exe  C:\Windows\system32\svchost.exe -k netsvcs  C:\Windows\system32\svchost.exe
33
** 532  444  spoolsv.exe  0xfa800b3666d0  14  580  0  False  2025-10-02 15:07:29.000000 UTC  N/A  \Device\HarddiskVolume1\Windows\System32\spoolsv.exe  C:\Windows\System32\spoolsv.exe  C:\Windows\System32\spoolsv.exe
34
** 1048  444  svchost.exe  0xfa800b3816c0  19  313  0  False  2025-10-02 15:07:29.000000 UTC  N/A  \Device\HarddiskVolume1\Windows\System32\svchost.exe  C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork  C:\Windows\system32\svchost.exe
35
364  352  csrss.exe  0xfa8009068060  10  283  1  False  2025-10-02 15:07:29.000000 UTC  N/A  \Device\HarddiskVolume1\Windows\System32\csrss.exe  %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16  C:\Windows\system32\csrss.exe
36
* 2620  364  conhost.exe  0xfa80091b6b30  2  59  1  False  2025-10-02 15:23:50.000000 UTC  N/A  \Device\HarddiskVolume1\Windows\System32\conhost.exe  \??\C:\Windows\system32\conhost.exe  C:\Windows\system32\conhost.exe
37
400  352  winlogon.exe  0xfa800b057060  3  117  1  False  2025-10-02 15:07:29.000000 UTC  N/A  \Device\HarddiskVolume1\Windows\System32\winlogon.exe  winlogon.exe  C:\Windows\system32\winlogon.exe
38
1488  1392  explorer.exe  0xfa800b4eeb30  34  1145  1  False  2025-10-02 15:07:30.000000 UTC  N/A  \Device\HarddiskVolume1\Windows\explorer.exe  C:\Windows\Explorer.EXE  C:\Windows\Explorer.EXE
39
* 2024  1488  wordpad.exe  0xfa80091e5b30  6  203  1  False  2025-10-02 17:16:30.000000 UTC  N/A  \Device\HarddiskVolume1\Program Files\Windows NT\Accessories\wordpad.exe  "C:\Program Files\Windows NT\Accessories\WORDPAD.EXE" "C:\Users\C3ngH\Desktop\hint.txt"  C:\Program Files\Windows NT\Accessories\WORDPAD.EXE
40
* 2624  1488  mspaint.exe  0xfa800b3f7a70  6  127  1  False  2025-10-02 17:16:41.000000 UTC  N/A  \Device\HarddiskVolume1\Windows\System32\mspaint.exe  "C:\Windows\system32\mspaint.exe"   C:\Windows\system32\mspaint.exe
41
* 2020  1488  cmd.exe  0xfa800a1ca630  1  22  1  False  2025-10-02 15:23:50.000000 UTC  N/A  \Device\HarddiskVolume1\Windows\System32\cmd.exe  "C:\Windows\system32\cmd.exe"   C:\Windows\system32\cmd.exe
42
** 2716  2020  DumpIt.exe  0xfa800b5fe060  1  25  1  True  2025-10-02 17:19:00.000000 UTC  N/A  \Device\HarddiskVolume1\Users\C3ngH\Desktop\DumpIt.exe  DumpIt.exe  C:\Users\C3ngH\Desktop\DumpIt.exe
43
2516  528  csrss.exe  0xfa800a23d210  7  77  3  False  2025-10-02 16:48:55.000000 UTC  N/A  \Device\HarddiskVolume1\Windows\System32\csrss.exe  %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16  C:\Windows\system32\csrss.exe
44
1252  528  winlogon.exe  0xfa800a273060  4  98  3  False  2025-10-02 16:48:55.000000 UTC  N/A  \Device\HarddiskVolume1\Windows\System32\winlogon.exe  winlogon.exe  C:\Windows\system32\winlogon.exe
45
* 716  1252  LogonUI.exe  0xfa800a2cdb30  7  186  3  False  2025-10-02 16:48:55.000000 UTC  N/A  \Device\HarddiskVolume1\Windows\System32\LogonUI.exe  "LogonUI.exe" /flags:0x0  C:\Windows\system32\LogonUI.exe

