过滤 POST 上传了一张图片，在 wireshark 显示分组字节查看 flag。 flag{h1dden_in_plain_s1ght_so_clever}
Stealthy_Ping
出题人把 prompt 都写好了…没什么可说的
1 2 3 4 5 6 7 8 9 10
from scapy.allimport * from scapy.layers.inet import ICMP
data = b"" pkts = rdpcap("stealthy.pcap") for p in pkts: if ICMP in p and p[ICMP].type == 8: if Raw in p: data += p[Raw].load print(data.decode(errors="ignore"))
AI
越狱的翻译官
我们的情报人员截获了一个内部翻译工具的访问权限。据可靠消息，该工具的系统指令中隐藏了一串至关重要的管理员验证码（Flag）。但这个 AI 坚称自己只是一个翻译工具，拒绝回答任何非翻译类问题。请施展你的“话术”，突破它的心理防线，完成这次越狱行动。
健忘的客服
某知名电商平台的在线客服系统最近引入了 AI 助手。据内部线人举报，该 AI 助手在初始化时会加载一段包含管理员敏感备注的历史对话记录。虽然开发者在系统指令中明确要求 AI 严禁泄露这些信息，但由于 AI 的“健忘”天性，它有时会在特定的诱导下吐露真言。
import csv from Cryptodome.Cipher import AES from Cryptodome.Protocol.KDF import PBKDF2 from Cryptodome.Util.Padding import unpad SALT = b"Hidden_Salt_Value" IV = b"Dynamic_IV_2026!"
# 建立映射 mapping = {} for h, m inzip(hex_str, masked): mapping[h] = m
# 补全缺失的映射 hex_chars = "0123456789abcdef" used_letters = set(mapping.values()) # 找出未使用的十六进制字符 for h in hex_chars: if h notin mapping: # 找出未使用的字母（在用户1088的掩码字符串中出现的） # 从用户1088的掩码字符串中收集所有字母 uid1088_masked = "nhyxzgccnvcbnkjdfbmkvymmgzvdknlmdjgmfbbzmgxgyfcxcjxnygyklhmhvflbdckdsdxyxjknchxjmcyzsmjgdfmzkgkc" all_letters = set(uid1088_masked) unused_letters = all_letters - used_letters if unused_letters: m = unused_letters.pop() mapping[h] = m print(f"Added mapping: {h} -> {m}") used_letters.add(m)
# 反向映射 reverse_mapping = {v: k for k, v in mapping.items()} return reverse_mapping
defmasked_to_hex(masked_str, mapping): """将掩码字符串转换为十六进制字符串""" hex_chars = [] for c in masked_str: hex_chars.append(mapping[c]) return''.join(hex_chars)
from Cryptodome.Util.number import long_to_bytes, inverse import math N = 1537884748858979344984622139011454953992115329679883538491908319138246091921498274358637436680512448439241262100285587807046443707172315933205249812858957682696042298989956461141902881429183636594753628743135064356466871926449025491719949584685980386415637381452831067763700174664366530386022318758880797851318865513819805575423751595935217787550727785581762050732320170865377545913819811601201991319740687562135220127389305902997114165560387384328336374652137501 H = 154799801776497555282869366204806859844554108290605484435085699069735229246209982042412551306148392905795054001685747858005041581620099512057462685418143747850311674756527443115064006232842660896907554307593506337902624987149443577136386630017192173439435248825361929777775075769874601799347813448127064460190 c = 947079095966373870949948511676670005359970636239892465556074855337021056334311243547507661589113359556998869576683081430822255548298082177641714203835530584472414433579564835750747803851221307816282765598694257243696737121627530261465454856101563276432560787831589321694832269222924392026577152715032013664572842206965295515644853873159857332014576943766047643165079830637886595253709410444509058582700944577562003221162643750113854082004831600652610612876288848 e = 65537
