[{"data":1,"prerenderedAt":630},["ShallowReactive",2],{"content:\u002F2022\u002Fctf-xupt-gctf":3,"surround:\u002F2022\u002Fctf-xupt-gctf":618},{"id":4,"title":5,"body":6,"categories":591,"date":593,"description":594,"draft":595,"extension":596,"image":597,"meta":598,"navigation":600,"path":601,"permalink":602,"published":602,"readingTime":603,"recommend":602,"references":602,"seo":608,"sitemap":609,"stem":610,"tags":611,"type":615,"updated":616,"__hash__":617},"content\u002Fposts\u002F2022\u002Fctf-xupt-gctf.md","西邮GCTF2022-个人WriteUp",{"type":7,"value":8,"toc":552},"minimark",[9,16,21,26,30,43,47,51,55,62,66,70,74,88,92,95,99,106,109,113,117,120,124,127,133,136,155,159,163,167,174,178,181,184,190,194,197,200,204,208,218,222,242,246,250,257,260,266,270,274,277,283,287,290,296,300,304,309,313,317,321,325,329,333,336,340,343,347,350,354,360,364,368,371,375,379,383,386,390,394,398,408,411,417,421,427,431,435,438,441,445,474,478,482,485,489,493,496,500,503,507,510,514,520,524,528,532,546],[10,11],"pic",{":mirror":12,"src":13,"densities":14,":height":15},"true","https:\u002F\u002Fmmbiz.qpic.cn\u002Fmmbiz_png\u002F9sIibiadwv3fbR2djcvEqTjtOJavT3z9ibWwsjQ9HSjSpJtePhe0Vkb1JNuUWeNcotGVXj5JYWPFdxr0oGZ3ibKnAw\u002F640","1.5x","1000",[17,18,20],"h2",{"id":19},"web","Web",[22,23,25],"h3",{"id":24},"_3-sign-in","3 Sign in",[10,27],{":mirror":12,"src":28,"densities":14,"caption":29},"https:\u002F\u002Fmmbiz.qpic.cn\u002Fmmbiz_png\u002F9sIibiadwv3fbR2djcvEqTjtOJavT3z9ibWSFfmZFCVQwH0e8iah91iapKxyxw3qNFcurGNIibibqY7Q2rrMkO7NQuCnA\u002F640","Sign in题目",[31,32,33,34,38,39,42],"p",{},"根据 ",[35,36,37],"code",{"code":37},"解压测试"," 判断，源码被打包到了 ",[35,40,41],{"code":41},"\u002Fwww.zip","，遂下载，解压后发现网站目录里有另一份文件，访问此路径得到 flag。",[10,44],{":mirror":12,"src":45,"densities":14,"caption":46},"https:\u002F\u002Fmmbiz.qpic.cn\u002Fmmbiz_png\u002F9sIibiadwv3fbR2djcvEqTjtOJavT3z9ibWTDJE3aYygOF6VeyBjTTvq3zvHusMIOl8elMhUDuy2eXtNlzsTAjOcw\u002F640","你猜猜直接打开会得到什么？",[22,48,50],{"id":49},"_4-md5","4 md5",[10,52],{":mirror":12,"src":53,"densities":14,"caption":54},"https:\u002F\u002Fmmbiz.qpic.cn\u002Fmmbiz_png\u002F9sIibiadwv3fbR2djcvEqTjtOJavT3z9ibW6hFaKWVxct4la1vMPwXrL4X8UwoeU3hmF5KMocg00Ao1HH8DA5nsOg\u002F640","md5题目",[31,56,57,58,61],{},"本题使用的是 PHP 语言 MD5 的相等判断漏洞。