1
* 2024  1488  wordpad.exe  0xfa80091e5b30  6  203  1  False  2025-10-02 17:16:30.000000 UTC  N/A  \Device\HarddiskVolume1\Program Files\Windows NT\Accessories\wordpad.exe  "C:\Program Files\Windows NT\Accessories\WORDPAD.EXE" "C:\Users\C3ngH\Desktop\hint.txt"  C:\Program Files\Windows NT\Accessories\WORDPAD.EXE
2

3
** 2716  2020  DumpIt.exe  0xfa800b5fe060  1  25  1  True  2025-10-02 17:19:00.000000 UTC  N/A  \Device\HarddiskVolume1\Users\C3ngH\Desktop\DumpIt.exe  DumpIt.exe  C:\Users\C3ngH\Desktop\DumpIt.exe

1
(base) ➜  forensics vol -f memory.raw windows.filescan | grep -i "hint.txt"
2
0x29457910 100.0\Users\C3ngH\Desktop\hint.txt
3
0x2a15a9f0  \Users\C3ngH\AppData\Roaming\Microsoft\Windows\Recent\hint.txt.lnk
4

5
(base) ➜  forensics vol -f memory.raw windows.dumpfiles --physaddr  0x29457910
6
Volatility 3 Framework 2.26.2
7
Progress:  100.00    PDB scanning finished
8
Cache  FileObject  FileName  Result
9

10
DataSectionObject  0x29457910  hint.txt  Error dumping file
11

12
(base) ➜  forensics mv file.0x29457910.0xfa8009896460.DataSectionObject.hint.txt.dat hint.txt
13
(base) ➜  forensics cat hint.txt
14
*画图*真好用啊，可以把一些我记不住的密码画出来，还不容易被其他人找到…
15
所以我每次都会新建一个和屏幕分辨率一样大小的画布然后把密码画下来嘻嘻~%
16

17
(base) ➜  forensics vol -f memory.raw windows.filescan | grep -i "flag"
18
0x2b10e070 100.0\Users\C3ngH\Desktop\flag.zip
19

20
(base) ➜  forensics vol -f memory.raw windows.dumpfiles --physaddr  0x2b10e070
21
Volatility 3 Framework 2.26.2
22
Progress:  100.00    PDB scanning finished
23
Cache  FileObject  FileName  Result
24

25
DataSectionObject  0x2b10e070  flag.zip  file.0x2b10e070.0xfa80091c7b40.DataSectionObject.flag.zip.dat
26
(base) ➜  forensics ls
27
dumpfiles                                                     proc_dumps
28
file.0x2b10e070.0xfa80091c7b40.DataSectionObject.flag.zip.dat 你也喜欢win7吗.7z
29
memory.raw
30

31
(base) ➜  forensics file file.0x2b10e070.0xfa80091c7b40.DataSectionObject.flag.zip.dat
32
file.0x2b10e070.0xfa80091c7b40.DataSectionObject.flag.zip.dat: Zip archive data, at least v2.0 to extract, compression method=AES Encrypted
33
(base) ➜  forensics mv file.0x2b10e070.0xfa80091c7b40.DataSectionObject.flag.zip.dat flag.zip
34

35
(base) ➜  forensics unzip flag.zip
36
Archive:  flag.zip
37
   skipping: flag.txt                unsupported compression method 99
38

39
(base) ➜  forensics unzip -v flag.zip
40
Archive:  flag.zip
41
 Length   Method    Size  Cmpr    Date    Time   CRC-32   Name
42
--------  ------  ------- ---- ---------- ----- --------  ----
43
      29  Unk:099      47 -62% 10-02-2025 23:35 af10f254  flag.txt
44
--------          -------  ---                            -------
45
      29               47 -62%                            1 file