# 解二次方程求 rD = H**2 - 4*N s = math.isqrt(D) if s*s != D: print("D 不是完全平方数") else: r = (H - s) // 2 if N % r == 0: print("找到 r:", r) # 在模 r 下解密 phi_r = r - 1 d_r = inverse(e, phi_r) m = pow(c, d_r, r) flag = long_to_bytes(m) print("Flag:", flag.decode()) else: print("r 不能整除 N")
from hashlib import sha256 from Cryptodome.Cipher import AES from Cryptodome.Util.Padding import unpad from Cryptodome.Util.number import long_to_bytes import random
# ---------- 辅助函数：Tonelli-Shanks 求模平方根 ----------def tonelli_shanks(a, p): if a == 0: return [0] ifpow(a, (p-1)//2, p) != 1: return [] # 不是二次剩余 if p % 4 == 3: r = pow(a, (p+1)//4, p) return [r, p-r] # 分解 p-1 = Q * 2^S Q = p - 1 S = 0 while Q % 2 == 0: Q //= 2 S += 1 # 寻找二次非剩余 z = 2 whilepow(z, (p-1)//2, p) != p - 1: z += 1 # 初始化 M = S c = pow(z, Q, p) t = pow(a, Q, p) R = pow(a, (Q+1)//2, p) while t != 1: # 找到最小的 i 使得 t^{2^i} = 1 i = 1 t2i = pow(t, 2, p) while t2i != 1: t2i = pow(t2i, 2, p) i += 1 b = pow(c, 2**(M-i-1), p) M = i c = pow(b, 2, p) t = (t * c) % p R = (R * b) % p return [R, p-R]
# ---------- 计算常数 ----------inv54 = pow(54, p-2, p) # 54 的模逆 D = inv54 E = (6480 * D * D) % p # 72*90*D^2
# 计算 A_i = 55^(5*i) mod pA = [0] * 11 # A[0] 未使用，A[i] 对应 i=1..10for i in range(1, 11): A[i] = pow(55, 5*i, p)
# 遍历 z1 和 z2 的符号组合 found = False for z1 in sqrt_ots[0]: # i=1 for z2 in sqrt_ots[1]: # i=2 # 构建线性方程组 # 系数矩阵两行 a1 = (A[1]*A[1]) % p b1 = (A[1] * D * (A[1]-1)) % p r1 = (z1 - E * ((A[1]-1)**2 % p)) % p
a2 = (A[2]*A[2]) % p b2 = (A[2] * D * (A[2]-1)) % p r2 = (z2 - E * ((A[2]-1)**2 % p)) % p
# 解方程组 a*u + b*v = r # 使用克莱姆法则 det = (a1 * b2 - a2 * b1) % p if det == 0: continue inv_det = pow(det, p-2, p) u = ( (r1 * b2 - r2 * b1) * inv_det ) % p v = ( (a1 * r2 - a2 * r1) * inv_det ) % p
# 检查 u 是否满足初始条件 if (u * u) % p != ots[0]: continue
# 用 i=3..10 验证 ok = True for idx inrange(2, 10): # 对应 ots[3]..ots[10] i = idx+1 # i 从 3 到 10 z_pred = (A[i]*A[i] * u + A[i] * D * (A[i]-1) * v + E * ((A[i]-1)**2 % p)) % p # 检查是否等于两个平方根之一 if z_pred notin sqrt_ots[idx]: ok = False breakifnot ok: continue
# 找到正确的 u, v print("找到 u, v:") print("u =", u) print("v =", v) found = True breakif found: break
ifnot found: print("未找到合适的 u, v") exit()
# ---------- 从 u, v 恢复 x0, y0 ----------# 解方程: x0*y0 = u, 90*x0 + 72*y0 = v # 化为二次方程: 90*x0^2 - v*x0 + 72*u = 0 mod p a_coef = 90 b_coef = (-v) % p c_coef = (72 * u) % p delta = (b_coef * b_coef - 4 * a_coef * c_coef) % p # 求 delta 的平方根 sqrt_delta = tonelli_shanks(delta, p) iflen(sqrt_delta) == 0: print("delta 不是二次剩余") exit()
inv_180 = pow(180, p-2, p) possible_x0 = [] for sd in sqrt_delta: x0 = ( (v + sd) * inv_180 ) % p # 注意 v 是原来的 v，b_coef = -v possible_x0.append(x0)
# 对于每个 x0 计算对应的 y0candidates = [] for x0 in possible_x0: y0 = (u * pow(x0, p-2, p)) % p # y0 = u / x0 # 验证第二个方程 if (90*x0 + 72*y0) % p == v: candidates.append((x0, y0))
print("可能的 (x0, y0):") for x0, y0 in candidates: print(f"x0 = {x0}, y0 = {y0}")