我所使用的 Edge 开发人员工具网络控制台不能得到预期中的结果，故使用 ",[35,59,60],{"code":60},"curl"," 来 post 参数，得到 flag。",[10,63],{":mirror":12,"src":64,"densities":14,"caption":65},"https:\u002F\u002Fmmbiz.qpic.cn\u002Fmmbiz_png\u002F9sIibiadwv3fbR2djcvEqTjtOJavT3z9ibWTVjL3YA0cJOwfvEHD7TlUuc6hKE0QZqwka3qpbZdJ403WNjNDuuktw\u002F640","curl命令",[22,67,69],{"id":68},"_6-method","6 Method",[10,71],{":mirror":12,"src":72,"densities":14,"caption":73},"https:\u002F\u002Fmmbiz.qpic.cn\u002Fmmbiz_png\u002F9sIibiadwv3fbR2djcvEqTjtOJavT3z9ibWtIicxHG2ZuyRrv1qYdIjhCjdhTibFsnoFVOR3icMQqy6xyedAZLXhMfyg\u002F640","Method题目",[31,75,76,77,80,81,84,85,87],{},"在控制台使用JavaScript发送",[35,78,79],{"code":79},"GCTF","请求，得到的body只是把图中的",[35,82,83],{"code":83},"GET","改成了",[35,86,79],{"code":79},"。",[10,89],{":mirror":12,"src":90,"densities":14,"caption":91},"https:\u002F\u002Fmmbiz.qpic.cn\u002Fmmbiz_png\u002F9sIibiadwv3fbR2djcvEqTjtOJavT3z9ibWPOAzZCP3ln6Qsm9yPoOoQIGJC5vXG85ca89fmEaHWfAicJTLBz6Rs7g\u002F640","控制台",[31,93,94],{},"在网络控制台查看请求，响应头中包含了 flag。",[10,96],{":mirror":12,"src":97,"densities":14,"caption":98},"https:\u002F\u002Fmmbiz.qpic.cn\u002Fmmbiz_png\u002F9sIibiadwv3fbR2djcvEqTjtOJavT3z9ibWDrox9jCFSUicbUJ23Pvy8LAOgRictdqgA8UfIG8hQDCMzTtY3cMIaKGw\u002F640","网络控制台",[31,100,101,102,105],{},"另外，也可使用 curl，但需要附上 ",[35,103,104],{"code":104},"-v"," 参数。",[10,107],{":mirror":12,"src":108,"densities":14,"caption":65},"https:\u002F\u002Fmmbiz.qpic.cn\u002Fmmbiz_png\u002F9sIibiadwv3fbR2djcvEqTjtOJavT3z9ibWWiaMqe4KOADrnPPQvicpMaKHRUFOjvEz1Lxata4ibeY0u1bARccUKtvxQ\u002F640",[22,110,112],{"id":111},"_7-secret","7 Secret",[10,114],{":mirror":12,"src":115,"densities":14,"caption":116},"https:\u002F\u002Fmmbiz.qpic.cn\u002Fmmbiz_png\u002F9sIibiadwv3fbR2djcvEqTjtOJavT3z9ibW9Sc4LicD0guR0CHEGvRibianjWFp66NmvSOm7j0CRk8NxCot8c07YFtQw\u002F640","Secret题目",[31,118,119],{},"使用Edge开发人员工具的网络条件工具伪造UA还不够，还需要伪造请求IP。",[22,121,123],{"id":122},"_8-backupfile","8 BackupFile",[10,125],{":mirror":12,"src":126,"densities":14},"https:\u002F\u002Fmmbiz.qpic.cn\u002Fmmbiz_png\u002F9sIibiadwv3fbR2djcvEqTjtOJavT3z9ibWGBGxS8cZJMDDqXOicdRymRpV3KA9AF88R9DBicQVMQ9d2icQtSfDCWqGA\u002F640",[31,128,129,130,87],{},"根据提示，下载 ",[35,131,132],{"code":132},"\u002Findex.php.bak",[10,134],{":mirror":12,"src":135,"densities":14},"https:\u002F\u002Fmmbiz.qpic.cn\u002Fmmbiz_png\u002F9sIibiadwv3fbR2djcvEqTjtOJavT3z9ibWAEm8RRE27JChicUEbleGD19ExF8CWdCicawAGpSon6lhxHDpedJ4Cg8w\u002F640",[31,137,138,139,142,143,146,147,150,151,154],{},"PHP 中数字与字符串判断是否不完全相等时，会将字符串转换为数字再比较，即传入的参数 ",[35,140,141],{"code":141},"$key"," 与 ",[35,144,145],{"code":145},"$str"," 的前几位数字 ",[35,148,149],{"code":149},"2333"," 比较。