1
*画图*真好用啊，可以把一些我记不住的密码画出来，还不容易被其他人找到…
2
所以我每次都会新建一个和屏幕分辨率一样大小的画布然后把密码画下来嘻嘻~%

1
import os
2
from PIL import Image
3
import struct
4

5
# --- 配置参数 ---
6
DUMP_FILE_PATH = "pid.2624.dmp"
7
OUTPUT_DIR = "extracted_images_fixed"
8
TARGET_WIDTH = 2560
9
TARGET_HEIGHT = 1600
10
BITS_PER_PIXEL = 32  # 假设为 32-bit (BGRA)
11
# 原始像素数据大小 (2560 * 1600 * 4 字节)
12
PIXEL_DATA_SIZE = TARGET_WIDTH * TARGET_HEIGHT * (BITS_PER_PIXEL // 8)
13
# 允许的尺寸误差范围 (用于原始数据块搜索)
14
SIZE_TOLERANCE_MB = 0.5
15

16
# --- 主提取函数 ---
17

18
def search_and_extract_raw(data):
19
    """搜索原始像素数据块，强制不透明并保存为 PNG 文件"""
20

21
    print(f"[*] 正在搜索 {TARGET_WIDTH}x{TARGET_HEIGHT} 的原始像素数据 ({PIXEL_DATA_SIZE / 1024 / 1024:.2f} MB)...")
22

23
    min_size = int(PIXEL_DATA_SIZE - SIZE_TOLERANCE_MB * 1024 * 1024)
24
    export_count = 0
25

26
    # 以四分之一数据大小作为步长，提高搜索精度
27
    for offset in range(0, len(data), PIXEL_DATA_SIZE // 4):
28

29
        raw_data = data[offset : offset + PIXEL_DATA_SIZE]
30

31
        if len(raw_data) < min_size:
32
            continue
33

34
        try:
35
            # 1. 将原始字节数据解释为图像 (BGRA)
36
            # 使用 'RGBA' 模式
37
            img = Image.frombytes('RGBA', (TARGET_WIDTH, TARGET_HEIGHT), raw_data, 'raw', 'BGRA', 0, 1)
38

39
            # 2. 强制不透明处理 (关键步骤!)
40
            # 分离 R, G, B, A 通道
41
            r, g, b, a = img.split()
42
            # 创建一个新的 Alpha 通道，全部设置为 255 (完全不透明)
43
            new_a = Image.new('L', img.size, 255)
44
            # 重新合并 R, G, B, 新的 A 通道
45
            img = Image.merge('RGBA', (r, g, b, new_a))
46

47
            # 3. 垂直翻转：修复 GDI 常见的 Bottom-up 存储问题(实测不需要)
48
#            img = img.transpose(Image.FLIP_TOP_BOTTOM)
49

50
            # 4. 保存为 PNG 文件
51
            output_path = os.path.join(OUTPUT_DIR, f"mspaint_2624_0x{offset:x}_fixed.png")
52
            img.save(output_path)
53

54
            print(f"[SUCCESS] 成功导出图片 (偏移: 0x{offset:x})，已强制不透明: {output_path}")
55
            export_count += 1
56

57
        except Exception as e:
58
            # print(f"[-] 偏移 0x{offset:x} 处数据转换失败: {e}")
59
            continue
60

61
    return export_count > 0
62

63
# --- 主逻辑 ---
64

65
if __name__ == "__main__":
66
    if not os.path.exists(DUMP_FILE_PATH):
67
        print(f"[ERROR] 找不到转储文件: {DUMP_FILE_PATH}")
68
        exit(1)
69

70
    if not os.path.exists(OUTPUT_DIR):
71
        os.makedirs(OUTPUT_DIR)
72

73
    print(f"[*] 正在读取内存转储文件: {DUMP_FILE_PATH}")
74
    with open(DUMP_FILE_PATH, 'rb') as f:
75
        memory_data = f.read()
76
    print(f"[*] 文件读取完毕 ({len(memory_data) / 1024 / 1024:.2f} MB)")
77

