当前位置：首页 > news >正文

2025 CISCN 初赛部分题目wp

news 2026/6/15 15:45:20

wasm-login
check.startsWith("ccaf33e3512e31f3")

爆破时间戳
`// solve_sunday.mjs
import { authenticate } from "./release.js";
import { createHash } from "node:crypto";

const TARGET_PREFIX = "ccaf33e3512e31f3";
const username = "admin";

// 调整搜索范围：补全 "周日晚上" 的时间段
// 结束时间：2025-12-22 00:00:00 (我们刚才扫过的起点)
const endTs = 1766332800000;
// 开始时间：往前推 5 小时 (周日 19:00 开始) -> 1766314800000
const startTs = 1766314800000;

console.log([+] 开始扫描周日深夜时段...);
console.log([+] 范围: ${new Date(startTs).toLocaleString()} -> ${new Date(endTs).toLocaleString()});
console.log([+] 目标前缀: ${TARGET_PREFIX});

const startTime = Date.now();
let count = 0;

for (let ts = startTs; ts < endTs; ts += 1) {
count++;

if (count % 500000 === 0) {
const speed = (count / ((Date.now() - startTime)/1000) / 1000).toFixed(1);
console.log([*] 进度: ${ts} | 速度: ${speed} k/s);
}

try {
const password = ts.toString();
const resultString = authenticate(username, password);

if (resultString) {
// 务必: parse -> stringify -> MD5
const jsonStr = JSON.stringify(JSON.parse(resultString));
const hash = createHash('md5').update(jsonStr).digest('hex');

if (hash.startsWith(TARGET_PREFIX)) {
console.log(\n\n[SUCCESS] 找到 Flag !!!);
console.log([+] 时间戳: ${ts});
console.log([+] Flag: flag{${hash}});
process.exit(0);
}
}
} catch (e) {}
}

console.log("[-] 周日时段扫描结束。");`

登录的时间戳应该是 1766334550699
WASM 返回为：

{"username":"admin","password":"L0In602=","signature":"LxZiwA05Y9h7wX1CI0gUitOE2LBy9y8McoBqWgKIdDo="}
对其 JSON.parse -> JSON.stringify 后做 MD5，得到：
ccaf33e3512e31f36228f0b97ccbc8f1
包裹上即可

babygame
godat逆向和羊城杯差不多标准aes是乱码

extends CenterContainer

@onready var flagTextEdit: Node = $PanelContainer / VBoxContainer / FlagTextEdit
@onready var label2: Node = $PanelContainer / VBoxContainer / Label2

static var key = "FanAglFanAglOoO!"
var data = ""

func _on_ready() -> void :
Flag.hide()

func get_key() -> String:
return key

func submit() -> void :
data = flagTextEdit.text

var aes = AESContext.new()
aes.start(AESContext.MODE_ECB_ENCRYPT, key.to_utf8_buffer())
var encrypted = aes.update(data.to_utf8_buffer())
aes.finish()

if encrypted.hex_encode() == "d458af702a680ae4d089ce32fc39945d":
label2.show()
else:
label2.hide()

func back() -> void :
get_tree().change_scene_to_file("res://scenes/menu.tscn")
是key 会动态变化
extends Node

@onready var fan = $"../Fan"

var score = 0

func add_point():
score += 1
if score == 1:
Flag.key = Flag.key.replace("A", "B")
fan.visible = true

每吃一个金币都会对调 A 和 B

Exp
·from itertools import product

try:
from Crypto.Cipher import AES
except ImportError:
raise SystemExit("需要 pycryptodome：pip install pycryptodome")

BASE_KEY = "FanAglFanAglOoO!"
CT_HEX = "d458af702a680ae4d089ce32fc39945d"

ct = bytes.fromhex(CT_HEX)

找出所有 'A' 的位置

a_pos = [i for i, ch in enumerate(BASE_KEY) if ch == "A"]
print("A positions:", a_pos, "count =", len(a_pos))

def build_key(bits):
# bits: 每个 A 位置是否改成 B
s = list(BASE_KEY)
for pos, b in zip(a_pos, bits):
if b == 1:
s[pos] = "B"
return "".join(s)

def is_valid_utf8(b: bytes) -> bool:
try:
b.decode("utf-8", errors="strict")
return True
except UnicodeDecodeError:
return False

for bits in product([0, 1], repeat=len(a_pos)):
key = build_key(bits).encode("utf-8") # 16 bytes
aes = AES.new(key, AES.MODE_ECB)
pt = aes.decrypt(ct)

ok_utf8 = is_valid_utf8(pt)
print("\n=== bits:", bits, "key:", build_key(bits), "utf8:", ok_utf8)
print("pt_hex:", pt.hex())
if ok_utf8:print("pt_utf8:", pt.decode("utf-8"))
else:# 用 latin-1 只是为了“看见每个字节”，不是说它能输入print("pt_latin1_preview:", pt.decode("latin-1"))

=== bits: (1, 1) key: FanBglFanBglOoO! utf8: True pt_hex: 774f577e796f75417265677245615421 pt_utf8: wOW~youAregrEaT

=== bits: (1, 1) key: FanBglFanBglOoO! utf8: True pt_hex: 774f577e796f75417265677245615421 pt_utf8: wOW~youAregrEaT flag{wOW~youAregrEaT}

Eternum
RAT/后门通信

C2 是 192.168.8.160:13337

流量包帧结构：
[ "ET3RNUMX"(8) ][ len(4, big-endian) ][ body(len) ]

pcap 里应用层帧格式
每条 TCP payload 里是多帧拼接：
b"ET3RNUMX" + u32_be(len) + body
body 是 AES-GCM
nonce = body[:12]
tag = body[-16:]
ct = body[12:-16]
AES key 是可执行文件里硬编码的 32 字节字符串
试试这个
xfqGcVjrOWp5tUGCPFQq448nPDjILTe7
AES-256 key。
解密后能看到服务端下发命令、客户端回传输出，其中有一条命令是：
base32 /var/opt/s*/
MZWGCZ33MI3WGNJYG4YDALJSMIYDCLJUMRSDILJYGUZDMLLBGRQTIN3BGY2WCMLBHF6Q==== base32解码就是 flag。