因此传入参数 ",[35,152,153],{"code":153},"key=2333","，获得 flag。",[10,156],{":mirror":12,"src":157,"densities":14,"caption":158},"https:\u002F\u002Fmmbiz.qpic.cn\u002Fmmbiz_png\u002F9sIibiadwv3fbR2djcvEqTjtOJavT3z9ibW1SZZDgPJzWdkgmQaG0g2WzGDRqqUBVgvFfRumsPdQgp5Gnic2ZojotQ\u002F640","传入参数key=2333",[22,160,162],{"id":161},"_11-一波三折","11 一波三折",[10,164],{":mirror":12,"src":165,"densities":14,"caption":166},"https:\u002F\u002Fmmbiz.qpic.cn\u002Fmmbiz_png\u002F9sIibiadwv3fbR2djcvEqTjtOJavT3z9ibWYtMQIM86VYRTGrNribOOYE3AOZRwU01W5YyasXp4Gx3Nz8HY4tqHmNg\u002F640","一波三折题目",[31,168,169,170,173],{},"根据提示查看 Cookie，访问 ",[35,171,172],{"code":172},"flag.html"," 却被重定向到百度。",[10,175],{":mirror":12,"src":176,"densities":14,"caption":177},"https:\u002F\u002Fmmbiz.qpic.cn\u002Fmmbiz_png\u002F9sIibiadwv3fbR2djcvEqTjtOJavT3z9ibWr3nJzsS3HShlbdSb89RGcmx4tbZkSIDM0gDOYF7HCExMssWwGEBUAQ\u002F640","怎么被重定向了",[31,179,180],{},"使用 curl 可避免重定向。",[10,182],{":mirror":12,"src":183,"densities":14,"caption":65},"https:\u002F\u002Fmmbiz.qpic.cn\u002Fmmbiz_png\u002F9sIibiadwv3fbR2djcvEqTjtOJavT3z9ibWEibLfZ8V7mTyzPC02icrSPIBvdp0pApMGRy7N4Njb7GJpSqwy5T11c3Q\u002F640",[31,185,186,187,87],{},"使用 Base64 解码工具，得到 ",[35,188,189],{"code":189},"flag{cc9383e8-120e-11ed-9c5d-902e16798283}",[22,191,193],{"id":192},"_50-pocman","50 Pocman",[10,195],{":mirror":12,"src":196,"densities":14},"https:\u002F\u002Fmmbiz.qpic.cn\u002Fmmbiz_png\u002F9sIibiadwv3fbR2djcvEqTjtOJavT3z9ibWY9ZgIASZc9jtFPiahUI6KBA988od6EJDwN4lO25kFk2Q1rm7vUW1icNw\u002F640",[31,198,199],{},"题目是吃豆人游戏，但我选择查看源代码，拿到 flag。",[17,201,203],{"id":202},"crypto","Crypto",[22,205,207],{"id":206},"_14-皈依","14 皈依",[31,209,210,211,214,215,87],{},"下载 ",[35,212,213],{"code":213},"flag.txt","，打开得到 ",[35,216,217],{"code":217},"flag{keyishere}",[22,219,221],{"id":220},"_15-三山半落青山外","15 三山半落青山外",[31,223,210,224,214,227,230,231,234,235,238,239,87],{},[35,225,226],{"code":226},"msg.txt",[35,228,229],{"code":229},"bWh7YXpoZnZsbWh9c25wcGx6YW5hc24=","，使用Base64解码得到 ",[35,232,233],{"code":233},"mh{azhfvlmh}snpplzanasn","，根据花括号位置判断使用了栅栏密码，由栏数为2解密得到 ",[35,236,237],{"code":237},"mshn{papzlhzfavnlamshn}@","，根据凯撒密码规则反向偏移7位得到 ",[35,240,241],{"code":241},"flag{itiseasytogetflag}",[22,243,245],{"id":244},"_19-ezaf","19 ezaf",[10,247],{":mirror":12,"src":248,"densities":14,"caption":249},"https:\u002F\u002Fmmbiz.qpic.cn\u002Fmmbiz_png\u002F9sIibiadwv3fbR2djcvEqTjtOJavT3z9ibW8WJSZTYDz1m2h0D2TicKsf7vQLCDb5dB3icHccDbOUFEHvDUHxrbiaybg\u002F640","ezaf题目",[31,251,252,253,256],{},"让加密工具直接加密字符集 ",[35,254,255],{"code":255},"a~z","，得到加密后的字符集。",[10,258],{":mirror":12,"src":259,"densities":14},"https:\u002F\u002Fmmbiz.qpic.cn\u002Fmmbiz_png\u002F9sIibiadwv3fbR2djcvEqTjtOJavT3z9ibW3gXib7JUgKANUEBiciawIW5KcKkCd1pMeTPBBOboPrjVwLHsUicuCZhbzg\u002F640",[31,261,262,263,87],{},"使用自己编写的 HTML 字符串映射工具，还原得到 ",[35,264,265],{"code":265},"flag{it_is_easy_right?}",[17,267,269],{"id":268},"reverse","Reverse",[22,271,273],{"id":272},"_22-sign-in","22 sign in",[10,275],{":mirror":12,"src":276,"densities":14},"https:\u002F\u002Fmmbiz.qpic.cn\u002Fmmbiz_png\u002F9sIibiadwv3fbR2djcvEqTjtOJavT3z9ibWHyFhsOVKEAIfXibibicI1buUxeQrRnSdtQWlTfVabn5AUxd1s8qsMibzaQ\u002F640",[31,278,279,280,87],{},"使用十六进制浏览，碰巧翻到这里，删去无效字符后得到 ",[35,281,282],{"code":282},"flag{hello_w0rld}",[22,284,286],{"id":285},"_23-ezre","23 ezre",[10,288],{":mirror":12,"src":289,"densities":14},"https:\u002F\u002Fmmbiz.qpic.cn\u002Fmmbiz_png\u002F9sIibiadwv3fbR2djcvEqTjtOJavT3z9ibW5qlfjgspRljbFM6nDMCI8gajgrldjGOXcQDrmLtKZTgYBF0rW3tIWw\u002F640",[31,291,292,293,87],{},"使用DIE的字符串浏览，得到 ",[35,294,295],{"code":295},"flag{Wow!You_find_me!}",[17,297,299],{"id":298},"pwn","PWN",[22,301,303],{"id":302},"_30-nc一下","30 nc一下",[10,305],{":mirror":12,"src":306,"densities":307,"caption":308},"https:\u002F\u002Fmmbiz.qpic.cn\u002Fmmbiz_png\u002F9sIibiadwv3fbR2djcvEqTjtOJavT3z9ibW1jMicEUkwohzUAa6qXBAHzzEme1p3hNg26NIibZfLbyJLyEuia9HDUoyA\u002F640","1x","好耶，是netcat",[10,310],{":mirror":12,"src":311,"densities":14,"caption":312},"https:\u002F\u002Fmmbiz.qpic.cn\u002Fmmbiz_png\u002F9sIibiadwv3fbR2djcvEqTjtOJavT3z9ibW2ibxpKCpnR7a1d6iapbbR7E2Fa7DUZSgiaxCK6Ht4v87ORolzGkQ9hsiag\u002F640","我信你个鬼",[17,314,316],{"id":315},"misc","Misc",[22,318,320],{"id":319},"_38-welcome","38 