78
    found_raw = search_and_extract_raw(memory_data)
79

80
    if not found_raw:
81
        print("\n[INFO] 未能通过原始数据块匹配导出任何图片。")
82
    else:
83
         print("\n[DONE] 所有匹配的数据块均已导出。请检查 'extracted_images_fixed' 文件夹中的 PNG 文件。")

1
flag{1z_volatility_F0r3ns1c5}

1
Info: 题组: Forensics - 爱茂TV (已完成 2/10)
2
Info: [✔] 0. 机主使用的用户名
3
flag{hajimi}
4

5
Info: [.] 格式：形如 flag{114514} 的字符串，全部小写
6
Info: [-] 1. 机主用户信息中隐藏的 Flag（按原样提交获取到的内容）
7
/etc/passwd
8
flag{I_l0v3_M4od1e}
9

10
Info: [-] 2. 机主最近自行安装字体的家族名称
11
Info: [.] 格式：形如 flag{114514} 的字符串，全部小写
12
HarmonyOS_SansSC
13
flag{harmonyos_sanssc}
14
flag{harmonyos_sans}
15
flag{鸿蒙黑体}
16

17

18
Info: [✔] 3. 机主使用的 FTP 传输工具（全小写不含扩展名）
19
flag{filezilla}
20

21
Info: [-] 4. 机主使用这个工具登录了一个外网服务器，请找出其 IP 地址与密码
22
Info: [.] 格式：flag{IP地址$密码}，形如 flag{114.514.19.19$810}
23

24

25
<?xml version="1.0" encoding="UTF-8"?>
26
<FileZilla3 version="3.68.1" platform="*nix">
27
  <RecentServers>
28
    <Server>
29
      <Host>192.168.233.1</Host>
30
      <Port>21</Port>
31
      <Protocol>0</Protocol>
32
      <Type>0</Type>
33
      <User>hajimi</User>
34
      <Pass encoding="base64">MTE0NTE0</Pass>
35
      <Logontype>1</Logontype>
36
      <PasvMode>MODE_DEFAULT</PasvMode>
37
      <EncodingType>Auto</EncodingType>
38
      <BypassProxy>0</BypassProxy>
39
    </Server>
40
    <Server>
41
      <Host>112.2.196.181</Host>
42
      <Port>21</Port>
43
      <Protocol>0</Protocol>
44
      <Type>0</Type>
45
      <User>hajimi</User>
46
      <Pass encoding="base64">MTE0X1M0ZjNQd2RfNTE0</Pass>
47
      <Logontype>1</Logontype>
48
      <PasvMode>MODE_DEFAULT</PasvMode>
49
      <EncodingType>Auto</EncodingType>
50
      <BypassProxy>0</BypassProxy>
51
    </Server>
52
    <Server>
53
      <Host>192.168.233.128</Host>
54
      <Port>21</Port>
55
      <Protocol>0</Protocol>
56
      <Type>0</Type>
57
      <User>hajimi</User>
58
      <Pass encoding="base64">MTE0NTE0</Pass>
59
      <Logontype>1</Logontype>
60
      <PasvMode>MODE_DEFAULT</PasvMode>
61
      <EncodingType>Auto</EncodingType>
62
      <BypassProxy>0</BypassProxy>
63
    </Server>
64
    <Server>
65
      <Host>127.0.0.1</Host>
66
      <Port>21</Port>
67
      <Protocol>0</Protocol>
68
      <Type>0</Type>
69
      <User>hajimi</User>
70
      <Pass encoding="base64">MTE0NTE0</Pass>
71
      <Logontype>1</Logontype>
72
      <PasvMode>MODE_DEFAULT</PasvMode>
73
      <EncodingType>Auto</EncodingType>
74
      <BypassProxy>0</BypassProxy>
75
    </Server>
76
  </RecentServers>
77
</FileZilla3>
78

