2026奶龙杯 | 部分题目WP

WEB

1.[NLCTF2026] LamentXU's chal

payload:

userId=aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa&role=%2b1

---

2.[NLCTF2026] signin

上一题的变式，

payload:

?userId=aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa&role=1abc

---

MISC

1.[NLCTF2026] SP赵云

---

2.这还是签到

---

3.[NLCTF2026] free wifi

拿到流量包后，发现只有40个流量包

发现有连续编号的DNS流量

按顺序整理出来：

550246125208591559560e57455951095844590458531059035c0445470655034315535a

尝试用十六进制编码：

s1 = "550246125208591559560e57455951095844590458531059035c0445470655034315535a"
print(bytes.fromhex(s1).decode('utf-8'))

输出结果：
UFYYVWEYQ	XDYXSY\EGUCSZ

过滤http协议,在debug/status发现异或运算密钥

异或逆运算：

c = "550246125208591559560e57455951095844590458531059035c0445470655034315535a"
c1 = bytes.fromhex(c)
key = b"latte"
m = bytearray()
for i in range(len(c1)):
  k = key[i % len(key)]
  v = c1[i]
  m.append(k ^ v)
m = bytes(m)
print(m)

输出结果：
b'9c2f7d8a-3b61-4e90-a42d-f0e13c9b7a66'

flag

---