Welcome",[10,322],{":mirror":12,"src":323,"densities":14,"caption":324},"https:\u002F\u002Fmmbiz.qpic.cn\u002Fmmbiz_png\u002F9sIibiadwv3fbR2djcvEqTjtOJavT3z9ibWJZF8vzzaplk2nFoZSF2JRSuELGOHyiaibPZDc2D9ibYeOibfIMGQLLE0xQ\u002F640","Welcome题目",[22,326,328],{"id":327},"_39-海绵宝宝的秘密","39 海绵宝宝的秘密",[10,330],{":mirror":12,"src":331,"densities":14,"caption":332},"https:\u002F\u002Fmmbiz.qpic.cn\u002Fmmbiz_png\u002F9sIibiadwv3fbR2djcvEqTjtOJavT3z9ibWp7tzyWVicdlX9IH6mhSOwZ48HAq3gbOMJQJFE2AylGa4r9o96Ppax4Q\u002F640","海绵宝宝的秘密",[31,334,335],{},"使用十六进制编辑器打开，发现 flag 藏在 png 文件的末尾。",[22,337,339],{"id":338},"_40-开心派大星","40 开心派大星",[31,341,342],{},"使用提供的密码字典“密码.txt”暴力破解压缩包“开心的派大星.zip”密码。",[10,344],{":mirror":12,"src":345,"densities":14,"caption":346},"https:\u002F\u002Fmmbiz.qpic.cn\u002Fmmbiz_png\u002F9sIibiadwv3fbR2djcvEqTjtOJavT3z9ibWycUKqOhmfxsjVLzQ9O8W2wUUibRdqZL341yA0zAJAZl0pb8GP8JB9fw\u002F640","暴力破解密码",[31,348,349],{},"解压后得到“开心的派大星.png”，使用十六进制编辑器修改png高度，得到派大星下方隐藏的文字。",[10,351],{":mirror":12,"src":352,"densities":14,"caption":353},"https:\u002F\u002Fmmbiz.qpic.cn\u002Fmmbiz_png\u002F9sIibiadwv3fbR2djcvEqTjtOJavT3z9ibWeFSKCRI6clY0O0sdjj9kib0LJWUKd36h7AiaZ84foBpM0ic0ynTMDaVFw\u002F640","开心派大星",[31,355,356,357,87],{},"Base58 解码得 ",[35,358,359],{"code":359},"flag{have_a_G00D_t1me!!}",[22,361,363],{"id":362},"_41-滴滴滴","41 滴滴滴",[10,365],{":mirror":12,"src":366,"densities":14,"caption":367},"https:\u002F\u002Fmmbiz.qpic.cn\u002Fmmbiz_png\u002F9sIibiadwv3fbR2djcvEqTjtOJavT3z9ibWuVWHymSfcvHhtULzDCRlUzsOibkapMeGODs78Pk7t3MwgbutCQe2IbA\u002F640","dididi.wav",[31,369,370],{},"使用 Audacity，根据波形写出摩斯密码。（这一步也可以直接播放，边听边写。）",[10,372],{":mirror":12,"src":373,"densities":14,"caption":374},"https:\u002F\u002Fmmbiz.qpic.cn\u002Fmmbiz_png\u002F9sIibiadwv3fbR2djcvEqTjtOJavT3z9ibWPFpr2V1Q1ybkw06yP5bGlCvTzUYSNyvf6YBZsyGXoFdiay71m3D2GuA\u002F640","摩斯密码",[22,376,378],{"id":377},"_42-无字天书","42 无字天书",[10,380],{":mirror":12,"src":381,"densities":14,"caption":382},"https:\u002F\u002Fmmbiz.qpic.cn\u002Fmmbiz_png\u002F9sIibiadwv3fbR2djcvEqTjtOJavT3z9ibWJqAbaQBljfsMqKOiasRic0wQiaEiaQ0ekGIn8BibJGldNfCG3bYhd5XgZYA\u002F640","无字天书题目",[31,384,385],{},"使用记事本打开，发现大量零宽字符。