79

80
外网
81
flag{112.2.196.181$114_S4f3Pwd_514}
82

83
Info: [-] 5. 机主对外通信使用的邮箱地址
84
flag{praxoppogrebro-5874@yopmail.net}
85

86
cat ./home/hajimi/.mozilla/firefox/djexozqp.default-esr/extension-settings.json
87
# 在 profile 目录统计所有出现过的邮箱并按次数排序（便于优先判断）
88
grep -RIna --binary-files=without-match -E "\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}\b" . 2>/dev/null \
89
  | grep -o -E "\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}\b" | sort | uniq -c | sort -nr | sed -n '1,50p'
90

91

92
Info: [-] 6. "加速器安装程序"的 MD5 值（全小写）
93
flag{7ce89dbb371ae598702e111cede3d75a}
94

95
Info: [-] 7. "加速器安装程序"释放的文件中，有一个是端口扫描程序经重命名而成，请找出其文件名与原程序名。
96
Info: [.] 格式：flag{文件名#原程序名}
97
flag{ls#fscan}
98

99
Info: [-] 8. "加速器安装程序"中的哪一行命令导致机主无法正常登录图形界面
100
Info: [.] 格式：flag{一行内的完整命令}
101
flag{systemctl disable lightdm >/dev/null 2>&1 || true}
102

103

104
Info: [-] 9. Shell 无法使用是由于什么文件被修改了？机主依然能使用哪些 Shell 登录（按字母序列出可执行文件名）？
105
Info: [.] 格式：flag{文件#shellA#shellB#...}，使用#分隔
106
flag{/etc/bash.bashrc#dash#sh}
107

108

109
chao@kali:/Users/chao/tmp/ctf/forensics/[Week3] 爱茂TV/mnt$ sed -n '1,120p' ./etc/shells
110
# /etc/shells: valid login shells
111
/bin/sh
112
/usr/bin/sh
113
/bin/bash
114
/usr/bin/bash
115
/bin/rbash
116
/usr/bin/rbash
117
/usr/bin/dash
118

119
chao@kali:/Users/chao/tmp/ctf/forensics/[Week3] 爱茂TV/mnt$ find home -type f -iname "sitemanager.xml" -o -iname "*filezilla*" 2>/dev/null
120
home/hajimi/.cache/filezilla
121
home/hajimi/文档/filezilla.log

1
你好🍎人[root@arch chenfeng]# cat Documents/diary-chenfeng.md
2
# 澄峰建站日记
3

4
## 2025-10-08
5

6
有个工作上的同事看我在做祝福视频，说订单收入还是在用电子表格去记不是很好，建议我搞个“全栈”网页。说是不仅方便管理，还有助于宣传涨热度...我问他能不能帮我做，他却回道“真做不出苹果项目”。
7

8
切，不就是看我火了嫉妒不想帮我做呗——你们这群安卓素质、安卓语法、安卓态度的安卓人真是够了，我还巴不得呢。听说 AI 啥的做这东西很专业，只需要写几句话就能出一个项目，我倒来试试看。
9

10
## 2025-10-10
11

12
可惜我有点拖延症，不过这 Copilot 真是帮了大忙，不出几轮对话就把项目生成出来了。接下来是要配环境，按 AI 说的要搞一个 LAMP 栈，估计还要一段时间。
13

14
## 2025-10-12
15

16
尝试着按网上的文档配了网站，结果移动的时候提示权限不足。
17

18
我就纳闷了，一个只有本地用户才能访问的服务器目录设置这么复杂的权限干什么？这一定是安卓开发者的阴谋！我把它改成 777 了，看你还怎么报错。
19

20
## 2025-10-14
21

22
配置 Apache 服务，几度要飞升。
23

24
先是访问子目录报 404，AI 说要用 vhost，结果这样一下来全都访问不了；数据库也是，一行一行敲的创建表代码，到访问的时候怎么会出问题？！AI 也行不通吗？安卓 AI。同事见我搞两个多小时红温了，才笑嘻嘻地过来教我改权限...什么安卓态度，搞得我好像不会自己做一样。
25

26
真是越想越来气，这些软件的开发者用的配置文件五花八门，文档也生硬晦涩，怕我们苹果人看不懂，这样就好低声下气问他们？？安卓服务！不，我的服务才不会是安卓服务。我们苹果人搭起来的服务必定是苹果服务。
27

28
## 2025-10-15
29

30
我不管了。今晚！这个属于我的苹果服务就要上线。不计一切代价，*安卓人除外*。
31

32
不过现有的数据量还是不够多，我得生成一些，不然也太冷清了。
33

34
**更新：**那个房管怎么知道我这服务的？！坏事了，这留言删都删不掉...算是记住你了；；不过你虚报一千什么意思？？！
35

36
**更新：**想来想去这个本月开销还是把前面一段时间的收支补上去好了，看着也显得我澄峰不是一般人，嘿嘿 我就是苹果人，不接受反驳。
37

38
## 2025-10-16
39

40
卧槽，我的赞助记录怎么全没了？订单记录也一团糟！傻了傻了，得赶快请个高人。
41

42
**更新：**想来想去还是睡不着，这么苹果的服务是怎么被攻击到的...也许我并不是100%的苹果人吧。
43

44
**更新：**质疑这个服务存在的意义了。删几个文件以儆效尤。

1
Info: 欢迎来到 ?CTF 2025 Android Platform！目前有 1 个题组。
2
Info: 初来乍到，输入 help 获取使用帮助。
3
NekoChecker [/] > show 0
4
Info: 题组: Forensics - 安卓服务？安卓人？ (已完成 0/10)
5

6
Info: [-] 0. 攻击事件发生在外网(WAN)还是内网(LAN)？并指出被攻击机器在网络的IP
7
Info: [.] 格式：flag{答案1#1.1.1.1}，第一个问题使用 `WAN` / `LAN` 回答
8
flag{LAN#192.168.119.139}✅
9

10
Info: [-] 1. 网页服务器连接使用的用户、密码与数据库名称
11
Info: [.] 格式：flag{用户名:密码@数据库名称}
12
flag{chenfeng:pingguochenfeng@chenfeng-db}✅
13

14
Info: [-] 2. Web服务于受攻击时段启动与关闭的时间
15
Info: [.] 格式：flag{hh:mm:ss-hh:mm:ss}
16
flag{20:00:08-22:31:11}✅
17

18
Info: [-] 3. 攻击者利用最多的 WebShell 文件名与连接密码
19
Info: [.] 格式：flag{filename.php&password}
20
flag{gift.php&chenfeng}✅
21

22
Info: [-] 4. 攻击者未能获得后端源码的原因是权限不对，
23
找出攻击者试图访问时使用的用户名与未能访问目录的权限
24
Info: [.] 格式：flag{username#%%%}，%代表一位数字
25
flag{http#700}✅
26

27
Info: [-] 5. 对数据库做出破坏的攻击者IP与可能执行的SQL语句
28
Info: [.] 格式：flag{1.1.1.1#command object}，SQL语句指令全小写且只有一行，无尾随分号
29
flag{192.168.119.1#drop table sponsorship}✅
30

31
Info: [-] 6. 扣除可能的欠款后，澄峰的收入与支出总和（一个有符号数）
32
-54552 欠2000（3000里虚报了1000）
33
flag{-56552}✅
34

35
Info: [-] 7. 数据库现存内容中的flag
36
flag{W3_w0uld_bec0me_fr1eNds_@ga1n}✅
37

38
Info: [-] 8. 除去赞助收入，澄峰的第一大收入来源与数额
39
Info: [.] 格式：flag{source#amount}
40
flag{直播间礼物#228220}✅
41

42

43
Info: [-] 9. 澄峰崩溃至极，使用了工具来深度删除文件，他使用了什么命令实现这一点
44
Info: [.] 格式：flag{命令}
45
flag{shred -uz .bash_history}✅

1
你好🍎人[root@arch ~]# cat .viminfo
2
> /etc/httpd/conf/httpd.conf
3
  *  1760529606  0
4
  "  231  0
5
  ^  231  1
6
  .  231  0
7
  +  52  0
8
  +  231  0
9
你好🍎人[root@arch ~]# ls
10
你好🍎人[root@arch ~]# cat /etc/httpd/conf/httpd.conf
11