使用零宽字符隐写工具，还原后得到flag。",[10,387],{":mirror":12,"src":388,"densities":14,"caption":389},"https:\u002F\u002Fmmbiz.qpic.cn\u002Fmmbiz_png\u002F9sIibiadwv3fbR2djcvEqTjtOJavT3z9ibWuoB9EGDVDIBO5VZWYSOwrOiaMowIgdItKZI3BsWe0QyNoic6Tvv3Allw\u002F640","零宽字符隐写工具",[22,391,393],{"id":392},"_43-excel","43 Excel",[10,395],{":mirror":12,"src":396,"densities":14,"caption":397},"https:\u002F\u002Fmmbiz.qpic.cn\u002Fmmbiz_png\u002F9sIibiadwv3fbR2djcvEqTjtOJavT3z9ibWWic7QpOrJFchcwMICfwa0cWyX6q76sVqw60dtV5AdpXAlt30YdxXCDg\u002F640","Excel",[31,399,400,401,404,405,407],{},"从 A2 单元格开始，向右、向下间断分布有数值 ",[35,402,403],{"code":403},"1","，使用公式引用后可以显示，发现数值 ",[35,406,403],{"code":403}," 所在的单元格组成了二维码。",[10,409],{":mirror":12,"src":410,"densities":14},"https:\u002F\u002Fmmbiz.qpic.cn\u002Fmmbiz_png\u002F9sIibiadwv3fbR2djcvEqTjtOJavT3z9ibWWS1XicDZr1NTNyndMGMubDzOB6L3iaGuADZZKELyS5S5ia4I6Ybu4Gt2w\u002F640",[31,412,413,414,416],{},"打算使用条件格式将 ",[35,415,403],{"code":403}," 显示为黑色，发现条件格式里已经给出了 Hint，将其修改到正确的区域。",[10,418],{":mirror":12,"src":419,"densities":14,"caption":420},"https:\u002F\u002Fmmbiz.qpic.cn\u002Fmmbiz_png\u002F9sIibiadwv3fbR2djcvEqTjtOJavT3z9ibWKsLAeFQQ9bnzT68Aoqvib9rG09ibObTian0RN0BK5icFGialUZVtRsPFXKg\u002F640","显示二维码",[31,422,423,424,87],{},"修改列宽，使单元格变成方形。扫码得到 ",[35,425,426],{"code":426},"flag{36982547439sdsd343}",[22,428,430],{"id":429},"_44-no-password","44 No Password",[10,432],{":mirror":12,"src":433,"densities":14,"caption":434},"https:\u002F\u002Fmmbiz.qpic.cn\u002Fmmbiz_png\u002F9sIibiadwv3fbR2djcvEqTjtOJavT3z9ibW2PT77yZIuHAxVRiamicHQicxdSvNa62YKtice4CKlq3ESJh2LOMribBzwZA\u002F640","No Password",[31,436,437],{},"知识点：Zip 伪加密",[31,439,440],{},"预期外的解法：使用 7-Zip 打开文件，直接得到答案。",[22,442,444],{"id":443},"_49-easy-game","49 easy-game",[31,446,447,448,451,452,455,456,459,460,455,463,466,467,455,470,473],{},"进入游戏存档1后生成 ",[35,449,450],{"code":450},"save1"," 文件，多次存档后使用十六进制编辑器对比文件，发现 ",[35,453,454],{"code":454},"0x00","~",[35,457,458],{"code":458},"0x02"," 为关卡 id，",[35,461,462],{"code":462},"0x03",[35,464,465],{"code":465},"0x06"," 为人物坐标 x（十进制），",[35,468,469],{"code":469},"0x07",[35,471,472],{"code":472},"0x09"," 为人物坐标 y（十进制）。