12
<IfModule ssl_module>
13
SSLRandomSeed startup builtin
14
SSLRandomSeed connect builtin
15
</IfModule>
16

17
IncludeOptional conf/conf.d/*.conf
18

19
Include conf/extra/php-fpm.conf
20

21
    ProxyPreserveHost On
22
    ProxyTimeout 60
23

24
    # 将 /api 转发到 127.0.0.1:5174（你的 FastAPI）
25
    ProxyPass        /api/ http://127.0.0.1:5174/api/ retry=0
26
    ProxyPassReverse /api/ http://127.0.0.1:5174/api/
27

28
    # 可选：为静态资源添加缓存头
29
    <FilesMatch "\\.(js|css|png|jpg|jpeg|gif|svg|ico)$">
30
        Header set Cache-Control "public, max-age=31536000, immutable"
31
    </FilesMatch>
32

33

34

35
# History of marks within files (newest to oldest):
36

37
> /etc/httpd/conf/httpd.conf
38
  *  1760367950  0
39
  "  288  20
40
  ^  288  21
41

42
> /var/log/httpd/error_log
43
  *  1760367793  0
44
  "  917  0
45

46
> /var/log/httpd/access_log
47
  *  1760367775  0
48
  "  277  0
49

50
> ~/Desktop/cfvideo/apps/python-server/start.sh
51
  *  1760359706  0
52
  "  9  29
53
  ^  8  2
54
  .  8  1
55
  +  9  51
56
  +  8  1
57

58
> /srv/http/test.php
59
  *  1760352730  0
60
  "  2  0
61
  ^  2  0
62
  .  1  19
63
  +  1  19
64

65
> /etc/bash.bashrc
66
  *  1760332289  0
67
  "  12  47
68
  ^  12  48
69

70
> /etc/bash.bash
71
  *  1760331537  0
72
  "  1  0
73

74
你好🍎人[root@arch chenfeng]# cat /home/chenfeng/Desktop/cfvideo/apps/python-server/start.sh
75
#!/bin/bash
76
# Python 后端服务启动脚本 (Unix/Linux/macOS)
77

78
# 切换到脚本所在目录
79
cd "$(dirname "$0")"
80

81
echo "启动 Python FastAPI 服务..."
82
# python3 run.py
83
uvicorn main:app --host 0.0.0.0 --port 5174 --reload
84

85

86
你好🍎人[chenfeng@arch ~]$ cat mount-shared.sh
87
#!/bin/bash
88

89
sudo /usr/bin/vmhgfs-fuse .host:/ /home/chenfeng/shares -o subtype=vmhgfs-fuse,allow_other
90

91

92
你好🍎人[chenfeng@arch ~]$ cat /etc/bash.bashrc
93
#
94
# /etc/bash.bashrc
95
#
96

97
# If not running interactively, don't do anything
98
[[ $- != *i* ]] && return
99

100
# Prevent doublesourcing
101
if [[ -z "${BASHRCSOURCED}" ]] ; then
102
  BASHRCSOURCED="Y"
103
  # the check is bash's default value
104
  [[ "$PS1" = '\s-\v\$ ' ]] && PS1='你好🍎人[\u@\h \W]\$ '
105
  case ${TERM} in
106
    Eterm*|alacritty*|aterm*|foot*|gnome*|konsole*|kterm*|putty*|rxvt*|tmux*|xterm*)
107
      PROMPT_COMMAND+=('printf "\033]0;%s@%s:%s\007" "${USER}" "${HOSTNAME%%.*}" "${PWD/#$HOME/\~}"')
108
      ;;
109
    screen*)
110
      PROMPT_COMMAND+=('printf "\033_%s@%s:%s\033\\" "${USER}" "${HOSTNAME%%.*}" "${PWD/#$HOME/\~}"')
111
      ;;
112
  esac
113
fi
114

115
if [[ -r /usr/share/bash-completion/bash_completion ]]; then
116
  . /usr/share/bash-completion/bash_completion
117
fi