进入新的关卡后将人物坐标修改（tp）至下一关入口。",[10,475],{":mirror":12,"src":476,"densities":14,"caption":477},"https:\u002F\u002Fmmbiz.qpic.cn\u002Fmmbiz_png\u002F9sIibiadwv3fbR2djcvEqTjtOJavT3z9ibWnjCEvF1ZDRkjKNj91jKjtqXyuMkrTxfraboVaAbvWjr0SW4NR95xqg\u002F640","欸嘿我进墙了",[10,479],{":mirror":12,"src":480,"densities":14,"caption":481},"https:\u002F\u002Fmmbiz.qpic.cn\u002Fmmbiz_png\u002F9sIibiadwv3fbR2djcvEqTjtOJavT3z9ibWMCuDvk1GdrLtjCR3o2n3FGQ4xjNnFjpiaLIULnjXRWib6ywZsHEB9Lhw\u002F640","闯过第三关后得到flag",[31,483,484],{},"之前尝试当作 Reverse 题目，用十六进制编辑器找大图片，整了半天提取到的却是编辑器工具栏的 sprite（精灵图\u002F雪碧图），气死我啦气死我啦气死我啦！！！最后看来，这个 flag 也是 sprite，就算提取出来也是未切分的。",[22,486,488],{"id":487},"_47-可爱捏","47 可爱捏",[10,490],{":mirror":12,"src":491,"densities":14,"caption":492},"https:\u002F\u002Fmmbiz.qpic.cn\u002Fmmbiz_png\u002F9sIibiadwv3fbR2djcvEqTjtOJavT3z9ibWm0EaRxe1y3nDqyhGxCFiaMR8RIVYlMLUqVf7WO9iaMkzibUbdY3d6Vq6g\u002F640","可爱捏",[31,494,495],{},"使用AAEncode解密工具，得到十六进制字符串。",[10,497],{":mirror":12,"src":498,"densities":14,"caption":499},"https:\u002F\u002Fmmbiz.qpic.cn\u002Fmmbiz_png\u002F9sIibiadwv3fbR2djcvEqTjtOJavT3z9ibWTPeIkOWR8eUKp3IZga4zxib3bNLWdLvE9A8uX6C56nEc7liagBu4Fic3g\u002F640","转文本",[31,501,502],{},"当作 ASCII 编码转换为文本，发现应该是 png 文件的十六进制编码。",[10,504],{":mirror":12,"src":505,"densities":14,"caption":506},"https:\u002F\u002Fmmbiz.qpic.cn\u002Fmmbiz_png\u002F9sIibiadwv3fbR2djcvEqTjtOJavT3z9ibWqHXQPsjPzJAkkElibvoh8oSOPUSkoMvHJp5swwyIaibxibBicsbYVBmROQ\u002F640","写文件",[31,508,509],{},"使用十六进制编辑器将编码存入文件，得到二维码图片。",[10,511],{":mirror":12,"src":512,"caption":513},"https:\u002F\u002Fmmbiz.qpic.cn\u002Fmmbiz_png\u002F9sIibiadwv3fbR2djcvEqTjtOJavT3z9ibWTYYbnHibvaRVhxwibF5mK2aiaGJjgYIurlpB6U8sclILnFt9knRqtcN2w\u002F640","生成图",[31,515,516,517,87],{},"扫码得到 ",[35,518,519],{"code":519},"flag{cutECutecute!}",[22,521,523],{"id":522},"_48-解方程","48 解方程",[10,525],{":mirror":12,"src":526,"densities":14,"caption":527},"https:\u002F\u002Fmmbiz.qpic.cn\u002Fmmbiz_png\u002F9sIibiadwv3fbR2djcvEqTjtOJavT3z9ibWQK4kb3ib9PHv8Uy9T8ib1dCE0s7v2GFC8l2R93S5icDk5fLiaTrTiaa65uA\u002F640","@代打出题人 你还接单吗？",[10,529],{":mirror":12,"src":530,"densities":14,"caption":531},"https:\u002F\u002Fmmbiz.qpic.cn\u002Fmmbiz_png\u002F9sIibiadwv3fbR2djcvEqTjtOJavT3z9ibWCpXkaNK4B15EGe3rZ5OdibGjFrAsPk2OjfNvjLtVK7icBL1gIDh4Nw6g\u002F640","解方程工具",[31,533,534,535,538,539,542,543,87],{},"使用解方程工具，得到 flag 为 ",[35,536,537],{"code":537},"[103, 111, 111, 100, 87, 111, 114, 107, 33, 33]","，转换为十六进制，拼接得到 ",[35,540,541],{"code":541},"676f6f64576f726b2121","，再作为ASCII码变成文本得到flag为 ",[35,544,545],{"code":545},"goodWork!!",[547,548,549],"quote",{},[31,550,551],{},"领到奖品了，是一张大鼠标垫和一本书，好耶！",{"title":553,"searchDepth":554,"depth":554,"links":555},"",4,[556,567,572,576,579],{"id":19,"depth":557,"text":20,"children":558},2,[559,561,562,563,564,565,566],{"id":24,"depth":560,"text":25},3,{"id":49,"depth":560,"text":50},{"id":68,"depth":560,"text":69},{"id":111,"depth":560,"text":112},{"id":122,"depth":560,"text":123},{"id":161,"depth":560,"text":162},{"id":192,"depth":560,"text":193},{"id":202,"depth":557,"text":203,"children":568},[569,570,571],{"id":206,"depth":560,"text":207},{"id":220,"depth":560,"text":221},{"id":244,"depth":560,"text":245},{"id":268,"depth":557,"text":269,"children":573},[574,575],{"id":272,"depth":560,"text":273},{"id":285,"depth":560,"text":286},{"id":298,"depth":557,"text":299,"children":577},[578],{"id":302,"depth":560,"text":303},{"id":315,"depth":557,"text":316,"children":580},[581,582,583,584,585,586,587,588,589,590],{"id":319,"depth":560,"text":320},{"id":327,"depth":560,"text":328},{"id":338,"depth":560,"text":339},{"id":362,"depth":560,"text":363},{"id":377,"depth":560,"text":378},{"id":392,"depth":560,"text":393},{"id":429,"depth":560,"text":430},{"id":443,"depth":560,"text":444},{"id":487,"depth":560,"text":488},{"id":522,"depth":560,"text":523},[592],"安全","2022-09-28 19:40:10","西邮GCTF2022新生赛参与记录。领到了奖品，感觉不错。",false,"md","https:\u002F\u002Ffly.webp.se\u002F?url=https:\u002F\u002Fmmbiz.qpic.cn\u002Fmmbiz_png\u002F9sIibiadwv3fbR2djcvEqTjtOJavT3z9ibWTVjL3YA0cJOwfvEHD7TlUuc6hKE0QZqwka3qpbZdJ403WNjNDuuktw\u002F640",{"slots":599},{},true,"\u002F2022\u002Fctf-xupt-gctf",null,{"text":604,"minutes":605,"time":606,"words":607},"6 min read",5.265,315900,1053,{"title":5,"description":594},{"loc":601},"posts\u002F2022\u002Fctf-xupt-gctf",[612,613,614],"CTF","WriteUp","校赛","tech","2022-11-13 16:11:55","lFKJEuqWMDw8UFs2cUi5pAmRTKmcquqXA_ykxpLjKl0",[619,624],{"title":620,"path":621,"stem":622,"date":623,"type":615,"children":-1},"混入西工大，打 CTF 上大分！","\u002F2022\u002Fctf-nwpu","posts\u002F2022\u002Fctf-nwpu","2022-09-06 21:02:00",{"title":625,"path":626,"stem":627,"date":628,"type":629,"children":-1},"周四在FF305，在了又在。","\u002F2022\u002Fthoughts-in-classroom","posts\u002F2022\u002Fthoughts-in-classroom","2022-10-08 18:01:00","story",1782091377331]